index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("b10884a495070c2f9ee183bbbb6d1b8f7351fc75d094f4bb212c38c859a6e867","c55a1c1e2d0623fd7c5b2224e2e5a7b6f053f997080fb4f3d37a37d1b9ce807a","27a823c06e68b5f32c2331ef89de4f1de1773f39449a3509b3f397c3c4376cad","e8d595834bb500f0bb3ad688fe7307e3a182229f3ef16a16549c9797cf1d8985","175d861d8f1337df6a0aafb845c2b7967d0c1ecd8c230e345d75d557440f15e5","54409f5edb22b2c84de1ff5e6a76dd4b34d5acde60a0777f16251ccf4849929f","11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5","b69bf007797fdfecc90c5511dde776dc6c18c48cddec2804753533dbee4af80d")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("b10884a495070c2f9ee183bbbb6d1b8f7351fc75d094f4bb212c38c859a6e867","c55a1c1e2d0623fd7c5b2224e2e5a7b6f053f997080fb4f3d37a37d1b9ce807a","27a823c06e68b5f32c2331ef89de4f1de1773f39449a3509b3f397c3c4376cad","e8d595834bb500f0bb3ad688fe7307e3a182229f3ef16a16549c9797cf1d8985","175d861d8f1337df6a0aafb845c2b7967d0c1ecd8c230e345d75d557440f15e5","54409f5edb22b2c84de1ff5e6a76dd4b34d5acde60a0777f16251ccf4849929f","11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5","b69bf007797fdfecc90c5511dde776dc6c18c48cddec2804753533dbee4af80d")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("b10884a495070c2f9ee183bbbb6d1b8f7351fc75d094f4bb212c38c859a6e867","c55a1c1e2d0623fd7c5b2224e2e5a7b6f053f997080fb4f3d37a37d1b9ce807a","27a823c06e68b5f32c2331ef89de4f1de1773f39449a3509b3f397c3c4376cad","e8d595834bb500f0bb3ad688fe7307e3a182229f3ef16a16549c9797cf1d8985","175d861d8f1337df6a0aafb845c2b7967d0c1ecd8c230e345d75d557440f15e5","54409f5edb22b2c84de1ff5e6a76dd4b34d5acde60a0777f16251ccf4849929f","11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5","b69bf007797fdfecc90c5511dde776dc6c18c48cddec2804753533dbee4af80d")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring64 NOT NULL AND customstring64 IN ("b10884a495070c2f9ee183bbbb6d1b8f7351fc75d094f4bb212c38c859a6e867","c55a1c1e2d0623fd7c5b2224e2e5a7b6f053f997080fb4f3d37a37d1b9ce807a","27a823c06e68b5f32c2331ef89de4f1de1773f39449a3509b3f397c3c4376cad","e8d595834bb500f0bb3ad688fe7307e3a182229f3ef16a16549c9797cf1d8985","175d861d8f1337df6a0aafb845c2b7967d0c1ecd8c230e345d75d557440f15e5","54409f5edb22b2c84de1ff5e6a76dd4b34d5acde60a0777f16251ccf4849929f","11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5","b69bf007797fdfecc90c5511dde776dc6c18c48cddec2804753533dbee4af80d")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("b10884a495070c2f9ee183bbbb6d1b8f7351fc75d094f4bb212c38c859a6e867","c55a1c1e2d0623fd7c5b2224e2e5a7b6f053f997080fb4f3d37a37d1b9ce807a","27a823c06e68b5f32c2331ef89de4f1de1773f39449a3509b3f397c3c4376cad","e8d595834bb500f0bb3ad688fe7307e3a182229f3ef16a16549c9797cf1d8985","175d861d8f1337df6a0aafb845c2b7967d0c1ecd8c230e345d75d557440f15e5","54409f5edb22b2c84de1ff5e6a76dd4b34d5acde60a0777f16251ccf4849929f","11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5","b69bf007797fdfecc90c5511dde776dc6c18c48cddec2804753533dbee4af80d")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("b10884a495070c2f9ee183bbbb6d1b8f7351fc75d094f4bb212c38c859a6e867","c55a1c1e2d0623fd7c5b2224e2e5a7b6f053f997080fb4f3d37a37d1b9ce807a","27a823c06e68b5f32c2331ef89de4f1de1773f39449a3509b3f397c3c4376cad","e8d595834bb500f0bb3ad688fe7307e3a182229f3ef16a16549c9797cf1d8985","175d861d8f1337df6a0aafb845c2b7967d0c1ecd8c230e345d75d557440f15e5","54409f5edb22b2c84de1ff5e6a76dd4b34d5acde60a0777f16251ccf4849929f","11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5","b69bf007797fdfecc90c5511dde776dc6c18c48cddec2804753533dbee4af80d")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("b10884a495070c2f9ee183bbbb6d1b8f7351fc75d094f4bb212c38c859a6e867","c55a1c1e2d0623fd7c5b2224e2e5a7b6f053f997080fb4f3d37a37d1b9ce807a","27a823c06e68b5f32c2331ef89de4f1de1773f39449a3509b3f397c3c4376cad","e8d595834bb500f0bb3ad688fe7307e3a182229f3ef16a16549c9797cf1d8985","175d861d8f1337df6a0aafb845c2b7967d0c1ecd8c230e345d75d557440f15e5","54409f5edb22b2c84de1ff5e6a76dd4b34d5acde60a0777f16251ccf4849929f","11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5","b69bf007797fdfecc90c5511dde776dc6c18c48cddec2804753533dbee4af80d")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("b10884a495070c2f9ee183bbbb6d1b8f7351fc75d094f4bb212c38c859a6e867","c55a1c1e2d0623fd7c5b2224e2e5a7b6f053f997080fb4f3d37a37d1b9ce807a","27a823c06e68b5f32c2331ef89de4f1de1773f39449a3509b3f397c3c4376cad","e8d595834bb500f0bb3ad688fe7307e3a182229f3ef16a16549c9797cf1d8985","175d861d8f1337df6a0aafb845c2b7967d0c1ecd8c230e345d75d557440f15e5","54409f5edb22b2c84de1ff5e6a76dd4b34d5acde60a0777f16251ccf4849929f","11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5","b69bf007797fdfecc90c5511dde776dc6c18c48cddec2804753533dbee4af80d")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("b10884a495070c2f9ee183bbbb6d1b8f7351fc75d094f4bb212c38c859a6e867","c55a1c1e2d0623fd7c5b2224e2e5a7b6f053f997080fb4f3d37a37d1b9ce807a","27a823c06e68b5f32c2331ef89de4f1de1773f39449a3509b3f397c3c4376cad","e8d595834bb500f0bb3ad688fe7307e3a182229f3ef16a16549c9797cf1d8985","175d861d8f1337df6a0aafb845c2b7967d0c1ecd8c230e345d75d557440f15e5","54409f5edb22b2c84de1ff5e6a76dd4b34d5acde60a0777f16251ccf4849929f","11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5","b69bf007797fdfecc90c5511dde776dc6c18c48cddec2804753533dbee4af80d")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("b10884a495070c2f9ee183bbbb6d1b8f7351fc75d094f4bb212c38c859a6e867","c55a1c1e2d0623fd7c5b2224e2e5a7b6f053f997080fb4f3d37a37d1b9ce807a","27a823c06e68b5f32c2331ef89de4f1de1773f39449a3509b3f397c3c4376cad","e8d595834bb500f0bb3ad688fe7307e3a182229f3ef16a16549c9797cf1d8985","175d861d8f1337df6a0aafb845c2b7967d0c1ecd8c230e345d75d557440f15e5","54409f5edb22b2c84de1ff5e6a76dd4b34d5acde60a0777f16251ccf4849929f","11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5","b69bf007797fdfecc90c5511dde776dc6c18c48cddec2804753533dbee4af80d")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("b10884a495070c2f9ee183bbbb6d1b8f7351fc75d094f4bb212c38c859a6e867","c55a1c1e2d0623fd7c5b2224e2e5a7b6f053f997080fb4f3d37a37d1b9ce807a","27a823c06e68b5f32c2331ef89de4f1de1773f39449a3509b3f397c3c4376cad","e8d595834bb500f0bb3ad688fe7307e3a182229f3ef16a16549c9797cf1d8985","175d861d8f1337df6a0aafb845c2b7967d0c1ecd8c230e345d75d557440f15e5","54409f5edb22b2c84de1ff5e6a76dd4b34d5acde60a0777f16251ccf4849929f","11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5","b69bf007797fdfecc90c5511dde776dc6c18c48cddec2804753533dbee4af80d")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("b10884a495070c2f9ee183bbbb6d1b8f7351fc75d094f4bb212c38c859a6e867","c55a1c1e2d0623fd7c5b2224e2e5a7b6f053f997080fb4f3d37a37d1b9ce807a","27a823c06e68b5f32c2331ef89de4f1de1773f39449a3509b3f397c3c4376cad","e8d595834bb500f0bb3ad688fe7307e3a182229f3ef16a16549c9797cf1d8985","175d861d8f1337df6a0aafb845c2b7967d0c1ecd8c230e345d75d557440f15e5","54409f5edb22b2c84de1ff5e6a76dd4b34d5acde60a0777f16251ccf4849929f","11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5","b69bf007797fdfecc90c5511dde776dc6c18c48cddec2804753533dbee4af80d")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("b10884a495070c2f9ee183bbbb6d1b8f7351fc75d094f4bb212c38c859a6e867","c55a1c1e2d0623fd7c5b2224e2e5a7b6f053f997080fb4f3d37a37d1b9ce807a","27a823c06e68b5f32c2331ef89de4f1de1773f39449a3509b3f397c3c4376cad","e8d595834bb500f0bb3ad688fe7307e3a182229f3ef16a16549c9797cf1d8985","175d861d8f1337df6a0aafb845c2b7967d0c1ecd8c230e345d75d557440f15e5","54409f5edb22b2c84de1ff5e6a76dd4b34d5acde60a0777f16251ccf4849929f","11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5","b69bf007797fdfecc90c5511dde776dc6c18c48cddec2804753533dbee4af80d")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("b10884a495070c2f9ee183bbbb6d1b8f7351fc75d094f4bb212c38c859a6e867","c55a1c1e2d0623fd7c5b2224e2e5a7b6f053f997080fb4f3d37a37d1b9ce807a","27a823c06e68b5f32c2331ef89de4f1de1773f39449a3509b3f397c3c4376cad","e8d595834bb500f0bb3ad688fe7307e3a182229f3ef16a16549c9797cf1d8985","175d861d8f1337df6a0aafb845c2b7967d0c1ecd8c230e345d75d557440f15e5","54409f5edb22b2c84de1ff5e6a76dd4b34d5acde60a0777f16251ccf4849929f","11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5","b69bf007797fdfecc90c5511dde776dc6c18c48cddec2804753533dbee4af80d")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("b10884a495070c2f9ee183bbbb6d1b8f7351fc75d094f4bb212c38c859a6e867","c55a1c1e2d0623fd7c5b2224e2e5a7b6f053f997080fb4f3d37a37d1b9ce807a","27a823c06e68b5f32c2331ef89de4f1de1773f39449a3509b3f397c3c4376cad","e8d595834bb500f0bb3ad688fe7307e3a182229f3ef16a16549c9797cf1d8985","175d861d8f1337df6a0aafb845c2b7967d0c1ecd8c230e345d75d557440f15e5","54409f5edb22b2c84de1ff5e6a76dd4b34d5acde60a0777f16251ccf4849929f","11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5","b69bf007797fdfecc90c5511dde776dc6c18c48cddec2804753533dbee4af80d")
index=activity AND rg_functionality="Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("b10884a495070c2f9ee183bbbb6d1b8f7351fc75d094f4bb212c38c859a6e867","c55a1c1e2d0623fd7c5b2224e2e5a7b6f053f997080fb4f3d37a37d1b9ce807a","27a823c06e68b5f32c2331ef89de4f1de1773f39449a3509b3f397c3c4376cad","e8d595834bb500f0bb3ad688fe7307e3a182229f3ef16a16549c9797cf1d8985","175d861d8f1337df6a0aafb845c2b7967d0c1ecd8c230e345d75d557440f15e5","54409f5edb22b2c84de1ff5e6a76dd4b34d5acde60a0777f16251ccf4849929f","11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5","b69bf007797fdfecc90c5511dde776dc6c18c48cddec2804753533dbee4af80d")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("b10884a495070c2f9ee183bbbb6d1b8f7351fc75d094f4bb212c38c859a6e867","c55a1c1e2d0623fd7c5b2224e2e5a7b6f053f997080fb4f3d37a37d1b9ce807a","27a823c06e68b5f32c2331ef89de4f1de1773f39449a3509b3f397c3c4376cad","e8d595834bb500f0bb3ad688fe7307e3a182229f3ef16a16549c9797cf1d8985","175d861d8f1337df6a0aafb845c2b7967d0c1ecd8c230e345d75d557440f15e5","54409f5edb22b2c84de1ff5e6a76dd4b34d5acde60a0777f16251ccf4849929f","11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5","b69bf007797fdfecc90c5511dde776dc6c18c48cddec2804753533dbee4af80d")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("b10884a495070c2f9ee183bbbb6d1b8f7351fc75d094f4bb212c38c859a6e867","c55a1c1e2d0623fd7c5b2224e2e5a7b6f053f997080fb4f3d37a37d1b9ce807a","27a823c06e68b5f32c2331ef89de4f1de1773f39449a3509b3f397c3c4376cad","e8d595834bb500f0bb3ad688fe7307e3a182229f3ef16a16549c9797cf1d8985","175d861d8f1337df6a0aafb845c2b7967d0c1ecd8c230e345d75d557440f15e5","54409f5edb22b2c84de1ff5e6a76dd4b34d5acde60a0777f16251ccf4849929f","11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5","b69bf007797fdfecc90c5511dde776dc6c18c48cddec2804753533dbee4af80d")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("b10884a495070c2f9ee183bbbb6d1b8f7351fc75d094f4bb212c38c859a6e867","c55a1c1e2d0623fd7c5b2224e2e5a7b6f053f997080fb4f3d37a37d1b9ce807a","27a823c06e68b5f32c2331ef89de4f1de1773f39449a3509b3f397c3c4376cad","e8d595834bb500f0bb3ad688fe7307e3a182229f3ef16a16549c9797cf1d8985","175d861d8f1337df6a0aafb845c2b7967d0c1ecd8c230e345d75d557440f15e5","54409f5edb22b2c84de1ff5e6a76dd4b34d5acde60a0777f16251ccf4849929f","11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5","b69bf007797fdfecc90c5511dde776dc6c18c48cddec2804753533dbee4af80d")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("b10884a495070c2f9ee183bbbb6d1b8f7351fc75d094f4bb212c38c859a6e867","c55a1c1e2d0623fd7c5b2224e2e5a7b6f053f997080fb4f3d37a37d1b9ce807a","27a823c06e68b5f32c2331ef89de4f1de1773f39449a3509b3f397c3c4376cad","e8d595834bb500f0bb3ad688fe7307e3a182229f3ef16a16549c9797cf1d8985","175d861d8f1337df6a0aafb845c2b7967d0c1ecd8c230e345d75d557440f15e5","54409f5edb22b2c84de1ff5e6a76dd4b34d5acde60a0777f16251ccf4849929f","11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5","b69bf007797fdfecc90c5511dde776dc6c18c48cddec2804753533dbee4af80d")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("b10884a495070c2f9ee183bbbb6d1b8f7351fc75d094f4bb212c38c859a6e867","c55a1c1e2d0623fd7c5b2224e2e5a7b6f053f997080fb4f3d37a37d1b9ce807a","27a823c06e68b5f32c2331ef89de4f1de1773f39449a3509b3f397c3c4376cad","e8d595834bb500f0bb3ad688fe7307e3a182229f3ef16a16549c9797cf1d8985","175d861d8f1337df6a0aafb845c2b7967d0c1ecd8c230e345d75d557440f15e5","54409f5edb22b2c84de1ff5e6a76dd4b34d5acde60a0777f16251ccf4849929f","11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5","b69bf007797fdfecc90c5511dde776dc6c18c48cddec2804753533dbee4af80d")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("b10884a495070c2f9ee183bbbb6d1b8f7351fc75d094f4bb212c38c859a6e867","c55a1c1e2d0623fd7c5b2224e2e5a7b6f053f997080fb4f3d37a37d1b9ce807a","27a823c06e68b5f32c2331ef89de4f1de1773f39449a3509b3f397c3c4376cad","e8d595834bb500f0bb3ad688fe7307e3a182229f3ef16a16549c9797cf1d8985","175d861d8f1337df6a0aafb845c2b7967d0c1ecd8c230e345d75d557440f15e5","54409f5edb22b2c84de1ff5e6a76dd4b34d5acde60a0777f16251ccf4849929f","11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5","b69bf007797fdfecc90c5511dde776dc6c18c48cddec2804753533dbee4af80d")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("b10884a495070c2f9ee183bbbb6d1b8f7351fc75d094f4bb212c38c859a6e867","c55a1c1e2d0623fd7c5b2224e2e5a7b6f053f997080fb4f3d37a37d1b9ce807a","27a823c06e68b5f32c2331ef89de4f1de1773f39449a3509b3f397c3c4376cad","e8d595834bb500f0bb3ad688fe7307e3a182229f3ef16a16549c9797cf1d8985","175d861d8f1337df6a0aafb845c2b7967d0c1ecd8c230e345d75d557440f15e5","54409f5edb22b2c84de1ff5e6a76dd4b34d5acde60a0777f16251ccf4849929f","11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5","b69bf007797fdfecc90c5511dde776dc6c18c48cddec2804753533dbee4af80d")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring64 NOT NULL AND customstring64 IN ("b10884a495070c2f9ee183bbbb6d1b8f7351fc75d094f4bb212c38c859a6e867","c55a1c1e2d0623fd7c5b2224e2e5a7b6f053f997080fb4f3d37a37d1b9ce807a","27a823c06e68b5f32c2331ef89de4f1de1773f39449a3509b3f397c3c4376cad","e8d595834bb500f0bb3ad688fe7307e3a182229f3ef16a16549c9797cf1d8985","175d861d8f1337df6a0aafb845c2b7967d0c1ecd8c230e345d75d557440f15e5","54409f5edb22b2c84de1ff5e6a76dd4b34d5acde60a0777f16251ccf4849929f","11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5","b69bf007797fdfecc90c5511dde776dc6c18c48cddec2804753533dbee4af80d")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("b10884a495070c2f9ee183bbbb6d1b8f7351fc75d094f4bb212c38c859a6e867","c55a1c1e2d0623fd7c5b2224e2e5a7b6f053f997080fb4f3d37a37d1b9ce807a","27a823c06e68b5f32c2331ef89de4f1de1773f39449a3509b3f397c3c4376cad","e8d595834bb500f0bb3ad688fe7307e3a182229f3ef16a16549c9797cf1d8985","175d861d8f1337df6a0aafb845c2b7967d0c1ecd8c230e345d75d557440f15e5","54409f5edb22b2c84de1ff5e6a76dd4b34d5acde60a0777f16251ccf4849929f","11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5","b69bf007797fdfecc90c5511dde776dc6c18c48cddec2804753533dbee4af80d")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("b10884a495070c2f9ee183bbbb6d1b8f7351fc75d094f4bb212c38c859a6e867","c55a1c1e2d0623fd7c5b2224e2e5a7b6f053f997080fb4f3d37a37d1b9ce807a","27a823c06e68b5f32c2331ef89de4f1de1773f39449a3509b3f397c3c4376cad","e8d595834bb500f0bb3ad688fe7307e3a182229f3ef16a16549c9797cf1d8985","175d861d8f1337df6a0aafb845c2b7967d0c1ecd8c230e345d75d557440f15e5","54409f5edb22b2c84de1ff5e6a76dd4b34d5acde60a0777f16251ccf4849929f","11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5","b69bf007797fdfecc90c5511dde776dc6c18c48cddec2804753533dbee4af80d")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("b10884a495070c2f9ee183bbbb6d1b8f7351fc75d094f4bb212c38c859a6e867","c55a1c1e2d0623fd7c5b2224e2e5a7b6f053f997080fb4f3d37a37d1b9ce807a","27a823c06e68b5f32c2331ef89de4f1de1773f39449a3509b3f397c3c4376cad","e8d595834bb500f0bb3ad688fe7307e3a182229f3ef16a16549c9797cf1d8985","175d861d8f1337df6a0aafb845c2b7967d0c1ecd8c230e345d75d557440f15e5","54409f5edb22b2c84de1ff5e6a76dd4b34d5acde60a0777f16251ccf4849929f","11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5","b69bf007797fdfecc90c5511dde776dc6c18c48cddec2804753533dbee4af80d")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring64 NOT NULL AND customstring64 IN ("b10884a495070c2f9ee183bbbb6d1b8f7351fc75d094f4bb212c38c859a6e867","c55a1c1e2d0623fd7c5b2224e2e5a7b6f053f997080fb4f3d37a37d1b9ce807a","27a823c06e68b5f32c2331ef89de4f1de1773f39449a3509b3f397c3c4376cad","e8d595834bb500f0bb3ad688fe7307e3a182229f3ef16a16549c9797cf1d8985","175d861d8f1337df6a0aafb845c2b7967d0c1ecd8c230e345d75d557440f15e5","54409f5edb22b2c84de1ff5e6a76dd4b34d5acde60a0777f16251ccf4849929f","11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5","b69bf007797fdfecc90c5511dde776dc6c18c48cddec2804753533dbee4af80d")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("b10884a495070c2f9ee183bbbb6d1b8f7351fc75d094f4bb212c38c859a6e867","c55a1c1e2d0623fd7c5b2224e2e5a7b6f053f997080fb4f3d37a37d1b9ce807a","27a823c06e68b5f32c2331ef89de4f1de1773f39449a3509b3f397c3c4376cad","e8d595834bb500f0bb3ad688fe7307e3a182229f3ef16a16549c9797cf1d8985","175d861d8f1337df6a0aafb845c2b7967d0c1ecd8c230e345d75d557440f15e5","54409f5edb22b2c84de1ff5e6a76dd4b34d5acde60a0777f16251ccf4849929f","11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5","b69bf007797fdfecc90c5511dde776dc6c18c48cddec2804753533dbee4af80d")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("b10884a495070c2f9ee183bbbb6d1b8f7351fc75d094f4bb212c38c859a6e867","c55a1c1e2d0623fd7c5b2224e2e5a7b6f053f997080fb4f3d37a37d1b9ce807a","27a823c06e68b5f32c2331ef89de4f1de1773f39449a3509b3f397c3c4376cad","e8d595834bb500f0bb3ad688fe7307e3a182229f3ef16a16549c9797cf1d8985","175d861d8f1337df6a0aafb845c2b7967d0c1ecd8c230e345d75d557440f15e5","54409f5edb22b2c84de1ff5e6a76dd4b34d5acde60a0777f16251ccf4849929f","11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5","b69bf007797fdfecc90c5511dde776dc6c18c48cddec2804753533dbee4af80d")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("b10884a495070c2f9ee183bbbb6d1b8f7351fc75d094f4bb212c38c859a6e867","c55a1c1e2d0623fd7c5b2224e2e5a7b6f053f997080fb4f3d37a37d1b9ce807a","27a823c06e68b5f32c2331ef89de4f1de1773f39449a3509b3f397c3c4376cad","e8d595834bb500f0bb3ad688fe7307e3a182229f3ef16a16549c9797cf1d8985","175d861d8f1337df6a0aafb845c2b7967d0c1ecd8c230e345d75d557440f15e5","54409f5edb22b2c84de1ff5e6a76dd4b34d5acde60a0777f16251ccf4849929f","11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5","b69bf007797fdfecc90c5511dde776dc6c18c48cddec2804753533dbee4af80d")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring64 NOT NULL AND customstring64 IN ("b10884a495070c2f9ee183bbbb6d1b8f7351fc75d094f4bb212c38c859a6e867","c55a1c1e2d0623fd7c5b2224e2e5a7b6f053f997080fb4f3d37a37d1b9ce807a","27a823c06e68b5f32c2331ef89de4f1de1773f39449a3509b3f397c3c4376cad","e8d595834bb500f0bb3ad688fe7307e3a182229f3ef16a16549c9797cf1d8985","175d861d8f1337df6a0aafb845c2b7967d0c1ecd8c230e345d75d557440f15e5","54409f5edb22b2c84de1ff5e6a76dd4b34d5acde60a0777f16251ccf4849929f","11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5","b69bf007797fdfecc90c5511dde776dc6c18c48cddec2804753533dbee4af80d")
index=activity AND rg_functionality="Endpoint Management Systems" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="139.162.102.163" AND destinationport=80 OR destinationaddress="139.162.102.163" AND destinationport=445 OR destinationaddress="139.162.102.163" AND destinationport=3306 OR destinationaddress="139.162.102.163" AND destinationport=3389 OR destinationaddress="24.199.123.1" AND destinationport=80 OR destinationaddress="24.199.123.1" AND destinationport=1234 OR destinationaddress="24.199.123.1" AND destinationport=4000 OR destinationaddress="24.199.123.1" AND destinationport=5000)
index=activity AND rg_functionality="Endpoint Management Systems" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="139.162.102.163" AND sourceport=80 OR sourceaddress="139.162.102.163" AND sourceport=445 OR sourceaddress="139.162.102.163" AND sourceport=3306 OR sourceaddress="139.162.102.163" AND sourceport=3389 OR sourceaddress="24.199.123.1" AND sourceport=80 OR sourceaddress="24.199.123.1" AND sourceport=1234 OR sourceaddress="24.199.123.1" AND sourceport=4000 OR sourceaddress="24.199.123.1" AND sourceport=5000)
index=activity AND rg_functionality="Endpoint Management Systems" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="139.162.102.163" AND sourceport=80 OR translatedipaddress="139.162.102.163" AND sourceport=445 OR translatedipaddress="139.162.102.163" AND sourceport=3306 OR translatedipaddress="139.162.102.163" AND sourceport=3389 OR translatedipaddress="24.199.123.1" AND sourceport=80 OR translatedipaddress="24.199.123.1" AND sourceport=1234 OR translatedipaddress="24.199.123.1" AND sourceport=4000 OR translatedipaddress="24.199.123.1" AND sourceport=5000)
index=activity AND rg_functionality="Endpoint Management Systems" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="139.162.102.163" AND destinationport=80 OR destinationtranslatedaddress="139.162.102.163" AND destinationport=445 OR destinationtranslatedaddress="139.162.102.163" AND destinationport=3306 OR destinationtranslatedaddress="139.162.102.163" AND destinationport=3389 OR destinationtranslatedaddress="24.199.123.1" AND destinationport=80 OR destinationtranslatedaddress="24.199.123.1" AND destinationport=1234 OR destinationtranslatedaddress="24.199.123.1" AND destinationport=4000 OR destinationtranslatedaddress="24.199.123.1" AND destinationport=5000)
index=activity AND rg_functionality="Endpoint Management Systems" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="139.162.102.163" AND destinationtranslatedport=80 OR destinationtranslatedaddress="139.162.102.163" AND destinationtranslatedport=445 OR destinationtranslatedaddress="139.162.102.163" AND destinationtranslatedport=3306 OR destinationtranslatedaddress="139.162.102.163" AND destinationtranslatedport=3389 OR destinationtranslatedaddress="24.199.123.1" AND destinationtranslatedport=80 OR destinationtranslatedaddress="24.199.123.1" AND destinationtranslatedport=1234 OR destinationtranslatedaddress="24.199.123.1" AND destinationtranslatedport=4000 OR destinationtranslatedaddress="24.199.123.1" AND destinationtranslatedport=5000)
index=activity AND rg_functionality="Endpoint Management Systems" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="139.162.102.163" AND translatedport=80 OR destinationtranslatedaddress="139.162.102.163" AND translatedport=445 OR destinationtranslatedaddress="139.162.102.163" AND translatedport=3306 OR destinationtranslatedaddress="139.162.102.163" AND translatedport=3389 OR destinationtranslatedaddress="24.199.123.1" AND translatedport=80 OR destinationtranslatedaddress="24.199.123.1" AND translatedport=1234 OR destinationtranslatedaddress="24.199.123.1" AND translatedport=4000 OR destinationtranslatedaddress="24.199.123.1" AND translatedport=5000)
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="139.162.102.163" AND destinationport=80 OR destinationaddress="139.162.102.163" AND destinationport=445 OR destinationaddress="139.162.102.163" AND destinationport=3306 OR destinationaddress="139.162.102.163" AND destinationport=3389 OR destinationaddress="24.199.123.1" AND destinationport=80 OR destinationaddress="24.199.123.1" AND destinationport=1234 OR destinationaddress="24.199.123.1" AND destinationport=4000 OR destinationaddress="24.199.123.1" AND destinationport=5000)
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="139.162.102.163" AND sourceport=80 OR sourceaddress="139.162.102.163" AND sourceport=445 OR sourceaddress="139.162.102.163" AND sourceport=3306 OR sourceaddress="139.162.102.163" AND sourceport=3389 OR sourceaddress="24.199.123.1" AND sourceport=80 OR sourceaddress="24.199.123.1" AND sourceport=1234 OR sourceaddress="24.199.123.1" AND sourceport=4000 OR sourceaddress="24.199.123.1" AND sourceport=5000)
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="139.162.102.163" AND sourceport=80 OR translatedipaddress="139.162.102.163" AND sourceport=445 OR translatedipaddress="139.162.102.163" AND sourceport=3306 OR translatedipaddress="139.162.102.163" AND sourceport=3389 OR translatedipaddress="24.199.123.1" AND sourceport=80 OR translatedipaddress="24.199.123.1" AND sourceport=1234 OR translatedipaddress="24.199.123.1" AND sourceport=4000 OR translatedipaddress="24.199.123.1" AND sourceport=5000)
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="139.162.102.163" AND destinationport=80 OR destinationtranslatedaddress="139.162.102.163" AND destinationport=445 OR destinationtranslatedaddress="139.162.102.163" AND destinationport=3306 OR destinationtranslatedaddress="139.162.102.163" AND destinationport=3389 OR destinationtranslatedaddress="24.199.123.1" AND destinationport=80 OR destinationtranslatedaddress="24.199.123.1" AND destinationport=1234 OR destinationtranslatedaddress="24.199.123.1" AND destinationport=4000 OR destinationtranslatedaddress="24.199.123.1" AND destinationport=5000)
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="139.162.102.163" AND destinationtranslatedport=80 OR destinationtranslatedaddress="139.162.102.163" AND destinationtranslatedport=445 OR destinationtranslatedaddress="139.162.102.163" AND destinationtranslatedport=3306 OR destinationtranslatedaddress="139.162.102.163" AND destinationtranslatedport=3389 OR destinationtranslatedaddress="24.199.123.1" AND destinationtranslatedport=80 OR destinationtranslatedaddress="24.199.123.1" AND destinationtranslatedport=1234 OR destinationtranslatedaddress="24.199.123.1" AND destinationtranslatedport=4000 OR destinationtranslatedaddress="24.199.123.1" AND destinationtranslatedport=5000)
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="139.162.102.163" AND translatedport=80 OR destinationtranslatedaddress="139.162.102.163" AND translatedport=445 OR destinationtranslatedaddress="139.162.102.163" AND translatedport=3306 OR destinationtranslatedaddress="139.162.102.163" AND translatedport=3389 OR destinationtranslatedaddress="24.199.123.1" AND translatedport=80 OR destinationtranslatedaddress="24.199.123.1" AND translatedport=1234 OR destinationtranslatedaddress="24.199.123.1" AND translatedport=4000 OR destinationtranslatedaddress="24.199.123.1" AND translatedport=5000)
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="139.162.102.163" AND destinationport=80 OR destinationaddress="139.162.102.163" AND destinationport=445 OR destinationaddress="139.162.102.163" AND destinationport=3306 OR destinationaddress="139.162.102.163" AND destinationport=3389 OR destinationaddress="24.199.123.1" AND destinationport=80 OR destinationaddress="24.199.123.1" AND destinationport=1234 OR destinationaddress="24.199.123.1" AND destinationport=4000 OR destinationaddress="24.199.123.1" AND destinationport=5000)
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="139.162.102.163" AND sourceport=80 OR sourceaddress="139.162.102.163" AND sourceport=445 OR sourceaddress="139.162.102.163" AND sourceport=3306 OR sourceaddress="139.162.102.163" AND sourceport=3389 OR sourceaddress="24.199.123.1" AND sourceport=80 OR sourceaddress="24.199.123.1" AND sourceport=1234 OR sourceaddress="24.199.123.1" AND sourceport=4000 OR sourceaddress="24.199.123.1" AND sourceport=5000)
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="139.162.102.163" AND sourceport=80 OR translatedipaddress="139.162.102.163" AND sourceport=445 OR translatedipaddress="139.162.102.163" AND sourceport=3306 OR translatedipaddress="139.162.102.163" AND sourceport=3389 OR translatedipaddress="24.199.123.1" AND sourceport=80 OR translatedipaddress="24.199.123.1" AND sourceport=1234 OR translatedipaddress="24.199.123.1" AND sourceport=4000 OR translatedipaddress="24.199.123.1" AND sourceport=5000)
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="139.162.102.163" AND destinationport=80 OR destinationtranslatedaddress="139.162.102.163" AND destinationport=445 OR destinationtranslatedaddress="139.162.102.163" AND destinationport=3306 OR destinationtranslatedaddress="139.162.102.163" AND destinationport=3389 OR destinationtranslatedaddress="24.199.123.1" AND destinationport=80 OR destinationtranslatedaddress="24.199.123.1" AND destinationport=1234 OR destinationtranslatedaddress="24.199.123.1" AND destinationport=4000 OR destinationtranslatedaddress="24.199.123.1" AND destinationport=5000)
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="139.162.102.163" AND destinationtranslatedport=80 OR destinationtranslatedaddress="139.162.102.163" AND destinationtranslatedport=445 OR destinationtranslatedaddress="139.162.102.163" AND destinationtranslatedport=3306 OR destinationtranslatedaddress="139.162.102.163" AND destinationtranslatedport=3389 OR destinationtranslatedaddress="24.199.123.1" AND destinationtranslatedport=80 OR destinationtranslatedaddress="24.199.123.1" AND destinationtranslatedport=1234 OR destinationtranslatedaddress="24.199.123.1" AND destinationtranslatedport=4000 OR destinationtranslatedaddress="24.199.123.1" AND destinationtranslatedport=5000)
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="139.162.102.163" AND translatedport=80 OR destinationtranslatedaddress="139.162.102.163" AND translatedport=445 OR destinationtranslatedaddress="139.162.102.163" AND translatedport=3306 OR destinationtranslatedaddress="139.162.102.163" AND translatedport=3389 OR destinationtranslatedaddress="24.199.123.1" AND translatedport=80 OR destinationtranslatedaddress="24.199.123.1" AND translatedport=1234 OR destinationtranslatedaddress="24.199.123.1" AND translatedport=4000 OR destinationtranslatedaddress="24.199.123.1" AND translatedport=5000)
index=activity AND rg_functionality="Email / Email Security" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="139.162.102.163" AND destinationport=80 OR destinationaddress="139.162.102.163" AND destinationport=445 OR destinationaddress="139.162.102.163" AND destinationport=3306 OR destinationaddress="139.162.102.163" AND destinationport=3389 OR destinationaddress="24.199.123.1" AND destinationport=80 OR destinationaddress="24.199.123.1" AND destinationport=1234 OR destinationaddress="24.199.123.1" AND destinationport=4000 OR destinationaddress="24.199.123.1" AND destinationport=5000)
index=activity AND rg_functionality="Email / Email Security" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="139.162.102.163" AND sourceport=80 OR sourceaddress="139.162.102.163" AND sourceport=445 OR sourceaddress="139.162.102.163" AND sourceport=3306 OR sourceaddress="139.162.102.163" AND sourceport=3389 OR sourceaddress="24.199.123.1" AND sourceport=80 OR sourceaddress="24.199.123.1" AND sourceport=1234 OR sourceaddress="24.199.123.1" AND sourceport=4000 OR sourceaddress="24.199.123.1" AND sourceport=5000)
index=activity AND rg_functionality="Email / Email Security" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="139.162.102.163" AND sourceport=80 OR translatedipaddress="139.162.102.163" AND sourceport=445 OR translatedipaddress="139.162.102.163" AND sourceport=3306 OR translatedipaddress="139.162.102.163" AND sourceport=3389 OR translatedipaddress="24.199.123.1" AND sourceport=80 OR translatedipaddress="24.199.123.1" AND sourceport=1234 OR translatedipaddress="24.199.123.1" AND sourceport=4000 OR translatedipaddress="24.199.123.1" AND sourceport=5000)
index=activity AND rg_functionality="Email / Email Security" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="139.162.102.163" AND destinationport=80 OR destinationtranslatedaddress="139.162.102.163" AND destinationport=445 OR destinationtranslatedaddress="139.162.102.163" AND destinationport=3306 OR destinationtranslatedaddress="139.162.102.163" AND destinationport=3389 OR destinationtranslatedaddress="24.199.123.1" AND destinationport=80 OR destinationtranslatedaddress="24.199.123.1" AND destinationport=1234 OR destinationtranslatedaddress="24.199.123.1" AND destinationport=4000 OR destinationtranslatedaddress="24.199.123.1" AND destinationport=5000)
index=activity AND rg_functionality="Email / Email Security" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="139.162.102.163" AND destinationtranslatedport=80 OR destinationtranslatedaddress="139.162.102.163" AND destinationtranslatedport=445 OR destinationtranslatedaddress="139.162.102.163" AND destinationtranslatedport=3306 OR destinationtranslatedaddress="139.162.102.163" AND destinationtranslatedport=3389 OR destinationtranslatedaddress="24.199.123.1" AND destinationtranslatedport=80 OR destinationtranslatedaddress="24.199.123.1" AND destinationtranslatedport=1234 OR destinationtranslatedaddress="24.199.123.1" AND destinationtranslatedport=4000 OR destinationtranslatedaddress="24.199.123.1" AND destinationtranslatedport=5000)
index=activity AND rg_functionality="Email / Email Security" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="139.162.102.163" AND translatedport=80 OR destinationtranslatedaddress="139.162.102.163" AND translatedport=445 OR destinationtranslatedaddress="139.162.102.163" AND translatedport=3306 OR destinationtranslatedaddress="139.162.102.163" AND translatedport=3389 OR destinationtranslatedaddress="24.199.123.1" AND translatedport=80 OR destinationtranslatedaddress="24.199.123.1" AND translatedport=1234 OR destinationtranslatedaddress="24.199.123.1" AND translatedport=4000 OR destinationtranslatedaddress="24.199.123.1" AND translatedport=5000)
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="139.162.102.163" AND destinationport=80 OR destinationaddress="139.162.102.163" AND destinationport=445 OR destinationaddress="139.162.102.163" AND destinationport=3306 OR destinationaddress="139.162.102.163" AND destinationport=3389 OR destinationaddress="24.199.123.1" AND destinationport=80 OR destinationaddress="24.199.123.1" AND destinationport=1234 OR destinationaddress="24.199.123.1" AND destinationport=4000 OR destinationaddress="24.199.123.1" AND destinationport=5000)
index=activity AND rg_functionality="Cloud Email / Email Security" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="139.162.102.163" AND sourceport=80 OR sourceaddress="139.162.102.163" AND sourceport=445 OR sourceaddress="139.162.102.163" AND sourceport=3306 OR sourceaddress="139.162.102.163" AND sourceport=3389 OR sourceaddress="24.199.123.1" AND sourceport=80 OR sourceaddress="24.199.123.1" AND sourceport=1234 OR sourceaddress="24.199.123.1" AND sourceport=4000 OR sourceaddress="24.199.123.1" AND sourceport=5000)
index=activity AND rg_functionality="Cloud Email / Email Security" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="139.162.102.163" AND sourceport=80 OR translatedipaddress="139.162.102.163" AND sourceport=445 OR translatedipaddress="139.162.102.163" AND sourceport=3306 OR translatedipaddress="139.162.102.163" AND sourceport=3389 OR translatedipaddress="24.199.123.1" AND sourceport=80 OR translatedipaddress="24.199.123.1" AND sourceport=1234 OR translatedipaddress="24.199.123.1" AND sourceport=4000 OR translatedipaddress="24.199.123.1" AND sourceport=5000)
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="139.162.102.163" AND destinationport=80 OR destinationtranslatedaddress="139.162.102.163" AND destinationport=445 OR destinationtranslatedaddress="139.162.102.163" AND destinationport=3306 OR destinationtranslatedaddress="139.162.102.163" AND destinationport=3389 OR destinationtranslatedaddress="24.199.123.1" AND destinationport=80 OR destinationtranslatedaddress="24.199.123.1" AND destinationport=1234 OR destinationtranslatedaddress="24.199.123.1" AND destinationport=4000 OR destinationtranslatedaddress="24.199.123.1" AND destinationport=5000)
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="139.162.102.163" AND destinationtranslatedport=80 OR destinationtranslatedaddress="139.162.102.163" AND destinationtranslatedport=445 OR destinationtranslatedaddress="139.162.102.163" AND destinationtranslatedport=3306 OR destinationtranslatedaddress="139.162.102.163" AND destinationtranslatedport=3389 OR destinationtranslatedaddress="24.199.123.1" AND destinationtranslatedport=80 OR destinationtranslatedaddress="24.199.123.1" AND destinationtranslatedport=1234 OR destinationtranslatedaddress="24.199.123.1" AND destinationtranslatedport=4000 OR destinationtranslatedaddress="24.199.123.1" AND destinationtranslatedport=5000)
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="139.162.102.163" AND translatedport=80 OR destinationtranslatedaddress="139.162.102.163" AND translatedport=445 OR destinationtranslatedaddress="139.162.102.163" AND translatedport=3306 OR destinationtranslatedaddress="139.162.102.163" AND translatedport=3389 OR destinationtranslatedaddress="24.199.123.1" AND translatedport=80 OR destinationtranslatedaddress="24.199.123.1" AND translatedport=1234 OR destinationtranslatedaddress="24.199.123.1" AND translatedport=4000 OR destinationtranslatedaddress="24.199.123.1" AND translatedport=5000)
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="139.162.102.163" AND destinationport=80 OR destinationaddress="139.162.102.163" AND destinationport=445 OR destinationaddress="139.162.102.163" AND destinationport=3306 OR destinationaddress="139.162.102.163" AND destinationport=3389 OR destinationaddress="24.199.123.1" AND destinationport=80 OR destinationaddress="24.199.123.1" AND destinationport=1234 OR destinationaddress="24.199.123.1" AND destinationport=4000 OR destinationaddress="24.199.123.1" AND destinationport=5000)
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="139.162.102.163" AND sourceport=80 OR sourceaddress="139.162.102.163" AND sourceport=445 OR sourceaddress="139.162.102.163" AND sourceport=3306 OR sourceaddress="139.162.102.163" AND sourceport=3389 OR sourceaddress="24.199.123.1" AND sourceport=80 OR sourceaddress="24.199.123.1" AND sourceport=1234 OR sourceaddress="24.199.123.1" AND sourceport=4000 OR sourceaddress="24.199.123.1" AND sourceport=5000)
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="139.162.102.163" AND sourceport=80 OR translatedipaddress="139.162.102.163" AND sourceport=445 OR translatedipaddress="139.162.102.163" AND sourceport=3306 OR translatedipaddress="139.162.102.163" AND sourceport=3389 OR translatedipaddress="24.199.123.1" AND sourceport=80 OR translatedipaddress="24.199.123.1" AND sourceport=1234 OR translatedipaddress="24.199.123.1" AND sourceport=4000 OR translatedipaddress="24.199.123.1" AND sourceport=5000)
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="139.162.102.163" AND destinationport=80 OR destinationtranslatedaddress="139.162.102.163" AND destinationport=445 OR destinationtranslatedaddress="139.162.102.163" AND destinationport=3306 OR destinationtranslatedaddress="139.162.102.163" AND destinationport=3389 OR destinationtranslatedaddress="24.199.123.1" AND destinationport=80 OR destinationtranslatedaddress="24.199.123.1" AND destinationport=1234 OR destinationtranslatedaddress="24.199.123.1" AND destinationport=4000 OR destinationtranslatedaddress="24.199.123.1" AND destinationport=5000)
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="139.162.102.163" AND destinationtranslatedport=80 OR destinationtranslatedaddress="139.162.102.163" AND destinationtranslatedport=445 OR destinationtranslatedaddress="139.162.102.163" AND destinationtranslatedport=3306 OR destinationtranslatedaddress="139.162.102.163" AND destinationtranslatedport=3389 OR destinationtranslatedaddress="24.199.123.1" AND destinationtranslatedport=80 OR destinationtranslatedaddress="24.199.123.1" AND destinationtranslatedport=1234 OR destinationtranslatedaddress="24.199.123.1" AND destinationtranslatedport=4000 OR destinationtranslatedaddress="24.199.123.1" AND destinationtranslatedport=5000)
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="139.162.102.163" AND translatedport=80 OR destinationtranslatedaddress="139.162.102.163" AND translatedport=445 OR destinationtranslatedaddress="139.162.102.163" AND translatedport=3306 OR destinationtranslatedaddress="139.162.102.163" AND translatedport=3389 OR destinationtranslatedaddress="24.199.123.1" AND translatedport=80 OR destinationtranslatedaddress="24.199.123.1" AND translatedport=1234 OR destinationtranslatedaddress="24.199.123.1" AND translatedport=4000 OR destinationtranslatedaddress="24.199.123.1" AND translatedport=5000)
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="139.162.102.163" AND destinationport=80 OR destinationaddress="139.162.102.163" AND destinationport=445 OR destinationaddress="139.162.102.163" AND destinationport=3306 OR destinationaddress="139.162.102.163" AND destinationport=3389 OR destinationaddress="24.199.123.1" AND destinationport=80 OR destinationaddress="24.199.123.1" AND destinationport=1234 OR destinationaddress="24.199.123.1" AND destinationport=4000 OR destinationaddress="24.199.123.1" AND destinationport=5000)
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="139.162.102.163" AND sourceport=80 OR sourceaddress="139.162.102.163" AND sourceport=445 OR sourceaddress="139.162.102.163" AND sourceport=3306 OR sourceaddress="139.162.102.163" AND sourceport=3389 OR sourceaddress="24.199.123.1" AND sourceport=80 OR sourceaddress="24.199.123.1" AND sourceport=1234 OR sourceaddress="24.199.123.1" AND sourceport=4000 OR sourceaddress="24.199.123.1" AND sourceport=5000)
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="139.162.102.163" AND sourceport=80 OR translatedipaddress="139.162.102.163" AND sourceport=445 OR translatedipaddress="139.162.102.163" AND sourceport=3306 OR translatedipaddress="139.162.102.163" AND sourceport=3389 OR translatedipaddress="24.199.123.1" AND sourceport=80 OR translatedipaddress="24.199.123.1" AND sourceport=1234 OR translatedipaddress="24.199.123.1" AND sourceport=4000 OR translatedipaddress="24.199.123.1" AND sourceport=5000)
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="139.162.102.163" AND destinationport=80 OR destinationtranslatedaddress="139.162.102.163" AND destinationport=445 OR destinationtranslatedaddress="139.162.102.163" AND destinationport=3306 OR destinationtranslatedaddress="139.162.102.163" AND destinationport=3389 OR destinationtranslatedaddress="24.199.123.1" AND destinationport=80 OR destinationtranslatedaddress="24.199.123.1" AND destinationport=1234 OR destinationtranslatedaddress="24.199.123.1" AND destinationport=4000 OR destinationtranslatedaddress="24.199.123.1" AND destinationport=5000)
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="139.162.102.163" AND destinationtranslatedport=80 OR destinationtranslatedaddress="139.162.102.163" AND destinationtranslatedport=445 OR destinationtranslatedaddress="139.162.102.163" AND destinationtranslatedport=3306 OR destinationtranslatedaddress="139.162.102.163" AND destinationtranslatedport=3389 OR destinationtranslatedaddress="24.199.123.1" AND destinationtranslatedport=80 OR destinationtranslatedaddress="24.199.123.1" AND destinationtranslatedport=1234 OR destinationtranslatedaddress="24.199.123.1" AND destinationtranslatedport=4000 OR destinationtranslatedaddress="24.199.123.1" AND destinationtranslatedport=5000)
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="139.162.102.163" AND translatedport=80 OR destinationtranslatedaddress="139.162.102.163" AND translatedport=445 OR destinationtranslatedaddress="139.162.102.163" AND translatedport=3306 OR destinationtranslatedaddress="139.162.102.163" AND translatedport=3389 OR destinationtranslatedaddress="24.199.123.1" AND translatedport=80 OR destinationtranslatedaddress="24.199.123.1" AND translatedport=1234 OR destinationtranslatedaddress="24.199.123.1" AND translatedport=4000 OR destinationtranslatedaddress="24.199.123.1" AND translatedport=5000)
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="139.162.102.163" AND destinationport=80 OR destinationaddress="139.162.102.163" AND destinationport=445 OR destinationaddress="139.162.102.163" AND destinationport=3306 OR destinationaddress="139.162.102.163" AND destinationport=3389 OR destinationaddress="24.199.123.1" AND destinationport=80 OR destinationaddress="24.199.123.1" AND destinationport=1234 OR destinationaddress="24.199.123.1" AND destinationport=4000 OR destinationaddress="24.199.123.1" AND destinationport=5000)
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="139.162.102.163" AND sourceport=80 OR sourceaddress="139.162.102.163" AND sourceport=445 OR sourceaddress="139.162.102.163" AND sourceport=3306 OR sourceaddress="139.162.102.163" AND sourceport=3389 OR sourceaddress="24.199.123.1" AND sourceport=80 OR sourceaddress="24.199.123.1" AND sourceport=1234 OR sourceaddress="24.199.123.1" AND sourceport=4000 OR sourceaddress="24.199.123.1" AND sourceport=5000)
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="139.162.102.163" AND sourceport=80 OR translatedipaddress="139.162.102.163" AND sourceport=445 OR translatedipaddress="139.162.102.163" AND sourceport=3306 OR translatedipaddress="139.162.102.163" AND sourceport=3389 OR translatedipaddress="24.199.123.1" AND sourceport=80 OR translatedipaddress="24.199.123.1" AND sourceport=1234 OR translatedipaddress="24.199.123.1" AND sourceport=4000 OR translatedipaddress="24.199.123.1" AND sourceport=5000)
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="139.162.102.163" AND destinationport=80 OR destinationtranslatedaddress="139.162.102.163" AND destinationport=445 OR destinationtranslatedaddress="139.162.102.163" AND destinationport=3306 OR destinationtranslatedaddress="139.162.102.163" AND destinationport=3389 OR destinationtranslatedaddress="24.199.123.1" AND destinationport=80 OR destinationtranslatedaddress="24.199.123.1" AND destinationport=1234 OR destinationtranslatedaddress="24.199.123.1" AND destinationport=4000 OR destinationtranslatedaddress="24.199.123.1" AND destinationport=5000)
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="139.162.102.163" AND destinationtranslatedport=80 OR destinationtranslatedaddress="139.162.102.163" AND destinationtranslatedport=445 OR destinationtranslatedaddress="139.162.102.163" AND destinationtranslatedport=3306 OR destinationtranslatedaddress="139.162.102.163" AND destinationtranslatedport=3389 OR destinationtranslatedaddress="24.199.123.1" AND destinationtranslatedport=80 OR destinationtranslatedaddress="24.199.123.1" AND destinationtranslatedport=1234 OR destinationtranslatedaddress="24.199.123.1" AND destinationtranslatedport=4000 OR destinationtranslatedaddress="24.199.123.1" AND destinationtranslatedport=5000)
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="139.162.102.163" AND translatedport=80 OR destinationtranslatedaddress="139.162.102.163" AND translatedport=445 OR destinationtranslatedaddress="139.162.102.163" AND translatedport=3306 OR destinationtranslatedaddress="139.162.102.163" AND translatedport=3389 OR destinationtranslatedaddress="24.199.123.1" AND translatedport=80 OR destinationtranslatedaddress="24.199.123.1" AND translatedport=1234 OR destinationtranslatedaddress="24.199.123.1" AND translatedport=4000 OR destinationtranslatedaddress="24.199.123.1" AND translatedport=5000)
index=activity AND rg_functionality="Next Generation Firewall" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="139.162.102.163" AND destinationport=80 OR destinationaddress="139.162.102.163" AND destinationport=445 OR destinationaddress="139.162.102.163" AND destinationport=3306 OR destinationaddress="139.162.102.163" AND destinationport=3389 OR destinationaddress="24.199.123.1" AND destinationport=80 OR destinationaddress="24.199.123.1" AND destinationport=1234 OR destinationaddress="24.199.123.1" AND destinationport=4000 OR destinationaddress="24.199.123.1" AND destinationport=5000)
index=activity AND rg_functionality="Next Generation Firewall" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="139.162.102.163" AND sourceport=80 OR sourceaddress="139.162.102.163" AND sourceport=445 OR sourceaddress="139.162.102.163" AND sourceport=3306 OR sourceaddress="139.162.102.163" AND sourceport=3389 OR sourceaddress="24.199.123.1" AND sourceport=80 OR sourceaddress="24.199.123.1" AND sourceport=1234 OR sourceaddress="24.199.123.1" AND sourceport=4000 OR sourceaddress="24.199.123.1" AND sourceport=5000)
index=activity AND rg_functionality="Next Generation Firewall" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="139.162.102.163" AND sourceport=80 OR translatedipaddress="139.162.102.163" AND sourceport=445 OR translatedipaddress="139.162.102.163" AND sourceport=3306 OR translatedipaddress="139.162.102.163" AND sourceport=3389 OR translatedipaddress="24.199.123.1" AND sourceport=80 OR translatedipaddress="24.199.123.1" AND sourceport=1234 OR translatedipaddress="24.199.123.1" AND sourceport=4000 OR translatedipaddress="24.199.123.1" AND sourceport=5000)
index=activity AND rg_functionality="Next Generation Firewall" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="139.162.102.163" AND destinationport=80 OR destinationtranslatedaddress="139.162.102.163" AND destinationport=445 OR destinationtranslatedaddress="139.162.102.163" AND destinationport=3306 OR destinationtranslatedaddress="139.162.102.163" AND destinationport=3389 OR destinationtranslatedaddress="24.199.123.1" AND destinationport=80 OR destinationtranslatedaddress="24.199.123.1" AND destinationport=1234 OR destinationtranslatedaddress="24.199.123.1" AND destinationport=4000 OR destinationtranslatedaddress="24.199.123.1" AND destinationport=5000)
index=activity AND rg_functionality="Next Generation Firewall" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="139.162.102.163" AND destinationtranslatedport=80 OR destinationtranslatedaddress="139.162.102.163" AND destinationtranslatedport=445 OR destinationtranslatedaddress="139.162.102.163" AND destinationtranslatedport=3306 OR destinationtranslatedaddress="139.162.102.163" AND destinationtranslatedport=3389 OR destinationtranslatedaddress="24.199.123.1" AND destinationtranslatedport=80 OR destinationtranslatedaddress="24.199.123.1" AND destinationtranslatedport=1234 OR destinationtranslatedaddress="24.199.123.1" AND destinationtranslatedport=4000 OR destinationtranslatedaddress="24.199.123.1" AND destinationtranslatedport=5000)
index=activity AND rg_functionality="Next Generation Firewall" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="139.162.102.163" AND translatedport=80 OR destinationtranslatedaddress="139.162.102.163" AND translatedport=445 OR destinationtranslatedaddress="139.162.102.163" AND translatedport=3306 OR destinationtranslatedaddress="139.162.102.163" AND translatedport=3389 OR destinationtranslatedaddress="24.199.123.1" AND translatedport=80 OR destinationtranslatedaddress="24.199.123.1" AND translatedport=1234 OR destinationtranslatedaddress="24.199.123.1" AND translatedport=4000 OR destinationtranslatedaddress="24.199.123.1" AND translatedport=5000)
index=activity AND rg_functionality="Firewall" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="139.162.102.163" AND destinationport=80 OR destinationaddress="139.162.102.163" AND destinationport=445 OR destinationaddress="139.162.102.163" AND destinationport=3306 OR destinationaddress="139.162.102.163" AND destinationport=3389 OR destinationaddress="24.199.123.1" AND destinationport=80 OR destinationaddress="24.199.123.1" AND destinationport=1234 OR destinationaddress="24.199.123.1" AND destinationport=4000 OR destinationaddress="24.199.123.1" AND destinationport=5000)
index=activity AND rg_functionality="Firewall" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="139.162.102.163" AND sourceport=80 OR sourceaddress="139.162.102.163" AND sourceport=445 OR sourceaddress="139.162.102.163" AND sourceport=3306 OR sourceaddress="139.162.102.163" AND sourceport=3389 OR sourceaddress="24.199.123.1" AND sourceport=80 OR sourceaddress="24.199.123.1" AND sourceport=1234 OR sourceaddress="24.199.123.1" AND sourceport=4000 OR sourceaddress="24.199.123.1" AND sourceport=5000)
index=activity AND rg_functionality="Firewall" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="139.162.102.163" AND sourceport=80 OR translatedipaddress="139.162.102.163" AND sourceport=445 OR translatedipaddress="139.162.102.163" AND sourceport=3306 OR translatedipaddress="139.162.102.163" AND sourceport=3389 OR translatedipaddress="24.199.123.1" AND sourceport=80 OR translatedipaddress="24.199.123.1" AND sourceport=1234 OR translatedipaddress="24.199.123.1" AND sourceport=4000 OR translatedipaddress="24.199.123.1" AND sourceport=5000)
index=activity AND rg_functionality="Firewall" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="139.162.102.163" AND destinationport=80 OR destinationtranslatedaddress="139.162.102.163" AND destinationport=445 OR destinationtranslatedaddress="139.162.102.163" AND destinationport=3306 OR destinationtranslatedaddress="139.162.102.163" AND destinationport=3389 OR destinationtranslatedaddress="24.199.123.1" AND destinationport=80 OR destinationtranslatedaddress="24.199.123.1" AND destinationport=1234 OR destinationtranslatedaddress="24.199.123.1" AND destinationport=4000 OR destinationtranslatedaddress="24.199.123.1" AND destinationport=5000)
index=activity AND rg_functionality="Firewall" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="139.162.102.163" AND destinationtranslatedport=80 OR destinationtranslatedaddress="139.162.102.163" AND destinationtranslatedport=445 OR destinationtranslatedaddress="139.162.102.163" AND destinationtranslatedport=3306 OR destinationtranslatedaddress="139.162.102.163" AND destinationtranslatedport=3389 OR destinationtranslatedaddress="24.199.123.1" AND destinationtranslatedport=80 OR destinationtranslatedaddress="24.199.123.1" AND destinationtranslatedport=1234 OR destinationtranslatedaddress="24.199.123.1" AND destinationtranslatedport=4000 OR destinationtranslatedaddress="24.199.123.1" AND destinationtranslatedport=5000)
index=activity AND rg_functionality="Firewall" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="139.162.102.163" AND translatedport=80 OR destinationtranslatedaddress="139.162.102.163" AND translatedport=445 OR destinationtranslatedaddress="139.162.102.163" AND translatedport=3306 OR destinationtranslatedaddress="139.162.102.163" AND translatedport=3389 OR destinationtranslatedaddress="24.199.123.1" AND translatedport=80 OR destinationtranslatedaddress="24.199.123.1" AND translatedport=1234 OR destinationtranslatedaddress="24.199.123.1" AND translatedport=4000 OR destinationtranslatedaddress="24.199.123.1" AND translatedport=5000)
index=activity AND rg_functionality="Web Proxy" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="139.162.102.163" AND destinationport=80 OR destinationaddress="139.162.102.163" AND destinationport=445 OR destinationaddress="139.162.102.163" AND destinationport=3306 OR destinationaddress="139.162.102.163" AND destinationport=3389 OR destinationaddress="24.199.123.1" AND destinationport=80 OR destinationaddress="24.199.123.1" AND destinationport=1234 OR destinationaddress="24.199.123.1" AND destinationport=4000 OR destinationaddress="24.199.123.1" AND destinationport=5000)
index=activity AND rg_functionality="Web Proxy" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="139.162.102.163" AND sourceport=80 OR sourceaddress="139.162.102.163" AND sourceport=445 OR sourceaddress="139.162.102.163" AND sourceport=3306 OR sourceaddress="139.162.102.163" AND sourceport=3389 OR sourceaddress="24.199.123.1" AND sourceport=80 OR sourceaddress="24.199.123.1" AND sourceport=1234 OR sourceaddress="24.199.123.1" AND sourceport=4000 OR sourceaddress="24.199.123.1" AND sourceport=5000)
index=activity AND rg_functionality="Web Proxy" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="139.162.102.163" AND sourceport=80 OR translatedipaddress="139.162.102.163" AND sourceport=445 OR translatedipaddress="139.162.102.163" AND sourceport=3306 OR translatedipaddress="139.162.102.163" AND sourceport=3389 OR translatedipaddress="24.199.123.1" AND sourceport=80 OR translatedipaddress="24.199.123.1" AND sourceport=1234 OR translatedipaddress="24.199.123.1" AND sourceport=4000 OR translatedipaddress="24.199.123.1" AND sourceport=5000)
index=activity AND rg_functionality="Web Proxy" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="139.162.102.163" AND destinationport=80 OR destinationtranslatedaddress="139.162.102.163" AND destinationport=445 OR destinationtranslatedaddress="139.162.102.163" AND destinationport=3306 OR destinationtranslatedaddress="139.162.102.163" AND destinationport=3389 OR destinationtranslatedaddress="24.199.123.1" AND destinationport=80 OR destinationtranslatedaddress="24.199.123.1" AND destinationport=1234 OR destinationtranslatedaddress="24.199.123.1" AND destinationport=4000 OR destinationtranslatedaddress="24.199.123.1" AND destinationport=5000)
index=activity AND rg_functionality="Web Proxy" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="139.162.102.163" AND destinationtranslatedport=80 OR destinationtranslatedaddress="139.162.102.163" AND destinationtranslatedport=445 OR destinationtranslatedaddress="139.162.102.163" AND destinationtranslatedport=3306 OR destinationtranslatedaddress="139.162.102.163" AND destinationtranslatedport=3389 OR destinationtranslatedaddress="24.199.123.1" AND destinationtranslatedport=80 OR destinationtranslatedaddress="24.199.123.1" AND destinationtranslatedport=1234 OR destinationtranslatedaddress="24.199.123.1" AND destinationtranslatedport=4000 OR destinationtranslatedaddress="24.199.123.1" AND destinationtranslatedport=5000)
index=activity AND rg_functionality="Web Proxy" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="139.162.102.163" AND translatedport=80 OR destinationtranslatedaddress="139.162.102.163" AND translatedport=445 OR destinationtranslatedaddress="139.162.102.163" AND translatedport=3306 OR destinationtranslatedaddress="139.162.102.163" AND translatedport=3389 OR destinationtranslatedaddress="24.199.123.1" AND translatedport=80 OR destinationtranslatedaddress="24.199.123.1" AND translatedport=1234 OR destinationtranslatedaddress="24.199.123.1" AND translatedport=4000 OR destinationtranslatedaddress="24.199.123.1" AND translatedport=5000)
index=activity AND rg_functionality="Flow" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="139.162.102.163" AND destinationport=80 OR destinationaddress="139.162.102.163" AND destinationport=445 OR destinationaddress="139.162.102.163" AND destinationport=3306 OR destinationaddress="139.162.102.163" AND destinationport=3389 OR destinationaddress="24.199.123.1" AND destinationport=80 OR destinationaddress="24.199.123.1" AND destinationport=1234 OR destinationaddress="24.199.123.1" AND destinationport=4000 OR destinationaddress="24.199.123.1" AND destinationport=5000)
index=activity AND rg_functionality="Flow" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="139.162.102.163" AND sourceport=80 OR sourceaddress="139.162.102.163" AND sourceport=445 OR sourceaddress="139.162.102.163" AND sourceport=3306 OR sourceaddress="139.162.102.163" AND sourceport=3389 OR sourceaddress="24.199.123.1" AND sourceport=80 OR sourceaddress="24.199.123.1" AND sourceport=1234 OR sourceaddress="24.199.123.1" AND sourceport=4000 OR sourceaddress="24.199.123.1" AND sourceport=5000)
index=activity AND rg_functionality="Flow" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="139.162.102.163" AND sourceport=80 OR translatedipaddress="139.162.102.163" AND sourceport=445 OR translatedipaddress="139.162.102.163" AND sourceport=3306 OR translatedipaddress="139.162.102.163" AND sourceport=3389 OR translatedipaddress="24.199.123.1" AND sourceport=80 OR translatedipaddress="24.199.123.1" AND sourceport=1234 OR translatedipaddress="24.199.123.1" AND sourceport=4000 OR translatedipaddress="24.199.123.1" AND sourceport=5000)
index=activity AND rg_functionality="Flow" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="139.162.102.163" AND destinationport=80 OR destinationtranslatedaddress="139.162.102.163" AND destinationport=445 OR destinationtranslatedaddress="139.162.102.163" AND destinationport=3306 OR destinationtranslatedaddress="139.162.102.163" AND destinationport=3389 OR destinationtranslatedaddress="24.199.123.1" AND destinationport=80 OR destinationtranslatedaddress="24.199.123.1" AND destinationport=1234 OR destinationtranslatedaddress="24.199.123.1" AND destinationport=4000 OR destinationtranslatedaddress="24.199.123.1" AND destinationport=5000)
index=activity AND rg_functionality="Flow" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="139.162.102.163" AND destinationtranslatedport=80 OR destinationtranslatedaddress="139.162.102.163" AND destinationtranslatedport=445 OR destinationtranslatedaddress="139.162.102.163" AND destinationtranslatedport=3306 OR destinationtranslatedaddress="139.162.102.163" AND destinationtranslatedport=3389 OR destinationtranslatedaddress="24.199.123.1" AND destinationtranslatedport=80 OR destinationtranslatedaddress="24.199.123.1" AND destinationtranslatedport=1234 OR destinationtranslatedaddress="24.199.123.1" AND destinationtranslatedport=4000 OR destinationtranslatedaddress="24.199.123.1" AND destinationtranslatedport=5000)
index=activity AND rg_functionality="Flow" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="139.162.102.163" AND translatedport=80 OR destinationtranslatedaddress="139.162.102.163" AND translatedport=445 OR destinationtranslatedaddress="139.162.102.163" AND translatedport=3306 OR destinationtranslatedaddress="139.162.102.163" AND translatedport=3389 OR destinationtranslatedaddress="24.199.123.1" AND translatedport=80 OR destinationtranslatedaddress="24.199.123.1" AND translatedport=1234 OR destinationtranslatedaddress="24.199.123.1" AND translatedport=4000 OR destinationtranslatedaddress="24.199.123.1" AND translatedport=5000)
index=activity AND rg_functionality="Web Server" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="139.162.102.163" AND destinationport=80 OR destinationaddress="139.162.102.163" AND destinationport=445 OR destinationaddress="139.162.102.163" AND destinationport=3306 OR destinationaddress="139.162.102.163" AND destinationport=3389 OR destinationaddress="24.199.123.1" AND destinationport=80 OR destinationaddress="24.199.123.1" AND destinationport=1234 OR destinationaddress="24.199.123.1" AND destinationport=4000 OR destinationaddress="24.199.123.1" AND destinationport=5000)
index=activity AND rg_functionality="Web Server" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="139.162.102.163" AND sourceport=80 OR sourceaddress="139.162.102.163" AND sourceport=445 OR sourceaddress="139.162.102.163" AND sourceport=3306 OR sourceaddress="139.162.102.163" AND sourceport=3389 OR sourceaddress="24.199.123.1" AND sourceport=80 OR sourceaddress="24.199.123.1" AND sourceport=1234 OR sourceaddress="24.199.123.1" AND sourceport=4000 OR sourceaddress="24.199.123.1" AND sourceport=5000)
index=activity AND rg_functionality="Web Server" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="139.162.102.163" AND sourceport=80 OR translatedipaddress="139.162.102.163" AND sourceport=445 OR translatedipaddress="139.162.102.163" AND sourceport=3306 OR translatedipaddress="139.162.102.163" AND sourceport=3389 OR translatedipaddress="24.199.123.1" AND sourceport=80 OR translatedipaddress="24.199.123.1" AND sourceport=1234 OR translatedipaddress="24.199.123.1" AND sourceport=4000 OR translatedipaddress="24.199.123.1" AND sourceport=5000)
index=activity AND rg_functionality="Web Server" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="139.162.102.163" AND destinationport=80 OR destinationtranslatedaddress="139.162.102.163" AND destinationport=445 OR destinationtranslatedaddress="139.162.102.163" AND destinationport=3306 OR destinationtranslatedaddress="139.162.102.163" AND destinationport=3389 OR destinationtranslatedaddress="24.199.123.1" AND destinationport=80 OR destinationtranslatedaddress="24.199.123.1" AND destinationport=1234 OR destinationtranslatedaddress="24.199.123.1" AND destinationport=4000 OR destinationtranslatedaddress="24.199.123.1" AND destinationport=5000)
index=activity AND rg_functionality="Web Server" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="139.162.102.163" AND destinationtranslatedport=80 OR destinationtranslatedaddress="139.162.102.163" AND destinationtranslatedport=445 OR destinationtranslatedaddress="139.162.102.163" AND destinationtranslatedport=3306 OR destinationtranslatedaddress="139.162.102.163" AND destinationtranslatedport=3389 OR destinationtranslatedaddress="24.199.123.1" AND destinationtranslatedport=80 OR destinationtranslatedaddress="24.199.123.1" AND destinationtranslatedport=1234 OR destinationtranslatedaddress="24.199.123.1" AND destinationtranslatedport=4000 OR destinationtranslatedaddress="24.199.123.1" AND destinationtranslatedport=5000)
index=activity AND rg_functionality="Web Server" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="139.162.102.163" AND translatedport=80 OR destinationtranslatedaddress="139.162.102.163" AND translatedport=445 OR destinationtranslatedaddress="139.162.102.163" AND translatedport=3306 OR destinationtranslatedaddress="139.162.102.163" AND translatedport=3389 OR destinationtranslatedaddress="24.199.123.1" AND translatedport=80 OR destinationtranslatedaddress="24.199.123.1" AND translatedport=1234 OR destinationtranslatedaddress="24.199.123.1" AND translatedport=4000 OR destinationtranslatedaddress="24.199.123.1" AND translatedport=5000)
index=activity AND rg_functionality="Web Application Firewall" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="139.162.102.163" AND destinationport=80 OR destinationaddress="139.162.102.163" AND destinationport=445 OR destinationaddress="139.162.102.163" AND destinationport=3306 OR destinationaddress="139.162.102.163" AND destinationport=3389 OR destinationaddress="24.199.123.1" AND destinationport=80 OR destinationaddress="24.199.123.1" AND destinationport=1234 OR destinationaddress="24.199.123.1" AND destinationport=4000 OR destinationaddress="24.199.123.1" AND destinationport=5000)
index=activity AND rg_functionality="Web Application Firewall" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="139.162.102.163" AND sourceport=80 OR sourceaddress="139.162.102.163" AND sourceport=445 OR sourceaddress="139.162.102.163" AND sourceport=3306 OR sourceaddress="139.162.102.163" AND sourceport=3389 OR sourceaddress="24.199.123.1" AND sourceport=80 OR sourceaddress="24.199.123.1" AND sourceport=1234 OR sourceaddress="24.199.123.1" AND sourceport=4000 OR sourceaddress="24.199.123.1" AND sourceport=5000)
index=activity AND rg_functionality="Web Application Firewall" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="139.162.102.163" AND sourceport=80 OR translatedipaddress="139.162.102.163" AND sourceport=445 OR translatedipaddress="139.162.102.163" AND sourceport=3306 OR translatedipaddress="139.162.102.163" AND sourceport=3389 OR translatedipaddress="24.199.123.1" AND sourceport=80 OR translatedipaddress="24.199.123.1" AND sourceport=1234 OR translatedipaddress="24.199.123.1" AND sourceport=4000 OR translatedipaddress="24.199.123.1" AND sourceport=5000)
index=activity AND rg_functionality="Web Application Firewall" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="139.162.102.163" AND destinationport=80 OR destinationtranslatedaddress="139.162.102.163" AND destinationport=445 OR destinationtranslatedaddress="139.162.102.163" AND destinationport=3306 OR destinationtranslatedaddress="139.162.102.163" AND destinationport=3389 OR destinationtranslatedaddress="24.199.123.1" AND destinationport=80 OR destinationtranslatedaddress="24.199.123.1" AND destinationport=1234 OR destinationtranslatedaddress="24.199.123.1" AND destinationport=4000 OR destinationtranslatedaddress="24.199.123.1" AND destinationport=5000)
index=activity AND rg_functionality="Web Application Firewall" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="139.162.102.163" AND destinationtranslatedport=80 OR destinationtranslatedaddress="139.162.102.163" AND destinationtranslatedport=445 OR destinationtranslatedaddress="139.162.102.163" AND destinationtranslatedport=3306 OR destinationtranslatedaddress="139.162.102.163" AND destinationtranslatedport=3389 OR destinationtranslatedaddress="24.199.123.1" AND destinationtranslatedport=80 OR destinationtranslatedaddress="24.199.123.1" AND destinationtranslatedport=1234 OR destinationtranslatedaddress="24.199.123.1" AND destinationtranslatedport=4000 OR destinationtranslatedaddress="24.199.123.1" AND destinationtranslatedport=5000)
index=activity AND rg_functionality="Web Application Firewall" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="139.162.102.163" AND translatedport=80 OR destinationtranslatedaddress="139.162.102.163" AND translatedport=445 OR destinationtranslatedaddress="139.162.102.163" AND translatedport=3306 OR destinationtranslatedaddress="139.162.102.163" AND translatedport=3389 OR destinationtranslatedaddress="24.199.123.1" AND translatedport=80 OR destinationtranslatedaddress="24.199.123.1" AND translatedport=1234 OR destinationtranslatedaddress="24.199.123.1" AND translatedport=4000 OR destinationtranslatedaddress="24.199.123.1" AND translatedport=5000)
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="139.162.102.163" AND destinationport=80 OR destinationaddress="139.162.102.163" AND destinationport=445 OR destinationaddress="139.162.102.163" AND destinationport=3306 OR destinationaddress="139.162.102.163" AND destinationport=3389 OR destinationaddress="24.199.123.1" AND destinationport=80 OR destinationaddress="24.199.123.1" AND destinationport=1234 OR destinationaddress="24.199.123.1" AND destinationport=4000 OR destinationaddress="24.199.123.1" AND destinationport=5000)
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="139.162.102.163" AND sourceport=80 OR sourceaddress="139.162.102.163" AND sourceport=445 OR sourceaddress="139.162.102.163" AND sourceport=3306 OR sourceaddress="139.162.102.163" AND sourceport=3389 OR sourceaddress="24.199.123.1" AND sourceport=80 OR sourceaddress="24.199.123.1" AND sourceport=1234 OR sourceaddress="24.199.123.1" AND sourceport=4000 OR sourceaddress="24.199.123.1" AND sourceport=5000)
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="139.162.102.163" AND sourceport=80 OR translatedipaddress="139.162.102.163" AND sourceport=445 OR translatedipaddress="139.162.102.163" AND sourceport=3306 OR translatedipaddress="139.162.102.163" AND sourceport=3389 OR translatedipaddress="24.199.123.1" AND sourceport=80 OR translatedipaddress="24.199.123.1" AND sourceport=1234 OR translatedipaddress="24.199.123.1" AND sourceport=4000 OR translatedipaddress="24.199.123.1" AND sourceport=5000)
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="139.162.102.163" AND destinationport=80 OR destinationtranslatedaddress="139.162.102.163" AND destinationport=445 OR destinationtranslatedaddress="139.162.102.163" AND destinationport=3306 OR destinationtranslatedaddress="139.162.102.163" AND destinationport=3389 OR destinationtranslatedaddress="24.199.123.1" AND destinationport=80 OR destinationtranslatedaddress="24.199.123.1" AND destinationport=1234 OR destinationtranslatedaddress="24.199.123.1" AND destinationport=4000 OR destinationtranslatedaddress="24.199.123.1" AND destinationport=5000)
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="139.162.102.163" AND destinationtranslatedport=80 OR destinationtranslatedaddress="139.162.102.163" AND destinationtranslatedport=445 OR destinationtranslatedaddress="139.162.102.163" AND destinationtranslatedport=3306 OR destinationtranslatedaddress="139.162.102.163" AND destinationtranslatedport=3389 OR destinationtranslatedaddress="24.199.123.1" AND destinationtranslatedport=80 OR destinationtranslatedaddress="24.199.123.1" AND destinationtranslatedport=1234 OR destinationtranslatedaddress="24.199.123.1" AND destinationtranslatedport=4000 OR destinationtranslatedaddress="24.199.123.1" AND destinationtranslatedport=5000)
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="139.162.102.163" AND translatedport=80 OR destinationtranslatedaddress="139.162.102.163" AND translatedport=445 OR destinationtranslatedaddress="139.162.102.163" AND translatedport=3306 OR destinationtranslatedaddress="139.162.102.163" AND translatedport=3389 OR destinationtranslatedaddress="24.199.123.1" AND translatedport=80 OR destinationtranslatedaddress="24.199.123.1" AND translatedport=1234 OR destinationtranslatedaddress="24.199.123.1" AND translatedport=4000 OR destinationtranslatedaddress="24.199.123.1" AND translatedport=5000)
index=activity AND rg_functionality="Cloud Services / Applications" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="139.162.102.163" AND destinationport=80 OR destinationaddress="139.162.102.163" AND destinationport=445 OR destinationaddress="139.162.102.163" AND destinationport=3306 OR destinationaddress="139.162.102.163" AND destinationport=3389 OR destinationaddress="24.199.123.1" AND destinationport=80 OR destinationaddress="24.199.123.1" AND destinationport=1234 OR destinationaddress="24.199.123.1" AND destinationport=4000 OR destinationaddress="24.199.123.1" AND destinationport=5000)
index=activity AND rg_functionality="Cloud Services / Applications" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="139.162.102.163" AND sourceport=80 OR sourceaddress="139.162.102.163" AND sourceport=445 OR sourceaddress="139.162.102.163" AND sourceport=3306 OR sourceaddress="139.162.102.163" AND sourceport=3389 OR sourceaddress="24.199.123.1" AND sourceport=80 OR sourceaddress="24.199.123.1" AND sourceport=1234 OR sourceaddress="24.199.123.1" AND sourceport=4000 OR sourceaddress="24.199.123.1" AND sourceport=5000)
index=activity AND rg_functionality="Cloud Services / Applications" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="139.162.102.163" AND sourceport=80 OR translatedipaddress="139.162.102.163" AND sourceport=445 OR translatedipaddress="139.162.102.163" AND sourceport=3306 OR translatedipaddress="139.162.102.163" AND sourceport=3389 OR translatedipaddress="24.199.123.1" AND sourceport=80 OR translatedipaddress="24.199.123.1" AND sourceport=1234 OR translatedipaddress="24.199.123.1" AND sourceport=4000 OR translatedipaddress="24.199.123.1" AND sourceport=5000)
index=activity AND rg_functionality="Cloud Services / Applications" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="139.162.102.163" AND destinationport=80 OR destinationtranslatedaddress="139.162.102.163" AND destinationport=445 OR destinationtranslatedaddress="139.162.102.163" AND destinationport=3306 OR destinationtranslatedaddress="139.162.102.163" AND destinationport=3389 OR destinationtranslatedaddress="24.199.123.1" AND destinationport=80 OR destinationtranslatedaddress="24.199.123.1" AND destinationport=1234 OR destinationtranslatedaddress="24.199.123.1" AND destinationport=4000 OR destinationtranslatedaddress="24.199.123.1" AND destinationport=5000)
index=activity AND rg_functionality="Cloud Services / Applications" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="139.162.102.163" AND destinationtranslatedport=80 OR destinationtranslatedaddress="139.162.102.163" AND destinationtranslatedport=445 OR destinationtranslatedaddress="139.162.102.163" AND destinationtranslatedport=3306 OR destinationtranslatedaddress="139.162.102.163" AND destinationtranslatedport=3389 OR destinationtranslatedaddress="24.199.123.1" AND destinationtranslatedport=80 OR destinationtranslatedaddress="24.199.123.1" AND destinationtranslatedport=1234 OR destinationtranslatedaddress="24.199.123.1" AND destinationtranslatedport=4000 OR destinationtranslatedaddress="24.199.123.1" AND destinationtranslatedport=5000)
index=activity AND rg_functionality="Cloud Services / Applications" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="139.162.102.163" AND translatedport=80 OR destinationtranslatedaddress="139.162.102.163" AND translatedport=445 OR destinationtranslatedaddress="139.162.102.163" AND translatedport=3306 OR destinationtranslatedaddress="139.162.102.163" AND translatedport=3389 OR destinationtranslatedaddress="24.199.123.1" AND translatedport=80 OR destinationtranslatedaddress="24.199.123.1" AND translatedport=1234 OR destinationtranslatedaddress="24.199.123.1" AND translatedport=4000 OR destinationtranslatedaddress="24.199.123.1" AND translatedport=5000)
index=activity AND rg_functionality="Cloud Application Audit" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="139.162.102.163" AND destinationport=80 OR destinationaddress="139.162.102.163" AND destinationport=445 OR destinationaddress="139.162.102.163" AND destinationport=3306 OR destinationaddress="139.162.102.163" AND destinationport=3389 OR destinationaddress="24.199.123.1" AND destinationport=80 OR destinationaddress="24.199.123.1" AND destinationport=1234 OR destinationaddress="24.199.123.1" AND destinationport=4000 OR destinationaddress="24.199.123.1" AND destinationport=5000)
index=activity AND rg_functionality="Cloud Application Audit" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="139.162.102.163" AND sourceport=80 OR sourceaddress="139.162.102.163" AND sourceport=445 OR sourceaddress="139.162.102.163" AND sourceport=3306 OR sourceaddress="139.162.102.163" AND sourceport=3389 OR sourceaddress="24.199.123.1" AND sourceport=80 OR sourceaddress="24.199.123.1" AND sourceport=1234 OR sourceaddress="24.199.123.1" AND sourceport=4000 OR sourceaddress="24.199.123.1" AND sourceport=5000)
index=activity AND rg_functionality="Cloud Application Audit" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="139.162.102.163" AND sourceport=80 OR translatedipaddress="139.162.102.163" AND sourceport=445 OR translatedipaddress="139.162.102.163" AND sourceport=3306 OR translatedipaddress="139.162.102.163" AND sourceport=3389 OR translatedipaddress="24.199.123.1" AND sourceport=80 OR translatedipaddress="24.199.123.1" AND sourceport=1234 OR translatedipaddress="24.199.123.1" AND sourceport=4000 OR translatedipaddress="24.199.123.1" AND sourceport=5000)
index=activity AND rg_functionality="Cloud Application Audit" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="139.162.102.163" AND destinationport=80 OR destinationtranslatedaddress="139.162.102.163" AND destinationport=445 OR destinationtranslatedaddress="139.162.102.163" AND destinationport=3306 OR destinationtranslatedaddress="139.162.102.163" AND destinationport=3389 OR destinationtranslatedaddress="24.199.123.1" AND destinationport=80 OR destinationtranslatedaddress="24.199.123.1" AND destinationport=1234 OR destinationtranslatedaddress="24.199.123.1" AND destinationport=4000 OR destinationtranslatedaddress="24.199.123.1" AND destinationport=5000)
index=activity AND rg_functionality="Cloud Application Audit" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="139.162.102.163" AND destinationtranslatedport=80 OR destinationtranslatedaddress="139.162.102.163" AND destinationtranslatedport=445 OR destinationtranslatedaddress="139.162.102.163" AND destinationtranslatedport=3306 OR destinationtranslatedaddress="139.162.102.163" AND destinationtranslatedport=3389 OR destinationtranslatedaddress="24.199.123.1" AND destinationtranslatedport=80 OR destinationtranslatedaddress="24.199.123.1" AND destinationtranslatedport=1234 OR destinationtranslatedaddress="24.199.123.1" AND destinationtranslatedport=4000 OR destinationtranslatedaddress="24.199.123.1" AND destinationtranslatedport=5000)
index=activity AND rg_functionality="Cloud Application Audit" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="139.162.102.163" AND translatedport=80 OR destinationtranslatedaddress="139.162.102.163" AND translatedport=445 OR destinationtranslatedaddress="139.162.102.163" AND translatedport=3306 OR destinationtranslatedaddress="139.162.102.163" AND translatedport=3389 OR destinationtranslatedaddress="24.199.123.1" AND translatedport=80 OR destinationtranslatedaddress="24.199.123.1" AND translatedport=1234 OR destinationtranslatedaddress="24.199.123.1" AND translatedport=4000 OR destinationtranslatedaddress="24.199.123.1" AND translatedport=5000)
index=activity AND rg_functionality="Authentication / VPN" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="139.162.102.163" AND destinationport=80 OR destinationaddress="139.162.102.163" AND destinationport=445 OR destinationaddress="139.162.102.163" AND destinationport=3306 OR destinationaddress="139.162.102.163" AND destinationport=3389 OR destinationaddress="24.199.123.1" AND destinationport=80 OR destinationaddress="24.199.123.1" AND destinationport=1234 OR destinationaddress="24.199.123.1" AND destinationport=4000 OR destinationaddress="24.199.123.1" AND destinationport=5000)
index=activity AND rg_functionality="Authentication / VPN" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="139.162.102.163" AND sourceport=80 OR sourceaddress="139.162.102.163" AND sourceport=445 OR sourceaddress="139.162.102.163" AND sourceport=3306 OR sourceaddress="139.162.102.163" AND sourceport=3389 OR sourceaddress="24.199.123.1" AND sourceport=80 OR sourceaddress="24.199.123.1" AND sourceport=1234 OR sourceaddress="24.199.123.1" AND sourceport=4000 OR sourceaddress="24.199.123.1" AND sourceport=5000)
index=activity AND rg_functionality="Authentication / VPN" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="139.162.102.163" AND sourceport=80 OR translatedipaddress="139.162.102.163" AND sourceport=445 OR translatedipaddress="139.162.102.163" AND sourceport=3306 OR translatedipaddress="139.162.102.163" AND sourceport=3389 OR translatedipaddress="24.199.123.1" AND sourceport=80 OR translatedipaddress="24.199.123.1" AND sourceport=1234 OR translatedipaddress="24.199.123.1" AND sourceport=4000 OR translatedipaddress="24.199.123.1" AND sourceport=5000)
index=activity AND rg_functionality="Authentication / VPN" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="139.162.102.163" AND destinationport=80 OR destinationtranslatedaddress="139.162.102.163" AND destinationport=445 OR destinationtranslatedaddress="139.162.102.163" AND destinationport=3306 OR destinationtranslatedaddress="139.162.102.163" AND destinationport=3389 OR destinationtranslatedaddress="24.199.123.1" AND destinationport=80 OR destinationtranslatedaddress="24.199.123.1" AND destinationport=1234 OR destinationtranslatedaddress="24.199.123.1" AND destinationport=4000 OR destinationtranslatedaddress="24.199.123.1" AND destinationport=5000)
index=activity AND rg_functionality="Authentication / VPN" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="139.162.102.163" AND destinationtranslatedport=80 OR destinationtranslatedaddress="139.162.102.163" AND destinationtranslatedport=445 OR destinationtranslatedaddress="139.162.102.163" AND destinationtranslatedport=3306 OR destinationtranslatedaddress="139.162.102.163" AND destinationtranslatedport=3389 OR destinationtranslatedaddress="24.199.123.1" AND destinationtranslatedport=80 OR destinationtranslatedaddress="24.199.123.1" AND destinationtranslatedport=1234 OR destinationtranslatedaddress="24.199.123.1" AND destinationtranslatedport=4000 OR destinationtranslatedaddress="24.199.123.1" AND destinationtranslatedport=5000)
index=activity AND rg_functionality="Authentication / VPN" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="139.162.102.163" AND translatedport=80 OR destinationtranslatedaddress="139.162.102.163" AND translatedport=445 OR destinationtranslatedaddress="139.162.102.163" AND translatedport=3306 OR destinationtranslatedaddress="139.162.102.163" AND translatedport=3389 OR destinationtranslatedaddress="24.199.123.1" AND translatedport=80 OR destinationtranslatedaddress="24.199.123.1" AND translatedport=1234 OR destinationtranslatedaddress="24.199.123.1" AND translatedport=4000 OR destinationtranslatedaddress="24.199.123.1" AND translatedport=5000)
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="139.162.102.163" AND destinationport=80 OR destinationaddress="139.162.102.163" AND destinationport=445 OR destinationaddress="139.162.102.163" AND destinationport=3306 OR destinationaddress="139.162.102.163" AND destinationport=3389 OR destinationaddress="24.199.123.1" AND destinationport=80 OR destinationaddress="24.199.123.1" AND destinationport=1234 OR destinationaddress="24.199.123.1" AND destinationport=4000 OR destinationaddress="24.199.123.1" AND destinationport=5000)
index=activity AND rg_functionality="Unix / Linux / AIX" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="139.162.102.163" AND sourceport=80 OR sourceaddress="139.162.102.163" AND sourceport=445 OR sourceaddress="139.162.102.163" AND sourceport=3306 OR sourceaddress="139.162.102.163" AND sourceport=3389 OR sourceaddress="24.199.123.1" AND sourceport=80 OR sourceaddress="24.199.123.1" AND sourceport=1234 OR sourceaddress="24.199.123.1" AND sourceport=4000 OR sourceaddress="24.199.123.1" AND sourceport=5000)
index=activity AND rg_functionality="Unix / Linux / AIX" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="139.162.102.163" AND sourceport=80 OR translatedipaddress="139.162.102.163" AND sourceport=445 OR translatedipaddress="139.162.102.163" AND sourceport=3306 OR translatedipaddress="139.162.102.163" AND sourceport=3389 OR translatedipaddress="24.199.123.1" AND sourceport=80 OR translatedipaddress="24.199.123.1" AND sourceport=1234 OR translatedipaddress="24.199.123.1" AND sourceport=4000 OR translatedipaddress="24.199.123.1" AND sourceport=5000)
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="139.162.102.163" AND destinationport=80 OR destinationtranslatedaddress="139.162.102.163" AND destinationport=445 OR destinationtranslatedaddress="139.162.102.163" AND destinationport=3306 OR destinationtranslatedaddress="139.162.102.163" AND destinationport=3389 OR destinationtranslatedaddress="24.199.123.1" AND destinationport=80 OR destinationtranslatedaddress="24.199.123.1" AND destinationport=1234 OR destinationtranslatedaddress="24.199.123.1" AND destinationport=4000 OR destinationtranslatedaddress="24.199.123.1" AND destinationport=5000)
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="139.162.102.163" AND destinationtranslatedport=80 OR destinationtranslatedaddress="139.162.102.163" AND destinationtranslatedport=445 OR destinationtranslatedaddress="139.162.102.163" AND destinationtranslatedport=3306 OR destinationtranslatedaddress="139.162.102.163" AND destinationtranslatedport=3389 OR destinationtranslatedaddress="24.199.123.1" AND destinationtranslatedport=80 OR destinationtranslatedaddress="24.199.123.1" AND destinationtranslatedport=1234 OR destinationtranslatedaddress="24.199.123.1" AND destinationtranslatedport=4000 OR destinationtranslatedaddress="24.199.123.1" AND destinationtranslatedport=5000)
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="139.162.102.163" AND translatedport=80 OR destinationtranslatedaddress="139.162.102.163" AND translatedport=445 OR destinationtranslatedaddress="139.162.102.163" AND translatedport=3306 OR destinationtranslatedaddress="139.162.102.163" AND translatedport=3389 OR destinationtranslatedaddress="24.199.123.1" AND translatedport=80 OR destinationtranslatedaddress="24.199.123.1" AND translatedport=1234 OR destinationtranslatedaddress="24.199.123.1" AND translatedport=4000 OR destinationtranslatedaddress="24.199.123.1" AND translatedport=5000)
index=activity AND rg_functionality="Authentication / WiFi" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="139.162.102.163" AND destinationport=80 OR destinationaddress="139.162.102.163" AND destinationport=445 OR destinationaddress="139.162.102.163" AND destinationport=3306 OR destinationaddress="139.162.102.163" AND destinationport=3389 OR destinationaddress="24.199.123.1" AND destinationport=80 OR destinationaddress="24.199.123.1" AND destinationport=1234 OR destinationaddress="24.199.123.1" AND destinationport=4000 OR destinationaddress="24.199.123.1" AND destinationport=5000)
index=activity AND rg_functionality="Authentication / WiFi" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="139.162.102.163" AND sourceport=80 OR sourceaddress="139.162.102.163" AND sourceport=445 OR sourceaddress="139.162.102.163" AND sourceport=3306 OR sourceaddress="139.162.102.163" AND sourceport=3389 OR sourceaddress="24.199.123.1" AND sourceport=80 OR sourceaddress="24.199.123.1" AND sourceport=1234 OR sourceaddress="24.199.123.1" AND sourceport=4000 OR sourceaddress="24.199.123.1" AND sourceport=5000)
index=activity AND rg_functionality="Authentication / WiFi" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="139.162.102.163" AND sourceport=80 OR translatedipaddress="139.162.102.163" AND sourceport=445 OR translatedipaddress="139.162.102.163" AND sourceport=3306 OR translatedipaddress="139.162.102.163" AND sourceport=3389 OR translatedipaddress="24.199.123.1" AND sourceport=80 OR translatedipaddress="24.199.123.1" AND sourceport=1234 OR translatedipaddress="24.199.123.1" AND sourceport=4000 OR translatedipaddress="24.199.123.1" AND sourceport=5000)
index=activity AND rg_functionality="Authentication / WiFi" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="139.162.102.163" AND destinationport=80 OR destinationtranslatedaddress="139.162.102.163" AND destinationport=445 OR destinationtranslatedaddress="139.162.102.163" AND destinationport=3306 OR destinationtranslatedaddress="139.162.102.163" AND destinationport=3389 OR destinationtranslatedaddress="24.199.123.1" AND destinationport=80 OR destinationtranslatedaddress="24.199.123.1" AND destinationport=1234 OR destinationtranslatedaddress="24.199.123.1" AND destinationport=4000 OR destinationtranslatedaddress="24.199.123.1" AND destinationport=5000)
index=activity AND rg_functionality="Authentication / WiFi" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="139.162.102.163" AND destinationtranslatedport=80 OR destinationtranslatedaddress="139.162.102.163" AND destinationtranslatedport=445 OR destinationtranslatedaddress="139.162.102.163" AND destinationtranslatedport=3306 OR destinationtranslatedaddress="139.162.102.163" AND destinationtranslatedport=3389 OR destinationtranslatedaddress="24.199.123.1" AND destinationtranslatedport=80 OR destinationtranslatedaddress="24.199.123.1" AND destinationtranslatedport=1234 OR destinationtranslatedaddress="24.199.123.1" AND destinationtranslatedport=4000 OR destinationtranslatedaddress="24.199.123.1" AND destinationtranslatedport=5000)
index=activity AND rg_functionality="Authentication / WiFi" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="139.162.102.163" AND translatedport=80 OR destinationtranslatedaddress="139.162.102.163" AND translatedport=445 OR destinationtranslatedaddress="139.162.102.163" AND translatedport=3306 OR destinationtranslatedaddress="139.162.102.163" AND translatedport=3389 OR destinationtranslatedaddress="24.199.123.1" AND translatedport=80 OR destinationtranslatedaddress="24.199.123.1" AND translatedport=1234 OR destinationtranslatedaddress="24.199.123.1" AND translatedport=4000 OR destinationtranslatedaddress="24.199.123.1" AND translatedport=5000)
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="139.162.102.163" AND destinationport=80 OR destinationaddress="139.162.102.163" AND destinationport=445 OR destinationaddress="139.162.102.163" AND destinationport=3306 OR destinationaddress="139.162.102.163" AND destinationport=3389 OR destinationaddress="24.199.123.1" AND destinationport=80 OR destinationaddress="24.199.123.1" AND destinationport=1234 OR destinationaddress="24.199.123.1" AND destinationport=4000 OR destinationaddress="24.199.123.1" AND destinationport=5000)
index=activity AND rg_functionality="Cloud Application Security Broker" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="139.162.102.163" AND sourceport=80 OR sourceaddress="139.162.102.163" AND sourceport=445 OR sourceaddress="139.162.102.163" AND sourceport=3306 OR sourceaddress="139.162.102.163" AND sourceport=3389 OR sourceaddress="24.199.123.1" AND sourceport=80 OR sourceaddress="24.199.123.1" AND sourceport=1234 OR sourceaddress="24.199.123.1" AND sourceport=4000 OR sourceaddress="24.199.123.1" AND sourceport=5000)
index=activity AND rg_functionality="Cloud Application Security Broker" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="139.162.102.163" AND sourceport=80 OR translatedipaddress="139.162.102.163" AND sourceport=445 OR translatedipaddress="139.162.102.163" AND sourceport=3306 OR translatedipaddress="139.162.102.163" AND sourceport=3389 OR translatedipaddress="24.199.123.1" AND sourceport=80 OR translatedipaddress="24.199.123.1" AND sourceport=1234 OR translatedipaddress="24.199.123.1" AND sourceport=4000 OR translatedipaddress="24.199.123.1" AND sourceport=5000)
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="139.162.102.163" AND destinationport=80 OR destinationtranslatedaddress="139.162.102.163" AND destinationport=445 OR destinationtranslatedaddress="139.162.102.163" AND destinationport=3306 OR destinationtranslatedaddress="139.162.102.163" AND destinationport=3389 OR destinationtranslatedaddress="24.199.123.1" AND destinationport=80 OR destinationtranslatedaddress="24.199.123.1" AND destinationport=1234 OR destinationtranslatedaddress="24.199.123.1" AND destinationport=4000 OR destinationtranslatedaddress="24.199.123.1" AND destinationport=5000)
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="139.162.102.163" AND destinationtranslatedport=80 OR destinationtranslatedaddress="139.162.102.163" AND destinationtranslatedport=445 OR destinationtranslatedaddress="139.162.102.163" AND destinationtranslatedport=3306 OR destinationtranslatedaddress="139.162.102.163" AND destinationtranslatedport=3389 OR destinationtranslatedaddress="24.199.123.1" AND destinationtranslatedport=80 OR destinationtranslatedaddress="24.199.123.1" AND destinationtranslatedport=1234 OR destinationtranslatedaddress="24.199.123.1" AND destinationtranslatedport=4000 OR destinationtranslatedaddress="24.199.123.1" AND destinationtranslatedport=5000)
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="139.162.102.163" AND translatedport=80 OR destinationtranslatedaddress="139.162.102.163" AND translatedport=445 OR destinationtranslatedaddress="139.162.102.163" AND translatedport=3306 OR destinationtranslatedaddress="139.162.102.163" AND translatedport=3389 OR destinationtranslatedaddress="24.199.123.1" AND translatedport=80 OR destinationtranslatedaddress="24.199.123.1" AND translatedport=1234 OR destinationtranslatedaddress="24.199.123.1" AND translatedport=4000 OR destinationtranslatedaddress="24.199.123.1" AND translatedport=5000)
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="139.162.102.163" AND destinationport=80 OR destinationaddress="139.162.102.163" AND destinationport=445 OR destinationaddress="139.162.102.163" AND destinationport=3306 OR destinationaddress="139.162.102.163" AND destinationport=3389 OR destinationaddress="24.199.123.1" AND destinationport=80 OR destinationaddress="24.199.123.1" AND destinationport=1234 OR destinationaddress="24.199.123.1" AND destinationport=4000 OR destinationaddress="24.199.123.1" AND destinationport=5000)
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="139.162.102.163" AND sourceport=80 OR sourceaddress="139.162.102.163" AND sourceport=445 OR sourceaddress="139.162.102.163" AND sourceport=3306 OR sourceaddress="139.162.102.163" AND sourceport=3389 OR sourceaddress="24.199.123.1" AND sourceport=80 OR sourceaddress="24.199.123.1" AND sourceport=1234 OR sourceaddress="24.199.123.1" AND sourceport=4000 OR sourceaddress="24.199.123.1" AND sourceport=5000)
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="139.162.102.163" AND sourceport=80 OR translatedipaddress="139.162.102.163" AND sourceport=445 OR translatedipaddress="139.162.102.163" AND sourceport=3306 OR translatedipaddress="139.162.102.163" AND sourceport=3389 OR translatedipaddress="24.199.123.1" AND sourceport=80 OR translatedipaddress="24.199.123.1" AND sourceport=1234 OR translatedipaddress="24.199.123.1" AND sourceport=4000 OR translatedipaddress="24.199.123.1" AND sourceport=5000)
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="139.162.102.163" AND destinationport=80 OR destinationtranslatedaddress="139.162.102.163" AND destinationport=445 OR destinationtranslatedaddress="139.162.102.163" AND destinationport=3306 OR destinationtranslatedaddress="139.162.102.163" AND destinationport=3389 OR destinationtranslatedaddress="24.199.123.1" AND destinationport=80 OR destinationtranslatedaddress="24.199.123.1" AND destinationport=1234 OR destinationtranslatedaddress="24.199.123.1" AND destinationport=4000 OR destinationtranslatedaddress="24.199.123.1" AND destinationport=5000)
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="139.162.102.163" AND destinationtranslatedport=80 OR destinationtranslatedaddress="139.162.102.163" AND destinationtranslatedport=445 OR destinationtranslatedaddress="139.162.102.163" AND destinationtranslatedport=3306 OR destinationtranslatedaddress="139.162.102.163" AND destinationtranslatedport=3389 OR destinationtranslatedaddress="24.199.123.1" AND destinationtranslatedport=80 OR destinationtranslatedaddress="24.199.123.1" AND destinationtranslatedport=1234 OR destinationtranslatedaddress="24.199.123.1" AND destinationtranslatedport=4000 OR destinationtranslatedaddress="24.199.123.1" AND destinationtranslatedport=5000)
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="139.162.102.163" AND translatedport=80 OR destinationtranslatedaddress="139.162.102.163" AND translatedport=445 OR destinationtranslatedaddress="139.162.102.163" AND translatedport=3306 OR destinationtranslatedaddress="139.162.102.163" AND translatedport=3389 OR destinationtranslatedaddress="24.199.123.1" AND translatedport=80 OR destinationtranslatedaddress="24.199.123.1" AND translatedport=1234 OR destinationtranslatedaddress="24.199.123.1" AND translatedport=4000 OR destinationtranslatedaddress="24.199.123.1" AND translatedport=5000)
