index=activity AND rg_functionality="Next Generation Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "cache-dns.com" OR destinationhostname CONTAINS "sekoia.io" OR destinationhostname CONTAINS "cache-dns-forwarding.com" OR destinationhostname CONTAINS "cache-dns-preview.com" OR destinationhostname CONTAINS "cache-docs.com" OR destinationhostname CONTAINS "cache-pdf.com" OR destinationhostname CONTAINS "cache-pdf.online" OR destinationhostname CONTAINS "cache-services.live" OR destinationhostname CONTAINS "cloud-docs.com" OR destinationhostname CONTAINS "cloud-drive.live" OR destinationhostname CONTAINS "cloud-storage.live" OR destinationhostname CONTAINS "docs-cache.com" OR destinationhostname CONTAINS "docs-forwarding.online" OR destinationhostname CONTAINS "docs-info.com" OR destinationhostname CONTAINS "docs-shared.com" OR destinationhostname CONTAINS "docs-shared.online" OR destinationhostname CONTAINS "docs-view.online" OR destinationhostname CONTAINS "document-forwarding.com" OR destinationhostname CONTAINS "document-online.live" OR destinationhostname CONTAINS "document-preview.com" OR destinationhostname CONTAINS "documents-cloud.com" OR destinationhostname CONTAINS "documents-cloud.online" OR destinationhostname CONTAINS "documents-forwarding.com" OR destinationhostname CONTAINS "document-share.live" OR destinationhostname CONTAINS "documents-online.live" OR destinationhostname CONTAINS "documents-pdf.online" OR destinationhostname CONTAINS "documents-preview.com" OR destinationhostname CONTAINS "documents-view.live" OR destinationhostname CONTAINS "document-view.live" OR destinationhostname CONTAINS "drive-docs.com" OR destinationhostname CONTAINS "drive-share.live" OR destinationhostname CONTAINS "goo-link.online" OR destinationhostname CONTAINS "hypertextteches.com" OR destinationhostname CONTAINS "mail-docs.online" OR destinationhostname CONTAINS "officeonline365.live" OR destinationhostname CONTAINS "online365-office.com" OR destinationhostname CONTAINS "online-document.live" OR destinationhostname CONTAINS "online-storage.live" OR destinationhostname CONTAINS "pdf-cache.com" OR destinationhostname CONTAINS "pdf-cache.online" OR destinationhostname CONTAINS "pdf-docs.online" OR destinationhostname CONTAINS "pdf-forwarding.online" OR destinationhostname CONTAINS "protection-checklinks.xyz" OR destinationhostname CONTAINS "protection-link.online" OR destinationhostname CONTAINS "protectionmail.online" OR destinationhostname CONTAINS "protection-office.live" OR destinationhostname CONTAINS "protect-link.online" OR destinationhostname CONTAINS "proton-docs.com" OR destinationhostname CONTAINS "proton-reader.com" OR destinationhostname CONTAINS "proton-viewer.com")
index=activity AND rg_functionality="Next Generation Firewall" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "cache-dns.com" OR sourcentdomain CONTAINS "sekoia.io" OR sourcentdomain CONTAINS "cache-dns-forwarding.com" OR sourcentdomain CONTAINS "cache-dns-preview.com" OR sourcentdomain CONTAINS "cache-docs.com" OR sourcentdomain CONTAINS "cache-pdf.com" OR sourcentdomain CONTAINS "cache-pdf.online" OR sourcentdomain CONTAINS "cache-services.live" OR sourcentdomain CONTAINS "cloud-docs.com" OR sourcentdomain CONTAINS "cloud-drive.live" OR sourcentdomain CONTAINS "cloud-storage.live" OR sourcentdomain CONTAINS "docs-cache.com" OR sourcentdomain CONTAINS "docs-forwarding.online" OR sourcentdomain CONTAINS "docs-info.com" OR sourcentdomain CONTAINS "docs-shared.com" OR sourcentdomain CONTAINS "docs-shared.online" OR sourcentdomain CONTAINS "docs-view.online" OR sourcentdomain CONTAINS "document-forwarding.com" OR sourcentdomain CONTAINS "document-online.live" OR sourcentdomain CONTAINS "document-preview.com" OR sourcentdomain CONTAINS "documents-cloud.com" OR sourcentdomain CONTAINS "documents-cloud.online" OR sourcentdomain CONTAINS "documents-forwarding.com" OR sourcentdomain CONTAINS "document-share.live" OR sourcentdomain CONTAINS "documents-online.live" OR sourcentdomain CONTAINS "documents-pdf.online" OR sourcentdomain CONTAINS "documents-preview.com" OR sourcentdomain CONTAINS "documents-view.live" OR sourcentdomain CONTAINS "document-view.live" OR sourcentdomain CONTAINS "drive-docs.com" OR sourcentdomain CONTAINS "drive-share.live" OR sourcentdomain CONTAINS "goo-link.online" OR sourcentdomain CONTAINS "hypertextteches.com" OR sourcentdomain CONTAINS "mail-docs.online" OR sourcentdomain CONTAINS "officeonline365.live" OR sourcentdomain CONTAINS "online365-office.com" OR sourcentdomain CONTAINS "online-document.live" OR sourcentdomain CONTAINS "online-storage.live" OR sourcentdomain CONTAINS "pdf-cache.com" OR sourcentdomain CONTAINS "pdf-cache.online" OR sourcentdomain CONTAINS "pdf-docs.online" OR sourcentdomain CONTAINS "pdf-forwarding.online" OR sourcentdomain CONTAINS "protection-checklinks.xyz" OR sourcentdomain CONTAINS "protection-link.online" OR sourcentdomain CONTAINS "protectionmail.online" OR sourcentdomain CONTAINS "protection-office.live" OR sourcentdomain CONTAINS "protect-link.online" OR sourcentdomain CONTAINS "proton-docs.com" OR sourcentdomain CONTAINS "proton-reader.com" OR sourcentdomain CONTAINS "proton-viewer.com")
index=activity AND rg_functionality="Next Generation Firewall" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "cache-dns.com" OR sourcehostname CONTAINS "sekoia.io" OR sourcehostname CONTAINS "cache-dns-forwarding.com" OR sourcehostname CONTAINS "cache-dns-preview.com" OR sourcehostname CONTAINS "cache-docs.com" OR sourcehostname CONTAINS "cache-pdf.com" OR sourcehostname CONTAINS "cache-pdf.online" OR sourcehostname CONTAINS "cache-services.live" OR sourcehostname CONTAINS "cloud-docs.com" OR sourcehostname CONTAINS "cloud-drive.live" OR sourcehostname CONTAINS "cloud-storage.live" OR sourcehostname CONTAINS "docs-cache.com" OR sourcehostname CONTAINS "docs-forwarding.online" OR sourcehostname CONTAINS "docs-info.com" OR sourcehostname CONTAINS "docs-shared.com" OR sourcehostname CONTAINS "docs-shared.online" OR sourcehostname CONTAINS "docs-view.online" OR sourcehostname CONTAINS "document-forwarding.com" OR sourcehostname CONTAINS "document-online.live" OR sourcehostname CONTAINS "document-preview.com" OR sourcehostname CONTAINS "documents-cloud.com" OR sourcehostname CONTAINS "documents-cloud.online" OR sourcehostname CONTAINS "documents-forwarding.com" OR sourcehostname CONTAINS "document-share.live" OR sourcehostname CONTAINS "documents-online.live" OR sourcehostname CONTAINS "documents-pdf.online" OR sourcehostname CONTAINS "documents-preview.com" OR sourcehostname CONTAINS "documents-view.live" OR sourcehostname CONTAINS "document-view.live" OR sourcehostname CONTAINS "drive-docs.com" OR sourcehostname CONTAINS "drive-share.live" OR sourcehostname CONTAINS "goo-link.online" OR sourcehostname CONTAINS "hypertextteches.com" OR sourcehostname CONTAINS "mail-docs.online" OR sourcehostname CONTAINS "officeonline365.live" OR sourcehostname CONTAINS "online365-office.com" OR sourcehostname CONTAINS "online-document.live" OR sourcehostname CONTAINS "online-storage.live" OR sourcehostname CONTAINS "pdf-cache.com" OR sourcehostname CONTAINS "pdf-cache.online" OR sourcehostname CONTAINS "pdf-docs.online" OR sourcehostname CONTAINS "pdf-forwarding.online" OR sourcehostname CONTAINS "protection-checklinks.xyz" OR sourcehostname CONTAINS "protection-link.online" OR sourcehostname CONTAINS "protectionmail.online" OR sourcehostname CONTAINS "protection-office.live" OR sourcehostname CONTAINS "protect-link.online" OR sourcehostname CONTAINS "proton-docs.com" OR sourcehostname CONTAINS "proton-reader.com" OR sourcehostname CONTAINS "proton-viewer.com")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "cache-dns.com" OR destinationntdomain CONTAINS "sekoia.io" OR destinationntdomain CONTAINS "cache-dns-forwarding.com" OR destinationntdomain CONTAINS "cache-dns-preview.com" OR destinationntdomain CONTAINS "cache-docs.com" OR destinationntdomain CONTAINS "cache-pdf.com" OR destinationntdomain CONTAINS "cache-pdf.online" OR destinationntdomain CONTAINS "cache-services.live" OR destinationntdomain CONTAINS "cloud-docs.com" OR destinationntdomain CONTAINS "cloud-drive.live" OR destinationntdomain CONTAINS "cloud-storage.live" OR destinationntdomain CONTAINS "docs-cache.com" OR destinationntdomain CONTAINS "docs-forwarding.online" OR destinationntdomain CONTAINS "docs-info.com" OR destinationntdomain CONTAINS "docs-shared.com" OR destinationntdomain CONTAINS "docs-shared.online" OR destinationntdomain CONTAINS "docs-view.online" OR destinationntdomain CONTAINS "document-forwarding.com" OR destinationntdomain CONTAINS "document-online.live" OR destinationntdomain CONTAINS "document-preview.com" OR destinationntdomain CONTAINS "documents-cloud.com" OR destinationntdomain CONTAINS "documents-cloud.online" OR destinationntdomain CONTAINS "documents-forwarding.com" OR destinationntdomain CONTAINS "document-share.live" OR destinationntdomain CONTAINS "documents-online.live" OR destinationntdomain CONTAINS "documents-pdf.online" OR destinationntdomain CONTAINS "documents-preview.com" OR destinationntdomain CONTAINS "documents-view.live" OR destinationntdomain CONTAINS "document-view.live" OR destinationntdomain CONTAINS "drive-docs.com" OR destinationntdomain CONTAINS "drive-share.live" OR destinationntdomain CONTAINS "goo-link.online" OR destinationntdomain CONTAINS "hypertextteches.com" OR destinationntdomain CONTAINS "mail-docs.online" OR destinationntdomain CONTAINS "officeonline365.live" OR destinationntdomain CONTAINS "online365-office.com" OR destinationntdomain CONTAINS "online-document.live" OR destinationntdomain CONTAINS "online-storage.live" OR destinationntdomain CONTAINS "pdf-cache.com" OR destinationntdomain CONTAINS "pdf-cache.online" OR destinationntdomain CONTAINS "pdf-docs.online" OR destinationntdomain CONTAINS "pdf-forwarding.online" OR destinationntdomain CONTAINS "protection-checklinks.xyz" OR destinationntdomain CONTAINS "protection-link.online" OR destinationntdomain CONTAINS "protectionmail.online" OR destinationntdomain CONTAINS "protection-office.live" OR destinationntdomain CONTAINS "protect-link.online" OR destinationntdomain CONTAINS "proton-docs.com" OR destinationntdomain CONTAINS "proton-reader.com" OR destinationntdomain CONTAINS "proton-viewer.com")
index=activity AND rg_functionality="Next Generation Firewall" AND requesturl NOT NULL AND (requesturl CONTAINS "cache-dns.com" OR requesturl CONTAINS "sekoia.io" OR requesturl CONTAINS "cache-dns-forwarding.com" OR requesturl CONTAINS "cache-dns-preview.com" OR requesturl CONTAINS "cache-docs.com" OR requesturl CONTAINS "cache-pdf.com" OR requesturl CONTAINS "cache-pdf.online" OR requesturl CONTAINS "cache-services.live" OR requesturl CONTAINS "cloud-docs.com" OR requesturl CONTAINS "cloud-drive.live" OR requesturl CONTAINS "cloud-storage.live" OR requesturl CONTAINS "docs-cache.com" OR requesturl CONTAINS "docs-forwarding.online" OR requesturl CONTAINS "docs-info.com" OR requesturl CONTAINS "docs-shared.com" OR requesturl CONTAINS "docs-shared.online" OR requesturl CONTAINS "docs-view.online" OR requesturl CONTAINS "document-forwarding.com" OR requesturl CONTAINS "document-online.live" OR requesturl CONTAINS "document-preview.com" OR requesturl CONTAINS "documents-cloud.com" OR requesturl CONTAINS "documents-cloud.online" OR requesturl CONTAINS "documents-forwarding.com" OR requesturl CONTAINS "document-share.live" OR requesturl CONTAINS "documents-online.live" OR requesturl CONTAINS "documents-pdf.online" OR requesturl CONTAINS "documents-preview.com" OR requesturl CONTAINS "documents-view.live" OR requesturl CONTAINS "document-view.live" OR requesturl CONTAINS "drive-docs.com" OR requesturl CONTAINS "drive-share.live" OR requesturl CONTAINS "goo-link.online" OR requesturl CONTAINS "hypertextteches.com" OR requesturl CONTAINS "mail-docs.online" OR requesturl CONTAINS "officeonline365.live" OR requesturl CONTAINS "online365-office.com" OR requesturl CONTAINS "online-document.live" OR requesturl CONTAINS "online-storage.live" OR requesturl CONTAINS "pdf-cache.com" OR requesturl CONTAINS "pdf-cache.online" OR requesturl CONTAINS "pdf-docs.online" OR requesturl CONTAINS "pdf-forwarding.online" OR requesturl CONTAINS "protection-checklinks.xyz" OR requesturl CONTAINS "protection-link.online" OR requesturl CONTAINS "protectionmail.online" OR requesturl CONTAINS "protection-office.live" OR requesturl CONTAINS "protect-link.online" OR requesturl CONTAINS "proton-docs.com" OR requesturl CONTAINS "proton-reader.com" OR requesturl CONTAINS "proton-viewer.com")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "relogin-dashboard.online" OR destinationhostname CONTAINS "safe-connection.online" OR destinationhostname CONTAINS "safelinks-protect.live" OR destinationhostname CONTAINS "secureoffice.live" OR destinationhostname CONTAINS "webresources.live" OR destinationhostname CONTAINS "word-yand.live" OR destinationhostname CONTAINS "yandx-online.cloud" OR destinationhostname CONTAINS "y-ml.co" OR destinationhostname CONTAINS "docs-drive.online" OR destinationhostname CONTAINS "docs-info.online" OR destinationhostname CONTAINS "cloud-mail.online" OR destinationhostname CONTAINS "onlinecloud365.live" OR destinationhostname CONTAINS "pdf-cloud.online" OR destinationhostname CONTAINS "pdf-shared.online" OR destinationhostname CONTAINS "proton-pdf.online" OR destinationhostname CONTAINS "proton-view.online" OR destinationhostname CONTAINS "office365-online.live" OR destinationhostname CONTAINS "doc-viewer.com" OR destinationhostname CONTAINS "file-milgov.systems" OR destinationhostname CONTAINS "office-protection.online")
index=activity AND rg_functionality="Next Generation Firewall" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "relogin-dashboard.online" OR sourcentdomain CONTAINS "safe-connection.online" OR sourcentdomain CONTAINS "safelinks-protect.live" OR sourcentdomain CONTAINS "secureoffice.live" OR sourcentdomain CONTAINS "webresources.live" OR sourcentdomain CONTAINS "word-yand.live" OR sourcentdomain CONTAINS "yandx-online.cloud" OR sourcentdomain CONTAINS "y-ml.co" OR sourcentdomain CONTAINS "docs-drive.online" OR sourcentdomain CONTAINS "docs-info.online" OR sourcentdomain CONTAINS "cloud-mail.online" OR sourcentdomain CONTAINS "onlinecloud365.live" OR sourcentdomain CONTAINS "pdf-cloud.online" OR sourcentdomain CONTAINS "pdf-shared.online" OR sourcentdomain CONTAINS "proton-pdf.online" OR sourcentdomain CONTAINS "proton-view.online" OR sourcentdomain CONTAINS "office365-online.live" OR sourcentdomain CONTAINS "doc-viewer.com" OR sourcentdomain CONTAINS "file-milgov.systems" OR sourcentdomain CONTAINS "office-protection.online")
index=activity AND rg_functionality="Next Generation Firewall" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "relogin-dashboard.online" OR sourcehostname CONTAINS "safe-connection.online" OR sourcehostname CONTAINS "safelinks-protect.live" OR sourcehostname CONTAINS "secureoffice.live" OR sourcehostname CONTAINS "webresources.live" OR sourcehostname CONTAINS "word-yand.live" OR sourcehostname CONTAINS "yandx-online.cloud" OR sourcehostname CONTAINS "y-ml.co" OR sourcehostname CONTAINS "docs-drive.online" OR sourcehostname CONTAINS "docs-info.online" OR sourcehostname CONTAINS "cloud-mail.online" OR sourcehostname CONTAINS "onlinecloud365.live" OR sourcehostname CONTAINS "pdf-cloud.online" OR sourcehostname CONTAINS "pdf-shared.online" OR sourcehostname CONTAINS "proton-pdf.online" OR sourcehostname CONTAINS "proton-view.online" OR sourcehostname CONTAINS "office365-online.live" OR sourcehostname CONTAINS "doc-viewer.com" OR sourcehostname CONTAINS "file-milgov.systems" OR sourcehostname CONTAINS "office-protection.online")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "relogin-dashboard.online" OR destinationntdomain CONTAINS "safe-connection.online" OR destinationntdomain CONTAINS "safelinks-protect.live" OR destinationntdomain CONTAINS "secureoffice.live" OR destinationntdomain CONTAINS "webresources.live" OR destinationntdomain CONTAINS "word-yand.live" OR destinationntdomain CONTAINS "yandx-online.cloud" OR destinationntdomain CONTAINS "y-ml.co" OR destinationntdomain CONTAINS "docs-drive.online" OR destinationntdomain CONTAINS "docs-info.online" OR destinationntdomain CONTAINS "cloud-mail.online" OR destinationntdomain CONTAINS "onlinecloud365.live" OR destinationntdomain CONTAINS "pdf-cloud.online" OR destinationntdomain CONTAINS "pdf-shared.online" OR destinationntdomain CONTAINS "proton-pdf.online" OR destinationntdomain CONTAINS "proton-view.online" OR destinationntdomain CONTAINS "office365-online.live" OR destinationntdomain CONTAINS "doc-viewer.com" OR destinationntdomain CONTAINS "file-milgov.systems" OR destinationntdomain CONTAINS "office-protection.online")
index=activity AND rg_functionality="Next Generation Firewall" AND requesturl NOT NULL AND (requesturl CONTAINS "relogin-dashboard.online" OR requesturl CONTAINS "safe-connection.online" OR requesturl CONTAINS "safelinks-protect.live" OR requesturl CONTAINS "secureoffice.live" OR requesturl CONTAINS "webresources.live" OR requesturl CONTAINS "word-yand.live" OR requesturl CONTAINS "yandx-online.cloud" OR requesturl CONTAINS "y-ml.co" OR requesturl CONTAINS "docs-drive.online" OR requesturl CONTAINS "docs-info.online" OR requesturl CONTAINS "cloud-mail.online" OR requesturl CONTAINS "onlinecloud365.live" OR requesturl CONTAINS "pdf-cloud.online" OR requesturl CONTAINS "pdf-shared.online" OR requesturl CONTAINS "proton-pdf.online" OR requesturl CONTAINS "proton-view.online" OR requesturl CONTAINS "office365-online.live" OR requesturl CONTAINS "doc-viewer.com" OR requesturl CONTAINS "file-milgov.systems" OR requesturl CONTAINS "office-protection.online")
index=activity AND rg_functionality="Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "cache-dns.com" OR destinationhostname CONTAINS "sekoia.io" OR destinationhostname CONTAINS "cache-dns-forwarding.com" OR destinationhostname CONTAINS "cache-dns-preview.com" OR destinationhostname CONTAINS "cache-docs.com" OR destinationhostname CONTAINS "cache-pdf.com" OR destinationhostname CONTAINS "cache-pdf.online" OR destinationhostname CONTAINS "cache-services.live" OR destinationhostname CONTAINS "cloud-docs.com" OR destinationhostname CONTAINS "cloud-drive.live" OR destinationhostname CONTAINS "cloud-storage.live" OR destinationhostname CONTAINS "docs-cache.com" OR destinationhostname CONTAINS "docs-forwarding.online" OR destinationhostname CONTAINS "docs-info.com" OR destinationhostname CONTAINS "docs-shared.com" OR destinationhostname CONTAINS "docs-shared.online" OR destinationhostname CONTAINS "docs-view.online" OR destinationhostname CONTAINS "document-forwarding.com" OR destinationhostname CONTAINS "document-online.live" OR destinationhostname CONTAINS "document-preview.com" OR destinationhostname CONTAINS "documents-cloud.com" OR destinationhostname CONTAINS "documents-cloud.online" OR destinationhostname CONTAINS "documents-forwarding.com" OR destinationhostname CONTAINS "document-share.live" OR destinationhostname CONTAINS "documents-online.live" OR destinationhostname CONTAINS "documents-pdf.online" OR destinationhostname CONTAINS "documents-preview.com" OR destinationhostname CONTAINS "documents-view.live" OR destinationhostname CONTAINS "document-view.live" OR destinationhostname CONTAINS "drive-docs.com" OR destinationhostname CONTAINS "drive-share.live" OR destinationhostname CONTAINS "goo-link.online" OR destinationhostname CONTAINS "hypertextteches.com" OR destinationhostname CONTAINS "mail-docs.online" OR destinationhostname CONTAINS "officeonline365.live" OR destinationhostname CONTAINS "online365-office.com" OR destinationhostname CONTAINS "online-document.live" OR destinationhostname CONTAINS "online-storage.live" OR destinationhostname CONTAINS "pdf-cache.com" OR destinationhostname CONTAINS "pdf-cache.online" OR destinationhostname CONTAINS "pdf-docs.online" OR destinationhostname CONTAINS "pdf-forwarding.online" OR destinationhostname CONTAINS "protection-checklinks.xyz" OR destinationhostname CONTAINS "protection-link.online" OR destinationhostname CONTAINS "protectionmail.online" OR destinationhostname CONTAINS "protection-office.live" OR destinationhostname CONTAINS "protect-link.online" OR destinationhostname CONTAINS "proton-docs.com" OR destinationhostname CONTAINS "proton-reader.com" OR destinationhostname CONTAINS "proton-viewer.com")
index=activity AND rg_functionality="Firewall" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "cache-dns.com" OR sourcentdomain CONTAINS "sekoia.io" OR sourcentdomain CONTAINS "cache-dns-forwarding.com" OR sourcentdomain CONTAINS "cache-dns-preview.com" OR sourcentdomain CONTAINS "cache-docs.com" OR sourcentdomain CONTAINS "cache-pdf.com" OR sourcentdomain CONTAINS "cache-pdf.online" OR sourcentdomain CONTAINS "cache-services.live" OR sourcentdomain CONTAINS "cloud-docs.com" OR sourcentdomain CONTAINS "cloud-drive.live" OR sourcentdomain CONTAINS "cloud-storage.live" OR sourcentdomain CONTAINS "docs-cache.com" OR sourcentdomain CONTAINS "docs-forwarding.online" OR sourcentdomain CONTAINS "docs-info.com" OR sourcentdomain CONTAINS "docs-shared.com" OR sourcentdomain CONTAINS "docs-shared.online" OR sourcentdomain CONTAINS "docs-view.online" OR sourcentdomain CONTAINS "document-forwarding.com" OR sourcentdomain CONTAINS "document-online.live" OR sourcentdomain CONTAINS "document-preview.com" OR sourcentdomain CONTAINS "documents-cloud.com" OR sourcentdomain CONTAINS "documents-cloud.online" OR sourcentdomain CONTAINS "documents-forwarding.com" OR sourcentdomain CONTAINS "document-share.live" OR sourcentdomain CONTAINS "documents-online.live" OR sourcentdomain CONTAINS "documents-pdf.online" OR sourcentdomain CONTAINS "documents-preview.com" OR sourcentdomain CONTAINS "documents-view.live" OR sourcentdomain CONTAINS "document-view.live" OR sourcentdomain CONTAINS "drive-docs.com" OR sourcentdomain CONTAINS "drive-share.live" OR sourcentdomain CONTAINS "goo-link.online" OR sourcentdomain CONTAINS "hypertextteches.com" OR sourcentdomain CONTAINS "mail-docs.online" OR sourcentdomain CONTAINS "officeonline365.live" OR sourcentdomain CONTAINS "online365-office.com" OR sourcentdomain CONTAINS "online-document.live" OR sourcentdomain CONTAINS "online-storage.live" OR sourcentdomain CONTAINS "pdf-cache.com" OR sourcentdomain CONTAINS "pdf-cache.online" OR sourcentdomain CONTAINS "pdf-docs.online" OR sourcentdomain CONTAINS "pdf-forwarding.online" OR sourcentdomain CONTAINS "protection-checklinks.xyz" OR sourcentdomain CONTAINS "protection-link.online" OR sourcentdomain CONTAINS "protectionmail.online" OR sourcentdomain CONTAINS "protection-office.live" OR sourcentdomain CONTAINS "protect-link.online" OR sourcentdomain CONTAINS "proton-docs.com" OR sourcentdomain CONTAINS "proton-reader.com" OR sourcentdomain CONTAINS "proton-viewer.com")
index=activity AND rg_functionality="Firewall" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "cache-dns.com" OR sourcehostname CONTAINS "sekoia.io" OR sourcehostname CONTAINS "cache-dns-forwarding.com" OR sourcehostname CONTAINS "cache-dns-preview.com" OR sourcehostname CONTAINS "cache-docs.com" OR sourcehostname CONTAINS "cache-pdf.com" OR sourcehostname CONTAINS "cache-pdf.online" OR sourcehostname CONTAINS "cache-services.live" OR sourcehostname CONTAINS "cloud-docs.com" OR sourcehostname CONTAINS "cloud-drive.live" OR sourcehostname CONTAINS "cloud-storage.live" OR sourcehostname CONTAINS "docs-cache.com" OR sourcehostname CONTAINS "docs-forwarding.online" OR sourcehostname CONTAINS "docs-info.com" OR sourcehostname CONTAINS "docs-shared.com" OR sourcehostname CONTAINS "docs-shared.online" OR sourcehostname CONTAINS "docs-view.online" OR sourcehostname CONTAINS "document-forwarding.com" OR sourcehostname CONTAINS "document-online.live" OR sourcehostname CONTAINS "document-preview.com" OR sourcehostname CONTAINS "documents-cloud.com" OR sourcehostname CONTAINS "documents-cloud.online" OR sourcehostname CONTAINS "documents-forwarding.com" OR sourcehostname CONTAINS "document-share.live" OR sourcehostname CONTAINS "documents-online.live" OR sourcehostname CONTAINS "documents-pdf.online" OR sourcehostname CONTAINS "documents-preview.com" OR sourcehostname CONTAINS "documents-view.live" OR sourcehostname CONTAINS "document-view.live" OR sourcehostname CONTAINS "drive-docs.com" OR sourcehostname CONTAINS "drive-share.live" OR sourcehostname CONTAINS "goo-link.online" OR sourcehostname CONTAINS "hypertextteches.com" OR sourcehostname CONTAINS "mail-docs.online" OR sourcehostname CONTAINS "officeonline365.live" OR sourcehostname CONTAINS "online365-office.com" OR sourcehostname CONTAINS "online-document.live" OR sourcehostname CONTAINS "online-storage.live" OR sourcehostname CONTAINS "pdf-cache.com" OR sourcehostname CONTAINS "pdf-cache.online" OR sourcehostname CONTAINS "pdf-docs.online" OR sourcehostname CONTAINS "pdf-forwarding.online" OR sourcehostname CONTAINS "protection-checklinks.xyz" OR sourcehostname CONTAINS "protection-link.online" OR sourcehostname CONTAINS "protectionmail.online" OR sourcehostname CONTAINS "protection-office.live" OR sourcehostname CONTAINS "protect-link.online" OR sourcehostname CONTAINS "proton-docs.com" OR sourcehostname CONTAINS "proton-reader.com" OR sourcehostname CONTAINS "proton-viewer.com")
index=activity AND rg_functionality="Firewall" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "cache-dns.com" OR destinationntdomain CONTAINS "sekoia.io" OR destinationntdomain CONTAINS "cache-dns-forwarding.com" OR destinationntdomain CONTAINS "cache-dns-preview.com" OR destinationntdomain CONTAINS "cache-docs.com" OR destinationntdomain CONTAINS "cache-pdf.com" OR destinationntdomain CONTAINS "cache-pdf.online" OR destinationntdomain CONTAINS "cache-services.live" OR destinationntdomain CONTAINS "cloud-docs.com" OR destinationntdomain CONTAINS "cloud-drive.live" OR destinationntdomain CONTAINS "cloud-storage.live" OR destinationntdomain CONTAINS "docs-cache.com" OR destinationntdomain CONTAINS "docs-forwarding.online" OR destinationntdomain CONTAINS "docs-info.com" OR destinationntdomain CONTAINS "docs-shared.com" OR destinationntdomain CONTAINS "docs-shared.online" OR destinationntdomain CONTAINS "docs-view.online" OR destinationntdomain CONTAINS "document-forwarding.com" OR destinationntdomain CONTAINS "document-online.live" OR destinationntdomain CONTAINS "document-preview.com" OR destinationntdomain CONTAINS "documents-cloud.com" OR destinationntdomain CONTAINS "documents-cloud.online" OR destinationntdomain CONTAINS "documents-forwarding.com" OR destinationntdomain CONTAINS "document-share.live" OR destinationntdomain CONTAINS "documents-online.live" OR destinationntdomain CONTAINS "documents-pdf.online" OR destinationntdomain CONTAINS "documents-preview.com" OR destinationntdomain CONTAINS "documents-view.live" OR destinationntdomain CONTAINS "document-view.live" OR destinationntdomain CONTAINS "drive-docs.com" OR destinationntdomain CONTAINS "drive-share.live" OR destinationntdomain CONTAINS "goo-link.online" OR destinationntdomain CONTAINS "hypertextteches.com" OR destinationntdomain CONTAINS "mail-docs.online" OR destinationntdomain CONTAINS "officeonline365.live" OR destinationntdomain CONTAINS "online365-office.com" OR destinationntdomain CONTAINS "online-document.live" OR destinationntdomain CONTAINS "online-storage.live" OR destinationntdomain CONTAINS "pdf-cache.com" OR destinationntdomain CONTAINS "pdf-cache.online" OR destinationntdomain CONTAINS "pdf-docs.online" OR destinationntdomain CONTAINS "pdf-forwarding.online" OR destinationntdomain CONTAINS "protection-checklinks.xyz" OR destinationntdomain CONTAINS "protection-link.online" OR destinationntdomain CONTAINS "protectionmail.online" OR destinationntdomain CONTAINS "protection-office.live" OR destinationntdomain CONTAINS "protect-link.online" OR destinationntdomain CONTAINS "proton-docs.com" OR destinationntdomain CONTAINS "proton-reader.com" OR destinationntdomain CONTAINS "proton-viewer.com")
index=activity AND rg_functionality="Firewall" AND requesturl NOT NULL AND (requesturl CONTAINS "cache-dns.com" OR requesturl CONTAINS "sekoia.io" OR requesturl CONTAINS "cache-dns-forwarding.com" OR requesturl CONTAINS "cache-dns-preview.com" OR requesturl CONTAINS "cache-docs.com" OR requesturl CONTAINS "cache-pdf.com" OR requesturl CONTAINS "cache-pdf.online" OR requesturl CONTAINS "cache-services.live" OR requesturl CONTAINS "cloud-docs.com" OR requesturl CONTAINS "cloud-drive.live" OR requesturl CONTAINS "cloud-storage.live" OR requesturl CONTAINS "docs-cache.com" OR requesturl CONTAINS "docs-forwarding.online" OR requesturl CONTAINS "docs-info.com" OR requesturl CONTAINS "docs-shared.com" OR requesturl CONTAINS "docs-shared.online" OR requesturl CONTAINS "docs-view.online" OR requesturl CONTAINS "document-forwarding.com" OR requesturl CONTAINS "document-online.live" OR requesturl CONTAINS "document-preview.com" OR requesturl CONTAINS "documents-cloud.com" OR requesturl CONTAINS "documents-cloud.online" OR requesturl CONTAINS "documents-forwarding.com" OR requesturl CONTAINS "document-share.live" OR requesturl CONTAINS "documents-online.live" OR requesturl CONTAINS "documents-pdf.online" OR requesturl CONTAINS "documents-preview.com" OR requesturl CONTAINS "documents-view.live" OR requesturl CONTAINS "document-view.live" OR requesturl CONTAINS "drive-docs.com" OR requesturl CONTAINS "drive-share.live" OR requesturl CONTAINS "goo-link.online" OR requesturl CONTAINS "hypertextteches.com" OR requesturl CONTAINS "mail-docs.online" OR requesturl CONTAINS "officeonline365.live" OR requesturl CONTAINS "online365-office.com" OR requesturl CONTAINS "online-document.live" OR requesturl CONTAINS "online-storage.live" OR requesturl CONTAINS "pdf-cache.com" OR requesturl CONTAINS "pdf-cache.online" OR requesturl CONTAINS "pdf-docs.online" OR requesturl CONTAINS "pdf-forwarding.online" OR requesturl CONTAINS "protection-checklinks.xyz" OR requesturl CONTAINS "protection-link.online" OR requesturl CONTAINS "protectionmail.online" OR requesturl CONTAINS "protection-office.live" OR requesturl CONTAINS "protect-link.online" OR requesturl CONTAINS "proton-docs.com" OR requesturl CONTAINS "proton-reader.com" OR requesturl CONTAINS "proton-viewer.com")
index=activity AND rg_functionality="Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "relogin-dashboard.online" OR destinationhostname CONTAINS "safe-connection.online" OR destinationhostname CONTAINS "safelinks-protect.live" OR destinationhostname CONTAINS "secureoffice.live" OR destinationhostname CONTAINS "webresources.live" OR destinationhostname CONTAINS "word-yand.live" OR destinationhostname CONTAINS "yandx-online.cloud" OR destinationhostname CONTAINS "y-ml.co" OR destinationhostname CONTAINS "docs-drive.online" OR destinationhostname CONTAINS "docs-info.online" OR destinationhostname CONTAINS "cloud-mail.online" OR destinationhostname CONTAINS "onlinecloud365.live" OR destinationhostname CONTAINS "pdf-cloud.online" OR destinationhostname CONTAINS "pdf-shared.online" OR destinationhostname CONTAINS "proton-pdf.online" OR destinationhostname CONTAINS "proton-view.online" OR destinationhostname CONTAINS "office365-online.live" OR destinationhostname CONTAINS "doc-viewer.com" OR destinationhostname CONTAINS "file-milgov.systems" OR destinationhostname CONTAINS "office-protection.online")
index=activity AND rg_functionality="Firewall" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "relogin-dashboard.online" OR sourcentdomain CONTAINS "safe-connection.online" OR sourcentdomain CONTAINS "safelinks-protect.live" OR sourcentdomain CONTAINS "secureoffice.live" OR sourcentdomain CONTAINS "webresources.live" OR sourcentdomain CONTAINS "word-yand.live" OR sourcentdomain CONTAINS "yandx-online.cloud" OR sourcentdomain CONTAINS "y-ml.co" OR sourcentdomain CONTAINS "docs-drive.online" OR sourcentdomain CONTAINS "docs-info.online" OR sourcentdomain CONTAINS "cloud-mail.online" OR sourcentdomain CONTAINS "onlinecloud365.live" OR sourcentdomain CONTAINS "pdf-cloud.online" OR sourcentdomain CONTAINS "pdf-shared.online" OR sourcentdomain CONTAINS "proton-pdf.online" OR sourcentdomain CONTAINS "proton-view.online" OR sourcentdomain CONTAINS "office365-online.live" OR sourcentdomain CONTAINS "doc-viewer.com" OR sourcentdomain CONTAINS "file-milgov.systems" OR sourcentdomain CONTAINS "office-protection.online")
index=activity AND rg_functionality="Firewall" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "relogin-dashboard.online" OR sourcehostname CONTAINS "safe-connection.online" OR sourcehostname CONTAINS "safelinks-protect.live" OR sourcehostname CONTAINS "secureoffice.live" OR sourcehostname CONTAINS "webresources.live" OR sourcehostname CONTAINS "word-yand.live" OR sourcehostname CONTAINS "yandx-online.cloud" OR sourcehostname CONTAINS "y-ml.co" OR sourcehostname CONTAINS "docs-drive.online" OR sourcehostname CONTAINS "docs-info.online" OR sourcehostname CONTAINS "cloud-mail.online" OR sourcehostname CONTAINS "onlinecloud365.live" OR sourcehostname CONTAINS "pdf-cloud.online" OR sourcehostname CONTAINS "pdf-shared.online" OR sourcehostname CONTAINS "proton-pdf.online" OR sourcehostname CONTAINS "proton-view.online" OR sourcehostname CONTAINS "office365-online.live" OR sourcehostname CONTAINS "doc-viewer.com" OR sourcehostname CONTAINS "file-milgov.systems" OR sourcehostname CONTAINS "office-protection.online")
index=activity AND rg_functionality="Firewall" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "relogin-dashboard.online" OR destinationntdomain CONTAINS "safe-connection.online" OR destinationntdomain CONTAINS "safelinks-protect.live" OR destinationntdomain CONTAINS "secureoffice.live" OR destinationntdomain CONTAINS "webresources.live" OR destinationntdomain CONTAINS "word-yand.live" OR destinationntdomain CONTAINS "yandx-online.cloud" OR destinationntdomain CONTAINS "y-ml.co" OR destinationntdomain CONTAINS "docs-drive.online" OR destinationntdomain CONTAINS "docs-info.online" OR destinationntdomain CONTAINS "cloud-mail.online" OR destinationntdomain CONTAINS "onlinecloud365.live" OR destinationntdomain CONTAINS "pdf-cloud.online" OR destinationntdomain CONTAINS "pdf-shared.online" OR destinationntdomain CONTAINS "proton-pdf.online" OR destinationntdomain CONTAINS "proton-view.online" OR destinationntdomain CONTAINS "office365-online.live" OR destinationntdomain CONTAINS "doc-viewer.com" OR destinationntdomain CONTAINS "file-milgov.systems" OR destinationntdomain CONTAINS "office-protection.online")
index=activity AND rg_functionality="Firewall" AND requesturl NOT NULL AND (requesturl CONTAINS "relogin-dashboard.online" OR requesturl CONTAINS "safe-connection.online" OR requesturl CONTAINS "safelinks-protect.live" OR requesturl CONTAINS "secureoffice.live" OR requesturl CONTAINS "webresources.live" OR requesturl CONTAINS "word-yand.live" OR requesturl CONTAINS "yandx-online.cloud" OR requesturl CONTAINS "y-ml.co" OR requesturl CONTAINS "docs-drive.online" OR requesturl CONTAINS "docs-info.online" OR requesturl CONTAINS "cloud-mail.online" OR requesturl CONTAINS "onlinecloud365.live" OR requesturl CONTAINS "pdf-cloud.online" OR requesturl CONTAINS "pdf-shared.online" OR requesturl CONTAINS "proton-pdf.online" OR requesturl CONTAINS "proton-view.online" OR requesturl CONTAINS "office365-online.live" OR requesturl CONTAINS "doc-viewer.com" OR requesturl CONTAINS "file-milgov.systems" OR requesturl CONTAINS "office-protection.online")
index=activity AND rg_functionality="Web Proxy" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "cache-dns.com" OR destinationhostname CONTAINS "sekoia.io" OR destinationhostname CONTAINS "cache-dns-forwarding.com" OR destinationhostname CONTAINS "cache-dns-preview.com" OR destinationhostname CONTAINS "cache-docs.com" OR destinationhostname CONTAINS "cache-pdf.com" OR destinationhostname CONTAINS "cache-pdf.online" OR destinationhostname CONTAINS "cache-services.live" OR destinationhostname CONTAINS "cloud-docs.com" OR destinationhostname CONTAINS "cloud-drive.live" OR destinationhostname CONTAINS "cloud-storage.live" OR destinationhostname CONTAINS "docs-cache.com" OR destinationhostname CONTAINS "docs-forwarding.online" OR destinationhostname CONTAINS "docs-info.com" OR destinationhostname CONTAINS "docs-shared.com" OR destinationhostname CONTAINS "docs-shared.online" OR destinationhostname CONTAINS "docs-view.online" OR destinationhostname CONTAINS "document-forwarding.com" OR destinationhostname CONTAINS "document-online.live" OR destinationhostname CONTAINS "document-preview.com" OR destinationhostname CONTAINS "documents-cloud.com" OR destinationhostname CONTAINS "documents-cloud.online" OR destinationhostname CONTAINS "documents-forwarding.com" OR destinationhostname CONTAINS "document-share.live" OR destinationhostname CONTAINS "documents-online.live" OR destinationhostname CONTAINS "documents-pdf.online" OR destinationhostname CONTAINS "documents-preview.com" OR destinationhostname CONTAINS "documents-view.live" OR destinationhostname CONTAINS "document-view.live" OR destinationhostname CONTAINS "drive-docs.com" OR destinationhostname CONTAINS "drive-share.live" OR destinationhostname CONTAINS "goo-link.online" OR destinationhostname CONTAINS "hypertextteches.com" OR destinationhostname CONTAINS "mail-docs.online" OR destinationhostname CONTAINS "officeonline365.live" OR destinationhostname CONTAINS "online365-office.com" OR destinationhostname CONTAINS "online-document.live" OR destinationhostname CONTAINS "online-storage.live" OR destinationhostname CONTAINS "pdf-cache.com" OR destinationhostname CONTAINS "pdf-cache.online" OR destinationhostname CONTAINS "pdf-docs.online" OR destinationhostname CONTAINS "pdf-forwarding.online" OR destinationhostname CONTAINS "protection-checklinks.xyz" OR destinationhostname CONTAINS "protection-link.online" OR destinationhostname CONTAINS "protectionmail.online" OR destinationhostname CONTAINS "protection-office.live" OR destinationhostname CONTAINS "protect-link.online" OR destinationhostname CONTAINS "proton-docs.com" OR destinationhostname CONTAINS "proton-reader.com" OR destinationhostname CONTAINS "proton-viewer.com")
index=activity AND rg_functionality="Web Proxy" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "cache-dns.com" OR sourcentdomain CONTAINS "sekoia.io" OR sourcentdomain CONTAINS "cache-dns-forwarding.com" OR sourcentdomain CONTAINS "cache-dns-preview.com" OR sourcentdomain CONTAINS "cache-docs.com" OR sourcentdomain CONTAINS "cache-pdf.com" OR sourcentdomain CONTAINS "cache-pdf.online" OR sourcentdomain CONTAINS "cache-services.live" OR sourcentdomain CONTAINS "cloud-docs.com" OR sourcentdomain CONTAINS "cloud-drive.live" OR sourcentdomain CONTAINS "cloud-storage.live" OR sourcentdomain CONTAINS "docs-cache.com" OR sourcentdomain CONTAINS "docs-forwarding.online" OR sourcentdomain CONTAINS "docs-info.com" OR sourcentdomain CONTAINS "docs-shared.com" OR sourcentdomain CONTAINS "docs-shared.online" OR sourcentdomain CONTAINS "docs-view.online" OR sourcentdomain CONTAINS "document-forwarding.com" OR sourcentdomain CONTAINS "document-online.live" OR sourcentdomain CONTAINS "document-preview.com" OR sourcentdomain CONTAINS "documents-cloud.com" OR sourcentdomain CONTAINS "documents-cloud.online" OR sourcentdomain CONTAINS "documents-forwarding.com" OR sourcentdomain CONTAINS "document-share.live" OR sourcentdomain CONTAINS "documents-online.live" OR sourcentdomain CONTAINS "documents-pdf.online" OR sourcentdomain CONTAINS "documents-preview.com" OR sourcentdomain CONTAINS "documents-view.live" OR sourcentdomain CONTAINS "document-view.live" OR sourcentdomain CONTAINS "drive-docs.com" OR sourcentdomain CONTAINS "drive-share.live" OR sourcentdomain CONTAINS "goo-link.online" OR sourcentdomain CONTAINS "hypertextteches.com" OR sourcentdomain CONTAINS "mail-docs.online" OR sourcentdomain CONTAINS "officeonline365.live" OR sourcentdomain CONTAINS "online365-office.com" OR sourcentdomain CONTAINS "online-document.live" OR sourcentdomain CONTAINS "online-storage.live" OR sourcentdomain CONTAINS "pdf-cache.com" OR sourcentdomain CONTAINS "pdf-cache.online" OR sourcentdomain CONTAINS "pdf-docs.online" OR sourcentdomain CONTAINS "pdf-forwarding.online" OR sourcentdomain CONTAINS "protection-checklinks.xyz" OR sourcentdomain CONTAINS "protection-link.online" OR sourcentdomain CONTAINS "protectionmail.online" OR sourcentdomain CONTAINS "protection-office.live" OR sourcentdomain CONTAINS "protect-link.online" OR sourcentdomain CONTAINS "proton-docs.com" OR sourcentdomain CONTAINS "proton-reader.com" OR sourcentdomain CONTAINS "proton-viewer.com")
index=activity AND rg_functionality="Web Proxy" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "cache-dns.com" OR sourcehostname CONTAINS "sekoia.io" OR sourcehostname CONTAINS "cache-dns-forwarding.com" OR sourcehostname CONTAINS "cache-dns-preview.com" OR sourcehostname CONTAINS "cache-docs.com" OR sourcehostname CONTAINS "cache-pdf.com" OR sourcehostname CONTAINS "cache-pdf.online" OR sourcehostname CONTAINS "cache-services.live" OR sourcehostname CONTAINS "cloud-docs.com" OR sourcehostname CONTAINS "cloud-drive.live" OR sourcehostname CONTAINS "cloud-storage.live" OR sourcehostname CONTAINS "docs-cache.com" OR sourcehostname CONTAINS "docs-forwarding.online" OR sourcehostname CONTAINS "docs-info.com" OR sourcehostname CONTAINS "docs-shared.com" OR sourcehostname CONTAINS "docs-shared.online" OR sourcehostname CONTAINS "docs-view.online" OR sourcehostname CONTAINS "document-forwarding.com" OR sourcehostname CONTAINS "document-online.live" OR sourcehostname CONTAINS "document-preview.com" OR sourcehostname CONTAINS "documents-cloud.com" OR sourcehostname CONTAINS "documents-cloud.online" OR sourcehostname CONTAINS "documents-forwarding.com" OR sourcehostname CONTAINS "document-share.live" OR sourcehostname CONTAINS "documents-online.live" OR sourcehostname CONTAINS "documents-pdf.online" OR sourcehostname CONTAINS "documents-preview.com" OR sourcehostname CONTAINS "documents-view.live" OR sourcehostname CONTAINS "document-view.live" OR sourcehostname CONTAINS "drive-docs.com" OR sourcehostname CONTAINS "drive-share.live" OR sourcehostname CONTAINS "goo-link.online" OR sourcehostname CONTAINS "hypertextteches.com" OR sourcehostname CONTAINS "mail-docs.online" OR sourcehostname CONTAINS "officeonline365.live" OR sourcehostname CONTAINS "online365-office.com" OR sourcehostname CONTAINS "online-document.live" OR sourcehostname CONTAINS "online-storage.live" OR sourcehostname CONTAINS "pdf-cache.com" OR sourcehostname CONTAINS "pdf-cache.online" OR sourcehostname CONTAINS "pdf-docs.online" OR sourcehostname CONTAINS "pdf-forwarding.online" OR sourcehostname CONTAINS "protection-checklinks.xyz" OR sourcehostname CONTAINS "protection-link.online" OR sourcehostname CONTAINS "protectionmail.online" OR sourcehostname CONTAINS "protection-office.live" OR sourcehostname CONTAINS "protect-link.online" OR sourcehostname CONTAINS "proton-docs.com" OR sourcehostname CONTAINS "proton-reader.com" OR sourcehostname CONTAINS "proton-viewer.com")
index=activity AND rg_functionality="Web Proxy" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "cache-dns.com" OR destinationntdomain CONTAINS "sekoia.io" OR destinationntdomain CONTAINS "cache-dns-forwarding.com" OR destinationntdomain CONTAINS "cache-dns-preview.com" OR destinationntdomain CONTAINS "cache-docs.com" OR destinationntdomain CONTAINS "cache-pdf.com" OR destinationntdomain CONTAINS "cache-pdf.online" OR destinationntdomain CONTAINS "cache-services.live" OR destinationntdomain CONTAINS "cloud-docs.com" OR destinationntdomain CONTAINS "cloud-drive.live" OR destinationntdomain CONTAINS "cloud-storage.live" OR destinationntdomain CONTAINS "docs-cache.com" OR destinationntdomain CONTAINS "docs-forwarding.online" OR destinationntdomain CONTAINS "docs-info.com" OR destinationntdomain CONTAINS "docs-shared.com" OR destinationntdomain CONTAINS "docs-shared.online" OR destinationntdomain CONTAINS "docs-view.online" OR destinationntdomain CONTAINS "document-forwarding.com" OR destinationntdomain CONTAINS "document-online.live" OR destinationntdomain CONTAINS "document-preview.com" OR destinationntdomain CONTAINS "documents-cloud.com" OR destinationntdomain CONTAINS "documents-cloud.online" OR destinationntdomain CONTAINS "documents-forwarding.com" OR destinationntdomain CONTAINS "document-share.live" OR destinationntdomain CONTAINS "documents-online.live" OR destinationntdomain CONTAINS "documents-pdf.online" OR destinationntdomain CONTAINS "documents-preview.com" OR destinationntdomain CONTAINS "documents-view.live" OR destinationntdomain CONTAINS "document-view.live" OR destinationntdomain CONTAINS "drive-docs.com" OR destinationntdomain CONTAINS "drive-share.live" OR destinationntdomain CONTAINS "goo-link.online" OR destinationntdomain CONTAINS "hypertextteches.com" OR destinationntdomain CONTAINS "mail-docs.online" OR destinationntdomain CONTAINS "officeonline365.live" OR destinationntdomain CONTAINS "online365-office.com" OR destinationntdomain CONTAINS "online-document.live" OR destinationntdomain CONTAINS "online-storage.live" OR destinationntdomain CONTAINS "pdf-cache.com" OR destinationntdomain CONTAINS "pdf-cache.online" OR destinationntdomain CONTAINS "pdf-docs.online" OR destinationntdomain CONTAINS "pdf-forwarding.online" OR destinationntdomain CONTAINS "protection-checklinks.xyz" OR destinationntdomain CONTAINS "protection-link.online" OR destinationntdomain CONTAINS "protectionmail.online" OR destinationntdomain CONTAINS "protection-office.live" OR destinationntdomain CONTAINS "protect-link.online" OR destinationntdomain CONTAINS "proton-docs.com" OR destinationntdomain CONTAINS "proton-reader.com" OR destinationntdomain CONTAINS "proton-viewer.com")
index=activity AND rg_functionality="Web Proxy" AND requesturl NOT NULL AND (requesturl CONTAINS "cache-dns.com" OR requesturl CONTAINS "sekoia.io" OR requesturl CONTAINS "cache-dns-forwarding.com" OR requesturl CONTAINS "cache-dns-preview.com" OR requesturl CONTAINS "cache-docs.com" OR requesturl CONTAINS "cache-pdf.com" OR requesturl CONTAINS "cache-pdf.online" OR requesturl CONTAINS "cache-services.live" OR requesturl CONTAINS "cloud-docs.com" OR requesturl CONTAINS "cloud-drive.live" OR requesturl CONTAINS "cloud-storage.live" OR requesturl CONTAINS "docs-cache.com" OR requesturl CONTAINS "docs-forwarding.online" OR requesturl CONTAINS "docs-info.com" OR requesturl CONTAINS "docs-shared.com" OR requesturl CONTAINS "docs-shared.online" OR requesturl CONTAINS "docs-view.online" OR requesturl CONTAINS "document-forwarding.com" OR requesturl CONTAINS "document-online.live" OR requesturl CONTAINS "document-preview.com" OR requesturl CONTAINS "documents-cloud.com" OR requesturl CONTAINS "documents-cloud.online" OR requesturl CONTAINS "documents-forwarding.com" OR requesturl CONTAINS "document-share.live" OR requesturl CONTAINS "documents-online.live" OR requesturl CONTAINS "documents-pdf.online" OR requesturl CONTAINS "documents-preview.com" OR requesturl CONTAINS "documents-view.live" OR requesturl CONTAINS "document-view.live" OR requesturl CONTAINS "drive-docs.com" OR requesturl CONTAINS "drive-share.live" OR requesturl CONTAINS "goo-link.online" OR requesturl CONTAINS "hypertextteches.com" OR requesturl CONTAINS "mail-docs.online" OR requesturl CONTAINS "officeonline365.live" OR requesturl CONTAINS "online365-office.com" OR requesturl CONTAINS "online-document.live" OR requesturl CONTAINS "online-storage.live" OR requesturl CONTAINS "pdf-cache.com" OR requesturl CONTAINS "pdf-cache.online" OR requesturl CONTAINS "pdf-docs.online" OR requesturl CONTAINS "pdf-forwarding.online" OR requesturl CONTAINS "protection-checklinks.xyz" OR requesturl CONTAINS "protection-link.online" OR requesturl CONTAINS "protectionmail.online" OR requesturl CONTAINS "protection-office.live" OR requesturl CONTAINS "protect-link.online" OR requesturl CONTAINS "proton-docs.com" OR requesturl CONTAINS "proton-reader.com" OR requesturl CONTAINS "proton-viewer.com")
index=activity AND rg_functionality="Web Proxy" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "relogin-dashboard.online" OR destinationhostname CONTAINS "safe-connection.online" OR destinationhostname CONTAINS "safelinks-protect.live" OR destinationhostname CONTAINS "secureoffice.live" OR destinationhostname CONTAINS "webresources.live" OR destinationhostname CONTAINS "word-yand.live" OR destinationhostname CONTAINS "yandx-online.cloud" OR destinationhostname CONTAINS "y-ml.co" OR destinationhostname CONTAINS "docs-drive.online" OR destinationhostname CONTAINS "docs-info.online" OR destinationhostname CONTAINS "cloud-mail.online" OR destinationhostname CONTAINS "onlinecloud365.live" OR destinationhostname CONTAINS "pdf-cloud.online" OR destinationhostname CONTAINS "pdf-shared.online" OR destinationhostname CONTAINS "proton-pdf.online" OR destinationhostname CONTAINS "proton-view.online" OR destinationhostname CONTAINS "office365-online.live" OR destinationhostname CONTAINS "doc-viewer.com" OR destinationhostname CONTAINS "file-milgov.systems" OR destinationhostname CONTAINS "office-protection.online")
index=activity AND rg_functionality="Web Proxy" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "relogin-dashboard.online" OR sourcentdomain CONTAINS "safe-connection.online" OR sourcentdomain CONTAINS "safelinks-protect.live" OR sourcentdomain CONTAINS "secureoffice.live" OR sourcentdomain CONTAINS "webresources.live" OR sourcentdomain CONTAINS "word-yand.live" OR sourcentdomain CONTAINS "yandx-online.cloud" OR sourcentdomain CONTAINS "y-ml.co" OR sourcentdomain CONTAINS "docs-drive.online" OR sourcentdomain CONTAINS "docs-info.online" OR sourcentdomain CONTAINS "cloud-mail.online" OR sourcentdomain CONTAINS "onlinecloud365.live" OR sourcentdomain CONTAINS "pdf-cloud.online" OR sourcentdomain CONTAINS "pdf-shared.online" OR sourcentdomain CONTAINS "proton-pdf.online" OR sourcentdomain CONTAINS "proton-view.online" OR sourcentdomain CONTAINS "office365-online.live" OR sourcentdomain CONTAINS "doc-viewer.com" OR sourcentdomain CONTAINS "file-milgov.systems" OR sourcentdomain CONTAINS "office-protection.online")
index=activity AND rg_functionality="Web Proxy" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "relogin-dashboard.online" OR sourcehostname CONTAINS "safe-connection.online" OR sourcehostname CONTAINS "safelinks-protect.live" OR sourcehostname CONTAINS "secureoffice.live" OR sourcehostname CONTAINS "webresources.live" OR sourcehostname CONTAINS "word-yand.live" OR sourcehostname CONTAINS "yandx-online.cloud" OR sourcehostname CONTAINS "y-ml.co" OR sourcehostname CONTAINS "docs-drive.online" OR sourcehostname CONTAINS "docs-info.online" OR sourcehostname CONTAINS "cloud-mail.online" OR sourcehostname CONTAINS "onlinecloud365.live" OR sourcehostname CONTAINS "pdf-cloud.online" OR sourcehostname CONTAINS "pdf-shared.online" OR sourcehostname CONTAINS "proton-pdf.online" OR sourcehostname CONTAINS "proton-view.online" OR sourcehostname CONTAINS "office365-online.live" OR sourcehostname CONTAINS "doc-viewer.com" OR sourcehostname CONTAINS "file-milgov.systems" OR sourcehostname CONTAINS "office-protection.online")
index=activity AND rg_functionality="Web Proxy" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "relogin-dashboard.online" OR destinationntdomain CONTAINS "safe-connection.online" OR destinationntdomain CONTAINS "safelinks-protect.live" OR destinationntdomain CONTAINS "secureoffice.live" OR destinationntdomain CONTAINS "webresources.live" OR destinationntdomain CONTAINS "word-yand.live" OR destinationntdomain CONTAINS "yandx-online.cloud" OR destinationntdomain CONTAINS "y-ml.co" OR destinationntdomain CONTAINS "docs-drive.online" OR destinationntdomain CONTAINS "docs-info.online" OR destinationntdomain CONTAINS "cloud-mail.online" OR destinationntdomain CONTAINS "onlinecloud365.live" OR destinationntdomain CONTAINS "pdf-cloud.online" OR destinationntdomain CONTAINS "pdf-shared.online" OR destinationntdomain CONTAINS "proton-pdf.online" OR destinationntdomain CONTAINS "proton-view.online" OR destinationntdomain CONTAINS "office365-online.live" OR destinationntdomain CONTAINS "doc-viewer.com" OR destinationntdomain CONTAINS "file-milgov.systems" OR destinationntdomain CONTAINS "office-protection.online")
index=activity AND rg_functionality="Web Proxy" AND requesturl NOT NULL AND (requesturl CONTAINS "relogin-dashboard.online" OR requesturl CONTAINS "safe-connection.online" OR requesturl CONTAINS "safelinks-protect.live" OR requesturl CONTAINS "secureoffice.live" OR requesturl CONTAINS "webresources.live" OR requesturl CONTAINS "word-yand.live" OR requesturl CONTAINS "yandx-online.cloud" OR requesturl CONTAINS "y-ml.co" OR requesturl CONTAINS "docs-drive.online" OR requesturl CONTAINS "docs-info.online" OR requesturl CONTAINS "cloud-mail.online" OR requesturl CONTAINS "onlinecloud365.live" OR requesturl CONTAINS "pdf-cloud.online" OR requesturl CONTAINS "pdf-shared.online" OR requesturl CONTAINS "proton-pdf.online" OR requesturl CONTAINS "proton-view.online" OR requesturl CONTAINS "office365-online.live" OR requesturl CONTAINS "doc-viewer.com" OR requesturl CONTAINS "file-milgov.systems" OR requesturl CONTAINS "office-protection.online")
index=activity AND rg_functionality="Flow" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "cache-dns.com" OR destinationhostname CONTAINS "sekoia.io" OR destinationhostname CONTAINS "cache-dns-forwarding.com" OR destinationhostname CONTAINS "cache-dns-preview.com" OR destinationhostname CONTAINS "cache-docs.com" OR destinationhostname CONTAINS "cache-pdf.com" OR destinationhostname CONTAINS "cache-pdf.online" OR destinationhostname CONTAINS "cache-services.live" OR destinationhostname CONTAINS "cloud-docs.com" OR destinationhostname CONTAINS "cloud-drive.live" OR destinationhostname CONTAINS "cloud-storage.live" OR destinationhostname CONTAINS "docs-cache.com" OR destinationhostname CONTAINS "docs-forwarding.online" OR destinationhostname CONTAINS "docs-info.com" OR destinationhostname CONTAINS "docs-shared.com" OR destinationhostname CONTAINS "docs-shared.online" OR destinationhostname CONTAINS "docs-view.online" OR destinationhostname CONTAINS "document-forwarding.com" OR destinationhostname CONTAINS "document-online.live" OR destinationhostname CONTAINS "document-preview.com" OR destinationhostname CONTAINS "documents-cloud.com" OR destinationhostname CONTAINS "documents-cloud.online" OR destinationhostname CONTAINS "documents-forwarding.com" OR destinationhostname CONTAINS "document-share.live" OR destinationhostname CONTAINS "documents-online.live" OR destinationhostname CONTAINS "documents-pdf.online" OR destinationhostname CONTAINS "documents-preview.com" OR destinationhostname CONTAINS "documents-view.live" OR destinationhostname CONTAINS "document-view.live" OR destinationhostname CONTAINS "drive-docs.com" OR destinationhostname CONTAINS "drive-share.live" OR destinationhostname CONTAINS "goo-link.online" OR destinationhostname CONTAINS "hypertextteches.com" OR destinationhostname CONTAINS "mail-docs.online" OR destinationhostname CONTAINS "officeonline365.live" OR destinationhostname CONTAINS "online365-office.com" OR destinationhostname CONTAINS "online-document.live" OR destinationhostname CONTAINS "online-storage.live" OR destinationhostname CONTAINS "pdf-cache.com" OR destinationhostname CONTAINS "pdf-cache.online" OR destinationhostname CONTAINS "pdf-docs.online" OR destinationhostname CONTAINS "pdf-forwarding.online" OR destinationhostname CONTAINS "protection-checklinks.xyz" OR destinationhostname CONTAINS "protection-link.online" OR destinationhostname CONTAINS "protectionmail.online" OR destinationhostname CONTAINS "protection-office.live" OR destinationhostname CONTAINS "protect-link.online" OR destinationhostname CONTAINS "proton-docs.com" OR destinationhostname CONTAINS "proton-reader.com" OR destinationhostname CONTAINS "proton-viewer.com")
index=activity AND rg_functionality="Flow" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "cache-dns.com" OR sourcentdomain CONTAINS "sekoia.io" OR sourcentdomain CONTAINS "cache-dns-forwarding.com" OR sourcentdomain CONTAINS "cache-dns-preview.com" OR sourcentdomain CONTAINS "cache-docs.com" OR sourcentdomain CONTAINS "cache-pdf.com" OR sourcentdomain CONTAINS "cache-pdf.online" OR sourcentdomain CONTAINS "cache-services.live" OR sourcentdomain CONTAINS "cloud-docs.com" OR sourcentdomain CONTAINS "cloud-drive.live" OR sourcentdomain CONTAINS "cloud-storage.live" OR sourcentdomain CONTAINS "docs-cache.com" OR sourcentdomain CONTAINS "docs-forwarding.online" OR sourcentdomain CONTAINS "docs-info.com" OR sourcentdomain CONTAINS "docs-shared.com" OR sourcentdomain CONTAINS "docs-shared.online" OR sourcentdomain CONTAINS "docs-view.online" OR sourcentdomain CONTAINS "document-forwarding.com" OR sourcentdomain CONTAINS "document-online.live" OR sourcentdomain CONTAINS "document-preview.com" OR sourcentdomain CONTAINS "documents-cloud.com" OR sourcentdomain CONTAINS "documents-cloud.online" OR sourcentdomain CONTAINS "documents-forwarding.com" OR sourcentdomain CONTAINS "document-share.live" OR sourcentdomain CONTAINS "documents-online.live" OR sourcentdomain CONTAINS "documents-pdf.online" OR sourcentdomain CONTAINS "documents-preview.com" OR sourcentdomain CONTAINS "documents-view.live" OR sourcentdomain CONTAINS "document-view.live" OR sourcentdomain CONTAINS "drive-docs.com" OR sourcentdomain CONTAINS "drive-share.live" OR sourcentdomain CONTAINS "goo-link.online" OR sourcentdomain CONTAINS "hypertextteches.com" OR sourcentdomain CONTAINS "mail-docs.online" OR sourcentdomain CONTAINS "officeonline365.live" OR sourcentdomain CONTAINS "online365-office.com" OR sourcentdomain CONTAINS "online-document.live" OR sourcentdomain CONTAINS "online-storage.live" OR sourcentdomain CONTAINS "pdf-cache.com" OR sourcentdomain CONTAINS "pdf-cache.online" OR sourcentdomain CONTAINS "pdf-docs.online" OR sourcentdomain CONTAINS "pdf-forwarding.online" OR sourcentdomain CONTAINS "protection-checklinks.xyz" OR sourcentdomain CONTAINS "protection-link.online" OR sourcentdomain CONTAINS "protectionmail.online" OR sourcentdomain CONTAINS "protection-office.live" OR sourcentdomain CONTAINS "protect-link.online" OR sourcentdomain CONTAINS "proton-docs.com" OR sourcentdomain CONTAINS "proton-reader.com" OR sourcentdomain CONTAINS "proton-viewer.com")
index=activity AND rg_functionality="Flow" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "cache-dns.com" OR sourcehostname CONTAINS "sekoia.io" OR sourcehostname CONTAINS "cache-dns-forwarding.com" OR sourcehostname CONTAINS "cache-dns-preview.com" OR sourcehostname CONTAINS "cache-docs.com" OR sourcehostname CONTAINS "cache-pdf.com" OR sourcehostname CONTAINS "cache-pdf.online" OR sourcehostname CONTAINS "cache-services.live" OR sourcehostname CONTAINS "cloud-docs.com" OR sourcehostname CONTAINS "cloud-drive.live" OR sourcehostname CONTAINS "cloud-storage.live" OR sourcehostname CONTAINS "docs-cache.com" OR sourcehostname CONTAINS "docs-forwarding.online" OR sourcehostname CONTAINS "docs-info.com" OR sourcehostname CONTAINS "docs-shared.com" OR sourcehostname CONTAINS "docs-shared.online" OR sourcehostname CONTAINS "docs-view.online" OR sourcehostname CONTAINS "document-forwarding.com" OR sourcehostname CONTAINS "document-online.live" OR sourcehostname CONTAINS "document-preview.com" OR sourcehostname CONTAINS "documents-cloud.com" OR sourcehostname CONTAINS "documents-cloud.online" OR sourcehostname CONTAINS "documents-forwarding.com" OR sourcehostname CONTAINS "document-share.live" OR sourcehostname CONTAINS "documents-online.live" OR sourcehostname CONTAINS "documents-pdf.online" OR sourcehostname CONTAINS "documents-preview.com" OR sourcehostname CONTAINS "documents-view.live" OR sourcehostname CONTAINS "document-view.live" OR sourcehostname CONTAINS "drive-docs.com" OR sourcehostname CONTAINS "drive-share.live" OR sourcehostname CONTAINS "goo-link.online" OR sourcehostname CONTAINS "hypertextteches.com" OR sourcehostname CONTAINS "mail-docs.online" OR sourcehostname CONTAINS "officeonline365.live" OR sourcehostname CONTAINS "online365-office.com" OR sourcehostname CONTAINS "online-document.live" OR sourcehostname CONTAINS "online-storage.live" OR sourcehostname CONTAINS "pdf-cache.com" OR sourcehostname CONTAINS "pdf-cache.online" OR sourcehostname CONTAINS "pdf-docs.online" OR sourcehostname CONTAINS "pdf-forwarding.online" OR sourcehostname CONTAINS "protection-checklinks.xyz" OR sourcehostname CONTAINS "protection-link.online" OR sourcehostname CONTAINS "protectionmail.online" OR sourcehostname CONTAINS "protection-office.live" OR sourcehostname CONTAINS "protect-link.online" OR sourcehostname CONTAINS "proton-docs.com" OR sourcehostname CONTAINS "proton-reader.com" OR sourcehostname CONTAINS "proton-viewer.com")
index=activity AND rg_functionality="Flow" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "cache-dns.com" OR destinationntdomain CONTAINS "sekoia.io" OR destinationntdomain CONTAINS "cache-dns-forwarding.com" OR destinationntdomain CONTAINS "cache-dns-preview.com" OR destinationntdomain CONTAINS "cache-docs.com" OR destinationntdomain CONTAINS "cache-pdf.com" OR destinationntdomain CONTAINS "cache-pdf.online" OR destinationntdomain CONTAINS "cache-services.live" OR destinationntdomain CONTAINS "cloud-docs.com" OR destinationntdomain CONTAINS "cloud-drive.live" OR destinationntdomain CONTAINS "cloud-storage.live" OR destinationntdomain CONTAINS "docs-cache.com" OR destinationntdomain CONTAINS "docs-forwarding.online" OR destinationntdomain CONTAINS "docs-info.com" OR destinationntdomain CONTAINS "docs-shared.com" OR destinationntdomain CONTAINS "docs-shared.online" OR destinationntdomain CONTAINS "docs-view.online" OR destinationntdomain CONTAINS "document-forwarding.com" OR destinationntdomain CONTAINS "document-online.live" OR destinationntdomain CONTAINS "document-preview.com" OR destinationntdomain CONTAINS "documents-cloud.com" OR destinationntdomain CONTAINS "documents-cloud.online" OR destinationntdomain CONTAINS "documents-forwarding.com" OR destinationntdomain CONTAINS "document-share.live" OR destinationntdomain CONTAINS "documents-online.live" OR destinationntdomain CONTAINS "documents-pdf.online" OR destinationntdomain CONTAINS "documents-preview.com" OR destinationntdomain CONTAINS "documents-view.live" OR destinationntdomain CONTAINS "document-view.live" OR destinationntdomain CONTAINS "drive-docs.com" OR destinationntdomain CONTAINS "drive-share.live" OR destinationntdomain CONTAINS "goo-link.online" OR destinationntdomain CONTAINS "hypertextteches.com" OR destinationntdomain CONTAINS "mail-docs.online" OR destinationntdomain CONTAINS "officeonline365.live" OR destinationntdomain CONTAINS "online365-office.com" OR destinationntdomain CONTAINS "online-document.live" OR destinationntdomain CONTAINS "online-storage.live" OR destinationntdomain CONTAINS "pdf-cache.com" OR destinationntdomain CONTAINS "pdf-cache.online" OR destinationntdomain CONTAINS "pdf-docs.online" OR destinationntdomain CONTAINS "pdf-forwarding.online" OR destinationntdomain CONTAINS "protection-checklinks.xyz" OR destinationntdomain CONTAINS "protection-link.online" OR destinationntdomain CONTAINS "protectionmail.online" OR destinationntdomain CONTAINS "protection-office.live" OR destinationntdomain CONTAINS "protect-link.online" OR destinationntdomain CONTAINS "proton-docs.com" OR destinationntdomain CONTAINS "proton-reader.com" OR destinationntdomain CONTAINS "proton-viewer.com")
index=activity AND rg_functionality="Flow" AND requesturl NOT NULL AND (requesturl CONTAINS "cache-dns.com" OR requesturl CONTAINS "sekoia.io" OR requesturl CONTAINS "cache-dns-forwarding.com" OR requesturl CONTAINS "cache-dns-preview.com" OR requesturl CONTAINS "cache-docs.com" OR requesturl CONTAINS "cache-pdf.com" OR requesturl CONTAINS "cache-pdf.online" OR requesturl CONTAINS "cache-services.live" OR requesturl CONTAINS "cloud-docs.com" OR requesturl CONTAINS "cloud-drive.live" OR requesturl CONTAINS "cloud-storage.live" OR requesturl CONTAINS "docs-cache.com" OR requesturl CONTAINS "docs-forwarding.online" OR requesturl CONTAINS "docs-info.com" OR requesturl CONTAINS "docs-shared.com" OR requesturl CONTAINS "docs-shared.online" OR requesturl CONTAINS "docs-view.online" OR requesturl CONTAINS "document-forwarding.com" OR requesturl CONTAINS "document-online.live" OR requesturl CONTAINS "document-preview.com" OR requesturl CONTAINS "documents-cloud.com" OR requesturl CONTAINS "documents-cloud.online" OR requesturl CONTAINS "documents-forwarding.com" OR requesturl CONTAINS "document-share.live" OR requesturl CONTAINS "documents-online.live" OR requesturl CONTAINS "documents-pdf.online" OR requesturl CONTAINS "documents-preview.com" OR requesturl CONTAINS "documents-view.live" OR requesturl CONTAINS "document-view.live" OR requesturl CONTAINS "drive-docs.com" OR requesturl CONTAINS "drive-share.live" OR requesturl CONTAINS "goo-link.online" OR requesturl CONTAINS "hypertextteches.com" OR requesturl CONTAINS "mail-docs.online" OR requesturl CONTAINS "officeonline365.live" OR requesturl CONTAINS "online365-office.com" OR requesturl CONTAINS "online-document.live" OR requesturl CONTAINS "online-storage.live" OR requesturl CONTAINS "pdf-cache.com" OR requesturl CONTAINS "pdf-cache.online" OR requesturl CONTAINS "pdf-docs.online" OR requesturl CONTAINS "pdf-forwarding.online" OR requesturl CONTAINS "protection-checklinks.xyz" OR requesturl CONTAINS "protection-link.online" OR requesturl CONTAINS "protectionmail.online" OR requesturl CONTAINS "protection-office.live" OR requesturl CONTAINS "protect-link.online" OR requesturl CONTAINS "proton-docs.com" OR requesturl CONTAINS "proton-reader.com" OR requesturl CONTAINS "proton-viewer.com")
index=activity AND rg_functionality="Flow" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "relogin-dashboard.online" OR destinationhostname CONTAINS "safe-connection.online" OR destinationhostname CONTAINS "safelinks-protect.live" OR destinationhostname CONTAINS "secureoffice.live" OR destinationhostname CONTAINS "webresources.live" OR destinationhostname CONTAINS "word-yand.live" OR destinationhostname CONTAINS "yandx-online.cloud" OR destinationhostname CONTAINS "y-ml.co" OR destinationhostname CONTAINS "docs-drive.online" OR destinationhostname CONTAINS "docs-info.online" OR destinationhostname CONTAINS "cloud-mail.online" OR destinationhostname CONTAINS "onlinecloud365.live" OR destinationhostname CONTAINS "pdf-cloud.online" OR destinationhostname CONTAINS "pdf-shared.online" OR destinationhostname CONTAINS "proton-pdf.online" OR destinationhostname CONTAINS "proton-view.online" OR destinationhostname CONTAINS "office365-online.live" OR destinationhostname CONTAINS "doc-viewer.com" OR destinationhostname CONTAINS "file-milgov.systems" OR destinationhostname CONTAINS "office-protection.online")
index=activity AND rg_functionality="Flow" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "relogin-dashboard.online" OR sourcentdomain CONTAINS "safe-connection.online" OR sourcentdomain CONTAINS "safelinks-protect.live" OR sourcentdomain CONTAINS "secureoffice.live" OR sourcentdomain CONTAINS "webresources.live" OR sourcentdomain CONTAINS "word-yand.live" OR sourcentdomain CONTAINS "yandx-online.cloud" OR sourcentdomain CONTAINS "y-ml.co" OR sourcentdomain CONTAINS "docs-drive.online" OR sourcentdomain CONTAINS "docs-info.online" OR sourcentdomain CONTAINS "cloud-mail.online" OR sourcentdomain CONTAINS "onlinecloud365.live" OR sourcentdomain CONTAINS "pdf-cloud.online" OR sourcentdomain CONTAINS "pdf-shared.online" OR sourcentdomain CONTAINS "proton-pdf.online" OR sourcentdomain CONTAINS "proton-view.online" OR sourcentdomain CONTAINS "office365-online.live" OR sourcentdomain CONTAINS "doc-viewer.com" OR sourcentdomain CONTAINS "file-milgov.systems" OR sourcentdomain CONTAINS "office-protection.online")
index=activity AND rg_functionality="Flow" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "relogin-dashboard.online" OR sourcehostname CONTAINS "safe-connection.online" OR sourcehostname CONTAINS "safelinks-protect.live" OR sourcehostname CONTAINS "secureoffice.live" OR sourcehostname CONTAINS "webresources.live" OR sourcehostname CONTAINS "word-yand.live" OR sourcehostname CONTAINS "yandx-online.cloud" OR sourcehostname CONTAINS "y-ml.co" OR sourcehostname CONTAINS "docs-drive.online" OR sourcehostname CONTAINS "docs-info.online" OR sourcehostname CONTAINS "cloud-mail.online" OR sourcehostname CONTAINS "onlinecloud365.live" OR sourcehostname CONTAINS "pdf-cloud.online" OR sourcehostname CONTAINS "pdf-shared.online" OR sourcehostname CONTAINS "proton-pdf.online" OR sourcehostname CONTAINS "proton-view.online" OR sourcehostname CONTAINS "office365-online.live" OR sourcehostname CONTAINS "doc-viewer.com" OR sourcehostname CONTAINS "file-milgov.systems" OR sourcehostname CONTAINS "office-protection.online")
index=activity AND rg_functionality="Flow" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "relogin-dashboard.online" OR destinationntdomain CONTAINS "safe-connection.online" OR destinationntdomain CONTAINS "safelinks-protect.live" OR destinationntdomain CONTAINS "secureoffice.live" OR destinationntdomain CONTAINS "webresources.live" OR destinationntdomain CONTAINS "word-yand.live" OR destinationntdomain CONTAINS "yandx-online.cloud" OR destinationntdomain CONTAINS "y-ml.co" OR destinationntdomain CONTAINS "docs-drive.online" OR destinationntdomain CONTAINS "docs-info.online" OR destinationntdomain CONTAINS "cloud-mail.online" OR destinationntdomain CONTAINS "onlinecloud365.live" OR destinationntdomain CONTAINS "pdf-cloud.online" OR destinationntdomain CONTAINS "pdf-shared.online" OR destinationntdomain CONTAINS "proton-pdf.online" OR destinationntdomain CONTAINS "proton-view.online" OR destinationntdomain CONTAINS "office365-online.live" OR destinationntdomain CONTAINS "doc-viewer.com" OR destinationntdomain CONTAINS "file-milgov.systems" OR destinationntdomain CONTAINS "office-protection.online")
index=activity AND rg_functionality="Flow" AND requesturl NOT NULL AND (requesturl CONTAINS "relogin-dashboard.online" OR requesturl CONTAINS "safe-connection.online" OR requesturl CONTAINS "safelinks-protect.live" OR requesturl CONTAINS "secureoffice.live" OR requesturl CONTAINS "webresources.live" OR requesturl CONTAINS "word-yand.live" OR requesturl CONTAINS "yandx-online.cloud" OR requesturl CONTAINS "y-ml.co" OR requesturl CONTAINS "docs-drive.online" OR requesturl CONTAINS "docs-info.online" OR requesturl CONTAINS "cloud-mail.online" OR requesturl CONTAINS "onlinecloud365.live" OR requesturl CONTAINS "pdf-cloud.online" OR requesturl CONTAINS "pdf-shared.online" OR requesturl CONTAINS "proton-pdf.online" OR requesturl CONTAINS "proton-view.online" OR requesturl CONTAINS "office365-online.live" OR requesturl CONTAINS "doc-viewer.com" OR requesturl CONTAINS "file-milgov.systems" OR requesturl CONTAINS "office-protection.online")
index=activity AND rg_functionality="Web Server" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "cache-dns.com" OR destinationhostname CONTAINS "sekoia.io" OR destinationhostname CONTAINS "cache-dns-forwarding.com" OR destinationhostname CONTAINS "cache-dns-preview.com" OR destinationhostname CONTAINS "cache-docs.com" OR destinationhostname CONTAINS "cache-pdf.com" OR destinationhostname CONTAINS "cache-pdf.online" OR destinationhostname CONTAINS "cache-services.live" OR destinationhostname CONTAINS "cloud-docs.com" OR destinationhostname CONTAINS "cloud-drive.live" OR destinationhostname CONTAINS "cloud-storage.live" OR destinationhostname CONTAINS "docs-cache.com" OR destinationhostname CONTAINS "docs-forwarding.online" OR destinationhostname CONTAINS "docs-info.com" OR destinationhostname CONTAINS "docs-shared.com" OR destinationhostname CONTAINS "docs-shared.online" OR destinationhostname CONTAINS "docs-view.online" OR destinationhostname CONTAINS "document-forwarding.com" OR destinationhostname CONTAINS "document-online.live" OR destinationhostname CONTAINS "document-preview.com" OR destinationhostname CONTAINS "documents-cloud.com" OR destinationhostname CONTAINS "documents-cloud.online" OR destinationhostname CONTAINS "documents-forwarding.com" OR destinationhostname CONTAINS "document-share.live" OR destinationhostname CONTAINS "documents-online.live" OR destinationhostname CONTAINS "documents-pdf.online" OR destinationhostname CONTAINS "documents-preview.com" OR destinationhostname CONTAINS "documents-view.live" OR destinationhostname CONTAINS "document-view.live" OR destinationhostname CONTAINS "drive-docs.com" OR destinationhostname CONTAINS "drive-share.live" OR destinationhostname CONTAINS "goo-link.online" OR destinationhostname CONTAINS "hypertextteches.com" OR destinationhostname CONTAINS "mail-docs.online" OR destinationhostname CONTAINS "officeonline365.live" OR destinationhostname CONTAINS "online365-office.com" OR destinationhostname CONTAINS "online-document.live" OR destinationhostname CONTAINS "online-storage.live" OR destinationhostname CONTAINS "pdf-cache.com" OR destinationhostname CONTAINS "pdf-cache.online" OR destinationhostname CONTAINS "pdf-docs.online" OR destinationhostname CONTAINS "pdf-forwarding.online" OR destinationhostname CONTAINS "protection-checklinks.xyz" OR destinationhostname CONTAINS "protection-link.online" OR destinationhostname CONTAINS "protectionmail.online" OR destinationhostname CONTAINS "protection-office.live" OR destinationhostname CONTAINS "protect-link.online" OR destinationhostname CONTAINS "proton-docs.com" OR destinationhostname CONTAINS "proton-reader.com" OR destinationhostname CONTAINS "proton-viewer.com")
index=activity AND rg_functionality="Web Server" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "cache-dns.com" OR sourcentdomain CONTAINS "sekoia.io" OR sourcentdomain CONTAINS "cache-dns-forwarding.com" OR sourcentdomain CONTAINS "cache-dns-preview.com" OR sourcentdomain CONTAINS "cache-docs.com" OR sourcentdomain CONTAINS "cache-pdf.com" OR sourcentdomain CONTAINS "cache-pdf.online" OR sourcentdomain CONTAINS "cache-services.live" OR sourcentdomain CONTAINS "cloud-docs.com" OR sourcentdomain CONTAINS "cloud-drive.live" OR sourcentdomain CONTAINS "cloud-storage.live" OR sourcentdomain CONTAINS "docs-cache.com" OR sourcentdomain CONTAINS "docs-forwarding.online" OR sourcentdomain CONTAINS "docs-info.com" OR sourcentdomain CONTAINS "docs-shared.com" OR sourcentdomain CONTAINS "docs-shared.online" OR sourcentdomain CONTAINS "docs-view.online" OR sourcentdomain CONTAINS "document-forwarding.com" OR sourcentdomain CONTAINS "document-online.live" OR sourcentdomain CONTAINS "document-preview.com" OR sourcentdomain CONTAINS "documents-cloud.com" OR sourcentdomain CONTAINS "documents-cloud.online" OR sourcentdomain CONTAINS "documents-forwarding.com" OR sourcentdomain CONTAINS "document-share.live" OR sourcentdomain CONTAINS "documents-online.live" OR sourcentdomain CONTAINS "documents-pdf.online" OR sourcentdomain CONTAINS "documents-preview.com" OR sourcentdomain CONTAINS "documents-view.live" OR sourcentdomain CONTAINS "document-view.live" OR sourcentdomain CONTAINS "drive-docs.com" OR sourcentdomain CONTAINS "drive-share.live" OR sourcentdomain CONTAINS "goo-link.online" OR sourcentdomain CONTAINS "hypertextteches.com" OR sourcentdomain CONTAINS "mail-docs.online" OR sourcentdomain CONTAINS "officeonline365.live" OR sourcentdomain CONTAINS "online365-office.com" OR sourcentdomain CONTAINS "online-document.live" OR sourcentdomain CONTAINS "online-storage.live" OR sourcentdomain CONTAINS "pdf-cache.com" OR sourcentdomain CONTAINS "pdf-cache.online" OR sourcentdomain CONTAINS "pdf-docs.online" OR sourcentdomain CONTAINS "pdf-forwarding.online" OR sourcentdomain CONTAINS "protection-checklinks.xyz" OR sourcentdomain CONTAINS "protection-link.online" OR sourcentdomain CONTAINS "protectionmail.online" OR sourcentdomain CONTAINS "protection-office.live" OR sourcentdomain CONTAINS "protect-link.online" OR sourcentdomain CONTAINS "proton-docs.com" OR sourcentdomain CONTAINS "proton-reader.com" OR sourcentdomain CONTAINS "proton-viewer.com")
index=activity AND rg_functionality="Web Server" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "cache-dns.com" OR sourcehostname CONTAINS "sekoia.io" OR sourcehostname CONTAINS "cache-dns-forwarding.com" OR sourcehostname CONTAINS "cache-dns-preview.com" OR sourcehostname CONTAINS "cache-docs.com" OR sourcehostname CONTAINS "cache-pdf.com" OR sourcehostname CONTAINS "cache-pdf.online" OR sourcehostname CONTAINS "cache-services.live" OR sourcehostname CONTAINS "cloud-docs.com" OR sourcehostname CONTAINS "cloud-drive.live" OR sourcehostname CONTAINS "cloud-storage.live" OR sourcehostname CONTAINS "docs-cache.com" OR sourcehostname CONTAINS "docs-forwarding.online" OR sourcehostname CONTAINS "docs-info.com" OR sourcehostname CONTAINS "docs-shared.com" OR sourcehostname CONTAINS "docs-shared.online" OR sourcehostname CONTAINS "docs-view.online" OR sourcehostname CONTAINS "document-forwarding.com" OR sourcehostname CONTAINS "document-online.live" OR sourcehostname CONTAINS "document-preview.com" OR sourcehostname CONTAINS "documents-cloud.com" OR sourcehostname CONTAINS "documents-cloud.online" OR sourcehostname CONTAINS "documents-forwarding.com" OR sourcehostname CONTAINS "document-share.live" OR sourcehostname CONTAINS "documents-online.live" OR sourcehostname CONTAINS "documents-pdf.online" OR sourcehostname CONTAINS "documents-preview.com" OR sourcehostname CONTAINS "documents-view.live" OR sourcehostname CONTAINS "document-view.live" OR sourcehostname CONTAINS "drive-docs.com" OR sourcehostname CONTAINS "drive-share.live" OR sourcehostname CONTAINS "goo-link.online" OR sourcehostname CONTAINS "hypertextteches.com" OR sourcehostname CONTAINS "mail-docs.online" OR sourcehostname CONTAINS "officeonline365.live" OR sourcehostname CONTAINS "online365-office.com" OR sourcehostname CONTAINS "online-document.live" OR sourcehostname CONTAINS "online-storage.live" OR sourcehostname CONTAINS "pdf-cache.com" OR sourcehostname CONTAINS "pdf-cache.online" OR sourcehostname CONTAINS "pdf-docs.online" OR sourcehostname CONTAINS "pdf-forwarding.online" OR sourcehostname CONTAINS "protection-checklinks.xyz" OR sourcehostname CONTAINS "protection-link.online" OR sourcehostname CONTAINS "protectionmail.online" OR sourcehostname CONTAINS "protection-office.live" OR sourcehostname CONTAINS "protect-link.online" OR sourcehostname CONTAINS "proton-docs.com" OR sourcehostname CONTAINS "proton-reader.com" OR sourcehostname CONTAINS "proton-viewer.com")
index=activity AND rg_functionality="Web Server" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "cache-dns.com" OR destinationntdomain CONTAINS "sekoia.io" OR destinationntdomain CONTAINS "cache-dns-forwarding.com" OR destinationntdomain CONTAINS "cache-dns-preview.com" OR destinationntdomain CONTAINS "cache-docs.com" OR destinationntdomain CONTAINS "cache-pdf.com" OR destinationntdomain CONTAINS "cache-pdf.online" OR destinationntdomain CONTAINS "cache-services.live" OR destinationntdomain CONTAINS "cloud-docs.com" OR destinationntdomain CONTAINS "cloud-drive.live" OR destinationntdomain CONTAINS "cloud-storage.live" OR destinationntdomain CONTAINS "docs-cache.com" OR destinationntdomain CONTAINS "docs-forwarding.online" OR destinationntdomain CONTAINS "docs-info.com" OR destinationntdomain CONTAINS "docs-shared.com" OR destinationntdomain CONTAINS "docs-shared.online" OR destinationntdomain CONTAINS "docs-view.online" OR destinationntdomain CONTAINS "document-forwarding.com" OR destinationntdomain CONTAINS "document-online.live" OR destinationntdomain CONTAINS "document-preview.com" OR destinationntdomain CONTAINS "documents-cloud.com" OR destinationntdomain CONTAINS "documents-cloud.online" OR destinationntdomain CONTAINS "documents-forwarding.com" OR destinationntdomain CONTAINS "document-share.live" OR destinationntdomain CONTAINS "documents-online.live" OR destinationntdomain CONTAINS "documents-pdf.online" OR destinationntdomain CONTAINS "documents-preview.com" OR destinationntdomain CONTAINS "documents-view.live" OR destinationntdomain CONTAINS "document-view.live" OR destinationntdomain CONTAINS "drive-docs.com" OR destinationntdomain CONTAINS "drive-share.live" OR destinationntdomain CONTAINS "goo-link.online" OR destinationntdomain CONTAINS "hypertextteches.com" OR destinationntdomain CONTAINS "mail-docs.online" OR destinationntdomain CONTAINS "officeonline365.live" OR destinationntdomain CONTAINS "online365-office.com" OR destinationntdomain CONTAINS "online-document.live" OR destinationntdomain CONTAINS "online-storage.live" OR destinationntdomain CONTAINS "pdf-cache.com" OR destinationntdomain CONTAINS "pdf-cache.online" OR destinationntdomain CONTAINS "pdf-docs.online" OR destinationntdomain CONTAINS "pdf-forwarding.online" OR destinationntdomain CONTAINS "protection-checklinks.xyz" OR destinationntdomain CONTAINS "protection-link.online" OR destinationntdomain CONTAINS "protectionmail.online" OR destinationntdomain CONTAINS "protection-office.live" OR destinationntdomain CONTAINS "protect-link.online" OR destinationntdomain CONTAINS "proton-docs.com" OR destinationntdomain CONTAINS "proton-reader.com" OR destinationntdomain CONTAINS "proton-viewer.com")
index=activity AND rg_functionality="Web Server" AND requesturl NOT NULL AND (requesturl CONTAINS "cache-dns.com" OR requesturl CONTAINS "sekoia.io" OR requesturl CONTAINS "cache-dns-forwarding.com" OR requesturl CONTAINS "cache-dns-preview.com" OR requesturl CONTAINS "cache-docs.com" OR requesturl CONTAINS "cache-pdf.com" OR requesturl CONTAINS "cache-pdf.online" OR requesturl CONTAINS "cache-services.live" OR requesturl CONTAINS "cloud-docs.com" OR requesturl CONTAINS "cloud-drive.live" OR requesturl CONTAINS "cloud-storage.live" OR requesturl CONTAINS "docs-cache.com" OR requesturl CONTAINS "docs-forwarding.online" OR requesturl CONTAINS "docs-info.com" OR requesturl CONTAINS "docs-shared.com" OR requesturl CONTAINS "docs-shared.online" OR requesturl CONTAINS "docs-view.online" OR requesturl CONTAINS "document-forwarding.com" OR requesturl CONTAINS "document-online.live" OR requesturl CONTAINS "document-preview.com" OR requesturl CONTAINS "documents-cloud.com" OR requesturl CONTAINS "documents-cloud.online" OR requesturl CONTAINS "documents-forwarding.com" OR requesturl CONTAINS "document-share.live" OR requesturl CONTAINS "documents-online.live" OR requesturl CONTAINS "documents-pdf.online" OR requesturl CONTAINS "documents-preview.com" OR requesturl CONTAINS "documents-view.live" OR requesturl CONTAINS "document-view.live" OR requesturl CONTAINS "drive-docs.com" OR requesturl CONTAINS "drive-share.live" OR requesturl CONTAINS "goo-link.online" OR requesturl CONTAINS "hypertextteches.com" OR requesturl CONTAINS "mail-docs.online" OR requesturl CONTAINS "officeonline365.live" OR requesturl CONTAINS "online365-office.com" OR requesturl CONTAINS "online-document.live" OR requesturl CONTAINS "online-storage.live" OR requesturl CONTAINS "pdf-cache.com" OR requesturl CONTAINS "pdf-cache.online" OR requesturl CONTAINS "pdf-docs.online" OR requesturl CONTAINS "pdf-forwarding.online" OR requesturl CONTAINS "protection-checklinks.xyz" OR requesturl CONTAINS "protection-link.online" OR requesturl CONTAINS "protectionmail.online" OR requesturl CONTAINS "protection-office.live" OR requesturl CONTAINS "protect-link.online" OR requesturl CONTAINS "proton-docs.com" OR requesturl CONTAINS "proton-reader.com" OR requesturl CONTAINS "proton-viewer.com")
index=activity AND rg_functionality="Web Server" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "relogin-dashboard.online" OR destinationhostname CONTAINS "safe-connection.online" OR destinationhostname CONTAINS "safelinks-protect.live" OR destinationhostname CONTAINS "secureoffice.live" OR destinationhostname CONTAINS "webresources.live" OR destinationhostname CONTAINS "word-yand.live" OR destinationhostname CONTAINS "yandx-online.cloud" OR destinationhostname CONTAINS "y-ml.co" OR destinationhostname CONTAINS "docs-drive.online" OR destinationhostname CONTAINS "docs-info.online" OR destinationhostname CONTAINS "cloud-mail.online" OR destinationhostname CONTAINS "onlinecloud365.live" OR destinationhostname CONTAINS "pdf-cloud.online" OR destinationhostname CONTAINS "pdf-shared.online" OR destinationhostname CONTAINS "proton-pdf.online" OR destinationhostname CONTAINS "proton-view.online" OR destinationhostname CONTAINS "office365-online.live" OR destinationhostname CONTAINS "doc-viewer.com" OR destinationhostname CONTAINS "file-milgov.systems" OR destinationhostname CONTAINS "office-protection.online")
index=activity AND rg_functionality="Web Server" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "relogin-dashboard.online" OR sourcentdomain CONTAINS "safe-connection.online" OR sourcentdomain CONTAINS "safelinks-protect.live" OR sourcentdomain CONTAINS "secureoffice.live" OR sourcentdomain CONTAINS "webresources.live" OR sourcentdomain CONTAINS "word-yand.live" OR sourcentdomain CONTAINS "yandx-online.cloud" OR sourcentdomain CONTAINS "y-ml.co" OR sourcentdomain CONTAINS "docs-drive.online" OR sourcentdomain CONTAINS "docs-info.online" OR sourcentdomain CONTAINS "cloud-mail.online" OR sourcentdomain CONTAINS "onlinecloud365.live" OR sourcentdomain CONTAINS "pdf-cloud.online" OR sourcentdomain CONTAINS "pdf-shared.online" OR sourcentdomain CONTAINS "proton-pdf.online" OR sourcentdomain CONTAINS "proton-view.online" OR sourcentdomain CONTAINS "office365-online.live" OR sourcentdomain CONTAINS "doc-viewer.com" OR sourcentdomain CONTAINS "file-milgov.systems" OR sourcentdomain CONTAINS "office-protection.online")
index=activity AND rg_functionality="Web Server" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "relogin-dashboard.online" OR sourcehostname CONTAINS "safe-connection.online" OR sourcehostname CONTAINS "safelinks-protect.live" OR sourcehostname CONTAINS "secureoffice.live" OR sourcehostname CONTAINS "webresources.live" OR sourcehostname CONTAINS "word-yand.live" OR sourcehostname CONTAINS "yandx-online.cloud" OR sourcehostname CONTAINS "y-ml.co" OR sourcehostname CONTAINS "docs-drive.online" OR sourcehostname CONTAINS "docs-info.online" OR sourcehostname CONTAINS "cloud-mail.online" OR sourcehostname CONTAINS "onlinecloud365.live" OR sourcehostname CONTAINS "pdf-cloud.online" OR sourcehostname CONTAINS "pdf-shared.online" OR sourcehostname CONTAINS "proton-pdf.online" OR sourcehostname CONTAINS "proton-view.online" OR sourcehostname CONTAINS "office365-online.live" OR sourcehostname CONTAINS "doc-viewer.com" OR sourcehostname CONTAINS "file-milgov.systems" OR sourcehostname CONTAINS "office-protection.online")
index=activity AND rg_functionality="Web Server" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "relogin-dashboard.online" OR destinationntdomain CONTAINS "safe-connection.online" OR destinationntdomain CONTAINS "safelinks-protect.live" OR destinationntdomain CONTAINS "secureoffice.live" OR destinationntdomain CONTAINS "webresources.live" OR destinationntdomain CONTAINS "word-yand.live" OR destinationntdomain CONTAINS "yandx-online.cloud" OR destinationntdomain CONTAINS "y-ml.co" OR destinationntdomain CONTAINS "docs-drive.online" OR destinationntdomain CONTAINS "docs-info.online" OR destinationntdomain CONTAINS "cloud-mail.online" OR destinationntdomain CONTAINS "onlinecloud365.live" OR destinationntdomain CONTAINS "pdf-cloud.online" OR destinationntdomain CONTAINS "pdf-shared.online" OR destinationntdomain CONTAINS "proton-pdf.online" OR destinationntdomain CONTAINS "proton-view.online" OR destinationntdomain CONTAINS "office365-online.live" OR destinationntdomain CONTAINS "doc-viewer.com" OR destinationntdomain CONTAINS "file-milgov.systems" OR destinationntdomain CONTAINS "office-protection.online")
index=activity AND rg_functionality="Web Server" AND requesturl NOT NULL AND (requesturl CONTAINS "relogin-dashboard.online" OR requesturl CONTAINS "safe-connection.online" OR requesturl CONTAINS "safelinks-protect.live" OR requesturl CONTAINS "secureoffice.live" OR requesturl CONTAINS "webresources.live" OR requesturl CONTAINS "word-yand.live" OR requesturl CONTAINS "yandx-online.cloud" OR requesturl CONTAINS "y-ml.co" OR requesturl CONTAINS "docs-drive.online" OR requesturl CONTAINS "docs-info.online" OR requesturl CONTAINS "cloud-mail.online" OR requesturl CONTAINS "onlinecloud365.live" OR requesturl CONTAINS "pdf-cloud.online" OR requesturl CONTAINS "pdf-shared.online" OR requesturl CONTAINS "proton-pdf.online" OR requesturl CONTAINS "proton-view.online" OR requesturl CONTAINS "office365-online.live" OR requesturl CONTAINS "doc-viewer.com" OR requesturl CONTAINS "file-milgov.systems" OR requesturl CONTAINS "office-protection.online")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "cache-dns.com" OR destinationhostname CONTAINS "sekoia.io" OR destinationhostname CONTAINS "cache-dns-forwarding.com" OR destinationhostname CONTAINS "cache-dns-preview.com" OR destinationhostname CONTAINS "cache-docs.com" OR destinationhostname CONTAINS "cache-pdf.com" OR destinationhostname CONTAINS "cache-pdf.online" OR destinationhostname CONTAINS "cache-services.live" OR destinationhostname CONTAINS "cloud-docs.com" OR destinationhostname CONTAINS "cloud-drive.live" OR destinationhostname CONTAINS "cloud-storage.live" OR destinationhostname CONTAINS "docs-cache.com" OR destinationhostname CONTAINS "docs-forwarding.online" OR destinationhostname CONTAINS "docs-info.com" OR destinationhostname CONTAINS "docs-shared.com" OR destinationhostname CONTAINS "docs-shared.online" OR destinationhostname CONTAINS "docs-view.online" OR destinationhostname CONTAINS "document-forwarding.com" OR destinationhostname CONTAINS "document-online.live" OR destinationhostname CONTAINS "document-preview.com" OR destinationhostname CONTAINS "documents-cloud.com" OR destinationhostname CONTAINS "documents-cloud.online" OR destinationhostname CONTAINS "documents-forwarding.com" OR destinationhostname CONTAINS "document-share.live" OR destinationhostname CONTAINS "documents-online.live" OR destinationhostname CONTAINS "documents-pdf.online" OR destinationhostname CONTAINS "documents-preview.com" OR destinationhostname CONTAINS "documents-view.live" OR destinationhostname CONTAINS "document-view.live" OR destinationhostname CONTAINS "drive-docs.com" OR destinationhostname CONTAINS "drive-share.live" OR destinationhostname CONTAINS "goo-link.online" OR destinationhostname CONTAINS "hypertextteches.com" OR destinationhostname CONTAINS "mail-docs.online" OR destinationhostname CONTAINS "officeonline365.live" OR destinationhostname CONTAINS "online365-office.com" OR destinationhostname CONTAINS "online-document.live" OR destinationhostname CONTAINS "online-storage.live" OR destinationhostname CONTAINS "pdf-cache.com" OR destinationhostname CONTAINS "pdf-cache.online" OR destinationhostname CONTAINS "pdf-docs.online" OR destinationhostname CONTAINS "pdf-forwarding.online" OR destinationhostname CONTAINS "protection-checklinks.xyz" OR destinationhostname CONTAINS "protection-link.online" OR destinationhostname CONTAINS "protectionmail.online" OR destinationhostname CONTAINS "protection-office.live" OR destinationhostname CONTAINS "protect-link.online" OR destinationhostname CONTAINS "proton-docs.com" OR destinationhostname CONTAINS "proton-reader.com" OR destinationhostname CONTAINS "proton-viewer.com")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "cache-dns.com" OR sourcentdomain CONTAINS "sekoia.io" OR sourcentdomain CONTAINS "cache-dns-forwarding.com" OR sourcentdomain CONTAINS "cache-dns-preview.com" OR sourcentdomain CONTAINS "cache-docs.com" OR sourcentdomain CONTAINS "cache-pdf.com" OR sourcentdomain CONTAINS "cache-pdf.online" OR sourcentdomain CONTAINS "cache-services.live" OR sourcentdomain CONTAINS "cloud-docs.com" OR sourcentdomain CONTAINS "cloud-drive.live" OR sourcentdomain CONTAINS "cloud-storage.live" OR sourcentdomain CONTAINS "docs-cache.com" OR sourcentdomain CONTAINS "docs-forwarding.online" OR sourcentdomain CONTAINS "docs-info.com" OR sourcentdomain CONTAINS "docs-shared.com" OR sourcentdomain CONTAINS "docs-shared.online" OR sourcentdomain CONTAINS "docs-view.online" OR sourcentdomain CONTAINS "document-forwarding.com" OR sourcentdomain CONTAINS "document-online.live" OR sourcentdomain CONTAINS "document-preview.com" OR sourcentdomain CONTAINS "documents-cloud.com" OR sourcentdomain CONTAINS "documents-cloud.online" OR sourcentdomain CONTAINS "documents-forwarding.com" OR sourcentdomain CONTAINS "document-share.live" OR sourcentdomain CONTAINS "documents-online.live" OR sourcentdomain CONTAINS "documents-pdf.online" OR sourcentdomain CONTAINS "documents-preview.com" OR sourcentdomain CONTAINS "documents-view.live" OR sourcentdomain CONTAINS "document-view.live" OR sourcentdomain CONTAINS "drive-docs.com" OR sourcentdomain CONTAINS "drive-share.live" OR sourcentdomain CONTAINS "goo-link.online" OR sourcentdomain CONTAINS "hypertextteches.com" OR sourcentdomain CONTAINS "mail-docs.online" OR sourcentdomain CONTAINS "officeonline365.live" OR sourcentdomain CONTAINS "online365-office.com" OR sourcentdomain CONTAINS "online-document.live" OR sourcentdomain CONTAINS "online-storage.live" OR sourcentdomain CONTAINS "pdf-cache.com" OR sourcentdomain CONTAINS "pdf-cache.online" OR sourcentdomain CONTAINS "pdf-docs.online" OR sourcentdomain CONTAINS "pdf-forwarding.online" OR sourcentdomain CONTAINS "protection-checklinks.xyz" OR sourcentdomain CONTAINS "protection-link.online" OR sourcentdomain CONTAINS "protectionmail.online" OR sourcentdomain CONTAINS "protection-office.live" OR sourcentdomain CONTAINS "protect-link.online" OR sourcentdomain CONTAINS "proton-docs.com" OR sourcentdomain CONTAINS "proton-reader.com" OR sourcentdomain CONTAINS "proton-viewer.com")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "cache-dns.com" OR sourcehostname CONTAINS "sekoia.io" OR sourcehostname CONTAINS "cache-dns-forwarding.com" OR sourcehostname CONTAINS "cache-dns-preview.com" OR sourcehostname CONTAINS "cache-docs.com" OR sourcehostname CONTAINS "cache-pdf.com" OR sourcehostname CONTAINS "cache-pdf.online" OR sourcehostname CONTAINS "cache-services.live" OR sourcehostname CONTAINS "cloud-docs.com" OR sourcehostname CONTAINS "cloud-drive.live" OR sourcehostname CONTAINS "cloud-storage.live" OR sourcehostname CONTAINS "docs-cache.com" OR sourcehostname CONTAINS "docs-forwarding.online" OR sourcehostname CONTAINS "docs-info.com" OR sourcehostname CONTAINS "docs-shared.com" OR sourcehostname CONTAINS "docs-shared.online" OR sourcehostname CONTAINS "docs-view.online" OR sourcehostname CONTAINS "document-forwarding.com" OR sourcehostname CONTAINS "document-online.live" OR sourcehostname CONTAINS "document-preview.com" OR sourcehostname CONTAINS "documents-cloud.com" OR sourcehostname CONTAINS "documents-cloud.online" OR sourcehostname CONTAINS "documents-forwarding.com" OR sourcehostname CONTAINS "document-share.live" OR sourcehostname CONTAINS "documents-online.live" OR sourcehostname CONTAINS "documents-pdf.online" OR sourcehostname CONTAINS "documents-preview.com" OR sourcehostname CONTAINS "documents-view.live" OR sourcehostname CONTAINS "document-view.live" OR sourcehostname CONTAINS "drive-docs.com" OR sourcehostname CONTAINS "drive-share.live" OR sourcehostname CONTAINS "goo-link.online" OR sourcehostname CONTAINS "hypertextteches.com" OR sourcehostname CONTAINS "mail-docs.online" OR sourcehostname CONTAINS "officeonline365.live" OR sourcehostname CONTAINS "online365-office.com" OR sourcehostname CONTAINS "online-document.live" OR sourcehostname CONTAINS "online-storage.live" OR sourcehostname CONTAINS "pdf-cache.com" OR sourcehostname CONTAINS "pdf-cache.online" OR sourcehostname CONTAINS "pdf-docs.online" OR sourcehostname CONTAINS "pdf-forwarding.online" OR sourcehostname CONTAINS "protection-checklinks.xyz" OR sourcehostname CONTAINS "protection-link.online" OR sourcehostname CONTAINS "protectionmail.online" OR sourcehostname CONTAINS "protection-office.live" OR sourcehostname CONTAINS "protect-link.online" OR sourcehostname CONTAINS "proton-docs.com" OR sourcehostname CONTAINS "proton-reader.com" OR sourcehostname CONTAINS "proton-viewer.com")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "cache-dns.com" OR destinationntdomain CONTAINS "sekoia.io" OR destinationntdomain CONTAINS "cache-dns-forwarding.com" OR destinationntdomain CONTAINS "cache-dns-preview.com" OR destinationntdomain CONTAINS "cache-docs.com" OR destinationntdomain CONTAINS "cache-pdf.com" OR destinationntdomain CONTAINS "cache-pdf.online" OR destinationntdomain CONTAINS "cache-services.live" OR destinationntdomain CONTAINS "cloud-docs.com" OR destinationntdomain CONTAINS "cloud-drive.live" OR destinationntdomain CONTAINS "cloud-storage.live" OR destinationntdomain CONTAINS "docs-cache.com" OR destinationntdomain CONTAINS "docs-forwarding.online" OR destinationntdomain CONTAINS "docs-info.com" OR destinationntdomain CONTAINS "docs-shared.com" OR destinationntdomain CONTAINS "docs-shared.online" OR destinationntdomain CONTAINS "docs-view.online" OR destinationntdomain CONTAINS "document-forwarding.com" OR destinationntdomain CONTAINS "document-online.live" OR destinationntdomain CONTAINS "document-preview.com" OR destinationntdomain CONTAINS "documents-cloud.com" OR destinationntdomain CONTAINS "documents-cloud.online" OR destinationntdomain CONTAINS "documents-forwarding.com" OR destinationntdomain CONTAINS "document-share.live" OR destinationntdomain CONTAINS "documents-online.live" OR destinationntdomain CONTAINS "documents-pdf.online" OR destinationntdomain CONTAINS "documents-preview.com" OR destinationntdomain CONTAINS "documents-view.live" OR destinationntdomain CONTAINS "document-view.live" OR destinationntdomain CONTAINS "drive-docs.com" OR destinationntdomain CONTAINS "drive-share.live" OR destinationntdomain CONTAINS "goo-link.online" OR destinationntdomain CONTAINS "hypertextteches.com" OR destinationntdomain CONTAINS "mail-docs.online" OR destinationntdomain CONTAINS "officeonline365.live" OR destinationntdomain CONTAINS "online365-office.com" OR destinationntdomain CONTAINS "online-document.live" OR destinationntdomain CONTAINS "online-storage.live" OR destinationntdomain CONTAINS "pdf-cache.com" OR destinationntdomain CONTAINS "pdf-cache.online" OR destinationntdomain CONTAINS "pdf-docs.online" OR destinationntdomain CONTAINS "pdf-forwarding.online" OR destinationntdomain CONTAINS "protection-checklinks.xyz" OR destinationntdomain CONTAINS "protection-link.online" OR destinationntdomain CONTAINS "protectionmail.online" OR destinationntdomain CONTAINS "protection-office.live" OR destinationntdomain CONTAINS "protect-link.online" OR destinationntdomain CONTAINS "proton-docs.com" OR destinationntdomain CONTAINS "proton-reader.com" OR destinationntdomain CONTAINS "proton-viewer.com")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND requesturl NOT NULL AND (requesturl CONTAINS "cache-dns.com" OR requesturl CONTAINS "sekoia.io" OR requesturl CONTAINS "cache-dns-forwarding.com" OR requesturl CONTAINS "cache-dns-preview.com" OR requesturl CONTAINS "cache-docs.com" OR requesturl CONTAINS "cache-pdf.com" OR requesturl CONTAINS "cache-pdf.online" OR requesturl CONTAINS "cache-services.live" OR requesturl CONTAINS "cloud-docs.com" OR requesturl CONTAINS "cloud-drive.live" OR requesturl CONTAINS "cloud-storage.live" OR requesturl CONTAINS "docs-cache.com" OR requesturl CONTAINS "docs-forwarding.online" OR requesturl CONTAINS "docs-info.com" OR requesturl CONTAINS "docs-shared.com" OR requesturl CONTAINS "docs-shared.online" OR requesturl CONTAINS "docs-view.online" OR requesturl CONTAINS "document-forwarding.com" OR requesturl CONTAINS "document-online.live" OR requesturl CONTAINS "document-preview.com" OR requesturl CONTAINS "documents-cloud.com" OR requesturl CONTAINS "documents-cloud.online" OR requesturl CONTAINS "documents-forwarding.com" OR requesturl CONTAINS "document-share.live" OR requesturl CONTAINS "documents-online.live" OR requesturl CONTAINS "documents-pdf.online" OR requesturl CONTAINS "documents-preview.com" OR requesturl CONTAINS "documents-view.live" OR requesturl CONTAINS "document-view.live" OR requesturl CONTAINS "drive-docs.com" OR requesturl CONTAINS "drive-share.live" OR requesturl CONTAINS "goo-link.online" OR requesturl CONTAINS "hypertextteches.com" OR requesturl CONTAINS "mail-docs.online" OR requesturl CONTAINS "officeonline365.live" OR requesturl CONTAINS "online365-office.com" OR requesturl CONTAINS "online-document.live" OR requesturl CONTAINS "online-storage.live" OR requesturl CONTAINS "pdf-cache.com" OR requesturl CONTAINS "pdf-cache.online" OR requesturl CONTAINS "pdf-docs.online" OR requesturl CONTAINS "pdf-forwarding.online" OR requesturl CONTAINS "protection-checklinks.xyz" OR requesturl CONTAINS "protection-link.online" OR requesturl CONTAINS "protectionmail.online" OR requesturl CONTAINS "protection-office.live" OR requesturl CONTAINS "protect-link.online" OR requesturl CONTAINS "proton-docs.com" OR requesturl CONTAINS "proton-reader.com" OR requesturl CONTAINS "proton-viewer.com")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "relogin-dashboard.online" OR destinationhostname CONTAINS "safe-connection.online" OR destinationhostname CONTAINS "safelinks-protect.live" OR destinationhostname CONTAINS "secureoffice.live" OR destinationhostname CONTAINS "webresources.live" OR destinationhostname CONTAINS "word-yand.live" OR destinationhostname CONTAINS "yandx-online.cloud" OR destinationhostname CONTAINS "y-ml.co" OR destinationhostname CONTAINS "docs-drive.online" OR destinationhostname CONTAINS "docs-info.online" OR destinationhostname CONTAINS "cloud-mail.online" OR destinationhostname CONTAINS "onlinecloud365.live" OR destinationhostname CONTAINS "pdf-cloud.online" OR destinationhostname CONTAINS "pdf-shared.online" OR destinationhostname CONTAINS "proton-pdf.online" OR destinationhostname CONTAINS "proton-view.online" OR destinationhostname CONTAINS "office365-online.live" OR destinationhostname CONTAINS "doc-viewer.com" OR destinationhostname CONTAINS "file-milgov.systems" OR destinationhostname CONTAINS "office-protection.online")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "relogin-dashboard.online" OR sourcentdomain CONTAINS "safe-connection.online" OR sourcentdomain CONTAINS "safelinks-protect.live" OR sourcentdomain CONTAINS "secureoffice.live" OR sourcentdomain CONTAINS "webresources.live" OR sourcentdomain CONTAINS "word-yand.live" OR sourcentdomain CONTAINS "yandx-online.cloud" OR sourcentdomain CONTAINS "y-ml.co" OR sourcentdomain CONTAINS "docs-drive.online" OR sourcentdomain CONTAINS "docs-info.online" OR sourcentdomain CONTAINS "cloud-mail.online" OR sourcentdomain CONTAINS "onlinecloud365.live" OR sourcentdomain CONTAINS "pdf-cloud.online" OR sourcentdomain CONTAINS "pdf-shared.online" OR sourcentdomain CONTAINS "proton-pdf.online" OR sourcentdomain CONTAINS "proton-view.online" OR sourcentdomain CONTAINS "office365-online.live" OR sourcentdomain CONTAINS "doc-viewer.com" OR sourcentdomain CONTAINS "file-milgov.systems" OR sourcentdomain CONTAINS "office-protection.online")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "relogin-dashboard.online" OR sourcehostname CONTAINS "safe-connection.online" OR sourcehostname CONTAINS "safelinks-protect.live" OR sourcehostname CONTAINS "secureoffice.live" OR sourcehostname CONTAINS "webresources.live" OR sourcehostname CONTAINS "word-yand.live" OR sourcehostname CONTAINS "yandx-online.cloud" OR sourcehostname CONTAINS "y-ml.co" OR sourcehostname CONTAINS "docs-drive.online" OR sourcehostname CONTAINS "docs-info.online" OR sourcehostname CONTAINS "cloud-mail.online" OR sourcehostname CONTAINS "onlinecloud365.live" OR sourcehostname CONTAINS "pdf-cloud.online" OR sourcehostname CONTAINS "pdf-shared.online" OR sourcehostname CONTAINS "proton-pdf.online" OR sourcehostname CONTAINS "proton-view.online" OR sourcehostname CONTAINS "office365-online.live" OR sourcehostname CONTAINS "doc-viewer.com" OR sourcehostname CONTAINS "file-milgov.systems" OR sourcehostname CONTAINS "office-protection.online")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "relogin-dashboard.online" OR destinationntdomain CONTAINS "safe-connection.online" OR destinationntdomain CONTAINS "safelinks-protect.live" OR destinationntdomain CONTAINS "secureoffice.live" OR destinationntdomain CONTAINS "webresources.live" OR destinationntdomain CONTAINS "word-yand.live" OR destinationntdomain CONTAINS "yandx-online.cloud" OR destinationntdomain CONTAINS "y-ml.co" OR destinationntdomain CONTAINS "docs-drive.online" OR destinationntdomain CONTAINS "docs-info.online" OR destinationntdomain CONTAINS "cloud-mail.online" OR destinationntdomain CONTAINS "onlinecloud365.live" OR destinationntdomain CONTAINS "pdf-cloud.online" OR destinationntdomain CONTAINS "pdf-shared.online" OR destinationntdomain CONTAINS "proton-pdf.online" OR destinationntdomain CONTAINS "proton-view.online" OR destinationntdomain CONTAINS "office365-online.live" OR destinationntdomain CONTAINS "doc-viewer.com" OR destinationntdomain CONTAINS "file-milgov.systems" OR destinationntdomain CONTAINS "office-protection.online")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND requesturl NOT NULL AND (requesturl CONTAINS "relogin-dashboard.online" OR requesturl CONTAINS "safe-connection.online" OR requesturl CONTAINS "safelinks-protect.live" OR requesturl CONTAINS "secureoffice.live" OR requesturl CONTAINS "webresources.live" OR requesturl CONTAINS "word-yand.live" OR requesturl CONTAINS "yandx-online.cloud" OR requesturl CONTAINS "y-ml.co" OR requesturl CONTAINS "docs-drive.online" OR requesturl CONTAINS "docs-info.online" OR requesturl CONTAINS "cloud-mail.online" OR requesturl CONTAINS "onlinecloud365.live" OR requesturl CONTAINS "pdf-cloud.online" OR requesturl CONTAINS "pdf-shared.online" OR requesturl CONTAINS "proton-pdf.online" OR requesturl CONTAINS "proton-view.online" OR requesturl CONTAINS "office365-online.live" OR requesturl CONTAINS "doc-viewer.com" OR requesturl CONTAINS "file-milgov.systems" OR requesturl CONTAINS "office-protection.online")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "cache-dns.com" OR destinationhostname CONTAINS "sekoia.io" OR destinationhostname CONTAINS "cache-dns-forwarding.com" OR destinationhostname CONTAINS "cache-dns-preview.com" OR destinationhostname CONTAINS "cache-docs.com" OR destinationhostname CONTAINS "cache-pdf.com" OR destinationhostname CONTAINS "cache-pdf.online" OR destinationhostname CONTAINS "cache-services.live" OR destinationhostname CONTAINS "cloud-docs.com" OR destinationhostname CONTAINS "cloud-drive.live" OR destinationhostname CONTAINS "cloud-storage.live" OR destinationhostname CONTAINS "docs-cache.com" OR destinationhostname CONTAINS "docs-forwarding.online" OR destinationhostname CONTAINS "docs-info.com" OR destinationhostname CONTAINS "docs-shared.com" OR destinationhostname CONTAINS "docs-shared.online" OR destinationhostname CONTAINS "docs-view.online" OR destinationhostname CONTAINS "document-forwarding.com" OR destinationhostname CONTAINS "document-online.live" OR destinationhostname CONTAINS "document-preview.com" OR destinationhostname CONTAINS "documents-cloud.com" OR destinationhostname CONTAINS "documents-cloud.online" OR destinationhostname CONTAINS "documents-forwarding.com" OR destinationhostname CONTAINS "document-share.live" OR destinationhostname CONTAINS "documents-online.live" OR destinationhostname CONTAINS "documents-pdf.online" OR destinationhostname CONTAINS "documents-preview.com" OR destinationhostname CONTAINS "documents-view.live" OR destinationhostname CONTAINS "document-view.live" OR destinationhostname CONTAINS "drive-docs.com" OR destinationhostname CONTAINS "drive-share.live" OR destinationhostname CONTAINS "goo-link.online" OR destinationhostname CONTAINS "hypertextteches.com" OR destinationhostname CONTAINS "mail-docs.online" OR destinationhostname CONTAINS "officeonline365.live" OR destinationhostname CONTAINS "online365-office.com" OR destinationhostname CONTAINS "online-document.live" OR destinationhostname CONTAINS "online-storage.live" OR destinationhostname CONTAINS "pdf-cache.com" OR destinationhostname CONTAINS "pdf-cache.online" OR destinationhostname CONTAINS "pdf-docs.online" OR destinationhostname CONTAINS "pdf-forwarding.online" OR destinationhostname CONTAINS "protection-checklinks.xyz" OR destinationhostname CONTAINS "protection-link.online" OR destinationhostname CONTAINS "protectionmail.online" OR destinationhostname CONTAINS "protection-office.live" OR destinationhostname CONTAINS "protect-link.online" OR destinationhostname CONTAINS "proton-docs.com" OR destinationhostname CONTAINS "proton-reader.com" OR destinationhostname CONTAINS "proton-viewer.com")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "cache-dns.com" OR sourcentdomain CONTAINS "sekoia.io" OR sourcentdomain CONTAINS "cache-dns-forwarding.com" OR sourcentdomain CONTAINS "cache-dns-preview.com" OR sourcentdomain CONTAINS "cache-docs.com" OR sourcentdomain CONTAINS "cache-pdf.com" OR sourcentdomain CONTAINS "cache-pdf.online" OR sourcentdomain CONTAINS "cache-services.live" OR sourcentdomain CONTAINS "cloud-docs.com" OR sourcentdomain CONTAINS "cloud-drive.live" OR sourcentdomain CONTAINS "cloud-storage.live" OR sourcentdomain CONTAINS "docs-cache.com" OR sourcentdomain CONTAINS "docs-forwarding.online" OR sourcentdomain CONTAINS "docs-info.com" OR sourcentdomain CONTAINS "docs-shared.com" OR sourcentdomain CONTAINS "docs-shared.online" OR sourcentdomain CONTAINS "docs-view.online" OR sourcentdomain CONTAINS "document-forwarding.com" OR sourcentdomain CONTAINS "document-online.live" OR sourcentdomain CONTAINS "document-preview.com" OR sourcentdomain CONTAINS "documents-cloud.com" OR sourcentdomain CONTAINS "documents-cloud.online" OR sourcentdomain CONTAINS "documents-forwarding.com" OR sourcentdomain CONTAINS "document-share.live" OR sourcentdomain CONTAINS "documents-online.live" OR sourcentdomain CONTAINS "documents-pdf.online" OR sourcentdomain CONTAINS "documents-preview.com" OR sourcentdomain CONTAINS "documents-view.live" OR sourcentdomain CONTAINS "document-view.live" OR sourcentdomain CONTAINS "drive-docs.com" OR sourcentdomain CONTAINS "drive-share.live" OR sourcentdomain CONTAINS "goo-link.online" OR sourcentdomain CONTAINS "hypertextteches.com" OR sourcentdomain CONTAINS "mail-docs.online" OR sourcentdomain CONTAINS "officeonline365.live" OR sourcentdomain CONTAINS "online365-office.com" OR sourcentdomain CONTAINS "online-document.live" OR sourcentdomain CONTAINS "online-storage.live" OR sourcentdomain CONTAINS "pdf-cache.com" OR sourcentdomain CONTAINS "pdf-cache.online" OR sourcentdomain CONTAINS "pdf-docs.online" OR sourcentdomain CONTAINS "pdf-forwarding.online" OR sourcentdomain CONTAINS "protection-checklinks.xyz" OR sourcentdomain CONTAINS "protection-link.online" OR sourcentdomain CONTAINS "protectionmail.online" OR sourcentdomain CONTAINS "protection-office.live" OR sourcentdomain CONTAINS "protect-link.online" OR sourcentdomain CONTAINS "proton-docs.com" OR sourcentdomain CONTAINS "proton-reader.com" OR sourcentdomain CONTAINS "proton-viewer.com")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "cache-dns.com" OR sourcehostname CONTAINS "sekoia.io" OR sourcehostname CONTAINS "cache-dns-forwarding.com" OR sourcehostname CONTAINS "cache-dns-preview.com" OR sourcehostname CONTAINS "cache-docs.com" OR sourcehostname CONTAINS "cache-pdf.com" OR sourcehostname CONTAINS "cache-pdf.online" OR sourcehostname CONTAINS "cache-services.live" OR sourcehostname CONTAINS "cloud-docs.com" OR sourcehostname CONTAINS "cloud-drive.live" OR sourcehostname CONTAINS "cloud-storage.live" OR sourcehostname CONTAINS "docs-cache.com" OR sourcehostname CONTAINS "docs-forwarding.online" OR sourcehostname CONTAINS "docs-info.com" OR sourcehostname CONTAINS "docs-shared.com" OR sourcehostname CONTAINS "docs-shared.online" OR sourcehostname CONTAINS "docs-view.online" OR sourcehostname CONTAINS "document-forwarding.com" OR sourcehostname CONTAINS "document-online.live" OR sourcehostname CONTAINS "document-preview.com" OR sourcehostname CONTAINS "documents-cloud.com" OR sourcehostname CONTAINS "documents-cloud.online" OR sourcehostname CONTAINS "documents-forwarding.com" OR sourcehostname CONTAINS "document-share.live" OR sourcehostname CONTAINS "documents-online.live" OR sourcehostname CONTAINS "documents-pdf.online" OR sourcehostname CONTAINS "documents-preview.com" OR sourcehostname CONTAINS "documents-view.live" OR sourcehostname CONTAINS "document-view.live" OR sourcehostname CONTAINS "drive-docs.com" OR sourcehostname CONTAINS "drive-share.live" OR sourcehostname CONTAINS "goo-link.online" OR sourcehostname CONTAINS "hypertextteches.com" OR sourcehostname CONTAINS "mail-docs.online" OR sourcehostname CONTAINS "officeonline365.live" OR sourcehostname CONTAINS "online365-office.com" OR sourcehostname CONTAINS "online-document.live" OR sourcehostname CONTAINS "online-storage.live" OR sourcehostname CONTAINS "pdf-cache.com" OR sourcehostname CONTAINS "pdf-cache.online" OR sourcehostname CONTAINS "pdf-docs.online" OR sourcehostname CONTAINS "pdf-forwarding.online" OR sourcehostname CONTAINS "protection-checklinks.xyz" OR sourcehostname CONTAINS "protection-link.online" OR sourcehostname CONTAINS "protectionmail.online" OR sourcehostname CONTAINS "protection-office.live" OR sourcehostname CONTAINS "protect-link.online" OR sourcehostname CONTAINS "proton-docs.com" OR sourcehostname CONTAINS "proton-reader.com" OR sourcehostname CONTAINS "proton-viewer.com")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "cache-dns.com" OR destinationntdomain CONTAINS "sekoia.io" OR destinationntdomain CONTAINS "cache-dns-forwarding.com" OR destinationntdomain CONTAINS "cache-dns-preview.com" OR destinationntdomain CONTAINS "cache-docs.com" OR destinationntdomain CONTAINS "cache-pdf.com" OR destinationntdomain CONTAINS "cache-pdf.online" OR destinationntdomain CONTAINS "cache-services.live" OR destinationntdomain CONTAINS "cloud-docs.com" OR destinationntdomain CONTAINS "cloud-drive.live" OR destinationntdomain CONTAINS "cloud-storage.live" OR destinationntdomain CONTAINS "docs-cache.com" OR destinationntdomain CONTAINS "docs-forwarding.online" OR destinationntdomain CONTAINS "docs-info.com" OR destinationntdomain CONTAINS "docs-shared.com" OR destinationntdomain CONTAINS "docs-shared.online" OR destinationntdomain CONTAINS "docs-view.online" OR destinationntdomain CONTAINS "document-forwarding.com" OR destinationntdomain CONTAINS "document-online.live" OR destinationntdomain CONTAINS "document-preview.com" OR destinationntdomain CONTAINS "documents-cloud.com" OR destinationntdomain CONTAINS "documents-cloud.online" OR destinationntdomain CONTAINS "documents-forwarding.com" OR destinationntdomain CONTAINS "document-share.live" OR destinationntdomain CONTAINS "documents-online.live" OR destinationntdomain CONTAINS "documents-pdf.online" OR destinationntdomain CONTAINS "documents-preview.com" OR destinationntdomain CONTAINS "documents-view.live" OR destinationntdomain CONTAINS "document-view.live" OR destinationntdomain CONTAINS "drive-docs.com" OR destinationntdomain CONTAINS "drive-share.live" OR destinationntdomain CONTAINS "goo-link.online" OR destinationntdomain CONTAINS "hypertextteches.com" OR destinationntdomain CONTAINS "mail-docs.online" OR destinationntdomain CONTAINS "officeonline365.live" OR destinationntdomain CONTAINS "online365-office.com" OR destinationntdomain CONTAINS "online-document.live" OR destinationntdomain CONTAINS "online-storage.live" OR destinationntdomain CONTAINS "pdf-cache.com" OR destinationntdomain CONTAINS "pdf-cache.online" OR destinationntdomain CONTAINS "pdf-docs.online" OR destinationntdomain CONTAINS "pdf-forwarding.online" OR destinationntdomain CONTAINS "protection-checklinks.xyz" OR destinationntdomain CONTAINS "protection-link.online" OR destinationntdomain CONTAINS "protectionmail.online" OR destinationntdomain CONTAINS "protection-office.live" OR destinationntdomain CONTAINS "protect-link.online" OR destinationntdomain CONTAINS "proton-docs.com" OR destinationntdomain CONTAINS "proton-reader.com" OR destinationntdomain CONTAINS "proton-viewer.com")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND requesturl NOT NULL AND (requesturl CONTAINS "cache-dns.com" OR requesturl CONTAINS "sekoia.io" OR requesturl CONTAINS "cache-dns-forwarding.com" OR requesturl CONTAINS "cache-dns-preview.com" OR requesturl CONTAINS "cache-docs.com" OR requesturl CONTAINS "cache-pdf.com" OR requesturl CONTAINS "cache-pdf.online" OR requesturl CONTAINS "cache-services.live" OR requesturl CONTAINS "cloud-docs.com" OR requesturl CONTAINS "cloud-drive.live" OR requesturl CONTAINS "cloud-storage.live" OR requesturl CONTAINS "docs-cache.com" OR requesturl CONTAINS "docs-forwarding.online" OR requesturl CONTAINS "docs-info.com" OR requesturl CONTAINS "docs-shared.com" OR requesturl CONTAINS "docs-shared.online" OR requesturl CONTAINS "docs-view.online" OR requesturl CONTAINS "document-forwarding.com" OR requesturl CONTAINS "document-online.live" OR requesturl CONTAINS "document-preview.com" OR requesturl CONTAINS "documents-cloud.com" OR requesturl CONTAINS "documents-cloud.online" OR requesturl CONTAINS "documents-forwarding.com" OR requesturl CONTAINS "document-share.live" OR requesturl CONTAINS "documents-online.live" OR requesturl CONTAINS "documents-pdf.online" OR requesturl CONTAINS "documents-preview.com" OR requesturl CONTAINS "documents-view.live" OR requesturl CONTAINS "document-view.live" OR requesturl CONTAINS "drive-docs.com" OR requesturl CONTAINS "drive-share.live" OR requesturl CONTAINS "goo-link.online" OR requesturl CONTAINS "hypertextteches.com" OR requesturl CONTAINS "mail-docs.online" OR requesturl CONTAINS "officeonline365.live" OR requesturl CONTAINS "online365-office.com" OR requesturl CONTAINS "online-document.live" OR requesturl CONTAINS "online-storage.live" OR requesturl CONTAINS "pdf-cache.com" OR requesturl CONTAINS "pdf-cache.online" OR requesturl CONTAINS "pdf-docs.online" OR requesturl CONTAINS "pdf-forwarding.online" OR requesturl CONTAINS "protection-checklinks.xyz" OR requesturl CONTAINS "protection-link.online" OR requesturl CONTAINS "protectionmail.online" OR requesturl CONTAINS "protection-office.live" OR requesturl CONTAINS "protect-link.online" OR requesturl CONTAINS "proton-docs.com" OR requesturl CONTAINS "proton-reader.com" OR requesturl CONTAINS "proton-viewer.com")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "relogin-dashboard.online" OR destinationhostname CONTAINS "safe-connection.online" OR destinationhostname CONTAINS "safelinks-protect.live" OR destinationhostname CONTAINS "secureoffice.live" OR destinationhostname CONTAINS "webresources.live" OR destinationhostname CONTAINS "word-yand.live" OR destinationhostname CONTAINS "yandx-online.cloud" OR destinationhostname CONTAINS "y-ml.co" OR destinationhostname CONTAINS "docs-drive.online" OR destinationhostname CONTAINS "docs-info.online" OR destinationhostname CONTAINS "cloud-mail.online" OR destinationhostname CONTAINS "onlinecloud365.live" OR destinationhostname CONTAINS "pdf-cloud.online" OR destinationhostname CONTAINS "pdf-shared.online" OR destinationhostname CONTAINS "proton-pdf.online" OR destinationhostname CONTAINS "proton-view.online" OR destinationhostname CONTAINS "office365-online.live" OR destinationhostname CONTAINS "doc-viewer.com" OR destinationhostname CONTAINS "file-milgov.systems" OR destinationhostname CONTAINS "office-protection.online")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "relogin-dashboard.online" OR sourcentdomain CONTAINS "safe-connection.online" OR sourcentdomain CONTAINS "safelinks-protect.live" OR sourcentdomain CONTAINS "secureoffice.live" OR sourcentdomain CONTAINS "webresources.live" OR sourcentdomain CONTAINS "word-yand.live" OR sourcentdomain CONTAINS "yandx-online.cloud" OR sourcentdomain CONTAINS "y-ml.co" OR sourcentdomain CONTAINS "docs-drive.online" OR sourcentdomain CONTAINS "docs-info.online" OR sourcentdomain CONTAINS "cloud-mail.online" OR sourcentdomain CONTAINS "onlinecloud365.live" OR sourcentdomain CONTAINS "pdf-cloud.online" OR sourcentdomain CONTAINS "pdf-shared.online" OR sourcentdomain CONTAINS "proton-pdf.online" OR sourcentdomain CONTAINS "proton-view.online" OR sourcentdomain CONTAINS "office365-online.live" OR sourcentdomain CONTAINS "doc-viewer.com" OR sourcentdomain CONTAINS "file-milgov.systems" OR sourcentdomain CONTAINS "office-protection.online")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "relogin-dashboard.online" OR sourcehostname CONTAINS "safe-connection.online" OR sourcehostname CONTAINS "safelinks-protect.live" OR sourcehostname CONTAINS "secureoffice.live" OR sourcehostname CONTAINS "webresources.live" OR sourcehostname CONTAINS "word-yand.live" OR sourcehostname CONTAINS "yandx-online.cloud" OR sourcehostname CONTAINS "y-ml.co" OR sourcehostname CONTAINS "docs-drive.online" OR sourcehostname CONTAINS "docs-info.online" OR sourcehostname CONTAINS "cloud-mail.online" OR sourcehostname CONTAINS "onlinecloud365.live" OR sourcehostname CONTAINS "pdf-cloud.online" OR sourcehostname CONTAINS "pdf-shared.online" OR sourcehostname CONTAINS "proton-pdf.online" OR sourcehostname CONTAINS "proton-view.online" OR sourcehostname CONTAINS "office365-online.live" OR sourcehostname CONTAINS "doc-viewer.com" OR sourcehostname CONTAINS "file-milgov.systems" OR sourcehostname CONTAINS "office-protection.online")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "relogin-dashboard.online" OR destinationntdomain CONTAINS "safe-connection.online" OR destinationntdomain CONTAINS "safelinks-protect.live" OR destinationntdomain CONTAINS "secureoffice.live" OR destinationntdomain CONTAINS "webresources.live" OR destinationntdomain CONTAINS "word-yand.live" OR destinationntdomain CONTAINS "yandx-online.cloud" OR destinationntdomain CONTAINS "y-ml.co" OR destinationntdomain CONTAINS "docs-drive.online" OR destinationntdomain CONTAINS "docs-info.online" OR destinationntdomain CONTAINS "cloud-mail.online" OR destinationntdomain CONTAINS "onlinecloud365.live" OR destinationntdomain CONTAINS "pdf-cloud.online" OR destinationntdomain CONTAINS "pdf-shared.online" OR destinationntdomain CONTAINS "proton-pdf.online" OR destinationntdomain CONTAINS "proton-view.online" OR destinationntdomain CONTAINS "office365-online.live" OR destinationntdomain CONTAINS "doc-viewer.com" OR destinationntdomain CONTAINS "file-milgov.systems" OR destinationntdomain CONTAINS "office-protection.online")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND requesturl NOT NULL AND (requesturl CONTAINS "relogin-dashboard.online" OR requesturl CONTAINS "safe-connection.online" OR requesturl CONTAINS "safelinks-protect.live" OR requesturl CONTAINS "secureoffice.live" OR requesturl CONTAINS "webresources.live" OR requesturl CONTAINS "word-yand.live" OR requesturl CONTAINS "yandx-online.cloud" OR requesturl CONTAINS "y-ml.co" OR requesturl CONTAINS "docs-drive.online" OR requesturl CONTAINS "docs-info.online" OR requesturl CONTAINS "cloud-mail.online" OR requesturl CONTAINS "onlinecloud365.live" OR requesturl CONTAINS "pdf-cloud.online" OR requesturl CONTAINS "pdf-shared.online" OR requesturl CONTAINS "proton-pdf.online" OR requesturl CONTAINS "proton-view.online" OR requesturl CONTAINS "office365-online.live" OR requesturl CONTAINS "doc-viewer.com" OR requesturl CONTAINS "file-milgov.systems" OR requesturl CONTAINS "office-protection.online")
index=activity AND rg_functionality="Web Application Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "cache-dns.com" OR destinationhostname CONTAINS "sekoia.io" OR destinationhostname CONTAINS "cache-dns-forwarding.com" OR destinationhostname CONTAINS "cache-dns-preview.com" OR destinationhostname CONTAINS "cache-docs.com" OR destinationhostname CONTAINS "cache-pdf.com" OR destinationhostname CONTAINS "cache-pdf.online" OR destinationhostname CONTAINS "cache-services.live" OR destinationhostname CONTAINS "cloud-docs.com" OR destinationhostname CONTAINS "cloud-drive.live" OR destinationhostname CONTAINS "cloud-storage.live" OR destinationhostname CONTAINS "docs-cache.com" OR destinationhostname CONTAINS "docs-forwarding.online" OR destinationhostname CONTAINS "docs-info.com" OR destinationhostname CONTAINS "docs-shared.com" OR destinationhostname CONTAINS "docs-shared.online" OR destinationhostname CONTAINS "docs-view.online" OR destinationhostname CONTAINS "document-forwarding.com" OR destinationhostname CONTAINS "document-online.live" OR destinationhostname CONTAINS "document-preview.com" OR destinationhostname CONTAINS "documents-cloud.com" OR destinationhostname CONTAINS "documents-cloud.online" OR destinationhostname CONTAINS "documents-forwarding.com" OR destinationhostname CONTAINS "document-share.live" OR destinationhostname CONTAINS "documents-online.live" OR destinationhostname CONTAINS "documents-pdf.online" OR destinationhostname CONTAINS "documents-preview.com" OR destinationhostname CONTAINS "documents-view.live" OR destinationhostname CONTAINS "document-view.live" OR destinationhostname CONTAINS "drive-docs.com" OR destinationhostname CONTAINS "drive-share.live" OR destinationhostname CONTAINS "goo-link.online" OR destinationhostname CONTAINS "hypertextteches.com" OR destinationhostname CONTAINS "mail-docs.online" OR destinationhostname CONTAINS "officeonline365.live" OR destinationhostname CONTAINS "online365-office.com" OR destinationhostname CONTAINS "online-document.live" OR destinationhostname CONTAINS "online-storage.live" OR destinationhostname CONTAINS "pdf-cache.com" OR destinationhostname CONTAINS "pdf-cache.online" OR destinationhostname CONTAINS "pdf-docs.online" OR destinationhostname CONTAINS "pdf-forwarding.online" OR destinationhostname CONTAINS "protection-checklinks.xyz" OR destinationhostname CONTAINS "protection-link.online" OR destinationhostname CONTAINS "protectionmail.online" OR destinationhostname CONTAINS "protection-office.live" OR destinationhostname CONTAINS "protect-link.online" OR destinationhostname CONTAINS "proton-docs.com" OR destinationhostname CONTAINS "proton-reader.com" OR destinationhostname CONTAINS "proton-viewer.com")
index=activity AND rg_functionality="Web Application Firewall" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "cache-dns.com" OR sourcentdomain CONTAINS "sekoia.io" OR sourcentdomain CONTAINS "cache-dns-forwarding.com" OR sourcentdomain CONTAINS "cache-dns-preview.com" OR sourcentdomain CONTAINS "cache-docs.com" OR sourcentdomain CONTAINS "cache-pdf.com" OR sourcentdomain CONTAINS "cache-pdf.online" OR sourcentdomain CONTAINS "cache-services.live" OR sourcentdomain CONTAINS "cloud-docs.com" OR sourcentdomain CONTAINS "cloud-drive.live" OR sourcentdomain CONTAINS "cloud-storage.live" OR sourcentdomain CONTAINS "docs-cache.com" OR sourcentdomain CONTAINS "docs-forwarding.online" OR sourcentdomain CONTAINS "docs-info.com" OR sourcentdomain CONTAINS "docs-shared.com" OR sourcentdomain CONTAINS "docs-shared.online" OR sourcentdomain CONTAINS "docs-view.online" OR sourcentdomain CONTAINS "document-forwarding.com" OR sourcentdomain CONTAINS "document-online.live" OR sourcentdomain CONTAINS "document-preview.com" OR sourcentdomain CONTAINS "documents-cloud.com" OR sourcentdomain CONTAINS "documents-cloud.online" OR sourcentdomain CONTAINS "documents-forwarding.com" OR sourcentdomain CONTAINS "document-share.live" OR sourcentdomain CONTAINS "documents-online.live" OR sourcentdomain CONTAINS "documents-pdf.online" OR sourcentdomain CONTAINS "documents-preview.com" OR sourcentdomain CONTAINS "documents-view.live" OR sourcentdomain CONTAINS "document-view.live" OR sourcentdomain CONTAINS "drive-docs.com" OR sourcentdomain CONTAINS "drive-share.live" OR sourcentdomain CONTAINS "goo-link.online" OR sourcentdomain CONTAINS "hypertextteches.com" OR sourcentdomain CONTAINS "mail-docs.online" OR sourcentdomain CONTAINS "officeonline365.live" OR sourcentdomain CONTAINS "online365-office.com" OR sourcentdomain CONTAINS "online-document.live" OR sourcentdomain CONTAINS "online-storage.live" OR sourcentdomain CONTAINS "pdf-cache.com" OR sourcentdomain CONTAINS "pdf-cache.online" OR sourcentdomain CONTAINS "pdf-docs.online" OR sourcentdomain CONTAINS "pdf-forwarding.online" OR sourcentdomain CONTAINS "protection-checklinks.xyz" OR sourcentdomain CONTAINS "protection-link.online" OR sourcentdomain CONTAINS "protectionmail.online" OR sourcentdomain CONTAINS "protection-office.live" OR sourcentdomain CONTAINS "protect-link.online" OR sourcentdomain CONTAINS "proton-docs.com" OR sourcentdomain CONTAINS "proton-reader.com" OR sourcentdomain CONTAINS "proton-viewer.com")
index=activity AND rg_functionality="Web Application Firewall" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "cache-dns.com" OR sourcehostname CONTAINS "sekoia.io" OR sourcehostname CONTAINS "cache-dns-forwarding.com" OR sourcehostname CONTAINS "cache-dns-preview.com" OR sourcehostname CONTAINS "cache-docs.com" OR sourcehostname CONTAINS "cache-pdf.com" OR sourcehostname CONTAINS "cache-pdf.online" OR sourcehostname CONTAINS "cache-services.live" OR sourcehostname CONTAINS "cloud-docs.com" OR sourcehostname CONTAINS "cloud-drive.live" OR sourcehostname CONTAINS "cloud-storage.live" OR sourcehostname CONTAINS "docs-cache.com" OR sourcehostname CONTAINS "docs-forwarding.online" OR sourcehostname CONTAINS "docs-info.com" OR sourcehostname CONTAINS "docs-shared.com" OR sourcehostname CONTAINS "docs-shared.online" OR sourcehostname CONTAINS "docs-view.online" OR sourcehostname CONTAINS "document-forwarding.com" OR sourcehostname CONTAINS "document-online.live" OR sourcehostname CONTAINS "document-preview.com" OR sourcehostname CONTAINS "documents-cloud.com" OR sourcehostname CONTAINS "documents-cloud.online" OR sourcehostname CONTAINS "documents-forwarding.com" OR sourcehostname CONTAINS "document-share.live" OR sourcehostname CONTAINS "documents-online.live" OR sourcehostname CONTAINS "documents-pdf.online" OR sourcehostname CONTAINS "documents-preview.com" OR sourcehostname CONTAINS "documents-view.live" OR sourcehostname CONTAINS "document-view.live" OR sourcehostname CONTAINS "drive-docs.com" OR sourcehostname CONTAINS "drive-share.live" OR sourcehostname CONTAINS "goo-link.online" OR sourcehostname CONTAINS "hypertextteches.com" OR sourcehostname CONTAINS "mail-docs.online" OR sourcehostname CONTAINS "officeonline365.live" OR sourcehostname CONTAINS "online365-office.com" OR sourcehostname CONTAINS "online-document.live" OR sourcehostname CONTAINS "online-storage.live" OR sourcehostname CONTAINS "pdf-cache.com" OR sourcehostname CONTAINS "pdf-cache.online" OR sourcehostname CONTAINS "pdf-docs.online" OR sourcehostname CONTAINS "pdf-forwarding.online" OR sourcehostname CONTAINS "protection-checklinks.xyz" OR sourcehostname CONTAINS "protection-link.online" OR sourcehostname CONTAINS "protectionmail.online" OR sourcehostname CONTAINS "protection-office.live" OR sourcehostname CONTAINS "protect-link.online" OR sourcehostname CONTAINS "proton-docs.com" OR sourcehostname CONTAINS "proton-reader.com" OR sourcehostname CONTAINS "proton-viewer.com")
index=activity AND rg_functionality="Web Application Firewall" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "cache-dns.com" OR destinationntdomain CONTAINS "sekoia.io" OR destinationntdomain CONTAINS "cache-dns-forwarding.com" OR destinationntdomain CONTAINS "cache-dns-preview.com" OR destinationntdomain CONTAINS "cache-docs.com" OR destinationntdomain CONTAINS "cache-pdf.com" OR destinationntdomain CONTAINS "cache-pdf.online" OR destinationntdomain CONTAINS "cache-services.live" OR destinationntdomain CONTAINS "cloud-docs.com" OR destinationntdomain CONTAINS "cloud-drive.live" OR destinationntdomain CONTAINS "cloud-storage.live" OR destinationntdomain CONTAINS "docs-cache.com" OR destinationntdomain CONTAINS "docs-forwarding.online" OR destinationntdomain CONTAINS "docs-info.com" OR destinationntdomain CONTAINS "docs-shared.com" OR destinationntdomain CONTAINS "docs-shared.online" OR destinationntdomain CONTAINS "docs-view.online" OR destinationntdomain CONTAINS "document-forwarding.com" OR destinationntdomain CONTAINS "document-online.live" OR destinationntdomain CONTAINS "document-preview.com" OR destinationntdomain CONTAINS "documents-cloud.com" OR destinationntdomain CONTAINS "documents-cloud.online" OR destinationntdomain CONTAINS "documents-forwarding.com" OR destinationntdomain CONTAINS "document-share.live" OR destinationntdomain CONTAINS "documents-online.live" OR destinationntdomain CONTAINS "documents-pdf.online" OR destinationntdomain CONTAINS "documents-preview.com" OR destinationntdomain CONTAINS "documents-view.live" OR destinationntdomain CONTAINS "document-view.live" OR destinationntdomain CONTAINS "drive-docs.com" OR destinationntdomain CONTAINS "drive-share.live" OR destinationntdomain CONTAINS "goo-link.online" OR destinationntdomain CONTAINS "hypertextteches.com" OR destinationntdomain CONTAINS "mail-docs.online" OR destinationntdomain CONTAINS "officeonline365.live" OR destinationntdomain CONTAINS "online365-office.com" OR destinationntdomain CONTAINS "online-document.live" OR destinationntdomain CONTAINS "online-storage.live" OR destinationntdomain CONTAINS "pdf-cache.com" OR destinationntdomain CONTAINS "pdf-cache.online" OR destinationntdomain CONTAINS "pdf-docs.online" OR destinationntdomain CONTAINS "pdf-forwarding.online" OR destinationntdomain CONTAINS "protection-checklinks.xyz" OR destinationntdomain CONTAINS "protection-link.online" OR destinationntdomain CONTAINS "protectionmail.online" OR destinationntdomain CONTAINS "protection-office.live" OR destinationntdomain CONTAINS "protect-link.online" OR destinationntdomain CONTAINS "proton-docs.com" OR destinationntdomain CONTAINS "proton-reader.com" OR destinationntdomain CONTAINS "proton-viewer.com")
index=activity AND rg_functionality="Web Application Firewall" AND requesturl NOT NULL AND (requesturl CONTAINS "cache-dns.com" OR requesturl CONTAINS "sekoia.io" OR requesturl CONTAINS "cache-dns-forwarding.com" OR requesturl CONTAINS "cache-dns-preview.com" OR requesturl CONTAINS "cache-docs.com" OR requesturl CONTAINS "cache-pdf.com" OR requesturl CONTAINS "cache-pdf.online" OR requesturl CONTAINS "cache-services.live" OR requesturl CONTAINS "cloud-docs.com" OR requesturl CONTAINS "cloud-drive.live" OR requesturl CONTAINS "cloud-storage.live" OR requesturl CONTAINS "docs-cache.com" OR requesturl CONTAINS "docs-forwarding.online" OR requesturl CONTAINS "docs-info.com" OR requesturl CONTAINS "docs-shared.com" OR requesturl CONTAINS "docs-shared.online" OR requesturl CONTAINS "docs-view.online" OR requesturl CONTAINS "document-forwarding.com" OR requesturl CONTAINS "document-online.live" OR requesturl CONTAINS "document-preview.com" OR requesturl CONTAINS "documents-cloud.com" OR requesturl CONTAINS "documents-cloud.online" OR requesturl CONTAINS "documents-forwarding.com" OR requesturl CONTAINS "document-share.live" OR requesturl CONTAINS "documents-online.live" OR requesturl CONTAINS "documents-pdf.online" OR requesturl CONTAINS "documents-preview.com" OR requesturl CONTAINS "documents-view.live" OR requesturl CONTAINS "document-view.live" OR requesturl CONTAINS "drive-docs.com" OR requesturl CONTAINS "drive-share.live" OR requesturl CONTAINS "goo-link.online" OR requesturl CONTAINS "hypertextteches.com" OR requesturl CONTAINS "mail-docs.online" OR requesturl CONTAINS "officeonline365.live" OR requesturl CONTAINS "online365-office.com" OR requesturl CONTAINS "online-document.live" OR requesturl CONTAINS "online-storage.live" OR requesturl CONTAINS "pdf-cache.com" OR requesturl CONTAINS "pdf-cache.online" OR requesturl CONTAINS "pdf-docs.online" OR requesturl CONTAINS "pdf-forwarding.online" OR requesturl CONTAINS "protection-checklinks.xyz" OR requesturl CONTAINS "protection-link.online" OR requesturl CONTAINS "protectionmail.online" OR requesturl CONTAINS "protection-office.live" OR requesturl CONTAINS "protect-link.online" OR requesturl CONTAINS "proton-docs.com" OR requesturl CONTAINS "proton-reader.com" OR requesturl CONTAINS "proton-viewer.com")
index=activity AND rg_functionality="Web Application Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "relogin-dashboard.online" OR destinationhostname CONTAINS "safe-connection.online" OR destinationhostname CONTAINS "safelinks-protect.live" OR destinationhostname CONTAINS "secureoffice.live" OR destinationhostname CONTAINS "webresources.live" OR destinationhostname CONTAINS "word-yand.live" OR destinationhostname CONTAINS "yandx-online.cloud" OR destinationhostname CONTAINS "y-ml.co" OR destinationhostname CONTAINS "docs-drive.online" OR destinationhostname CONTAINS "docs-info.online" OR destinationhostname CONTAINS "cloud-mail.online" OR destinationhostname CONTAINS "onlinecloud365.live" OR destinationhostname CONTAINS "pdf-cloud.online" OR destinationhostname CONTAINS "pdf-shared.online" OR destinationhostname CONTAINS "proton-pdf.online" OR destinationhostname CONTAINS "proton-view.online" OR destinationhostname CONTAINS "office365-online.live" OR destinationhostname CONTAINS "doc-viewer.com" OR destinationhostname CONTAINS "file-milgov.systems" OR destinationhostname CONTAINS "office-protection.online")
index=activity AND rg_functionality="Web Application Firewall" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "relogin-dashboard.online" OR sourcentdomain CONTAINS "safe-connection.online" OR sourcentdomain CONTAINS "safelinks-protect.live" OR sourcentdomain CONTAINS "secureoffice.live" OR sourcentdomain CONTAINS "webresources.live" OR sourcentdomain CONTAINS "word-yand.live" OR sourcentdomain CONTAINS "yandx-online.cloud" OR sourcentdomain CONTAINS "y-ml.co" OR sourcentdomain CONTAINS "docs-drive.online" OR sourcentdomain CONTAINS "docs-info.online" OR sourcentdomain CONTAINS "cloud-mail.online" OR sourcentdomain CONTAINS "onlinecloud365.live" OR sourcentdomain CONTAINS "pdf-cloud.online" OR sourcentdomain CONTAINS "pdf-shared.online" OR sourcentdomain CONTAINS "proton-pdf.online" OR sourcentdomain CONTAINS "proton-view.online" OR sourcentdomain CONTAINS "office365-online.live" OR sourcentdomain CONTAINS "doc-viewer.com" OR sourcentdomain CONTAINS "file-milgov.systems" OR sourcentdomain CONTAINS "office-protection.online")
index=activity AND rg_functionality="Web Application Firewall" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "relogin-dashboard.online" OR sourcehostname CONTAINS "safe-connection.online" OR sourcehostname CONTAINS "safelinks-protect.live" OR sourcehostname CONTAINS "secureoffice.live" OR sourcehostname CONTAINS "webresources.live" OR sourcehostname CONTAINS "word-yand.live" OR sourcehostname CONTAINS "yandx-online.cloud" OR sourcehostname CONTAINS "y-ml.co" OR sourcehostname CONTAINS "docs-drive.online" OR sourcehostname CONTAINS "docs-info.online" OR sourcehostname CONTAINS "cloud-mail.online" OR sourcehostname CONTAINS "onlinecloud365.live" OR sourcehostname CONTAINS "pdf-cloud.online" OR sourcehostname CONTAINS "pdf-shared.online" OR sourcehostname CONTAINS "proton-pdf.online" OR sourcehostname CONTAINS "proton-view.online" OR sourcehostname CONTAINS "office365-online.live" OR sourcehostname CONTAINS "doc-viewer.com" OR sourcehostname CONTAINS "file-milgov.systems" OR sourcehostname CONTAINS "office-protection.online")
index=activity AND rg_functionality="Web Application Firewall" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "relogin-dashboard.online" OR destinationntdomain CONTAINS "safe-connection.online" OR destinationntdomain CONTAINS "safelinks-protect.live" OR destinationntdomain CONTAINS "secureoffice.live" OR destinationntdomain CONTAINS "webresources.live" OR destinationntdomain CONTAINS "word-yand.live" OR destinationntdomain CONTAINS "yandx-online.cloud" OR destinationntdomain CONTAINS "y-ml.co" OR destinationntdomain CONTAINS "docs-drive.online" OR destinationntdomain CONTAINS "docs-info.online" OR destinationntdomain CONTAINS "cloud-mail.online" OR destinationntdomain CONTAINS "onlinecloud365.live" OR destinationntdomain CONTAINS "pdf-cloud.online" OR destinationntdomain CONTAINS "pdf-shared.online" OR destinationntdomain CONTAINS "proton-pdf.online" OR destinationntdomain CONTAINS "proton-view.online" OR destinationntdomain CONTAINS "office365-online.live" OR destinationntdomain CONTAINS "doc-viewer.com" OR destinationntdomain CONTAINS "file-milgov.systems" OR destinationntdomain CONTAINS "office-protection.online")
index=activity AND rg_functionality="Web Application Firewall" AND requesturl NOT NULL AND (requesturl CONTAINS "relogin-dashboard.online" OR requesturl CONTAINS "safe-connection.online" OR requesturl CONTAINS "safelinks-protect.live" OR requesturl CONTAINS "secureoffice.live" OR requesturl CONTAINS "webresources.live" OR requesturl CONTAINS "word-yand.live" OR requesturl CONTAINS "yandx-online.cloud" OR requesturl CONTAINS "y-ml.co" OR requesturl CONTAINS "docs-drive.online" OR requesturl CONTAINS "docs-info.online" OR requesturl CONTAINS "cloud-mail.online" OR requesturl CONTAINS "onlinecloud365.live" OR requesturl CONTAINS "pdf-cloud.online" OR requesturl CONTAINS "pdf-shared.online" OR requesturl CONTAINS "proton-pdf.online" OR requesturl CONTAINS "proton-view.online" OR requesturl CONTAINS "office365-online.live" OR requesturl CONTAINS "doc-viewer.com" OR requesturl CONTAINS "file-milgov.systems" OR requesturl CONTAINS "office-protection.online")
index=activity AND rg_functionality="Endpoint management systems" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "cache-dns.com" OR destinationhostname CONTAINS "sekoia.io" OR destinationhostname CONTAINS "cache-dns-forwarding.com" OR destinationhostname CONTAINS "cache-dns-preview.com" OR destinationhostname CONTAINS "cache-docs.com" OR destinationhostname CONTAINS "cache-pdf.com" OR destinationhostname CONTAINS "cache-pdf.online" OR destinationhostname CONTAINS "cache-services.live" OR destinationhostname CONTAINS "cloud-docs.com" OR destinationhostname CONTAINS "cloud-drive.live" OR destinationhostname CONTAINS "cloud-storage.live" OR destinationhostname CONTAINS "docs-cache.com" OR destinationhostname CONTAINS "docs-forwarding.online" OR destinationhostname CONTAINS "docs-info.com" OR destinationhostname CONTAINS "docs-shared.com" OR destinationhostname CONTAINS "docs-shared.online" OR destinationhostname CONTAINS "docs-view.online" OR destinationhostname CONTAINS "document-forwarding.com" OR destinationhostname CONTAINS "document-online.live" OR destinationhostname CONTAINS "document-preview.com" OR destinationhostname CONTAINS "documents-cloud.com" OR destinationhostname CONTAINS "documents-cloud.online" OR destinationhostname CONTAINS "documents-forwarding.com" OR destinationhostname CONTAINS "document-share.live" OR destinationhostname CONTAINS "documents-online.live" OR destinationhostname CONTAINS "documents-pdf.online" OR destinationhostname CONTAINS "documents-preview.com" OR destinationhostname CONTAINS "documents-view.live" OR destinationhostname CONTAINS "document-view.live" OR destinationhostname CONTAINS "drive-docs.com" OR destinationhostname CONTAINS "drive-share.live" OR destinationhostname CONTAINS "goo-link.online" OR destinationhostname CONTAINS "hypertextteches.com" OR destinationhostname CONTAINS "mail-docs.online" OR destinationhostname CONTAINS "officeonline365.live" OR destinationhostname CONTAINS "online365-office.com" OR destinationhostname CONTAINS "online-document.live" OR destinationhostname CONTAINS "online-storage.live" OR destinationhostname CONTAINS "pdf-cache.com" OR destinationhostname CONTAINS "pdf-cache.online" OR destinationhostname CONTAINS "pdf-docs.online" OR destinationhostname CONTAINS "pdf-forwarding.online" OR destinationhostname CONTAINS "protection-checklinks.xyz" OR destinationhostname CONTAINS "protection-link.online" OR destinationhostname CONTAINS "protectionmail.online" OR destinationhostname CONTAINS "protection-office.live" OR destinationhostname CONTAINS "protect-link.online" OR destinationhostname CONTAINS "proton-docs.com" OR destinationhostname CONTAINS "proton-reader.com" OR destinationhostname CONTAINS "proton-viewer.com")
index=activity AND rg_functionality="Endpoint management systems" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "cache-dns.com" OR sourcentdomain CONTAINS "sekoia.io" OR sourcentdomain CONTAINS "cache-dns-forwarding.com" OR sourcentdomain CONTAINS "cache-dns-preview.com" OR sourcentdomain CONTAINS "cache-docs.com" OR sourcentdomain CONTAINS "cache-pdf.com" OR sourcentdomain CONTAINS "cache-pdf.online" OR sourcentdomain CONTAINS "cache-services.live" OR sourcentdomain CONTAINS "cloud-docs.com" OR sourcentdomain CONTAINS "cloud-drive.live" OR sourcentdomain CONTAINS "cloud-storage.live" OR sourcentdomain CONTAINS "docs-cache.com" OR sourcentdomain CONTAINS "docs-forwarding.online" OR sourcentdomain CONTAINS "docs-info.com" OR sourcentdomain CONTAINS "docs-shared.com" OR sourcentdomain CONTAINS "docs-shared.online" OR sourcentdomain CONTAINS "docs-view.online" OR sourcentdomain CONTAINS "document-forwarding.com" OR sourcentdomain CONTAINS "document-online.live" OR sourcentdomain CONTAINS "document-preview.com" OR sourcentdomain CONTAINS "documents-cloud.com" OR sourcentdomain CONTAINS "documents-cloud.online" OR sourcentdomain CONTAINS "documents-forwarding.com" OR sourcentdomain CONTAINS "document-share.live" OR sourcentdomain CONTAINS "documents-online.live" OR sourcentdomain CONTAINS "documents-pdf.online" OR sourcentdomain CONTAINS "documents-preview.com" OR sourcentdomain CONTAINS "documents-view.live" OR sourcentdomain CONTAINS "document-view.live" OR sourcentdomain CONTAINS "drive-docs.com" OR sourcentdomain CONTAINS "drive-share.live" OR sourcentdomain CONTAINS "goo-link.online" OR sourcentdomain CONTAINS "hypertextteches.com" OR sourcentdomain CONTAINS "mail-docs.online" OR sourcentdomain CONTAINS "officeonline365.live" OR sourcentdomain CONTAINS "online365-office.com" OR sourcentdomain CONTAINS "online-document.live" OR sourcentdomain CONTAINS "online-storage.live" OR sourcentdomain CONTAINS "pdf-cache.com" OR sourcentdomain CONTAINS "pdf-cache.online" OR sourcentdomain CONTAINS "pdf-docs.online" OR sourcentdomain CONTAINS "pdf-forwarding.online" OR sourcentdomain CONTAINS "protection-checklinks.xyz" OR sourcentdomain CONTAINS "protection-link.online" OR sourcentdomain CONTAINS "protectionmail.online" OR sourcentdomain CONTAINS "protection-office.live" OR sourcentdomain CONTAINS "protect-link.online" OR sourcentdomain CONTAINS "proton-docs.com" OR sourcentdomain CONTAINS "proton-reader.com" OR sourcentdomain CONTAINS "proton-viewer.com")
index=activity AND rg_functionality="Endpoint management systems" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "cache-dns.com" OR sourcehostname CONTAINS "sekoia.io" OR sourcehostname CONTAINS "cache-dns-forwarding.com" OR sourcehostname CONTAINS "cache-dns-preview.com" OR sourcehostname CONTAINS "cache-docs.com" OR sourcehostname CONTAINS "cache-pdf.com" OR sourcehostname CONTAINS "cache-pdf.online" OR sourcehostname CONTAINS "cache-services.live" OR sourcehostname CONTAINS "cloud-docs.com" OR sourcehostname CONTAINS "cloud-drive.live" OR sourcehostname CONTAINS "cloud-storage.live" OR sourcehostname CONTAINS "docs-cache.com" OR sourcehostname CONTAINS "docs-forwarding.online" OR sourcehostname CONTAINS "docs-info.com" OR sourcehostname CONTAINS "docs-shared.com" OR sourcehostname CONTAINS "docs-shared.online" OR sourcehostname CONTAINS "docs-view.online" OR sourcehostname CONTAINS "document-forwarding.com" OR sourcehostname CONTAINS "document-online.live" OR sourcehostname CONTAINS "document-preview.com" OR sourcehostname CONTAINS "documents-cloud.com" OR sourcehostname CONTAINS "documents-cloud.online" OR sourcehostname CONTAINS "documents-forwarding.com" OR sourcehostname CONTAINS "document-share.live" OR sourcehostname CONTAINS "documents-online.live" OR sourcehostname CONTAINS "documents-pdf.online" OR sourcehostname CONTAINS "documents-preview.com" OR sourcehostname CONTAINS "documents-view.live" OR sourcehostname CONTAINS "document-view.live" OR sourcehostname CONTAINS "drive-docs.com" OR sourcehostname CONTAINS "drive-share.live" OR sourcehostname CONTAINS "goo-link.online" OR sourcehostname CONTAINS "hypertextteches.com" OR sourcehostname CONTAINS "mail-docs.online" OR sourcehostname CONTAINS "officeonline365.live" OR sourcehostname CONTAINS "online365-office.com" OR sourcehostname CONTAINS "online-document.live" OR sourcehostname CONTAINS "online-storage.live" OR sourcehostname CONTAINS "pdf-cache.com" OR sourcehostname CONTAINS "pdf-cache.online" OR sourcehostname CONTAINS "pdf-docs.online" OR sourcehostname CONTAINS "pdf-forwarding.online" OR sourcehostname CONTAINS "protection-checklinks.xyz" OR sourcehostname CONTAINS "protection-link.online" OR sourcehostname CONTAINS "protectionmail.online" OR sourcehostname CONTAINS "protection-office.live" OR sourcehostname CONTAINS "protect-link.online" OR sourcehostname CONTAINS "proton-docs.com" OR sourcehostname CONTAINS "proton-reader.com" OR sourcehostname CONTAINS "proton-viewer.com")
index=activity AND rg_functionality="Endpoint management systems" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "cache-dns.com" OR destinationntdomain CONTAINS "sekoia.io" OR destinationntdomain CONTAINS "cache-dns-forwarding.com" OR destinationntdomain CONTAINS "cache-dns-preview.com" OR destinationntdomain CONTAINS "cache-docs.com" OR destinationntdomain CONTAINS "cache-pdf.com" OR destinationntdomain CONTAINS "cache-pdf.online" OR destinationntdomain CONTAINS "cache-services.live" OR destinationntdomain CONTAINS "cloud-docs.com" OR destinationntdomain CONTAINS "cloud-drive.live" OR destinationntdomain CONTAINS "cloud-storage.live" OR destinationntdomain CONTAINS "docs-cache.com" OR destinationntdomain CONTAINS "docs-forwarding.online" OR destinationntdomain CONTAINS "docs-info.com" OR destinationntdomain CONTAINS "docs-shared.com" OR destinationntdomain CONTAINS "docs-shared.online" OR destinationntdomain CONTAINS "docs-view.online" OR destinationntdomain CONTAINS "document-forwarding.com" OR destinationntdomain CONTAINS "document-online.live" OR destinationntdomain CONTAINS "document-preview.com" OR destinationntdomain CONTAINS "documents-cloud.com" OR destinationntdomain CONTAINS "documents-cloud.online" OR destinationntdomain CONTAINS "documents-forwarding.com" OR destinationntdomain CONTAINS "document-share.live" OR destinationntdomain CONTAINS "documents-online.live" OR destinationntdomain CONTAINS "documents-pdf.online" OR destinationntdomain CONTAINS "documents-preview.com" OR destinationntdomain CONTAINS "documents-view.live" OR destinationntdomain CONTAINS "document-view.live" OR destinationntdomain CONTAINS "drive-docs.com" OR destinationntdomain CONTAINS "drive-share.live" OR destinationntdomain CONTAINS "goo-link.online" OR destinationntdomain CONTAINS "hypertextteches.com" OR destinationntdomain CONTAINS "mail-docs.online" OR destinationntdomain CONTAINS "officeonline365.live" OR destinationntdomain CONTAINS "online365-office.com" OR destinationntdomain CONTAINS "online-document.live" OR destinationntdomain CONTAINS "online-storage.live" OR destinationntdomain CONTAINS "pdf-cache.com" OR destinationntdomain CONTAINS "pdf-cache.online" OR destinationntdomain CONTAINS "pdf-docs.online" OR destinationntdomain CONTAINS "pdf-forwarding.online" OR destinationntdomain CONTAINS "protection-checklinks.xyz" OR destinationntdomain CONTAINS "protection-link.online" OR destinationntdomain CONTAINS "protectionmail.online" OR destinationntdomain CONTAINS "protection-office.live" OR destinationntdomain CONTAINS "protect-link.online" OR destinationntdomain CONTAINS "proton-docs.com" OR destinationntdomain CONTAINS "proton-reader.com" OR destinationntdomain CONTAINS "proton-viewer.com")
index=activity AND rg_functionality="Endpoint management systems" AND requesturl NOT NULL AND (requesturl CONTAINS "cache-dns.com" OR requesturl CONTAINS "sekoia.io" OR requesturl CONTAINS "cache-dns-forwarding.com" OR requesturl CONTAINS "cache-dns-preview.com" OR requesturl CONTAINS "cache-docs.com" OR requesturl CONTAINS "cache-pdf.com" OR requesturl CONTAINS "cache-pdf.online" OR requesturl CONTAINS "cache-services.live" OR requesturl CONTAINS "cloud-docs.com" OR requesturl CONTAINS "cloud-drive.live" OR requesturl CONTAINS "cloud-storage.live" OR requesturl CONTAINS "docs-cache.com" OR requesturl CONTAINS "docs-forwarding.online" OR requesturl CONTAINS "docs-info.com" OR requesturl CONTAINS "docs-shared.com" OR requesturl CONTAINS "docs-shared.online" OR requesturl CONTAINS "docs-view.online" OR requesturl CONTAINS "document-forwarding.com" OR requesturl CONTAINS "document-online.live" OR requesturl CONTAINS "document-preview.com" OR requesturl CONTAINS "documents-cloud.com" OR requesturl CONTAINS "documents-cloud.online" OR requesturl CONTAINS "documents-forwarding.com" OR requesturl CONTAINS "document-share.live" OR requesturl CONTAINS "documents-online.live" OR requesturl CONTAINS "documents-pdf.online" OR requesturl CONTAINS "documents-preview.com" OR requesturl CONTAINS "documents-view.live" OR requesturl CONTAINS "document-view.live" OR requesturl CONTAINS "drive-docs.com" OR requesturl CONTAINS "drive-share.live" OR requesturl CONTAINS "goo-link.online" OR requesturl CONTAINS "hypertextteches.com" OR requesturl CONTAINS "mail-docs.online" OR requesturl CONTAINS "officeonline365.live" OR requesturl CONTAINS "online365-office.com" OR requesturl CONTAINS "online-document.live" OR requesturl CONTAINS "online-storage.live" OR requesturl CONTAINS "pdf-cache.com" OR requesturl CONTAINS "pdf-cache.online" OR requesturl CONTAINS "pdf-docs.online" OR requesturl CONTAINS "pdf-forwarding.online" OR requesturl CONTAINS "protection-checklinks.xyz" OR requesturl CONTAINS "protection-link.online" OR requesturl CONTAINS "protectionmail.online" OR requesturl CONTAINS "protection-office.live" OR requesturl CONTAINS "protect-link.online" OR requesturl CONTAINS "proton-docs.com" OR requesturl CONTAINS "proton-reader.com" OR requesturl CONTAINS "proton-viewer.com")
index=activity AND rg_functionality="Endpoint management systems" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "relogin-dashboard.online" OR destinationhostname CONTAINS "safe-connection.online" OR destinationhostname CONTAINS "safelinks-protect.live" OR destinationhostname CONTAINS "secureoffice.live" OR destinationhostname CONTAINS "webresources.live" OR destinationhostname CONTAINS "word-yand.live" OR destinationhostname CONTAINS "yandx-online.cloud" OR destinationhostname CONTAINS "y-ml.co" OR destinationhostname CONTAINS "docs-drive.online" OR destinationhostname CONTAINS "docs-info.online" OR destinationhostname CONTAINS "cloud-mail.online" OR destinationhostname CONTAINS "onlinecloud365.live" OR destinationhostname CONTAINS "pdf-cloud.online" OR destinationhostname CONTAINS "pdf-shared.online" OR destinationhostname CONTAINS "proton-pdf.online" OR destinationhostname CONTAINS "proton-view.online" OR destinationhostname CONTAINS "office365-online.live" OR destinationhostname CONTAINS "doc-viewer.com" OR destinationhostname CONTAINS "file-milgov.systems" OR destinationhostname CONTAINS "office-protection.online")
index=activity AND rg_functionality="Endpoint management systems" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "relogin-dashboard.online" OR sourcentdomain CONTAINS "safe-connection.online" OR sourcentdomain CONTAINS "safelinks-protect.live" OR sourcentdomain CONTAINS "secureoffice.live" OR sourcentdomain CONTAINS "webresources.live" OR sourcentdomain CONTAINS "word-yand.live" OR sourcentdomain CONTAINS "yandx-online.cloud" OR sourcentdomain CONTAINS "y-ml.co" OR sourcentdomain CONTAINS "docs-drive.online" OR sourcentdomain CONTAINS "docs-info.online" OR sourcentdomain CONTAINS "cloud-mail.online" OR sourcentdomain CONTAINS "onlinecloud365.live" OR sourcentdomain CONTAINS "pdf-cloud.online" OR sourcentdomain CONTAINS "pdf-shared.online" OR sourcentdomain CONTAINS "proton-pdf.online" OR sourcentdomain CONTAINS "proton-view.online" OR sourcentdomain CONTAINS "office365-online.live" OR sourcentdomain CONTAINS "doc-viewer.com" OR sourcentdomain CONTAINS "file-milgov.systems" OR sourcentdomain CONTAINS "office-protection.online")
index=activity AND rg_functionality="Endpoint management systems" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "relogin-dashboard.online" OR sourcehostname CONTAINS "safe-connection.online" OR sourcehostname CONTAINS "safelinks-protect.live" OR sourcehostname CONTAINS "secureoffice.live" OR sourcehostname CONTAINS "webresources.live" OR sourcehostname CONTAINS "word-yand.live" OR sourcehostname CONTAINS "yandx-online.cloud" OR sourcehostname CONTAINS "y-ml.co" OR sourcehostname CONTAINS "docs-drive.online" OR sourcehostname CONTAINS "docs-info.online" OR sourcehostname CONTAINS "cloud-mail.online" OR sourcehostname CONTAINS "onlinecloud365.live" OR sourcehostname CONTAINS "pdf-cloud.online" OR sourcehostname CONTAINS "pdf-shared.online" OR sourcehostname CONTAINS "proton-pdf.online" OR sourcehostname CONTAINS "proton-view.online" OR sourcehostname CONTAINS "office365-online.live" OR sourcehostname CONTAINS "doc-viewer.com" OR sourcehostname CONTAINS "file-milgov.systems" OR sourcehostname CONTAINS "office-protection.online")
index=activity AND rg_functionality="Endpoint management systems" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "relogin-dashboard.online" OR destinationntdomain CONTAINS "safe-connection.online" OR destinationntdomain CONTAINS "safelinks-protect.live" OR destinationntdomain CONTAINS "secureoffice.live" OR destinationntdomain CONTAINS "webresources.live" OR destinationntdomain CONTAINS "word-yand.live" OR destinationntdomain CONTAINS "yandx-online.cloud" OR destinationntdomain CONTAINS "y-ml.co" OR destinationntdomain CONTAINS "docs-drive.online" OR destinationntdomain CONTAINS "docs-info.online" OR destinationntdomain CONTAINS "cloud-mail.online" OR destinationntdomain CONTAINS "onlinecloud365.live" OR destinationntdomain CONTAINS "pdf-cloud.online" OR destinationntdomain CONTAINS "pdf-shared.online" OR destinationntdomain CONTAINS "proton-pdf.online" OR destinationntdomain CONTAINS "proton-view.online" OR destinationntdomain CONTAINS "office365-online.live" OR destinationntdomain CONTAINS "doc-viewer.com" OR destinationntdomain CONTAINS "file-milgov.systems" OR destinationntdomain CONTAINS "office-protection.online")
index=activity AND rg_functionality="Endpoint management systems" AND requesturl NOT NULL AND (requesturl CONTAINS "relogin-dashboard.online" OR requesturl CONTAINS "safe-connection.online" OR requesturl CONTAINS "safelinks-protect.live" OR requesturl CONTAINS "secureoffice.live" OR requesturl CONTAINS "webresources.live" OR requesturl CONTAINS "word-yand.live" OR requesturl CONTAINS "yandx-online.cloud" OR requesturl CONTAINS "y-ml.co" OR requesturl CONTAINS "docs-drive.online" OR requesturl CONTAINS "docs-info.online" OR requesturl CONTAINS "cloud-mail.online" OR requesturl CONTAINS "onlinecloud365.live" OR requesturl CONTAINS "pdf-cloud.online" OR requesturl CONTAINS "pdf-shared.online" OR requesturl CONTAINS "proton-pdf.online" OR requesturl CONTAINS "proton-view.online" OR requesturl CONTAINS "office365-online.live" OR requesturl CONTAINS "doc-viewer.com" OR requesturl CONTAINS "file-milgov.systems" OR requesturl CONTAINS "office-protection.online")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "cache-dns.com" OR destinationhostname CONTAINS "sekoia.io" OR destinationhostname CONTAINS "cache-dns-forwarding.com" OR destinationhostname CONTAINS "cache-dns-preview.com" OR destinationhostname CONTAINS "cache-docs.com" OR destinationhostname CONTAINS "cache-pdf.com" OR destinationhostname CONTAINS "cache-pdf.online" OR destinationhostname CONTAINS "cache-services.live" OR destinationhostname CONTAINS "cloud-docs.com" OR destinationhostname CONTAINS "cloud-drive.live" OR destinationhostname CONTAINS "cloud-storage.live" OR destinationhostname CONTAINS "docs-cache.com" OR destinationhostname CONTAINS "docs-forwarding.online" OR destinationhostname CONTAINS "docs-info.com" OR destinationhostname CONTAINS "docs-shared.com" OR destinationhostname CONTAINS "docs-shared.online" OR destinationhostname CONTAINS "docs-view.online" OR destinationhostname CONTAINS "document-forwarding.com" OR destinationhostname CONTAINS "document-online.live" OR destinationhostname CONTAINS "document-preview.com" OR destinationhostname CONTAINS "documents-cloud.com" OR destinationhostname CONTAINS "documents-cloud.online" OR destinationhostname CONTAINS "documents-forwarding.com" OR destinationhostname CONTAINS "document-share.live" OR destinationhostname CONTAINS "documents-online.live" OR destinationhostname CONTAINS "documents-pdf.online" OR destinationhostname CONTAINS "documents-preview.com" OR destinationhostname CONTAINS "documents-view.live" OR destinationhostname CONTAINS "document-view.live" OR destinationhostname CONTAINS "drive-docs.com" OR destinationhostname CONTAINS "drive-share.live" OR destinationhostname CONTAINS "goo-link.online" OR destinationhostname CONTAINS "hypertextteches.com" OR destinationhostname CONTAINS "mail-docs.online" OR destinationhostname CONTAINS "officeonline365.live" OR destinationhostname CONTAINS "online365-office.com" OR destinationhostname CONTAINS "online-document.live" OR destinationhostname CONTAINS "online-storage.live" OR destinationhostname CONTAINS "pdf-cache.com" OR destinationhostname CONTAINS "pdf-cache.online" OR destinationhostname CONTAINS "pdf-docs.online" OR destinationhostname CONTAINS "pdf-forwarding.online" OR destinationhostname CONTAINS "protection-checklinks.xyz" OR destinationhostname CONTAINS "protection-link.online" OR destinationhostname CONTAINS "protectionmail.online" OR destinationhostname CONTAINS "protection-office.live" OR destinationhostname CONTAINS "protect-link.online" OR destinationhostname CONTAINS "proton-docs.com" OR destinationhostname CONTAINS "proton-reader.com" OR destinationhostname CONTAINS "proton-viewer.com")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "cache-dns.com" OR sourcentdomain CONTAINS "sekoia.io" OR sourcentdomain CONTAINS "cache-dns-forwarding.com" OR sourcentdomain CONTAINS "cache-dns-preview.com" OR sourcentdomain CONTAINS "cache-docs.com" OR sourcentdomain CONTAINS "cache-pdf.com" OR sourcentdomain CONTAINS "cache-pdf.online" OR sourcentdomain CONTAINS "cache-services.live" OR sourcentdomain CONTAINS "cloud-docs.com" OR sourcentdomain CONTAINS "cloud-drive.live" OR sourcentdomain CONTAINS "cloud-storage.live" OR sourcentdomain CONTAINS "docs-cache.com" OR sourcentdomain CONTAINS "docs-forwarding.online" OR sourcentdomain CONTAINS "docs-info.com" OR sourcentdomain CONTAINS "docs-shared.com" OR sourcentdomain CONTAINS "docs-shared.online" OR sourcentdomain CONTAINS "docs-view.online" OR sourcentdomain CONTAINS "document-forwarding.com" OR sourcentdomain CONTAINS "document-online.live" OR sourcentdomain CONTAINS "document-preview.com" OR sourcentdomain CONTAINS "documents-cloud.com" OR sourcentdomain CONTAINS "documents-cloud.online" OR sourcentdomain CONTAINS "documents-forwarding.com" OR sourcentdomain CONTAINS "document-share.live" OR sourcentdomain CONTAINS "documents-online.live" OR sourcentdomain CONTAINS "documents-pdf.online" OR sourcentdomain CONTAINS "documents-preview.com" OR sourcentdomain CONTAINS "documents-view.live" OR sourcentdomain CONTAINS "document-view.live" OR sourcentdomain CONTAINS "drive-docs.com" OR sourcentdomain CONTAINS "drive-share.live" OR sourcentdomain CONTAINS "goo-link.online" OR sourcentdomain CONTAINS "hypertextteches.com" OR sourcentdomain CONTAINS "mail-docs.online" OR sourcentdomain CONTAINS "officeonline365.live" OR sourcentdomain CONTAINS "online365-office.com" OR sourcentdomain CONTAINS "online-document.live" OR sourcentdomain CONTAINS "online-storage.live" OR sourcentdomain CONTAINS "pdf-cache.com" OR sourcentdomain CONTAINS "pdf-cache.online" OR sourcentdomain CONTAINS "pdf-docs.online" OR sourcentdomain CONTAINS "pdf-forwarding.online" OR sourcentdomain CONTAINS "protection-checklinks.xyz" OR sourcentdomain CONTAINS "protection-link.online" OR sourcentdomain CONTAINS "protectionmail.online" OR sourcentdomain CONTAINS "protection-office.live" OR sourcentdomain CONTAINS "protect-link.online" OR sourcentdomain CONTAINS "proton-docs.com" OR sourcentdomain CONTAINS "proton-reader.com" OR sourcentdomain CONTAINS "proton-viewer.com")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "cache-dns.com" OR sourcehostname CONTAINS "sekoia.io" OR sourcehostname CONTAINS "cache-dns-forwarding.com" OR sourcehostname CONTAINS "cache-dns-preview.com" OR sourcehostname CONTAINS "cache-docs.com" OR sourcehostname CONTAINS "cache-pdf.com" OR sourcehostname CONTAINS "cache-pdf.online" OR sourcehostname CONTAINS "cache-services.live" OR sourcehostname CONTAINS "cloud-docs.com" OR sourcehostname CONTAINS "cloud-drive.live" OR sourcehostname CONTAINS "cloud-storage.live" OR sourcehostname CONTAINS "docs-cache.com" OR sourcehostname CONTAINS "docs-forwarding.online" OR sourcehostname CONTAINS "docs-info.com" OR sourcehostname CONTAINS "docs-shared.com" OR sourcehostname CONTAINS "docs-shared.online" OR sourcehostname CONTAINS "docs-view.online" OR sourcehostname CONTAINS "document-forwarding.com" OR sourcehostname CONTAINS "document-online.live" OR sourcehostname CONTAINS "document-preview.com" OR sourcehostname CONTAINS "documents-cloud.com" OR sourcehostname CONTAINS "documents-cloud.online" OR sourcehostname CONTAINS "documents-forwarding.com" OR sourcehostname CONTAINS "document-share.live" OR sourcehostname CONTAINS "documents-online.live" OR sourcehostname CONTAINS "documents-pdf.online" OR sourcehostname CONTAINS "documents-preview.com" OR sourcehostname CONTAINS "documents-view.live" OR sourcehostname CONTAINS "document-view.live" OR sourcehostname CONTAINS "drive-docs.com" OR sourcehostname CONTAINS "drive-share.live" OR sourcehostname CONTAINS "goo-link.online" OR sourcehostname CONTAINS "hypertextteches.com" OR sourcehostname CONTAINS "mail-docs.online" OR sourcehostname CONTAINS "officeonline365.live" OR sourcehostname CONTAINS "online365-office.com" OR sourcehostname CONTAINS "online-document.live" OR sourcehostname CONTAINS "online-storage.live" OR sourcehostname CONTAINS "pdf-cache.com" OR sourcehostname CONTAINS "pdf-cache.online" OR sourcehostname CONTAINS "pdf-docs.online" OR sourcehostname CONTAINS "pdf-forwarding.online" OR sourcehostname CONTAINS "protection-checklinks.xyz" OR sourcehostname CONTAINS "protection-link.online" OR sourcehostname CONTAINS "protectionmail.online" OR sourcehostname CONTAINS "protection-office.live" OR sourcehostname CONTAINS "protect-link.online" OR sourcehostname CONTAINS "proton-docs.com" OR sourcehostname CONTAINS "proton-reader.com" OR sourcehostname CONTAINS "proton-viewer.com")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "cache-dns.com" OR destinationntdomain CONTAINS "sekoia.io" OR destinationntdomain CONTAINS "cache-dns-forwarding.com" OR destinationntdomain CONTAINS "cache-dns-preview.com" OR destinationntdomain CONTAINS "cache-docs.com" OR destinationntdomain CONTAINS "cache-pdf.com" OR destinationntdomain CONTAINS "cache-pdf.online" OR destinationntdomain CONTAINS "cache-services.live" OR destinationntdomain CONTAINS "cloud-docs.com" OR destinationntdomain CONTAINS "cloud-drive.live" OR destinationntdomain CONTAINS "cloud-storage.live" OR destinationntdomain CONTAINS "docs-cache.com" OR destinationntdomain CONTAINS "docs-forwarding.online" OR destinationntdomain CONTAINS "docs-info.com" OR destinationntdomain CONTAINS "docs-shared.com" OR destinationntdomain CONTAINS "docs-shared.online" OR destinationntdomain CONTAINS "docs-view.online" OR destinationntdomain CONTAINS "document-forwarding.com" OR destinationntdomain CONTAINS "document-online.live" OR destinationntdomain CONTAINS "document-preview.com" OR destinationntdomain CONTAINS "documents-cloud.com" OR destinationntdomain CONTAINS "documents-cloud.online" OR destinationntdomain CONTAINS "documents-forwarding.com" OR destinationntdomain CONTAINS "document-share.live" OR destinationntdomain CONTAINS "documents-online.live" OR destinationntdomain CONTAINS "documents-pdf.online" OR destinationntdomain CONTAINS "documents-preview.com" OR destinationntdomain CONTAINS "documents-view.live" OR destinationntdomain CONTAINS "document-view.live" OR destinationntdomain CONTAINS "drive-docs.com" OR destinationntdomain CONTAINS "drive-share.live" OR destinationntdomain CONTAINS "goo-link.online" OR destinationntdomain CONTAINS "hypertextteches.com" OR destinationntdomain CONTAINS "mail-docs.online" OR destinationntdomain CONTAINS "officeonline365.live" OR destinationntdomain CONTAINS "online365-office.com" OR destinationntdomain CONTAINS "online-document.live" OR destinationntdomain CONTAINS "online-storage.live" OR destinationntdomain CONTAINS "pdf-cache.com" OR destinationntdomain CONTAINS "pdf-cache.online" OR destinationntdomain CONTAINS "pdf-docs.online" OR destinationntdomain CONTAINS "pdf-forwarding.online" OR destinationntdomain CONTAINS "protection-checklinks.xyz" OR destinationntdomain CONTAINS "protection-link.online" OR destinationntdomain CONTAINS "protectionmail.online" OR destinationntdomain CONTAINS "protection-office.live" OR destinationntdomain CONTAINS "protect-link.online" OR destinationntdomain CONTAINS "proton-docs.com" OR destinationntdomain CONTAINS "proton-reader.com" OR destinationntdomain CONTAINS "proton-viewer.com")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND requesturl NOT NULL AND (requesturl CONTAINS "cache-dns.com" OR requesturl CONTAINS "sekoia.io" OR requesturl CONTAINS "cache-dns-forwarding.com" OR requesturl CONTAINS "cache-dns-preview.com" OR requesturl CONTAINS "cache-docs.com" OR requesturl CONTAINS "cache-pdf.com" OR requesturl CONTAINS "cache-pdf.online" OR requesturl CONTAINS "cache-services.live" OR requesturl CONTAINS "cloud-docs.com" OR requesturl CONTAINS "cloud-drive.live" OR requesturl CONTAINS "cloud-storage.live" OR requesturl CONTAINS "docs-cache.com" OR requesturl CONTAINS "docs-forwarding.online" OR requesturl CONTAINS "docs-info.com" OR requesturl CONTAINS "docs-shared.com" OR requesturl CONTAINS "docs-shared.online" OR requesturl CONTAINS "docs-view.online" OR requesturl CONTAINS "document-forwarding.com" OR requesturl CONTAINS "document-online.live" OR requesturl CONTAINS "document-preview.com" OR requesturl CONTAINS "documents-cloud.com" OR requesturl CONTAINS "documents-cloud.online" OR requesturl CONTAINS "documents-forwarding.com" OR requesturl CONTAINS "document-share.live" OR requesturl CONTAINS "documents-online.live" OR requesturl CONTAINS "documents-pdf.online" OR requesturl CONTAINS "documents-preview.com" OR requesturl CONTAINS "documents-view.live" OR requesturl CONTAINS "document-view.live" OR requesturl CONTAINS "drive-docs.com" OR requesturl CONTAINS "drive-share.live" OR requesturl CONTAINS "goo-link.online" OR requesturl CONTAINS "hypertextteches.com" OR requesturl CONTAINS "mail-docs.online" OR requesturl CONTAINS "officeonline365.live" OR requesturl CONTAINS "online365-office.com" OR requesturl CONTAINS "online-document.live" OR requesturl CONTAINS "online-storage.live" OR requesturl CONTAINS "pdf-cache.com" OR requesturl CONTAINS "pdf-cache.online" OR requesturl CONTAINS "pdf-docs.online" OR requesturl CONTAINS "pdf-forwarding.online" OR requesturl CONTAINS "protection-checklinks.xyz" OR requesturl CONTAINS "protection-link.online" OR requesturl CONTAINS "protectionmail.online" OR requesturl CONTAINS "protection-office.live" OR requesturl CONTAINS "protect-link.online" OR requesturl CONTAINS "proton-docs.com" OR requesturl CONTAINS "proton-reader.com" OR requesturl CONTAINS "proton-viewer.com")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "relogin-dashboard.online" OR destinationhostname CONTAINS "safe-connection.online" OR destinationhostname CONTAINS "safelinks-protect.live" OR destinationhostname CONTAINS "secureoffice.live" OR destinationhostname CONTAINS "webresources.live" OR destinationhostname CONTAINS "word-yand.live" OR destinationhostname CONTAINS "yandx-online.cloud" OR destinationhostname CONTAINS "y-ml.co" OR destinationhostname CONTAINS "docs-drive.online" OR destinationhostname CONTAINS "docs-info.online" OR destinationhostname CONTAINS "cloud-mail.online" OR destinationhostname CONTAINS "onlinecloud365.live" OR destinationhostname CONTAINS "pdf-cloud.online" OR destinationhostname CONTAINS "pdf-shared.online" OR destinationhostname CONTAINS "proton-pdf.online" OR destinationhostname CONTAINS "proton-view.online" OR destinationhostname CONTAINS "office365-online.live" OR destinationhostname CONTAINS "doc-viewer.com" OR destinationhostname CONTAINS "file-milgov.systems" OR destinationhostname CONTAINS "office-protection.online")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "relogin-dashboard.online" OR sourcentdomain CONTAINS "safe-connection.online" OR sourcentdomain CONTAINS "safelinks-protect.live" OR sourcentdomain CONTAINS "secureoffice.live" OR sourcentdomain CONTAINS "webresources.live" OR sourcentdomain CONTAINS "word-yand.live" OR sourcentdomain CONTAINS "yandx-online.cloud" OR sourcentdomain CONTAINS "y-ml.co" OR sourcentdomain CONTAINS "docs-drive.online" OR sourcentdomain CONTAINS "docs-info.online" OR sourcentdomain CONTAINS "cloud-mail.online" OR sourcentdomain CONTAINS "onlinecloud365.live" OR sourcentdomain CONTAINS "pdf-cloud.online" OR sourcentdomain CONTAINS "pdf-shared.online" OR sourcentdomain CONTAINS "proton-pdf.online" OR sourcentdomain CONTAINS "proton-view.online" OR sourcentdomain CONTAINS "office365-online.live" OR sourcentdomain CONTAINS "doc-viewer.com" OR sourcentdomain CONTAINS "file-milgov.systems" OR sourcentdomain CONTAINS "office-protection.online")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "relogin-dashboard.online" OR sourcehostname CONTAINS "safe-connection.online" OR sourcehostname CONTAINS "safelinks-protect.live" OR sourcehostname CONTAINS "secureoffice.live" OR sourcehostname CONTAINS "webresources.live" OR sourcehostname CONTAINS "word-yand.live" OR sourcehostname CONTAINS "yandx-online.cloud" OR sourcehostname CONTAINS "y-ml.co" OR sourcehostname CONTAINS "docs-drive.online" OR sourcehostname CONTAINS "docs-info.online" OR sourcehostname CONTAINS "cloud-mail.online" OR sourcehostname CONTAINS "onlinecloud365.live" OR sourcehostname CONTAINS "pdf-cloud.online" OR sourcehostname CONTAINS "pdf-shared.online" OR sourcehostname CONTAINS "proton-pdf.online" OR sourcehostname CONTAINS "proton-view.online" OR sourcehostname CONTAINS "office365-online.live" OR sourcehostname CONTAINS "doc-viewer.com" OR sourcehostname CONTAINS "file-milgov.systems" OR sourcehostname CONTAINS "office-protection.online")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "relogin-dashboard.online" OR destinationntdomain CONTAINS "safe-connection.online" OR destinationntdomain CONTAINS "safelinks-protect.live" OR destinationntdomain CONTAINS "secureoffice.live" OR destinationntdomain CONTAINS "webresources.live" OR destinationntdomain CONTAINS "word-yand.live" OR destinationntdomain CONTAINS "yandx-online.cloud" OR destinationntdomain CONTAINS "y-ml.co" OR destinationntdomain CONTAINS "docs-drive.online" OR destinationntdomain CONTAINS "docs-info.online" OR destinationntdomain CONTAINS "cloud-mail.online" OR destinationntdomain CONTAINS "onlinecloud365.live" OR destinationntdomain CONTAINS "pdf-cloud.online" OR destinationntdomain CONTAINS "pdf-shared.online" OR destinationntdomain CONTAINS "proton-pdf.online" OR destinationntdomain CONTAINS "proton-view.online" OR destinationntdomain CONTAINS "office365-online.live" OR destinationntdomain CONTAINS "doc-viewer.com" OR destinationntdomain CONTAINS "file-milgov.systems" OR destinationntdomain CONTAINS "office-protection.online")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND requesturl NOT NULL AND (requesturl CONTAINS "relogin-dashboard.online" OR requesturl CONTAINS "safe-connection.online" OR requesturl CONTAINS "safelinks-protect.live" OR requesturl CONTAINS "secureoffice.live" OR requesturl CONTAINS "webresources.live" OR requesturl CONTAINS "word-yand.live" OR requesturl CONTAINS "yandx-online.cloud" OR requesturl CONTAINS "y-ml.co" OR requesturl CONTAINS "docs-drive.online" OR requesturl CONTAINS "docs-info.online" OR requesturl CONTAINS "cloud-mail.online" OR requesturl CONTAINS "onlinecloud365.live" OR requesturl CONTAINS "pdf-cloud.online" OR requesturl CONTAINS "pdf-shared.online" OR requesturl CONTAINS "proton-pdf.online" OR requesturl CONTAINS "proton-view.online" OR requesturl CONTAINS "office365-online.live" OR requesturl CONTAINS "doc-viewer.com" OR requesturl CONTAINS "file-milgov.systems" OR requesturl CONTAINS "office-protection.online")
index=activity AND rg_functionality="Cloud Application Audit" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "cache-dns.com" OR destinationhostname CONTAINS "sekoia.io" OR destinationhostname CONTAINS "cache-dns-forwarding.com" OR destinationhostname CONTAINS "cache-dns-preview.com" OR destinationhostname CONTAINS "cache-docs.com" OR destinationhostname CONTAINS "cache-pdf.com" OR destinationhostname CONTAINS "cache-pdf.online" OR destinationhostname CONTAINS "cache-services.live" OR destinationhostname CONTAINS "cloud-docs.com" OR destinationhostname CONTAINS "cloud-drive.live" OR destinationhostname CONTAINS "cloud-storage.live" OR destinationhostname CONTAINS "docs-cache.com" OR destinationhostname CONTAINS "docs-forwarding.online" OR destinationhostname CONTAINS "docs-info.com" OR destinationhostname CONTAINS "docs-shared.com" OR destinationhostname CONTAINS "docs-shared.online" OR destinationhostname CONTAINS "docs-view.online" OR destinationhostname CONTAINS "document-forwarding.com" OR destinationhostname CONTAINS "document-online.live" OR destinationhostname CONTAINS "document-preview.com" OR destinationhostname CONTAINS "documents-cloud.com" OR destinationhostname CONTAINS "documents-cloud.online" OR destinationhostname CONTAINS "documents-forwarding.com" OR destinationhostname CONTAINS "document-share.live" OR destinationhostname CONTAINS "documents-online.live" OR destinationhostname CONTAINS "documents-pdf.online" OR destinationhostname CONTAINS "documents-preview.com" OR destinationhostname CONTAINS "documents-view.live" OR destinationhostname CONTAINS "document-view.live" OR destinationhostname CONTAINS "drive-docs.com" OR destinationhostname CONTAINS "drive-share.live" OR destinationhostname CONTAINS "goo-link.online" OR destinationhostname CONTAINS "hypertextteches.com" OR destinationhostname CONTAINS "mail-docs.online" OR destinationhostname CONTAINS "officeonline365.live" OR destinationhostname CONTAINS "online365-office.com" OR destinationhostname CONTAINS "online-document.live" OR destinationhostname CONTAINS "online-storage.live" OR destinationhostname CONTAINS "pdf-cache.com" OR destinationhostname CONTAINS "pdf-cache.online" OR destinationhostname CONTAINS "pdf-docs.online" OR destinationhostname CONTAINS "pdf-forwarding.online" OR destinationhostname CONTAINS "protection-checklinks.xyz" OR destinationhostname CONTAINS "protection-link.online" OR destinationhostname CONTAINS "protectionmail.online" OR destinationhostname CONTAINS "protection-office.live" OR destinationhostname CONTAINS "protect-link.online" OR destinationhostname CONTAINS "proton-docs.com" OR destinationhostname CONTAINS "proton-reader.com" OR destinationhostname CONTAINS "proton-viewer.com")
index=activity AND rg_functionality="Cloud Application Audit" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "cache-dns.com" OR sourcentdomain CONTAINS "sekoia.io" OR sourcentdomain CONTAINS "cache-dns-forwarding.com" OR sourcentdomain CONTAINS "cache-dns-preview.com" OR sourcentdomain CONTAINS "cache-docs.com" OR sourcentdomain CONTAINS "cache-pdf.com" OR sourcentdomain CONTAINS "cache-pdf.online" OR sourcentdomain CONTAINS "cache-services.live" OR sourcentdomain CONTAINS "cloud-docs.com" OR sourcentdomain CONTAINS "cloud-drive.live" OR sourcentdomain CONTAINS "cloud-storage.live" OR sourcentdomain CONTAINS "docs-cache.com" OR sourcentdomain CONTAINS "docs-forwarding.online" OR sourcentdomain CONTAINS "docs-info.com" OR sourcentdomain CONTAINS "docs-shared.com" OR sourcentdomain CONTAINS "docs-shared.online" OR sourcentdomain CONTAINS "docs-view.online" OR sourcentdomain CONTAINS "document-forwarding.com" OR sourcentdomain CONTAINS "document-online.live" OR sourcentdomain CONTAINS "document-preview.com" OR sourcentdomain CONTAINS "documents-cloud.com" OR sourcentdomain CONTAINS "documents-cloud.online" OR sourcentdomain CONTAINS "documents-forwarding.com" OR sourcentdomain CONTAINS "document-share.live" OR sourcentdomain CONTAINS "documents-online.live" OR sourcentdomain CONTAINS "documents-pdf.online" OR sourcentdomain CONTAINS "documents-preview.com" OR sourcentdomain CONTAINS "documents-view.live" OR sourcentdomain CONTAINS "document-view.live" OR sourcentdomain CONTAINS "drive-docs.com" OR sourcentdomain CONTAINS "drive-share.live" OR sourcentdomain CONTAINS "goo-link.online" OR sourcentdomain CONTAINS "hypertextteches.com" OR sourcentdomain CONTAINS "mail-docs.online" OR sourcentdomain CONTAINS "officeonline365.live" OR sourcentdomain CONTAINS "online365-office.com" OR sourcentdomain CONTAINS "online-document.live" OR sourcentdomain CONTAINS "online-storage.live" OR sourcentdomain CONTAINS "pdf-cache.com" OR sourcentdomain CONTAINS "pdf-cache.online" OR sourcentdomain CONTAINS "pdf-docs.online" OR sourcentdomain CONTAINS "pdf-forwarding.online" OR sourcentdomain CONTAINS "protection-checklinks.xyz" OR sourcentdomain CONTAINS "protection-link.online" OR sourcentdomain CONTAINS "protectionmail.online" OR sourcentdomain CONTAINS "protection-office.live" OR sourcentdomain CONTAINS "protect-link.online" OR sourcentdomain CONTAINS "proton-docs.com" OR sourcentdomain CONTAINS "proton-reader.com" OR sourcentdomain CONTAINS "proton-viewer.com")
index=activity AND rg_functionality="Cloud Application Audit" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "cache-dns.com" OR sourcehostname CONTAINS "sekoia.io" OR sourcehostname CONTAINS "cache-dns-forwarding.com" OR sourcehostname CONTAINS "cache-dns-preview.com" OR sourcehostname CONTAINS "cache-docs.com" OR sourcehostname CONTAINS "cache-pdf.com" OR sourcehostname CONTAINS "cache-pdf.online" OR sourcehostname CONTAINS "cache-services.live" OR sourcehostname CONTAINS "cloud-docs.com" OR sourcehostname CONTAINS "cloud-drive.live" OR sourcehostname CONTAINS "cloud-storage.live" OR sourcehostname CONTAINS "docs-cache.com" OR sourcehostname CONTAINS "docs-forwarding.online" OR sourcehostname CONTAINS "docs-info.com" OR sourcehostname CONTAINS "docs-shared.com" OR sourcehostname CONTAINS "docs-shared.online" OR sourcehostname CONTAINS "docs-view.online" OR sourcehostname CONTAINS "document-forwarding.com" OR sourcehostname CONTAINS "document-online.live" OR sourcehostname CONTAINS "document-preview.com" OR sourcehostname CONTAINS "documents-cloud.com" OR sourcehostname CONTAINS "documents-cloud.online" OR sourcehostname CONTAINS "documents-forwarding.com" OR sourcehostname CONTAINS "document-share.live" OR sourcehostname CONTAINS "documents-online.live" OR sourcehostname CONTAINS "documents-pdf.online" OR sourcehostname CONTAINS "documents-preview.com" OR sourcehostname CONTAINS "documents-view.live" OR sourcehostname CONTAINS "document-view.live" OR sourcehostname CONTAINS "drive-docs.com" OR sourcehostname CONTAINS "drive-share.live" OR sourcehostname CONTAINS "goo-link.online" OR sourcehostname CONTAINS "hypertextteches.com" OR sourcehostname CONTAINS "mail-docs.online" OR sourcehostname CONTAINS "officeonline365.live" OR sourcehostname CONTAINS "online365-office.com" OR sourcehostname CONTAINS "online-document.live" OR sourcehostname CONTAINS "online-storage.live" OR sourcehostname CONTAINS "pdf-cache.com" OR sourcehostname CONTAINS "pdf-cache.online" OR sourcehostname CONTAINS "pdf-docs.online" OR sourcehostname CONTAINS "pdf-forwarding.online" OR sourcehostname CONTAINS "protection-checklinks.xyz" OR sourcehostname CONTAINS "protection-link.online" OR sourcehostname CONTAINS "protectionmail.online" OR sourcehostname CONTAINS "protection-office.live" OR sourcehostname CONTAINS "protect-link.online" OR sourcehostname CONTAINS "proton-docs.com" OR sourcehostname CONTAINS "proton-reader.com" OR sourcehostname CONTAINS "proton-viewer.com")
index=activity AND rg_functionality="Cloud Application Audit" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "cache-dns.com" OR destinationntdomain CONTAINS "sekoia.io" OR destinationntdomain CONTAINS "cache-dns-forwarding.com" OR destinationntdomain CONTAINS "cache-dns-preview.com" OR destinationntdomain CONTAINS "cache-docs.com" OR destinationntdomain CONTAINS "cache-pdf.com" OR destinationntdomain CONTAINS "cache-pdf.online" OR destinationntdomain CONTAINS "cache-services.live" OR destinationntdomain CONTAINS "cloud-docs.com" OR destinationntdomain CONTAINS "cloud-drive.live" OR destinationntdomain CONTAINS "cloud-storage.live" OR destinationntdomain CONTAINS "docs-cache.com" OR destinationntdomain CONTAINS "docs-forwarding.online" OR destinationntdomain CONTAINS "docs-info.com" OR destinationntdomain CONTAINS "docs-shared.com" OR destinationntdomain CONTAINS "docs-shared.online" OR destinationntdomain CONTAINS "docs-view.online" OR destinationntdomain CONTAINS "document-forwarding.com" OR destinationntdomain CONTAINS "document-online.live" OR destinationntdomain CONTAINS "document-preview.com" OR destinationntdomain CONTAINS "documents-cloud.com" OR destinationntdomain CONTAINS "documents-cloud.online" OR destinationntdomain CONTAINS "documents-forwarding.com" OR destinationntdomain CONTAINS "document-share.live" OR destinationntdomain CONTAINS "documents-online.live" OR destinationntdomain CONTAINS "documents-pdf.online" OR destinationntdomain CONTAINS "documents-preview.com" OR destinationntdomain CONTAINS "documents-view.live" OR destinationntdomain CONTAINS "document-view.live" OR destinationntdomain CONTAINS "drive-docs.com" OR destinationntdomain CONTAINS "drive-share.live" OR destinationntdomain CONTAINS "goo-link.online" OR destinationntdomain CONTAINS "hypertextteches.com" OR destinationntdomain CONTAINS "mail-docs.online" OR destinationntdomain CONTAINS "officeonline365.live" OR destinationntdomain CONTAINS "online365-office.com" OR destinationntdomain CONTAINS "online-document.live" OR destinationntdomain CONTAINS "online-storage.live" OR destinationntdomain CONTAINS "pdf-cache.com" OR destinationntdomain CONTAINS "pdf-cache.online" OR destinationntdomain CONTAINS "pdf-docs.online" OR destinationntdomain CONTAINS "pdf-forwarding.online" OR destinationntdomain CONTAINS "protection-checklinks.xyz" OR destinationntdomain CONTAINS "protection-link.online" OR destinationntdomain CONTAINS "protectionmail.online" OR destinationntdomain CONTAINS "protection-office.live" OR destinationntdomain CONTAINS "protect-link.online" OR destinationntdomain CONTAINS "proton-docs.com" OR destinationntdomain CONTAINS "proton-reader.com" OR destinationntdomain CONTAINS "proton-viewer.com")
index=activity AND rg_functionality="Cloud Application Audit" AND requesturl NOT NULL AND (requesturl CONTAINS "cache-dns.com" OR requesturl CONTAINS "sekoia.io" OR requesturl CONTAINS "cache-dns-forwarding.com" OR requesturl CONTAINS "cache-dns-preview.com" OR requesturl CONTAINS "cache-docs.com" OR requesturl CONTAINS "cache-pdf.com" OR requesturl CONTAINS "cache-pdf.online" OR requesturl CONTAINS "cache-services.live" OR requesturl CONTAINS "cloud-docs.com" OR requesturl CONTAINS "cloud-drive.live" OR requesturl CONTAINS "cloud-storage.live" OR requesturl CONTAINS "docs-cache.com" OR requesturl CONTAINS "docs-forwarding.online" OR requesturl CONTAINS "docs-info.com" OR requesturl CONTAINS "docs-shared.com" OR requesturl CONTAINS "docs-shared.online" OR requesturl CONTAINS "docs-view.online" OR requesturl CONTAINS "document-forwarding.com" OR requesturl CONTAINS "document-online.live" OR requesturl CONTAINS "document-preview.com" OR requesturl CONTAINS "documents-cloud.com" OR requesturl CONTAINS "documents-cloud.online" OR requesturl CONTAINS "documents-forwarding.com" OR requesturl CONTAINS "document-share.live" OR requesturl CONTAINS "documents-online.live" OR requesturl CONTAINS "documents-pdf.online" OR requesturl CONTAINS "documents-preview.com" OR requesturl CONTAINS "documents-view.live" OR requesturl CONTAINS "document-view.live" OR requesturl CONTAINS "drive-docs.com" OR requesturl CONTAINS "drive-share.live" OR requesturl CONTAINS "goo-link.online" OR requesturl CONTAINS "hypertextteches.com" OR requesturl CONTAINS "mail-docs.online" OR requesturl CONTAINS "officeonline365.live" OR requesturl CONTAINS "online365-office.com" OR requesturl CONTAINS "online-document.live" OR requesturl CONTAINS "online-storage.live" OR requesturl CONTAINS "pdf-cache.com" OR requesturl CONTAINS "pdf-cache.online" OR requesturl CONTAINS "pdf-docs.online" OR requesturl CONTAINS "pdf-forwarding.online" OR requesturl CONTAINS "protection-checklinks.xyz" OR requesturl CONTAINS "protection-link.online" OR requesturl CONTAINS "protectionmail.online" OR requesturl CONTAINS "protection-office.live" OR requesturl CONTAINS "protect-link.online" OR requesturl CONTAINS "proton-docs.com" OR requesturl CONTAINS "proton-reader.com" OR requesturl CONTAINS "proton-viewer.com")
index=activity AND rg_functionality="Cloud Application Audit" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "relogin-dashboard.online" OR destinationhostname CONTAINS "safe-connection.online" OR destinationhostname CONTAINS "safelinks-protect.live" OR destinationhostname CONTAINS "secureoffice.live" OR destinationhostname CONTAINS "webresources.live" OR destinationhostname CONTAINS "word-yand.live" OR destinationhostname CONTAINS "yandx-online.cloud" OR destinationhostname CONTAINS "y-ml.co" OR destinationhostname CONTAINS "docs-drive.online" OR destinationhostname CONTAINS "docs-info.online" OR destinationhostname CONTAINS "cloud-mail.online" OR destinationhostname CONTAINS "onlinecloud365.live" OR destinationhostname CONTAINS "pdf-cloud.online" OR destinationhostname CONTAINS "pdf-shared.online" OR destinationhostname CONTAINS "proton-pdf.online" OR destinationhostname CONTAINS "proton-view.online" OR destinationhostname CONTAINS "office365-online.live" OR destinationhostname CONTAINS "doc-viewer.com" OR destinationhostname CONTAINS "file-milgov.systems" OR destinationhostname CONTAINS "office-protection.online")
index=activity AND rg_functionality="Cloud Application Audit" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "relogin-dashboard.online" OR sourcentdomain CONTAINS "safe-connection.online" OR sourcentdomain CONTAINS "safelinks-protect.live" OR sourcentdomain CONTAINS "secureoffice.live" OR sourcentdomain CONTAINS "webresources.live" OR sourcentdomain CONTAINS "word-yand.live" OR sourcentdomain CONTAINS "yandx-online.cloud" OR sourcentdomain CONTAINS "y-ml.co" OR sourcentdomain CONTAINS "docs-drive.online" OR sourcentdomain CONTAINS "docs-info.online" OR sourcentdomain CONTAINS "cloud-mail.online" OR sourcentdomain CONTAINS "onlinecloud365.live" OR sourcentdomain CONTAINS "pdf-cloud.online" OR sourcentdomain CONTAINS "pdf-shared.online" OR sourcentdomain CONTAINS "proton-pdf.online" OR sourcentdomain CONTAINS "proton-view.online" OR sourcentdomain CONTAINS "office365-online.live" OR sourcentdomain CONTAINS "doc-viewer.com" OR sourcentdomain CONTAINS "file-milgov.systems" OR sourcentdomain CONTAINS "office-protection.online")
index=activity AND rg_functionality="Cloud Application Audit" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "relogin-dashboard.online" OR sourcehostname CONTAINS "safe-connection.online" OR sourcehostname CONTAINS "safelinks-protect.live" OR sourcehostname CONTAINS "secureoffice.live" OR sourcehostname CONTAINS "webresources.live" OR sourcehostname CONTAINS "word-yand.live" OR sourcehostname CONTAINS "yandx-online.cloud" OR sourcehostname CONTAINS "y-ml.co" OR sourcehostname CONTAINS "docs-drive.online" OR sourcehostname CONTAINS "docs-info.online" OR sourcehostname CONTAINS "cloud-mail.online" OR sourcehostname CONTAINS "onlinecloud365.live" OR sourcehostname CONTAINS "pdf-cloud.online" OR sourcehostname CONTAINS "pdf-shared.online" OR sourcehostname CONTAINS "proton-pdf.online" OR sourcehostname CONTAINS "proton-view.online" OR sourcehostname CONTAINS "office365-online.live" OR sourcehostname CONTAINS "doc-viewer.com" OR sourcehostname CONTAINS "file-milgov.systems" OR sourcehostname CONTAINS "office-protection.online")
index=activity AND rg_functionality="Cloud Application Audit" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "relogin-dashboard.online" OR destinationntdomain CONTAINS "safe-connection.online" OR destinationntdomain CONTAINS "safelinks-protect.live" OR destinationntdomain CONTAINS "secureoffice.live" OR destinationntdomain CONTAINS "webresources.live" OR destinationntdomain CONTAINS "word-yand.live" OR destinationntdomain CONTAINS "yandx-online.cloud" OR destinationntdomain CONTAINS "y-ml.co" OR destinationntdomain CONTAINS "docs-drive.online" OR destinationntdomain CONTAINS "docs-info.online" OR destinationntdomain CONTAINS "cloud-mail.online" OR destinationntdomain CONTAINS "onlinecloud365.live" OR destinationntdomain CONTAINS "pdf-cloud.online" OR destinationntdomain CONTAINS "pdf-shared.online" OR destinationntdomain CONTAINS "proton-pdf.online" OR destinationntdomain CONTAINS "proton-view.online" OR destinationntdomain CONTAINS "office365-online.live" OR destinationntdomain CONTAINS "doc-viewer.com" OR destinationntdomain CONTAINS "file-milgov.systems" OR destinationntdomain CONTAINS "office-protection.online")
index=activity AND rg_functionality="Cloud Application Audit" AND requesturl NOT NULL AND (requesturl CONTAINS "relogin-dashboard.online" OR requesturl CONTAINS "safe-connection.online" OR requesturl CONTAINS "safelinks-protect.live" OR requesturl CONTAINS "secureoffice.live" OR requesturl CONTAINS "webresources.live" OR requesturl CONTAINS "word-yand.live" OR requesturl CONTAINS "yandx-online.cloud" OR requesturl CONTAINS "y-ml.co" OR requesturl CONTAINS "docs-drive.online" OR requesturl CONTAINS "docs-info.online" OR requesturl CONTAINS "cloud-mail.online" OR requesturl CONTAINS "onlinecloud365.live" OR requesturl CONTAINS "pdf-cloud.online" OR requesturl CONTAINS "pdf-shared.online" OR requesturl CONTAINS "proton-pdf.online" OR requesturl CONTAINS "proton-view.online" OR requesturl CONTAINS "office365-online.live" OR requesturl CONTAINS "doc-viewer.com" OR requesturl CONTAINS "file-milgov.systems" OR requesturl CONTAINS "office-protection.online")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "cache-dns.com" OR destinationhostname CONTAINS "sekoia.io" OR destinationhostname CONTAINS "cache-dns-forwarding.com" OR destinationhostname CONTAINS "cache-dns-preview.com" OR destinationhostname CONTAINS "cache-docs.com" OR destinationhostname CONTAINS "cache-pdf.com" OR destinationhostname CONTAINS "cache-pdf.online" OR destinationhostname CONTAINS "cache-services.live" OR destinationhostname CONTAINS "cloud-docs.com" OR destinationhostname CONTAINS "cloud-drive.live" OR destinationhostname CONTAINS "cloud-storage.live" OR destinationhostname CONTAINS "docs-cache.com" OR destinationhostname CONTAINS "docs-forwarding.online" OR destinationhostname CONTAINS "docs-info.com" OR destinationhostname CONTAINS "docs-shared.com" OR destinationhostname CONTAINS "docs-shared.online" OR destinationhostname CONTAINS "docs-view.online" OR destinationhostname CONTAINS "document-forwarding.com" OR destinationhostname CONTAINS "document-online.live" OR destinationhostname CONTAINS "document-preview.com" OR destinationhostname CONTAINS "documents-cloud.com" OR destinationhostname CONTAINS "documents-cloud.online" OR destinationhostname CONTAINS "documents-forwarding.com" OR destinationhostname CONTAINS "document-share.live" OR destinationhostname CONTAINS "documents-online.live" OR destinationhostname CONTAINS "documents-pdf.online" OR destinationhostname CONTAINS "documents-preview.com" OR destinationhostname CONTAINS "documents-view.live" OR destinationhostname CONTAINS "document-view.live" OR destinationhostname CONTAINS "drive-docs.com" OR destinationhostname CONTAINS "drive-share.live" OR destinationhostname CONTAINS "goo-link.online" OR destinationhostname CONTAINS "hypertextteches.com" OR destinationhostname CONTAINS "mail-docs.online" OR destinationhostname CONTAINS "officeonline365.live" OR destinationhostname CONTAINS "online365-office.com" OR destinationhostname CONTAINS "online-document.live" OR destinationhostname CONTAINS "online-storage.live" OR destinationhostname CONTAINS "pdf-cache.com" OR destinationhostname CONTAINS "pdf-cache.online" OR destinationhostname CONTAINS "pdf-docs.online" OR destinationhostname CONTAINS "pdf-forwarding.online" OR destinationhostname CONTAINS "protection-checklinks.xyz" OR destinationhostname CONTAINS "protection-link.online" OR destinationhostname CONTAINS "protectionmail.online" OR destinationhostname CONTAINS "protection-office.live" OR destinationhostname CONTAINS "protect-link.online" OR destinationhostname CONTAINS "proton-docs.com" OR destinationhostname CONTAINS "proton-reader.com" OR destinationhostname CONTAINS "proton-viewer.com")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "cache-dns.com" OR sourcentdomain CONTAINS "sekoia.io" OR sourcentdomain CONTAINS "cache-dns-forwarding.com" OR sourcentdomain CONTAINS "cache-dns-preview.com" OR sourcentdomain CONTAINS "cache-docs.com" OR sourcentdomain CONTAINS "cache-pdf.com" OR sourcentdomain CONTAINS "cache-pdf.online" OR sourcentdomain CONTAINS "cache-services.live" OR sourcentdomain CONTAINS "cloud-docs.com" OR sourcentdomain CONTAINS "cloud-drive.live" OR sourcentdomain CONTAINS "cloud-storage.live" OR sourcentdomain CONTAINS "docs-cache.com" OR sourcentdomain CONTAINS "docs-forwarding.online" OR sourcentdomain CONTAINS "docs-info.com" OR sourcentdomain CONTAINS "docs-shared.com" OR sourcentdomain CONTAINS "docs-shared.online" OR sourcentdomain CONTAINS "docs-view.online" OR sourcentdomain CONTAINS "document-forwarding.com" OR sourcentdomain CONTAINS "document-online.live" OR sourcentdomain CONTAINS "document-preview.com" OR sourcentdomain CONTAINS "documents-cloud.com" OR sourcentdomain CONTAINS "documents-cloud.online" OR sourcentdomain CONTAINS "documents-forwarding.com" OR sourcentdomain CONTAINS "document-share.live" OR sourcentdomain CONTAINS "documents-online.live" OR sourcentdomain CONTAINS "documents-pdf.online" OR sourcentdomain CONTAINS "documents-preview.com" OR sourcentdomain CONTAINS "documents-view.live" OR sourcentdomain CONTAINS "document-view.live" OR sourcentdomain CONTAINS "drive-docs.com" OR sourcentdomain CONTAINS "drive-share.live" OR sourcentdomain CONTAINS "goo-link.online" OR sourcentdomain CONTAINS "hypertextteches.com" OR sourcentdomain CONTAINS "mail-docs.online" OR sourcentdomain CONTAINS "officeonline365.live" OR sourcentdomain CONTAINS "online365-office.com" OR sourcentdomain CONTAINS "online-document.live" OR sourcentdomain CONTAINS "online-storage.live" OR sourcentdomain CONTAINS "pdf-cache.com" OR sourcentdomain CONTAINS "pdf-cache.online" OR sourcentdomain CONTAINS "pdf-docs.online" OR sourcentdomain CONTAINS "pdf-forwarding.online" OR sourcentdomain CONTAINS "protection-checklinks.xyz" OR sourcentdomain CONTAINS "protection-link.online" OR sourcentdomain CONTAINS "protectionmail.online" OR sourcentdomain CONTAINS "protection-office.live" OR sourcentdomain CONTAINS "protect-link.online" OR sourcentdomain CONTAINS "proton-docs.com" OR sourcentdomain CONTAINS "proton-reader.com" OR sourcentdomain CONTAINS "proton-viewer.com")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "cache-dns.com" OR sourcehostname CONTAINS "sekoia.io" OR sourcehostname CONTAINS "cache-dns-forwarding.com" OR sourcehostname CONTAINS "cache-dns-preview.com" OR sourcehostname CONTAINS "cache-docs.com" OR sourcehostname CONTAINS "cache-pdf.com" OR sourcehostname CONTAINS "cache-pdf.online" OR sourcehostname CONTAINS "cache-services.live" OR sourcehostname CONTAINS "cloud-docs.com" OR sourcehostname CONTAINS "cloud-drive.live" OR sourcehostname CONTAINS "cloud-storage.live" OR sourcehostname CONTAINS "docs-cache.com" OR sourcehostname CONTAINS "docs-forwarding.online" OR sourcehostname CONTAINS "docs-info.com" OR sourcehostname CONTAINS "docs-shared.com" OR sourcehostname CONTAINS "docs-shared.online" OR sourcehostname CONTAINS "docs-view.online" OR sourcehostname CONTAINS "document-forwarding.com" OR sourcehostname CONTAINS "document-online.live" OR sourcehostname CONTAINS "document-preview.com" OR sourcehostname CONTAINS "documents-cloud.com" OR sourcehostname CONTAINS "documents-cloud.online" OR sourcehostname CONTAINS "documents-forwarding.com" OR sourcehostname CONTAINS "document-share.live" OR sourcehostname CONTAINS "documents-online.live" OR sourcehostname CONTAINS "documents-pdf.online" OR sourcehostname CONTAINS "documents-preview.com" OR sourcehostname CONTAINS "documents-view.live" OR sourcehostname CONTAINS "document-view.live" OR sourcehostname CONTAINS "drive-docs.com" OR sourcehostname CONTAINS "drive-share.live" OR sourcehostname CONTAINS "goo-link.online" OR sourcehostname CONTAINS "hypertextteches.com" OR sourcehostname CONTAINS "mail-docs.online" OR sourcehostname CONTAINS "officeonline365.live" OR sourcehostname CONTAINS "online365-office.com" OR sourcehostname CONTAINS "online-document.live" OR sourcehostname CONTAINS "online-storage.live" OR sourcehostname CONTAINS "pdf-cache.com" OR sourcehostname CONTAINS "pdf-cache.online" OR sourcehostname CONTAINS "pdf-docs.online" OR sourcehostname CONTAINS "pdf-forwarding.online" OR sourcehostname CONTAINS "protection-checklinks.xyz" OR sourcehostname CONTAINS "protection-link.online" OR sourcehostname CONTAINS "protectionmail.online" OR sourcehostname CONTAINS "protection-office.live" OR sourcehostname CONTAINS "protect-link.online" OR sourcehostname CONTAINS "proton-docs.com" OR sourcehostname CONTAINS "proton-reader.com" OR sourcehostname CONTAINS "proton-viewer.com")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "cache-dns.com" OR destinationntdomain CONTAINS "sekoia.io" OR destinationntdomain CONTAINS "cache-dns-forwarding.com" OR destinationntdomain CONTAINS "cache-dns-preview.com" OR destinationntdomain CONTAINS "cache-docs.com" OR destinationntdomain CONTAINS "cache-pdf.com" OR destinationntdomain CONTAINS "cache-pdf.online" OR destinationntdomain CONTAINS "cache-services.live" OR destinationntdomain CONTAINS "cloud-docs.com" OR destinationntdomain CONTAINS "cloud-drive.live" OR destinationntdomain CONTAINS "cloud-storage.live" OR destinationntdomain CONTAINS "docs-cache.com" OR destinationntdomain CONTAINS "docs-forwarding.online" OR destinationntdomain CONTAINS "docs-info.com" OR destinationntdomain CONTAINS "docs-shared.com" OR destinationntdomain CONTAINS "docs-shared.online" OR destinationntdomain CONTAINS "docs-view.online" OR destinationntdomain CONTAINS "document-forwarding.com" OR destinationntdomain CONTAINS "document-online.live" OR destinationntdomain CONTAINS "document-preview.com" OR destinationntdomain CONTAINS "documents-cloud.com" OR destinationntdomain CONTAINS "documents-cloud.online" OR destinationntdomain CONTAINS "documents-forwarding.com" OR destinationntdomain CONTAINS "document-share.live" OR destinationntdomain CONTAINS "documents-online.live" OR destinationntdomain CONTAINS "documents-pdf.online" OR destinationntdomain CONTAINS "documents-preview.com" OR destinationntdomain CONTAINS "documents-view.live" OR destinationntdomain CONTAINS "document-view.live" OR destinationntdomain CONTAINS "drive-docs.com" OR destinationntdomain CONTAINS "drive-share.live" OR destinationntdomain CONTAINS "goo-link.online" OR destinationntdomain CONTAINS "hypertextteches.com" OR destinationntdomain CONTAINS "mail-docs.online" OR destinationntdomain CONTAINS "officeonline365.live" OR destinationntdomain CONTAINS "online365-office.com" OR destinationntdomain CONTAINS "online-document.live" OR destinationntdomain CONTAINS "online-storage.live" OR destinationntdomain CONTAINS "pdf-cache.com" OR destinationntdomain CONTAINS "pdf-cache.online" OR destinationntdomain CONTAINS "pdf-docs.online" OR destinationntdomain CONTAINS "pdf-forwarding.online" OR destinationntdomain CONTAINS "protection-checklinks.xyz" OR destinationntdomain CONTAINS "protection-link.online" OR destinationntdomain CONTAINS "protectionmail.online" OR destinationntdomain CONTAINS "protection-office.live" OR destinationntdomain CONTAINS "protect-link.online" OR destinationntdomain CONTAINS "proton-docs.com" OR destinationntdomain CONTAINS "proton-reader.com" OR destinationntdomain CONTAINS "proton-viewer.com")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND requesturl NOT NULL AND (requesturl CONTAINS "cache-dns.com" OR requesturl CONTAINS "sekoia.io" OR requesturl CONTAINS "cache-dns-forwarding.com" OR requesturl CONTAINS "cache-dns-preview.com" OR requesturl CONTAINS "cache-docs.com" OR requesturl CONTAINS "cache-pdf.com" OR requesturl CONTAINS "cache-pdf.online" OR requesturl CONTAINS "cache-services.live" OR requesturl CONTAINS "cloud-docs.com" OR requesturl CONTAINS "cloud-drive.live" OR requesturl CONTAINS "cloud-storage.live" OR requesturl CONTAINS "docs-cache.com" OR requesturl CONTAINS "docs-forwarding.online" OR requesturl CONTAINS "docs-info.com" OR requesturl CONTAINS "docs-shared.com" OR requesturl CONTAINS "docs-shared.online" OR requesturl CONTAINS "docs-view.online" OR requesturl CONTAINS "document-forwarding.com" OR requesturl CONTAINS "document-online.live" OR requesturl CONTAINS "document-preview.com" OR requesturl CONTAINS "documents-cloud.com" OR requesturl CONTAINS "documents-cloud.online" OR requesturl CONTAINS "documents-forwarding.com" OR requesturl CONTAINS "document-share.live" OR requesturl CONTAINS "documents-online.live" OR requesturl CONTAINS "documents-pdf.online" OR requesturl CONTAINS "documents-preview.com" OR requesturl CONTAINS "documents-view.live" OR requesturl CONTAINS "document-view.live" OR requesturl CONTAINS "drive-docs.com" OR requesturl CONTAINS "drive-share.live" OR requesturl CONTAINS "goo-link.online" OR requesturl CONTAINS "hypertextteches.com" OR requesturl CONTAINS "mail-docs.online" OR requesturl CONTAINS "officeonline365.live" OR requesturl CONTAINS "online365-office.com" OR requesturl CONTAINS "online-document.live" OR requesturl CONTAINS "online-storage.live" OR requesturl CONTAINS "pdf-cache.com" OR requesturl CONTAINS "pdf-cache.online" OR requesturl CONTAINS "pdf-docs.online" OR requesturl CONTAINS "pdf-forwarding.online" OR requesturl CONTAINS "protection-checklinks.xyz" OR requesturl CONTAINS "protection-link.online" OR requesturl CONTAINS "protectionmail.online" OR requesturl CONTAINS "protection-office.live" OR requesturl CONTAINS "protect-link.online" OR requesturl CONTAINS "proton-docs.com" OR requesturl CONTAINS "proton-reader.com" OR requesturl CONTAINS "proton-viewer.com")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "relogin-dashboard.online" OR destinationhostname CONTAINS "safe-connection.online" OR destinationhostname CONTAINS "safelinks-protect.live" OR destinationhostname CONTAINS "secureoffice.live" OR destinationhostname CONTAINS "webresources.live" OR destinationhostname CONTAINS "word-yand.live" OR destinationhostname CONTAINS "yandx-online.cloud" OR destinationhostname CONTAINS "y-ml.co" OR destinationhostname CONTAINS "docs-drive.online" OR destinationhostname CONTAINS "docs-info.online" OR destinationhostname CONTAINS "cloud-mail.online" OR destinationhostname CONTAINS "onlinecloud365.live" OR destinationhostname CONTAINS "pdf-cloud.online" OR destinationhostname CONTAINS "pdf-shared.online" OR destinationhostname CONTAINS "proton-pdf.online" OR destinationhostname CONTAINS "proton-view.online" OR destinationhostname CONTAINS "office365-online.live" OR destinationhostname CONTAINS "doc-viewer.com" OR destinationhostname CONTAINS "file-milgov.systems" OR destinationhostname CONTAINS "office-protection.online")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "relogin-dashboard.online" OR sourcentdomain CONTAINS "safe-connection.online" OR sourcentdomain CONTAINS "safelinks-protect.live" OR sourcentdomain CONTAINS "secureoffice.live" OR sourcentdomain CONTAINS "webresources.live" OR sourcentdomain CONTAINS "word-yand.live" OR sourcentdomain CONTAINS "yandx-online.cloud" OR sourcentdomain CONTAINS "y-ml.co" OR sourcentdomain CONTAINS "docs-drive.online" OR sourcentdomain CONTAINS "docs-info.online" OR sourcentdomain CONTAINS "cloud-mail.online" OR sourcentdomain CONTAINS "onlinecloud365.live" OR sourcentdomain CONTAINS "pdf-cloud.online" OR sourcentdomain CONTAINS "pdf-shared.online" OR sourcentdomain CONTAINS "proton-pdf.online" OR sourcentdomain CONTAINS "proton-view.online" OR sourcentdomain CONTAINS "office365-online.live" OR sourcentdomain CONTAINS "doc-viewer.com" OR sourcentdomain CONTAINS "file-milgov.systems" OR sourcentdomain CONTAINS "office-protection.online")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "relogin-dashboard.online" OR sourcehostname CONTAINS "safe-connection.online" OR sourcehostname CONTAINS "safelinks-protect.live" OR sourcehostname CONTAINS "secureoffice.live" OR sourcehostname CONTAINS "webresources.live" OR sourcehostname CONTAINS "word-yand.live" OR sourcehostname CONTAINS "yandx-online.cloud" OR sourcehostname CONTAINS "y-ml.co" OR sourcehostname CONTAINS "docs-drive.online" OR sourcehostname CONTAINS "docs-info.online" OR sourcehostname CONTAINS "cloud-mail.online" OR sourcehostname CONTAINS "onlinecloud365.live" OR sourcehostname CONTAINS "pdf-cloud.online" OR sourcehostname CONTAINS "pdf-shared.online" OR sourcehostname CONTAINS "proton-pdf.online" OR sourcehostname CONTAINS "proton-view.online" OR sourcehostname CONTAINS "office365-online.live" OR sourcehostname CONTAINS "doc-viewer.com" OR sourcehostname CONTAINS "file-milgov.systems" OR sourcehostname CONTAINS "office-protection.online")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "relogin-dashboard.online" OR destinationntdomain CONTAINS "safe-connection.online" OR destinationntdomain CONTAINS "safelinks-protect.live" OR destinationntdomain CONTAINS "secureoffice.live" OR destinationntdomain CONTAINS "webresources.live" OR destinationntdomain CONTAINS "word-yand.live" OR destinationntdomain CONTAINS "yandx-online.cloud" OR destinationntdomain CONTAINS "y-ml.co" OR destinationntdomain CONTAINS "docs-drive.online" OR destinationntdomain CONTAINS "docs-info.online" OR destinationntdomain CONTAINS "cloud-mail.online" OR destinationntdomain CONTAINS "onlinecloud365.live" OR destinationntdomain CONTAINS "pdf-cloud.online" OR destinationntdomain CONTAINS "pdf-shared.online" OR destinationntdomain CONTAINS "proton-pdf.online" OR destinationntdomain CONTAINS "proton-view.online" OR destinationntdomain CONTAINS "office365-online.live" OR destinationntdomain CONTAINS "doc-viewer.com" OR destinationntdomain CONTAINS "file-milgov.systems" OR destinationntdomain CONTAINS "office-protection.online")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND requesturl NOT NULL AND (requesturl CONTAINS "relogin-dashboard.online" OR requesturl CONTAINS "safe-connection.online" OR requesturl CONTAINS "safelinks-protect.live" OR requesturl CONTAINS "secureoffice.live" OR requesturl CONTAINS "webresources.live" OR requesturl CONTAINS "word-yand.live" OR requesturl CONTAINS "yandx-online.cloud" OR requesturl CONTAINS "y-ml.co" OR requesturl CONTAINS "docs-drive.online" OR requesturl CONTAINS "docs-info.online" OR requesturl CONTAINS "cloud-mail.online" OR requesturl CONTAINS "onlinecloud365.live" OR requesturl CONTAINS "pdf-cloud.online" OR requesturl CONTAINS "pdf-shared.online" OR requesturl CONTAINS "proton-pdf.online" OR requesturl CONTAINS "proton-view.online" OR requesturl CONTAINS "office365-online.live" OR requesturl CONTAINS "doc-viewer.com" OR requesturl CONTAINS "file-milgov.systems" OR requesturl CONTAINS "office-protection.online")
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "cache-dns.com" OR destinationhostname CONTAINS "sekoia.io" OR destinationhostname CONTAINS "cache-dns-forwarding.com" OR destinationhostname CONTAINS "cache-dns-preview.com" OR destinationhostname CONTAINS "cache-docs.com" OR destinationhostname CONTAINS "cache-pdf.com" OR destinationhostname CONTAINS "cache-pdf.online" OR destinationhostname CONTAINS "cache-services.live" OR destinationhostname CONTAINS "cloud-docs.com" OR destinationhostname CONTAINS "cloud-drive.live" OR destinationhostname CONTAINS "cloud-storage.live" OR destinationhostname CONTAINS "docs-cache.com" OR destinationhostname CONTAINS "docs-forwarding.online" OR destinationhostname CONTAINS "docs-info.com" OR destinationhostname CONTAINS "docs-shared.com" OR destinationhostname CONTAINS "docs-shared.online" OR destinationhostname CONTAINS "docs-view.online" OR destinationhostname CONTAINS "document-forwarding.com" OR destinationhostname CONTAINS "document-online.live" OR destinationhostname CONTAINS "document-preview.com" OR destinationhostname CONTAINS "documents-cloud.com" OR destinationhostname CONTAINS "documents-cloud.online" OR destinationhostname CONTAINS "documents-forwarding.com" OR destinationhostname CONTAINS "document-share.live" OR destinationhostname CONTAINS "documents-online.live" OR destinationhostname CONTAINS "documents-pdf.online" OR destinationhostname CONTAINS "documents-preview.com" OR destinationhostname CONTAINS "documents-view.live" OR destinationhostname CONTAINS "document-view.live" OR destinationhostname CONTAINS "drive-docs.com" OR destinationhostname CONTAINS "drive-share.live" OR destinationhostname CONTAINS "goo-link.online" OR destinationhostname CONTAINS "hypertextteches.com" OR destinationhostname CONTAINS "mail-docs.online" OR destinationhostname CONTAINS "officeonline365.live" OR destinationhostname CONTAINS "online365-office.com" OR destinationhostname CONTAINS "online-document.live" OR destinationhostname CONTAINS "online-storage.live" OR destinationhostname CONTAINS "pdf-cache.com" OR destinationhostname CONTAINS "pdf-cache.online" OR destinationhostname CONTAINS "pdf-docs.online" OR destinationhostname CONTAINS "pdf-forwarding.online" OR destinationhostname CONTAINS "protection-checklinks.xyz" OR destinationhostname CONTAINS "protection-link.online" OR destinationhostname CONTAINS "protectionmail.online" OR destinationhostname CONTAINS "protection-office.live" OR destinationhostname CONTAINS "protect-link.online" OR destinationhostname CONTAINS "proton-docs.com" OR destinationhostname CONTAINS "proton-reader.com" OR destinationhostname CONTAINS "proton-viewer.com")
index=activity AND rg_functionality="Unix / Linux / AIX" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "cache-dns.com" OR sourcentdomain CONTAINS "sekoia.io" OR sourcentdomain CONTAINS "cache-dns-forwarding.com" OR sourcentdomain CONTAINS "cache-dns-preview.com" OR sourcentdomain CONTAINS "cache-docs.com" OR sourcentdomain CONTAINS "cache-pdf.com" OR sourcentdomain CONTAINS "cache-pdf.online" OR sourcentdomain CONTAINS "cache-services.live" OR sourcentdomain CONTAINS "cloud-docs.com" OR sourcentdomain CONTAINS "cloud-drive.live" OR sourcentdomain CONTAINS "cloud-storage.live" OR sourcentdomain CONTAINS "docs-cache.com" OR sourcentdomain CONTAINS "docs-forwarding.online" OR sourcentdomain CONTAINS "docs-info.com" OR sourcentdomain CONTAINS "docs-shared.com" OR sourcentdomain CONTAINS "docs-shared.online" OR sourcentdomain CONTAINS "docs-view.online" OR sourcentdomain CONTAINS "document-forwarding.com" OR sourcentdomain CONTAINS "document-online.live" OR sourcentdomain CONTAINS "document-preview.com" OR sourcentdomain CONTAINS "documents-cloud.com" OR sourcentdomain CONTAINS "documents-cloud.online" OR sourcentdomain CONTAINS "documents-forwarding.com" OR sourcentdomain CONTAINS "document-share.live" OR sourcentdomain CONTAINS "documents-online.live" OR sourcentdomain CONTAINS "documents-pdf.online" OR sourcentdomain CONTAINS "documents-preview.com" OR sourcentdomain CONTAINS "documents-view.live" OR sourcentdomain CONTAINS "document-view.live" OR sourcentdomain CONTAINS "drive-docs.com" OR sourcentdomain CONTAINS "drive-share.live" OR sourcentdomain CONTAINS "goo-link.online" OR sourcentdomain CONTAINS "hypertextteches.com" OR sourcentdomain CONTAINS "mail-docs.online" OR sourcentdomain CONTAINS "officeonline365.live" OR sourcentdomain CONTAINS "online365-office.com" OR sourcentdomain CONTAINS "online-document.live" OR sourcentdomain CONTAINS "online-storage.live" OR sourcentdomain CONTAINS "pdf-cache.com" OR sourcentdomain CONTAINS "pdf-cache.online" OR sourcentdomain CONTAINS "pdf-docs.online" OR sourcentdomain CONTAINS "pdf-forwarding.online" OR sourcentdomain CONTAINS "protection-checklinks.xyz" OR sourcentdomain CONTAINS "protection-link.online" OR sourcentdomain CONTAINS "protectionmail.online" OR sourcentdomain CONTAINS "protection-office.live" OR sourcentdomain CONTAINS "protect-link.online" OR sourcentdomain CONTAINS "proton-docs.com" OR sourcentdomain CONTAINS "proton-reader.com" OR sourcentdomain CONTAINS "proton-viewer.com")
index=activity AND rg_functionality="Unix / Linux / AIX" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "cache-dns.com" OR sourcehostname CONTAINS "sekoia.io" OR sourcehostname CONTAINS "cache-dns-forwarding.com" OR sourcehostname CONTAINS "cache-dns-preview.com" OR sourcehostname CONTAINS "cache-docs.com" OR sourcehostname CONTAINS "cache-pdf.com" OR sourcehostname CONTAINS "cache-pdf.online" OR sourcehostname CONTAINS "cache-services.live" OR sourcehostname CONTAINS "cloud-docs.com" OR sourcehostname CONTAINS "cloud-drive.live" OR sourcehostname CONTAINS "cloud-storage.live" OR sourcehostname CONTAINS "docs-cache.com" OR sourcehostname CONTAINS "docs-forwarding.online" OR sourcehostname CONTAINS "docs-info.com" OR sourcehostname CONTAINS "docs-shared.com" OR sourcehostname CONTAINS "docs-shared.online" OR sourcehostname CONTAINS "docs-view.online" OR sourcehostname CONTAINS "document-forwarding.com" OR sourcehostname CONTAINS "document-online.live" OR sourcehostname CONTAINS "document-preview.com" OR sourcehostname CONTAINS "documents-cloud.com" OR sourcehostname CONTAINS "documents-cloud.online" OR sourcehostname CONTAINS "documents-forwarding.com" OR sourcehostname CONTAINS "document-share.live" OR sourcehostname CONTAINS "documents-online.live" OR sourcehostname CONTAINS "documents-pdf.online" OR sourcehostname CONTAINS "documents-preview.com" OR sourcehostname CONTAINS "documents-view.live" OR sourcehostname CONTAINS "document-view.live" OR sourcehostname CONTAINS "drive-docs.com" OR sourcehostname CONTAINS "drive-share.live" OR sourcehostname CONTAINS "goo-link.online" OR sourcehostname CONTAINS "hypertextteches.com" OR sourcehostname CONTAINS "mail-docs.online" OR sourcehostname CONTAINS "officeonline365.live" OR sourcehostname CONTAINS "online365-office.com" OR sourcehostname CONTAINS "online-document.live" OR sourcehostname CONTAINS "online-storage.live" OR sourcehostname CONTAINS "pdf-cache.com" OR sourcehostname CONTAINS "pdf-cache.online" OR sourcehostname CONTAINS "pdf-docs.online" OR sourcehostname CONTAINS "pdf-forwarding.online" OR sourcehostname CONTAINS "protection-checklinks.xyz" OR sourcehostname CONTAINS "protection-link.online" OR sourcehostname CONTAINS "protectionmail.online" OR sourcehostname CONTAINS "protection-office.live" OR sourcehostname CONTAINS "protect-link.online" OR sourcehostname CONTAINS "proton-docs.com" OR sourcehostname CONTAINS "proton-reader.com" OR sourcehostname CONTAINS "proton-viewer.com")
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "cache-dns.com" OR destinationntdomain CONTAINS "sekoia.io" OR destinationntdomain CONTAINS "cache-dns-forwarding.com" OR destinationntdomain CONTAINS "cache-dns-preview.com" OR destinationntdomain CONTAINS "cache-docs.com" OR destinationntdomain CONTAINS "cache-pdf.com" OR destinationntdomain CONTAINS "cache-pdf.online" OR destinationntdomain CONTAINS "cache-services.live" OR destinationntdomain CONTAINS "cloud-docs.com" OR destinationntdomain CONTAINS "cloud-drive.live" OR destinationntdomain CONTAINS "cloud-storage.live" OR destinationntdomain CONTAINS "docs-cache.com" OR destinationntdomain CONTAINS "docs-forwarding.online" OR destinationntdomain CONTAINS "docs-info.com" OR destinationntdomain CONTAINS "docs-shared.com" OR destinationntdomain CONTAINS "docs-shared.online" OR destinationntdomain CONTAINS "docs-view.online" OR destinationntdomain CONTAINS "document-forwarding.com" OR destinationntdomain CONTAINS "document-online.live" OR destinationntdomain CONTAINS "document-preview.com" OR destinationntdomain CONTAINS "documents-cloud.com" OR destinationntdomain CONTAINS "documents-cloud.online" OR destinationntdomain CONTAINS "documents-forwarding.com" OR destinationntdomain CONTAINS "document-share.live" OR destinationntdomain CONTAINS "documents-online.live" OR destinationntdomain CONTAINS "documents-pdf.online" OR destinationntdomain CONTAINS "documents-preview.com" OR destinationntdomain CONTAINS "documents-view.live" OR destinationntdomain CONTAINS "document-view.live" OR destinationntdomain CONTAINS "drive-docs.com" OR destinationntdomain CONTAINS "drive-share.live" OR destinationntdomain CONTAINS "goo-link.online" OR destinationntdomain CONTAINS "hypertextteches.com" OR destinationntdomain CONTAINS "mail-docs.online" OR destinationntdomain CONTAINS "officeonline365.live" OR destinationntdomain CONTAINS "online365-office.com" OR destinationntdomain CONTAINS "online-document.live" OR destinationntdomain CONTAINS "online-storage.live" OR destinationntdomain CONTAINS "pdf-cache.com" OR destinationntdomain CONTAINS "pdf-cache.online" OR destinationntdomain CONTAINS "pdf-docs.online" OR destinationntdomain CONTAINS "pdf-forwarding.online" OR destinationntdomain CONTAINS "protection-checklinks.xyz" OR destinationntdomain CONTAINS "protection-link.online" OR destinationntdomain CONTAINS "protectionmail.online" OR destinationntdomain CONTAINS "protection-office.live" OR destinationntdomain CONTAINS "protect-link.online" OR destinationntdomain CONTAINS "proton-docs.com" OR destinationntdomain CONTAINS "proton-reader.com" OR destinationntdomain CONTAINS "proton-viewer.com")
index=activity AND rg_functionality="Unix / Linux / AIX" AND requesturl NOT NULL AND (requesturl CONTAINS "cache-dns.com" OR requesturl CONTAINS "sekoia.io" OR requesturl CONTAINS "cache-dns-forwarding.com" OR requesturl CONTAINS "cache-dns-preview.com" OR requesturl CONTAINS "cache-docs.com" OR requesturl CONTAINS "cache-pdf.com" OR requesturl CONTAINS "cache-pdf.online" OR requesturl CONTAINS "cache-services.live" OR requesturl CONTAINS "cloud-docs.com" OR requesturl CONTAINS "cloud-drive.live" OR requesturl CONTAINS "cloud-storage.live" OR requesturl CONTAINS "docs-cache.com" OR requesturl CONTAINS "docs-forwarding.online" OR requesturl CONTAINS "docs-info.com" OR requesturl CONTAINS "docs-shared.com" OR requesturl CONTAINS "docs-shared.online" OR requesturl CONTAINS "docs-view.online" OR requesturl CONTAINS "document-forwarding.com" OR requesturl CONTAINS "document-online.live" OR requesturl CONTAINS "document-preview.com" OR requesturl CONTAINS "documents-cloud.com" OR requesturl CONTAINS "documents-cloud.online" OR requesturl CONTAINS "documents-forwarding.com" OR requesturl CONTAINS "document-share.live" OR requesturl CONTAINS "documents-online.live" OR requesturl CONTAINS "documents-pdf.online" OR requesturl CONTAINS "documents-preview.com" OR requesturl CONTAINS "documents-view.live" OR requesturl CONTAINS "document-view.live" OR requesturl CONTAINS "drive-docs.com" OR requesturl CONTAINS "drive-share.live" OR requesturl CONTAINS "goo-link.online" OR requesturl CONTAINS "hypertextteches.com" OR requesturl CONTAINS "mail-docs.online" OR requesturl CONTAINS "officeonline365.live" OR requesturl CONTAINS "online365-office.com" OR requesturl CONTAINS "online-document.live" OR requesturl CONTAINS "online-storage.live" OR requesturl CONTAINS "pdf-cache.com" OR requesturl CONTAINS "pdf-cache.online" OR requesturl CONTAINS "pdf-docs.online" OR requesturl CONTAINS "pdf-forwarding.online" OR requesturl CONTAINS "protection-checklinks.xyz" OR requesturl CONTAINS "protection-link.online" OR requesturl CONTAINS "protectionmail.online" OR requesturl CONTAINS "protection-office.live" OR requesturl CONTAINS "protect-link.online" OR requesturl CONTAINS "proton-docs.com" OR requesturl CONTAINS "proton-reader.com" OR requesturl CONTAINS "proton-viewer.com")
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "relogin-dashboard.online" OR destinationhostname CONTAINS "safe-connection.online" OR destinationhostname CONTAINS "safelinks-protect.live" OR destinationhostname CONTAINS "secureoffice.live" OR destinationhostname CONTAINS "webresources.live" OR destinationhostname CONTAINS "word-yand.live" OR destinationhostname CONTAINS "yandx-online.cloud" OR destinationhostname CONTAINS "y-ml.co" OR destinationhostname CONTAINS "docs-drive.online" OR destinationhostname CONTAINS "docs-info.online" OR destinationhostname CONTAINS "cloud-mail.online" OR destinationhostname CONTAINS "onlinecloud365.live" OR destinationhostname CONTAINS "pdf-cloud.online" OR destinationhostname CONTAINS "pdf-shared.online" OR destinationhostname CONTAINS "proton-pdf.online" OR destinationhostname CONTAINS "proton-view.online" OR destinationhostname CONTAINS "office365-online.live" OR destinationhostname CONTAINS "doc-viewer.com" OR destinationhostname CONTAINS "file-milgov.systems" OR destinationhostname CONTAINS "office-protection.online")
index=activity AND rg_functionality="Unix / Linux / AIX" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "relogin-dashboard.online" OR sourcentdomain CONTAINS "safe-connection.online" OR sourcentdomain CONTAINS "safelinks-protect.live" OR sourcentdomain CONTAINS "secureoffice.live" OR sourcentdomain CONTAINS "webresources.live" OR sourcentdomain CONTAINS "word-yand.live" OR sourcentdomain CONTAINS "yandx-online.cloud" OR sourcentdomain CONTAINS "y-ml.co" OR sourcentdomain CONTAINS "docs-drive.online" OR sourcentdomain CONTAINS "docs-info.online" OR sourcentdomain CONTAINS "cloud-mail.online" OR sourcentdomain CONTAINS "onlinecloud365.live" OR sourcentdomain CONTAINS "pdf-cloud.online" OR sourcentdomain CONTAINS "pdf-shared.online" OR sourcentdomain CONTAINS "proton-pdf.online" OR sourcentdomain CONTAINS "proton-view.online" OR sourcentdomain CONTAINS "office365-online.live" OR sourcentdomain CONTAINS "doc-viewer.com" OR sourcentdomain CONTAINS "file-milgov.systems" OR sourcentdomain CONTAINS "office-protection.online")
index=activity AND rg_functionality="Unix / Linux / AIX" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "relogin-dashboard.online" OR sourcehostname CONTAINS "safe-connection.online" OR sourcehostname CONTAINS "safelinks-protect.live" OR sourcehostname CONTAINS "secureoffice.live" OR sourcehostname CONTAINS "webresources.live" OR sourcehostname CONTAINS "word-yand.live" OR sourcehostname CONTAINS "yandx-online.cloud" OR sourcehostname CONTAINS "y-ml.co" OR sourcehostname CONTAINS "docs-drive.online" OR sourcehostname CONTAINS "docs-info.online" OR sourcehostname CONTAINS "cloud-mail.online" OR sourcehostname CONTAINS "onlinecloud365.live" OR sourcehostname CONTAINS "pdf-cloud.online" OR sourcehostname CONTAINS "pdf-shared.online" OR sourcehostname CONTAINS "proton-pdf.online" OR sourcehostname CONTAINS "proton-view.online" OR sourcehostname CONTAINS "office365-online.live" OR sourcehostname CONTAINS "doc-viewer.com" OR sourcehostname CONTAINS "file-milgov.systems" OR sourcehostname CONTAINS "office-protection.online")
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "relogin-dashboard.online" OR destinationntdomain CONTAINS "safe-connection.online" OR destinationntdomain CONTAINS "safelinks-protect.live" OR destinationntdomain CONTAINS "secureoffice.live" OR destinationntdomain CONTAINS "webresources.live" OR destinationntdomain CONTAINS "word-yand.live" OR destinationntdomain CONTAINS "yandx-online.cloud" OR destinationntdomain CONTAINS "y-ml.co" OR destinationntdomain CONTAINS "docs-drive.online" OR destinationntdomain CONTAINS "docs-info.online" OR destinationntdomain CONTAINS "cloud-mail.online" OR destinationntdomain CONTAINS "onlinecloud365.live" OR destinationntdomain CONTAINS "pdf-cloud.online" OR destinationntdomain CONTAINS "pdf-shared.online" OR destinationntdomain CONTAINS "proton-pdf.online" OR destinationntdomain CONTAINS "proton-view.online" OR destinationntdomain CONTAINS "office365-online.live" OR destinationntdomain CONTAINS "doc-viewer.com" OR destinationntdomain CONTAINS "file-milgov.systems" OR destinationntdomain CONTAINS "office-protection.online")
index=activity AND rg_functionality="Unix / Linux / AIX" AND requesturl NOT NULL AND (requesturl CONTAINS "relogin-dashboard.online" OR requesturl CONTAINS "safe-connection.online" OR requesturl CONTAINS "safelinks-protect.live" OR requesturl CONTAINS "secureoffice.live" OR requesturl CONTAINS "webresources.live" OR requesturl CONTAINS "word-yand.live" OR requesturl CONTAINS "yandx-online.cloud" OR requesturl CONTAINS "y-ml.co" OR requesturl CONTAINS "docs-drive.online" OR requesturl CONTAINS "docs-info.online" OR requesturl CONTAINS "cloud-mail.online" OR requesturl CONTAINS "onlinecloud365.live" OR requesturl CONTAINS "pdf-cloud.online" OR requesturl CONTAINS "pdf-shared.online" OR requesturl CONTAINS "proton-pdf.online" OR requesturl CONTAINS "proton-view.online" OR requesturl CONTAINS "office365-online.live" OR requesturl CONTAINS "doc-viewer.com" OR requesturl CONTAINS "file-milgov.systems" OR requesturl CONTAINS "office-protection.online")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "cache-dns.com" OR destinationhostname CONTAINS "sekoia.io" OR destinationhostname CONTAINS "cache-dns-forwarding.com" OR destinationhostname CONTAINS "cache-dns-preview.com" OR destinationhostname CONTAINS "cache-docs.com" OR destinationhostname CONTAINS "cache-pdf.com" OR destinationhostname CONTAINS "cache-pdf.online" OR destinationhostname CONTAINS "cache-services.live" OR destinationhostname CONTAINS "cloud-docs.com" OR destinationhostname CONTAINS "cloud-drive.live" OR destinationhostname CONTAINS "cloud-storage.live" OR destinationhostname CONTAINS "docs-cache.com" OR destinationhostname CONTAINS "docs-forwarding.online" OR destinationhostname CONTAINS "docs-info.com" OR destinationhostname CONTAINS "docs-shared.com" OR destinationhostname CONTAINS "docs-shared.online" OR destinationhostname CONTAINS "docs-view.online" OR destinationhostname CONTAINS "document-forwarding.com" OR destinationhostname CONTAINS "document-online.live" OR destinationhostname CONTAINS "document-preview.com" OR destinationhostname CONTAINS "documents-cloud.com" OR destinationhostname CONTAINS "documents-cloud.online" OR destinationhostname CONTAINS "documents-forwarding.com" OR destinationhostname CONTAINS "document-share.live" OR destinationhostname CONTAINS "documents-online.live" OR destinationhostname CONTAINS "documents-pdf.online" OR destinationhostname CONTAINS "documents-preview.com" OR destinationhostname CONTAINS "documents-view.live" OR destinationhostname CONTAINS "document-view.live" OR destinationhostname CONTAINS "drive-docs.com" OR destinationhostname CONTAINS "drive-share.live" OR destinationhostname CONTAINS "goo-link.online" OR destinationhostname CONTAINS "hypertextteches.com" OR destinationhostname CONTAINS "mail-docs.online" OR destinationhostname CONTAINS "officeonline365.live" OR destinationhostname CONTAINS "online365-office.com" OR destinationhostname CONTAINS "online-document.live" OR destinationhostname CONTAINS "online-storage.live" OR destinationhostname CONTAINS "pdf-cache.com" OR destinationhostname CONTAINS "pdf-cache.online" OR destinationhostname CONTAINS "pdf-docs.online" OR destinationhostname CONTAINS "pdf-forwarding.online" OR destinationhostname CONTAINS "protection-checklinks.xyz" OR destinationhostname CONTAINS "protection-link.online" OR destinationhostname CONTAINS "protectionmail.online" OR destinationhostname CONTAINS "protection-office.live" OR destinationhostname CONTAINS "protect-link.online" OR destinationhostname CONTAINS "proton-docs.com" OR destinationhostname CONTAINS "proton-reader.com" OR destinationhostname CONTAINS "proton-viewer.com")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "cache-dns.com" OR sourcentdomain CONTAINS "sekoia.io" OR sourcentdomain CONTAINS "cache-dns-forwarding.com" OR sourcentdomain CONTAINS "cache-dns-preview.com" OR sourcentdomain CONTAINS "cache-docs.com" OR sourcentdomain CONTAINS "cache-pdf.com" OR sourcentdomain CONTAINS "cache-pdf.online" OR sourcentdomain CONTAINS "cache-services.live" OR sourcentdomain CONTAINS "cloud-docs.com" OR sourcentdomain CONTAINS "cloud-drive.live" OR sourcentdomain CONTAINS "cloud-storage.live" OR sourcentdomain CONTAINS "docs-cache.com" OR sourcentdomain CONTAINS "docs-forwarding.online" OR sourcentdomain CONTAINS "docs-info.com" OR sourcentdomain CONTAINS "docs-shared.com" OR sourcentdomain CONTAINS "docs-shared.online" OR sourcentdomain CONTAINS "docs-view.online" OR sourcentdomain CONTAINS "document-forwarding.com" OR sourcentdomain CONTAINS "document-online.live" OR sourcentdomain CONTAINS "document-preview.com" OR sourcentdomain CONTAINS "documents-cloud.com" OR sourcentdomain CONTAINS "documents-cloud.online" OR sourcentdomain CONTAINS "documents-forwarding.com" OR sourcentdomain CONTAINS "document-share.live" OR sourcentdomain CONTAINS "documents-online.live" OR sourcentdomain CONTAINS "documents-pdf.online" OR sourcentdomain CONTAINS "documents-preview.com" OR sourcentdomain CONTAINS "documents-view.live" OR sourcentdomain CONTAINS "document-view.live" OR sourcentdomain CONTAINS "drive-docs.com" OR sourcentdomain CONTAINS "drive-share.live" OR sourcentdomain CONTAINS "goo-link.online" OR sourcentdomain CONTAINS "hypertextteches.com" OR sourcentdomain CONTAINS "mail-docs.online" OR sourcentdomain CONTAINS "officeonline365.live" OR sourcentdomain CONTAINS "online365-office.com" OR sourcentdomain CONTAINS "online-document.live" OR sourcentdomain CONTAINS "online-storage.live" OR sourcentdomain CONTAINS "pdf-cache.com" OR sourcentdomain CONTAINS "pdf-cache.online" OR sourcentdomain CONTAINS "pdf-docs.online" OR sourcentdomain CONTAINS "pdf-forwarding.online" OR sourcentdomain CONTAINS "protection-checklinks.xyz" OR sourcentdomain CONTAINS "protection-link.online" OR sourcentdomain CONTAINS "protectionmail.online" OR sourcentdomain CONTAINS "protection-office.live" OR sourcentdomain CONTAINS "protect-link.online" OR sourcentdomain CONTAINS "proton-docs.com" OR sourcentdomain CONTAINS "proton-reader.com" OR sourcentdomain CONTAINS "proton-viewer.com")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "cache-dns.com" OR sourcehostname CONTAINS "sekoia.io" OR sourcehostname CONTAINS "cache-dns-forwarding.com" OR sourcehostname CONTAINS "cache-dns-preview.com" OR sourcehostname CONTAINS "cache-docs.com" OR sourcehostname CONTAINS "cache-pdf.com" OR sourcehostname CONTAINS "cache-pdf.online" OR sourcehostname CONTAINS "cache-services.live" OR sourcehostname CONTAINS "cloud-docs.com" OR sourcehostname CONTAINS "cloud-drive.live" OR sourcehostname CONTAINS "cloud-storage.live" OR sourcehostname CONTAINS "docs-cache.com" OR sourcehostname CONTAINS "docs-forwarding.online" OR sourcehostname CONTAINS "docs-info.com" OR sourcehostname CONTAINS "docs-shared.com" OR sourcehostname CONTAINS "docs-shared.online" OR sourcehostname CONTAINS "docs-view.online" OR sourcehostname CONTAINS "document-forwarding.com" OR sourcehostname CONTAINS "document-online.live" OR sourcehostname CONTAINS "document-preview.com" OR sourcehostname CONTAINS "documents-cloud.com" OR sourcehostname CONTAINS "documents-cloud.online" OR sourcehostname CONTAINS "documents-forwarding.com" OR sourcehostname CONTAINS "document-share.live" OR sourcehostname CONTAINS "documents-online.live" OR sourcehostname CONTAINS "documents-pdf.online" OR sourcehostname CONTAINS "documents-preview.com" OR sourcehostname CONTAINS "documents-view.live" OR sourcehostname CONTAINS "document-view.live" OR sourcehostname CONTAINS "drive-docs.com" OR sourcehostname CONTAINS "drive-share.live" OR sourcehostname CONTAINS "goo-link.online" OR sourcehostname CONTAINS "hypertextteches.com" OR sourcehostname CONTAINS "mail-docs.online" OR sourcehostname CONTAINS "officeonline365.live" OR sourcehostname CONTAINS "online365-office.com" OR sourcehostname CONTAINS "online-document.live" OR sourcehostname CONTAINS "online-storage.live" OR sourcehostname CONTAINS "pdf-cache.com" OR sourcehostname CONTAINS "pdf-cache.online" OR sourcehostname CONTAINS "pdf-docs.online" OR sourcehostname CONTAINS "pdf-forwarding.online" OR sourcehostname CONTAINS "protection-checklinks.xyz" OR sourcehostname CONTAINS "protection-link.online" OR sourcehostname CONTAINS "protectionmail.online" OR sourcehostname CONTAINS "protection-office.live" OR sourcehostname CONTAINS "protect-link.online" OR sourcehostname CONTAINS "proton-docs.com" OR sourcehostname CONTAINS "proton-reader.com" OR sourcehostname CONTAINS "proton-viewer.com")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "cache-dns.com" OR destinationntdomain CONTAINS "sekoia.io" OR destinationntdomain CONTAINS "cache-dns-forwarding.com" OR destinationntdomain CONTAINS "cache-dns-preview.com" OR destinationntdomain CONTAINS "cache-docs.com" OR destinationntdomain CONTAINS "cache-pdf.com" OR destinationntdomain CONTAINS "cache-pdf.online" OR destinationntdomain CONTAINS "cache-services.live" OR destinationntdomain CONTAINS "cloud-docs.com" OR destinationntdomain CONTAINS "cloud-drive.live" OR destinationntdomain CONTAINS "cloud-storage.live" OR destinationntdomain CONTAINS "docs-cache.com" OR destinationntdomain CONTAINS "docs-forwarding.online" OR destinationntdomain CONTAINS "docs-info.com" OR destinationntdomain CONTAINS "docs-shared.com" OR destinationntdomain CONTAINS "docs-shared.online" OR destinationntdomain CONTAINS "docs-view.online" OR destinationntdomain CONTAINS "document-forwarding.com" OR destinationntdomain CONTAINS "document-online.live" OR destinationntdomain CONTAINS "document-preview.com" OR destinationntdomain CONTAINS "documents-cloud.com" OR destinationntdomain CONTAINS "documents-cloud.online" OR destinationntdomain CONTAINS "documents-forwarding.com" OR destinationntdomain CONTAINS "document-share.live" OR destinationntdomain CONTAINS "documents-online.live" OR destinationntdomain CONTAINS "documents-pdf.online" OR destinationntdomain CONTAINS "documents-preview.com" OR destinationntdomain CONTAINS "documents-view.live" OR destinationntdomain CONTAINS "document-view.live" OR destinationntdomain CONTAINS "drive-docs.com" OR destinationntdomain CONTAINS "drive-share.live" OR destinationntdomain CONTAINS "goo-link.online" OR destinationntdomain CONTAINS "hypertextteches.com" OR destinationntdomain CONTAINS "mail-docs.online" OR destinationntdomain CONTAINS "officeonline365.live" OR destinationntdomain CONTAINS "online365-office.com" OR destinationntdomain CONTAINS "online-document.live" OR destinationntdomain CONTAINS "online-storage.live" OR destinationntdomain CONTAINS "pdf-cache.com" OR destinationntdomain CONTAINS "pdf-cache.online" OR destinationntdomain CONTAINS "pdf-docs.online" OR destinationntdomain CONTAINS "pdf-forwarding.online" OR destinationntdomain CONTAINS "protection-checklinks.xyz" OR destinationntdomain CONTAINS "protection-link.online" OR destinationntdomain CONTAINS "protectionmail.online" OR destinationntdomain CONTAINS "protection-office.live" OR destinationntdomain CONTAINS "protect-link.online" OR destinationntdomain CONTAINS "proton-docs.com" OR destinationntdomain CONTAINS "proton-reader.com" OR destinationntdomain CONTAINS "proton-viewer.com")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND requesturl NOT NULL AND (requesturl CONTAINS "cache-dns.com" OR requesturl CONTAINS "sekoia.io" OR requesturl CONTAINS "cache-dns-forwarding.com" OR requesturl CONTAINS "cache-dns-preview.com" OR requesturl CONTAINS "cache-docs.com" OR requesturl CONTAINS "cache-pdf.com" OR requesturl CONTAINS "cache-pdf.online" OR requesturl CONTAINS "cache-services.live" OR requesturl CONTAINS "cloud-docs.com" OR requesturl CONTAINS "cloud-drive.live" OR requesturl CONTAINS "cloud-storage.live" OR requesturl CONTAINS "docs-cache.com" OR requesturl CONTAINS "docs-forwarding.online" OR requesturl CONTAINS "docs-info.com" OR requesturl CONTAINS "docs-shared.com" OR requesturl CONTAINS "docs-shared.online" OR requesturl CONTAINS "docs-view.online" OR requesturl CONTAINS "document-forwarding.com" OR requesturl CONTAINS "document-online.live" OR requesturl CONTAINS "document-preview.com" OR requesturl CONTAINS "documents-cloud.com" OR requesturl CONTAINS "documents-cloud.online" OR requesturl CONTAINS "documents-forwarding.com" OR requesturl CONTAINS "document-share.live" OR requesturl CONTAINS "documents-online.live" OR requesturl CONTAINS "documents-pdf.online" OR requesturl CONTAINS "documents-preview.com" OR requesturl CONTAINS "documents-view.live" OR requesturl CONTAINS "document-view.live" OR requesturl CONTAINS "drive-docs.com" OR requesturl CONTAINS "drive-share.live" OR requesturl CONTAINS "goo-link.online" OR requesturl CONTAINS "hypertextteches.com" OR requesturl CONTAINS "mail-docs.online" OR requesturl CONTAINS "officeonline365.live" OR requesturl CONTAINS "online365-office.com" OR requesturl CONTAINS "online-document.live" OR requesturl CONTAINS "online-storage.live" OR requesturl CONTAINS "pdf-cache.com" OR requesturl CONTAINS "pdf-cache.online" OR requesturl CONTAINS "pdf-docs.online" OR requesturl CONTAINS "pdf-forwarding.online" OR requesturl CONTAINS "protection-checklinks.xyz" OR requesturl CONTAINS "protection-link.online" OR requesturl CONTAINS "protectionmail.online" OR requesturl CONTAINS "protection-office.live" OR requesturl CONTAINS "protect-link.online" OR requesturl CONTAINS "proton-docs.com" OR requesturl CONTAINS "proton-reader.com" OR requesturl CONTAINS "proton-viewer.com")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "relogin-dashboard.online" OR destinationhostname CONTAINS "safe-connection.online" OR destinationhostname CONTAINS "safelinks-protect.live" OR destinationhostname CONTAINS "secureoffice.live" OR destinationhostname CONTAINS "webresources.live" OR destinationhostname CONTAINS "word-yand.live" OR destinationhostname CONTAINS "yandx-online.cloud" OR destinationhostname CONTAINS "y-ml.co" OR destinationhostname CONTAINS "docs-drive.online" OR destinationhostname CONTAINS "docs-info.online" OR destinationhostname CONTAINS "cloud-mail.online" OR destinationhostname CONTAINS "onlinecloud365.live" OR destinationhostname CONTAINS "pdf-cloud.online" OR destinationhostname CONTAINS "pdf-shared.online" OR destinationhostname CONTAINS "proton-pdf.online" OR destinationhostname CONTAINS "proton-view.online" OR destinationhostname CONTAINS "office365-online.live" OR destinationhostname CONTAINS "doc-viewer.com" OR destinationhostname CONTAINS "file-milgov.systems" OR destinationhostname CONTAINS "office-protection.online")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "relogin-dashboard.online" OR sourcentdomain CONTAINS "safe-connection.online" OR sourcentdomain CONTAINS "safelinks-protect.live" OR sourcentdomain CONTAINS "secureoffice.live" OR sourcentdomain CONTAINS "webresources.live" OR sourcentdomain CONTAINS "word-yand.live" OR sourcentdomain CONTAINS "yandx-online.cloud" OR sourcentdomain CONTAINS "y-ml.co" OR sourcentdomain CONTAINS "docs-drive.online" OR sourcentdomain CONTAINS "docs-info.online" OR sourcentdomain CONTAINS "cloud-mail.online" OR sourcentdomain CONTAINS "onlinecloud365.live" OR sourcentdomain CONTAINS "pdf-cloud.online" OR sourcentdomain CONTAINS "pdf-shared.online" OR sourcentdomain CONTAINS "proton-pdf.online" OR sourcentdomain CONTAINS "proton-view.online" OR sourcentdomain CONTAINS "office365-online.live" OR sourcentdomain CONTAINS "doc-viewer.com" OR sourcentdomain CONTAINS "file-milgov.systems" OR sourcentdomain CONTAINS "office-protection.online")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "relogin-dashboard.online" OR sourcehostname CONTAINS "safe-connection.online" OR sourcehostname CONTAINS "safelinks-protect.live" OR sourcehostname CONTAINS "secureoffice.live" OR sourcehostname CONTAINS "webresources.live" OR sourcehostname CONTAINS "word-yand.live" OR sourcehostname CONTAINS "yandx-online.cloud" OR sourcehostname CONTAINS "y-ml.co" OR sourcehostname CONTAINS "docs-drive.online" OR sourcehostname CONTAINS "docs-info.online" OR sourcehostname CONTAINS "cloud-mail.online" OR sourcehostname CONTAINS "onlinecloud365.live" OR sourcehostname CONTAINS "pdf-cloud.online" OR sourcehostname CONTAINS "pdf-shared.online" OR sourcehostname CONTAINS "proton-pdf.online" OR sourcehostname CONTAINS "proton-view.online" OR sourcehostname CONTAINS "office365-online.live" OR sourcehostname CONTAINS "doc-viewer.com" OR sourcehostname CONTAINS "file-milgov.systems" OR sourcehostname CONTAINS "office-protection.online")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "relogin-dashboard.online" OR destinationntdomain CONTAINS "safe-connection.online" OR destinationntdomain CONTAINS "safelinks-protect.live" OR destinationntdomain CONTAINS "secureoffice.live" OR destinationntdomain CONTAINS "webresources.live" OR destinationntdomain CONTAINS "word-yand.live" OR destinationntdomain CONTAINS "yandx-online.cloud" OR destinationntdomain CONTAINS "y-ml.co" OR destinationntdomain CONTAINS "docs-drive.online" OR destinationntdomain CONTAINS "docs-info.online" OR destinationntdomain CONTAINS "cloud-mail.online" OR destinationntdomain CONTAINS "onlinecloud365.live" OR destinationntdomain CONTAINS "pdf-cloud.online" OR destinationntdomain CONTAINS "pdf-shared.online" OR destinationntdomain CONTAINS "proton-pdf.online" OR destinationntdomain CONTAINS "proton-view.online" OR destinationntdomain CONTAINS "office365-online.live" OR destinationntdomain CONTAINS "doc-viewer.com" OR destinationntdomain CONTAINS "file-milgov.systems" OR destinationntdomain CONTAINS "office-protection.online")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND requesturl NOT NULL AND (requesturl CONTAINS "relogin-dashboard.online" OR requesturl CONTAINS "safe-connection.online" OR requesturl CONTAINS "safelinks-protect.live" OR requesturl CONTAINS "secureoffice.live" OR requesturl CONTAINS "webresources.live" OR requesturl CONTAINS "word-yand.live" OR requesturl CONTAINS "yandx-online.cloud" OR requesturl CONTAINS "y-ml.co" OR requesturl CONTAINS "docs-drive.online" OR requesturl CONTAINS "docs-info.online" OR requesturl CONTAINS "cloud-mail.online" OR requesturl CONTAINS "onlinecloud365.live" OR requesturl CONTAINS "pdf-cloud.online" OR requesturl CONTAINS "pdf-shared.online" OR requesturl CONTAINS "proton-pdf.online" OR requesturl CONTAINS "proton-view.online" OR requesturl CONTAINS "office365-online.live" OR requesturl CONTAINS "doc-viewer.com" OR requesturl CONTAINS "file-milgov.systems" OR requesturl CONTAINS "office-protection.online")
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "cache-dns.com" OR destinationhostname CONTAINS "sekoia.io" OR destinationhostname CONTAINS "cache-dns-forwarding.com" OR destinationhostname CONTAINS "cache-dns-preview.com" OR destinationhostname CONTAINS "cache-docs.com" OR destinationhostname CONTAINS "cache-pdf.com" OR destinationhostname CONTAINS "cache-pdf.online" OR destinationhostname CONTAINS "cache-services.live" OR destinationhostname CONTAINS "cloud-docs.com" OR destinationhostname CONTAINS "cloud-drive.live" OR destinationhostname CONTAINS "cloud-storage.live" OR destinationhostname CONTAINS "docs-cache.com" OR destinationhostname CONTAINS "docs-forwarding.online" OR destinationhostname CONTAINS "docs-info.com" OR destinationhostname CONTAINS "docs-shared.com" OR destinationhostname CONTAINS "docs-shared.online" OR destinationhostname CONTAINS "docs-view.online" OR destinationhostname CONTAINS "document-forwarding.com" OR destinationhostname CONTAINS "document-online.live" OR destinationhostname CONTAINS "document-preview.com" OR destinationhostname CONTAINS "documents-cloud.com" OR destinationhostname CONTAINS "documents-cloud.online" OR destinationhostname CONTAINS "documents-forwarding.com" OR destinationhostname CONTAINS "document-share.live" OR destinationhostname CONTAINS "documents-online.live" OR destinationhostname CONTAINS "documents-pdf.online" OR destinationhostname CONTAINS "documents-preview.com" OR destinationhostname CONTAINS "documents-view.live" OR destinationhostname CONTAINS "document-view.live" OR destinationhostname CONTAINS "drive-docs.com" OR destinationhostname CONTAINS "drive-share.live" OR destinationhostname CONTAINS "goo-link.online" OR destinationhostname CONTAINS "hypertextteches.com" OR destinationhostname CONTAINS "mail-docs.online" OR destinationhostname CONTAINS "officeonline365.live" OR destinationhostname CONTAINS "online365-office.com" OR destinationhostname CONTAINS "online-document.live" OR destinationhostname CONTAINS "online-storage.live" OR destinationhostname CONTAINS "pdf-cache.com" OR destinationhostname CONTAINS "pdf-cache.online" OR destinationhostname CONTAINS "pdf-docs.online" OR destinationhostname CONTAINS "pdf-forwarding.online" OR destinationhostname CONTAINS "protection-checklinks.xyz" OR destinationhostname CONTAINS "protection-link.online" OR destinationhostname CONTAINS "protectionmail.online" OR destinationhostname CONTAINS "protection-office.live" OR destinationhostname CONTAINS "protect-link.online" OR destinationhostname CONTAINS "proton-docs.com" OR destinationhostname CONTAINS "proton-reader.com" OR destinationhostname CONTAINS "proton-viewer.com")
index=activity AND rg_functionality="Cloud Application Security Broker" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "cache-dns.com" OR sourcentdomain CONTAINS "sekoia.io" OR sourcentdomain CONTAINS "cache-dns-forwarding.com" OR sourcentdomain CONTAINS "cache-dns-preview.com" OR sourcentdomain CONTAINS "cache-docs.com" OR sourcentdomain CONTAINS "cache-pdf.com" OR sourcentdomain CONTAINS "cache-pdf.online" OR sourcentdomain CONTAINS "cache-services.live" OR sourcentdomain CONTAINS "cloud-docs.com" OR sourcentdomain CONTAINS "cloud-drive.live" OR sourcentdomain CONTAINS "cloud-storage.live" OR sourcentdomain CONTAINS "docs-cache.com" OR sourcentdomain CONTAINS "docs-forwarding.online" OR sourcentdomain CONTAINS "docs-info.com" OR sourcentdomain CONTAINS "docs-shared.com" OR sourcentdomain CONTAINS "docs-shared.online" OR sourcentdomain CONTAINS "docs-view.online" OR sourcentdomain CONTAINS "document-forwarding.com" OR sourcentdomain CONTAINS "document-online.live" OR sourcentdomain CONTAINS "document-preview.com" OR sourcentdomain CONTAINS "documents-cloud.com" OR sourcentdomain CONTAINS "documents-cloud.online" OR sourcentdomain CONTAINS "documents-forwarding.com" OR sourcentdomain CONTAINS "document-share.live" OR sourcentdomain CONTAINS "documents-online.live" OR sourcentdomain CONTAINS "documents-pdf.online" OR sourcentdomain CONTAINS "documents-preview.com" OR sourcentdomain CONTAINS "documents-view.live" OR sourcentdomain CONTAINS "document-view.live" OR sourcentdomain CONTAINS "drive-docs.com" OR sourcentdomain CONTAINS "drive-share.live" OR sourcentdomain CONTAINS "goo-link.online" OR sourcentdomain CONTAINS "hypertextteches.com" OR sourcentdomain CONTAINS "mail-docs.online" OR sourcentdomain CONTAINS "officeonline365.live" OR sourcentdomain CONTAINS "online365-office.com" OR sourcentdomain CONTAINS "online-document.live" OR sourcentdomain CONTAINS "online-storage.live" OR sourcentdomain CONTAINS "pdf-cache.com" OR sourcentdomain CONTAINS "pdf-cache.online" OR sourcentdomain CONTAINS "pdf-docs.online" OR sourcentdomain CONTAINS "pdf-forwarding.online" OR sourcentdomain CONTAINS "protection-checklinks.xyz" OR sourcentdomain CONTAINS "protection-link.online" OR sourcentdomain CONTAINS "protectionmail.online" OR sourcentdomain CONTAINS "protection-office.live" OR sourcentdomain CONTAINS "protect-link.online" OR sourcentdomain CONTAINS "proton-docs.com" OR sourcentdomain CONTAINS "proton-reader.com" OR sourcentdomain CONTAINS "proton-viewer.com")
index=activity AND rg_functionality="Cloud Application Security Broker" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "cache-dns.com" OR sourcehostname CONTAINS "sekoia.io" OR sourcehostname CONTAINS "cache-dns-forwarding.com" OR sourcehostname CONTAINS "cache-dns-preview.com" OR sourcehostname CONTAINS "cache-docs.com" OR sourcehostname CONTAINS "cache-pdf.com" OR sourcehostname CONTAINS "cache-pdf.online" OR sourcehostname CONTAINS "cache-services.live" OR sourcehostname CONTAINS "cloud-docs.com" OR sourcehostname CONTAINS "cloud-drive.live" OR sourcehostname CONTAINS "cloud-storage.live" OR sourcehostname CONTAINS "docs-cache.com" OR sourcehostname CONTAINS "docs-forwarding.online" OR sourcehostname CONTAINS "docs-info.com" OR sourcehostname CONTAINS "docs-shared.com" OR sourcehostname CONTAINS "docs-shared.online" OR sourcehostname CONTAINS "docs-view.online" OR sourcehostname CONTAINS "document-forwarding.com" OR sourcehostname CONTAINS "document-online.live" OR sourcehostname CONTAINS "document-preview.com" OR sourcehostname CONTAINS "documents-cloud.com" OR sourcehostname CONTAINS "documents-cloud.online" OR sourcehostname CONTAINS "documents-forwarding.com" OR sourcehostname CONTAINS "document-share.live" OR sourcehostname CONTAINS "documents-online.live" OR sourcehostname CONTAINS "documents-pdf.online" OR sourcehostname CONTAINS "documents-preview.com" OR sourcehostname CONTAINS "documents-view.live" OR sourcehostname CONTAINS "document-view.live" OR sourcehostname CONTAINS "drive-docs.com" OR sourcehostname CONTAINS "drive-share.live" OR sourcehostname CONTAINS "goo-link.online" OR sourcehostname CONTAINS "hypertextteches.com" OR sourcehostname CONTAINS "mail-docs.online" OR sourcehostname CONTAINS "officeonline365.live" OR sourcehostname CONTAINS "online365-office.com" OR sourcehostname CONTAINS "online-document.live" OR sourcehostname CONTAINS "online-storage.live" OR sourcehostname CONTAINS "pdf-cache.com" OR sourcehostname CONTAINS "pdf-cache.online" OR sourcehostname CONTAINS "pdf-docs.online" OR sourcehostname CONTAINS "pdf-forwarding.online" OR sourcehostname CONTAINS "protection-checklinks.xyz" OR sourcehostname CONTAINS "protection-link.online" OR sourcehostname CONTAINS "protectionmail.online" OR sourcehostname CONTAINS "protection-office.live" OR sourcehostname CONTAINS "protect-link.online" OR sourcehostname CONTAINS "proton-docs.com" OR sourcehostname CONTAINS "proton-reader.com" OR sourcehostname CONTAINS "proton-viewer.com")
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "cache-dns.com" OR destinationntdomain CONTAINS "sekoia.io" OR destinationntdomain CONTAINS "cache-dns-forwarding.com" OR destinationntdomain CONTAINS "cache-dns-preview.com" OR destinationntdomain CONTAINS "cache-docs.com" OR destinationntdomain CONTAINS "cache-pdf.com" OR destinationntdomain CONTAINS "cache-pdf.online" OR destinationntdomain CONTAINS "cache-services.live" OR destinationntdomain CONTAINS "cloud-docs.com" OR destinationntdomain CONTAINS "cloud-drive.live" OR destinationntdomain CONTAINS "cloud-storage.live" OR destinationntdomain CONTAINS "docs-cache.com" OR destinationntdomain CONTAINS "docs-forwarding.online" OR destinationntdomain CONTAINS "docs-info.com" OR destinationntdomain CONTAINS "docs-shared.com" OR destinationntdomain CONTAINS "docs-shared.online" OR destinationntdomain CONTAINS "docs-view.online" OR destinationntdomain CONTAINS "document-forwarding.com" OR destinationntdomain CONTAINS "document-online.live" OR destinationntdomain CONTAINS "document-preview.com" OR destinationntdomain CONTAINS "documents-cloud.com" OR destinationntdomain CONTAINS "documents-cloud.online" OR destinationntdomain CONTAINS "documents-forwarding.com" OR destinationntdomain CONTAINS "document-share.live" OR destinationntdomain CONTAINS "documents-online.live" OR destinationntdomain CONTAINS "documents-pdf.online" OR destinationntdomain CONTAINS "documents-preview.com" OR destinationntdomain CONTAINS "documents-view.live" OR destinationntdomain CONTAINS "document-view.live" OR destinationntdomain CONTAINS "drive-docs.com" OR destinationntdomain CONTAINS "drive-share.live" OR destinationntdomain CONTAINS "goo-link.online" OR destinationntdomain CONTAINS "hypertextteches.com" OR destinationntdomain CONTAINS "mail-docs.online" OR destinationntdomain CONTAINS "officeonline365.live" OR destinationntdomain CONTAINS "online365-office.com" OR destinationntdomain CONTAINS "online-document.live" OR destinationntdomain CONTAINS "online-storage.live" OR destinationntdomain CONTAINS "pdf-cache.com" OR destinationntdomain CONTAINS "pdf-cache.online" OR destinationntdomain CONTAINS "pdf-docs.online" OR destinationntdomain CONTAINS "pdf-forwarding.online" OR destinationntdomain CONTAINS "protection-checklinks.xyz" OR destinationntdomain CONTAINS "protection-link.online" OR destinationntdomain CONTAINS "protectionmail.online" OR destinationntdomain CONTAINS "protection-office.live" OR destinationntdomain CONTAINS "protect-link.online" OR destinationntdomain CONTAINS "proton-docs.com" OR destinationntdomain CONTAINS "proton-reader.com" OR destinationntdomain CONTAINS "proton-viewer.com")
index=activity AND rg_functionality="Cloud Application Security Broker" AND requesturl NOT NULL AND (requesturl CONTAINS "cache-dns.com" OR requesturl CONTAINS "sekoia.io" OR requesturl CONTAINS "cache-dns-forwarding.com" OR requesturl CONTAINS "cache-dns-preview.com" OR requesturl CONTAINS "cache-docs.com" OR requesturl CONTAINS "cache-pdf.com" OR requesturl CONTAINS "cache-pdf.online" OR requesturl CONTAINS "cache-services.live" OR requesturl CONTAINS "cloud-docs.com" OR requesturl CONTAINS "cloud-drive.live" OR requesturl CONTAINS "cloud-storage.live" OR requesturl CONTAINS "docs-cache.com" OR requesturl CONTAINS "docs-forwarding.online" OR requesturl CONTAINS "docs-info.com" OR requesturl CONTAINS "docs-shared.com" OR requesturl CONTAINS "docs-shared.online" OR requesturl CONTAINS "docs-view.online" OR requesturl CONTAINS "document-forwarding.com" OR requesturl CONTAINS "document-online.live" OR requesturl CONTAINS "document-preview.com" OR requesturl CONTAINS "documents-cloud.com" OR requesturl CONTAINS "documents-cloud.online" OR requesturl CONTAINS "documents-forwarding.com" OR requesturl CONTAINS "document-share.live" OR requesturl CONTAINS "documents-online.live" OR requesturl CONTAINS "documents-pdf.online" OR requesturl CONTAINS "documents-preview.com" OR requesturl CONTAINS "documents-view.live" OR requesturl CONTAINS "document-view.live" OR requesturl CONTAINS "drive-docs.com" OR requesturl CONTAINS "drive-share.live" OR requesturl CONTAINS "goo-link.online" OR requesturl CONTAINS "hypertextteches.com" OR requesturl CONTAINS "mail-docs.online" OR requesturl CONTAINS "officeonline365.live" OR requesturl CONTAINS "online365-office.com" OR requesturl CONTAINS "online-document.live" OR requesturl CONTAINS "online-storage.live" OR requesturl CONTAINS "pdf-cache.com" OR requesturl CONTAINS "pdf-cache.online" OR requesturl CONTAINS "pdf-docs.online" OR requesturl CONTAINS "pdf-forwarding.online" OR requesturl CONTAINS "protection-checklinks.xyz" OR requesturl CONTAINS "protection-link.online" OR requesturl CONTAINS "protectionmail.online" OR requesturl CONTAINS "protection-office.live" OR requesturl CONTAINS "protect-link.online" OR requesturl CONTAINS "proton-docs.com" OR requesturl CONTAINS "proton-reader.com" OR requesturl CONTAINS "proton-viewer.com")
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "relogin-dashboard.online" OR destinationhostname CONTAINS "safe-connection.online" OR destinationhostname CONTAINS "safelinks-protect.live" OR destinationhostname CONTAINS "secureoffice.live" OR destinationhostname CONTAINS "webresources.live" OR destinationhostname CONTAINS "word-yand.live" OR destinationhostname CONTAINS "yandx-online.cloud" OR destinationhostname CONTAINS "y-ml.co" OR destinationhostname CONTAINS "docs-drive.online" OR destinationhostname CONTAINS "docs-info.online" OR destinationhostname CONTAINS "cloud-mail.online" OR destinationhostname CONTAINS "onlinecloud365.live" OR destinationhostname CONTAINS "pdf-cloud.online" OR destinationhostname CONTAINS "pdf-shared.online" OR destinationhostname CONTAINS "proton-pdf.online" OR destinationhostname CONTAINS "proton-view.online" OR destinationhostname CONTAINS "office365-online.live" OR destinationhostname CONTAINS "doc-viewer.com" OR destinationhostname CONTAINS "file-milgov.systems" OR destinationhostname CONTAINS "office-protection.online")
index=activity AND rg_functionality="Cloud Application Security Broker" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "relogin-dashboard.online" OR sourcentdomain CONTAINS "safe-connection.online" OR sourcentdomain CONTAINS "safelinks-protect.live" OR sourcentdomain CONTAINS "secureoffice.live" OR sourcentdomain CONTAINS "webresources.live" OR sourcentdomain CONTAINS "word-yand.live" OR sourcentdomain CONTAINS "yandx-online.cloud" OR sourcentdomain CONTAINS "y-ml.co" OR sourcentdomain CONTAINS "docs-drive.online" OR sourcentdomain CONTAINS "docs-info.online" OR sourcentdomain CONTAINS "cloud-mail.online" OR sourcentdomain CONTAINS "onlinecloud365.live" OR sourcentdomain CONTAINS "pdf-cloud.online" OR sourcentdomain CONTAINS "pdf-shared.online" OR sourcentdomain CONTAINS "proton-pdf.online" OR sourcentdomain CONTAINS "proton-view.online" OR sourcentdomain CONTAINS "office365-online.live" OR sourcentdomain CONTAINS "doc-viewer.com" OR sourcentdomain CONTAINS "file-milgov.systems" OR sourcentdomain CONTAINS "office-protection.online")
index=activity AND rg_functionality="Cloud Application Security Broker" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "relogin-dashboard.online" OR sourcehostname CONTAINS "safe-connection.online" OR sourcehostname CONTAINS "safelinks-protect.live" OR sourcehostname CONTAINS "secureoffice.live" OR sourcehostname CONTAINS "webresources.live" OR sourcehostname CONTAINS "word-yand.live" OR sourcehostname CONTAINS "yandx-online.cloud" OR sourcehostname CONTAINS "y-ml.co" OR sourcehostname CONTAINS "docs-drive.online" OR sourcehostname CONTAINS "docs-info.online" OR sourcehostname CONTAINS "cloud-mail.online" OR sourcehostname CONTAINS "onlinecloud365.live" OR sourcehostname CONTAINS "pdf-cloud.online" OR sourcehostname CONTAINS "pdf-shared.online" OR sourcehostname CONTAINS "proton-pdf.online" OR sourcehostname CONTAINS "proton-view.online" OR sourcehostname CONTAINS "office365-online.live" OR sourcehostname CONTAINS "doc-viewer.com" OR sourcehostname CONTAINS "file-milgov.systems" OR sourcehostname CONTAINS "office-protection.online")
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "relogin-dashboard.online" OR destinationntdomain CONTAINS "safe-connection.online" OR destinationntdomain CONTAINS "safelinks-protect.live" OR destinationntdomain CONTAINS "secureoffice.live" OR destinationntdomain CONTAINS "webresources.live" OR destinationntdomain CONTAINS "word-yand.live" OR destinationntdomain CONTAINS "yandx-online.cloud" OR destinationntdomain CONTAINS "y-ml.co" OR destinationntdomain CONTAINS "docs-drive.online" OR destinationntdomain CONTAINS "docs-info.online" OR destinationntdomain CONTAINS "cloud-mail.online" OR destinationntdomain CONTAINS "onlinecloud365.live" OR destinationntdomain CONTAINS "pdf-cloud.online" OR destinationntdomain CONTAINS "pdf-shared.online" OR destinationntdomain CONTAINS "proton-pdf.online" OR destinationntdomain CONTAINS "proton-view.online" OR destinationntdomain CONTAINS "office365-online.live" OR destinationntdomain CONTAINS "doc-viewer.com" OR destinationntdomain CONTAINS "file-milgov.systems" OR destinationntdomain CONTAINS "office-protection.online")
index=activity AND rg_functionality="Cloud Application Security Broker" AND requesturl NOT NULL AND (requesturl CONTAINS "relogin-dashboard.online" OR requesturl CONTAINS "safe-connection.online" OR requesturl CONTAINS "safelinks-protect.live" OR requesturl CONTAINS "secureoffice.live" OR requesturl CONTAINS "webresources.live" OR requesturl CONTAINS "word-yand.live" OR requesturl CONTAINS "yandx-online.cloud" OR requesturl CONTAINS "y-ml.co" OR requesturl CONTAINS "docs-drive.online" OR requesturl CONTAINS "docs-info.online" OR requesturl CONTAINS "cloud-mail.online" OR requesturl CONTAINS "onlinecloud365.live" OR requesturl CONTAINS "pdf-cloud.online" OR requesturl CONTAINS "pdf-shared.online" OR requesturl CONTAINS "proton-pdf.online" OR requesturl CONTAINS "proton-view.online" OR requesturl CONTAINS "office365-online.live" OR requesturl CONTAINS "doc-viewer.com" OR requesturl CONTAINS "file-milgov.systems" OR requesturl CONTAINS "office-protection.online")
index=activity AND rg_functionality="Source Code Repository" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "cache-dns.com" OR destinationhostname CONTAINS "sekoia.io" OR destinationhostname CONTAINS "cache-dns-forwarding.com" OR destinationhostname CONTAINS "cache-dns-preview.com" OR destinationhostname CONTAINS "cache-docs.com" OR destinationhostname CONTAINS "cache-pdf.com" OR destinationhostname CONTAINS "cache-pdf.online" OR destinationhostname CONTAINS "cache-services.live" OR destinationhostname CONTAINS "cloud-docs.com" OR destinationhostname CONTAINS "cloud-drive.live" OR destinationhostname CONTAINS "cloud-storage.live" OR destinationhostname CONTAINS "docs-cache.com" OR destinationhostname CONTAINS "docs-forwarding.online" OR destinationhostname CONTAINS "docs-info.com" OR destinationhostname CONTAINS "docs-shared.com" OR destinationhostname CONTAINS "docs-shared.online" OR destinationhostname CONTAINS "docs-view.online" OR destinationhostname CONTAINS "document-forwarding.com" OR destinationhostname CONTAINS "document-online.live" OR destinationhostname CONTAINS "document-preview.com" OR destinationhostname CONTAINS "documents-cloud.com" OR destinationhostname CONTAINS "documents-cloud.online" OR destinationhostname CONTAINS "documents-forwarding.com" OR destinationhostname CONTAINS "document-share.live" OR destinationhostname CONTAINS "documents-online.live" OR destinationhostname CONTAINS "documents-pdf.online" OR destinationhostname CONTAINS "documents-preview.com" OR destinationhostname CONTAINS "documents-view.live" OR destinationhostname CONTAINS "document-view.live" OR destinationhostname CONTAINS "drive-docs.com" OR destinationhostname CONTAINS "drive-share.live" OR destinationhostname CONTAINS "goo-link.online" OR destinationhostname CONTAINS "hypertextteches.com" OR destinationhostname CONTAINS "mail-docs.online" OR destinationhostname CONTAINS "officeonline365.live" OR destinationhostname CONTAINS "online365-office.com" OR destinationhostname CONTAINS "online-document.live" OR destinationhostname CONTAINS "online-storage.live" OR destinationhostname CONTAINS "pdf-cache.com" OR destinationhostname CONTAINS "pdf-cache.online" OR destinationhostname CONTAINS "pdf-docs.online" OR destinationhostname CONTAINS "pdf-forwarding.online" OR destinationhostname CONTAINS "protection-checklinks.xyz" OR destinationhostname CONTAINS "protection-link.online" OR destinationhostname CONTAINS "protectionmail.online" OR destinationhostname CONTAINS "protection-office.live" OR destinationhostname CONTAINS "protect-link.online" OR destinationhostname CONTAINS "proton-docs.com" OR destinationhostname CONTAINS "proton-reader.com" OR destinationhostname CONTAINS "proton-viewer.com")
index=activity AND rg_functionality="Source Code Repository" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "cache-dns.com" OR sourcentdomain CONTAINS "sekoia.io" OR sourcentdomain CONTAINS "cache-dns-forwarding.com" OR sourcentdomain CONTAINS "cache-dns-preview.com" OR sourcentdomain CONTAINS "cache-docs.com" OR sourcentdomain CONTAINS "cache-pdf.com" OR sourcentdomain CONTAINS "cache-pdf.online" OR sourcentdomain CONTAINS "cache-services.live" OR sourcentdomain CONTAINS "cloud-docs.com" OR sourcentdomain CONTAINS "cloud-drive.live" OR sourcentdomain CONTAINS "cloud-storage.live" OR sourcentdomain CONTAINS "docs-cache.com" OR sourcentdomain CONTAINS "docs-forwarding.online" OR sourcentdomain CONTAINS "docs-info.com" OR sourcentdomain CONTAINS "docs-shared.com" OR sourcentdomain CONTAINS "docs-shared.online" OR sourcentdomain CONTAINS "docs-view.online" OR sourcentdomain CONTAINS "document-forwarding.com" OR sourcentdomain CONTAINS "document-online.live" OR sourcentdomain CONTAINS "document-preview.com" OR sourcentdomain CONTAINS "documents-cloud.com" OR sourcentdomain CONTAINS "documents-cloud.online" OR sourcentdomain CONTAINS "documents-forwarding.com" OR sourcentdomain CONTAINS "document-share.live" OR sourcentdomain CONTAINS "documents-online.live" OR sourcentdomain CONTAINS "documents-pdf.online" OR sourcentdomain CONTAINS "documents-preview.com" OR sourcentdomain CONTAINS "documents-view.live" OR sourcentdomain CONTAINS "document-view.live" OR sourcentdomain CONTAINS "drive-docs.com" OR sourcentdomain CONTAINS "drive-share.live" OR sourcentdomain CONTAINS "goo-link.online" OR sourcentdomain CONTAINS "hypertextteches.com" OR sourcentdomain CONTAINS "mail-docs.online" OR sourcentdomain CONTAINS "officeonline365.live" OR sourcentdomain CONTAINS "online365-office.com" OR sourcentdomain CONTAINS "online-document.live" OR sourcentdomain CONTAINS "online-storage.live" OR sourcentdomain CONTAINS "pdf-cache.com" OR sourcentdomain CONTAINS "pdf-cache.online" OR sourcentdomain CONTAINS "pdf-docs.online" OR sourcentdomain CONTAINS "pdf-forwarding.online" OR sourcentdomain CONTAINS "protection-checklinks.xyz" OR sourcentdomain CONTAINS "protection-link.online" OR sourcentdomain CONTAINS "protectionmail.online" OR sourcentdomain CONTAINS "protection-office.live" OR sourcentdomain CONTAINS "protect-link.online" OR sourcentdomain CONTAINS "proton-docs.com" OR sourcentdomain CONTAINS "proton-reader.com" OR sourcentdomain CONTAINS "proton-viewer.com")
index=activity AND rg_functionality="Source Code Repository" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "cache-dns.com" OR sourcehostname CONTAINS "sekoia.io" OR sourcehostname CONTAINS "cache-dns-forwarding.com" OR sourcehostname CONTAINS "cache-dns-preview.com" OR sourcehostname CONTAINS "cache-docs.com" OR sourcehostname CONTAINS "cache-pdf.com" OR sourcehostname CONTAINS "cache-pdf.online" OR sourcehostname CONTAINS "cache-services.live" OR sourcehostname CONTAINS "cloud-docs.com" OR sourcehostname CONTAINS "cloud-drive.live" OR sourcehostname CONTAINS "cloud-storage.live" OR sourcehostname CONTAINS "docs-cache.com" OR sourcehostname CONTAINS "docs-forwarding.online" OR sourcehostname CONTAINS "docs-info.com" OR sourcehostname CONTAINS "docs-shared.com" OR sourcehostname CONTAINS "docs-shared.online" OR sourcehostname CONTAINS "docs-view.online" OR sourcehostname CONTAINS "document-forwarding.com" OR sourcehostname CONTAINS "document-online.live" OR sourcehostname CONTAINS "document-preview.com" OR sourcehostname CONTAINS "documents-cloud.com" OR sourcehostname CONTAINS "documents-cloud.online" OR sourcehostname CONTAINS "documents-forwarding.com" OR sourcehostname CONTAINS "document-share.live" OR sourcehostname CONTAINS "documents-online.live" OR sourcehostname CONTAINS "documents-pdf.online" OR sourcehostname CONTAINS "documents-preview.com" OR sourcehostname CONTAINS "documents-view.live" OR sourcehostname CONTAINS "document-view.live" OR sourcehostname CONTAINS "drive-docs.com" OR sourcehostname CONTAINS "drive-share.live" OR sourcehostname CONTAINS "goo-link.online" OR sourcehostname CONTAINS "hypertextteches.com" OR sourcehostname CONTAINS "mail-docs.online" OR sourcehostname CONTAINS "officeonline365.live" OR sourcehostname CONTAINS "online365-office.com" OR sourcehostname CONTAINS "online-document.live" OR sourcehostname CONTAINS "online-storage.live" OR sourcehostname CONTAINS "pdf-cache.com" OR sourcehostname CONTAINS "pdf-cache.online" OR sourcehostname CONTAINS "pdf-docs.online" OR sourcehostname CONTAINS "pdf-forwarding.online" OR sourcehostname CONTAINS "protection-checklinks.xyz" OR sourcehostname CONTAINS "protection-link.online" OR sourcehostname CONTAINS "protectionmail.online" OR sourcehostname CONTAINS "protection-office.live" OR sourcehostname CONTAINS "protect-link.online" OR sourcehostname CONTAINS "proton-docs.com" OR sourcehostname CONTAINS "proton-reader.com" OR sourcehostname CONTAINS "proton-viewer.com")
index=activity AND rg_functionality="Source Code Repository" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "cache-dns.com" OR destinationntdomain CONTAINS "sekoia.io" OR destinationntdomain CONTAINS "cache-dns-forwarding.com" OR destinationntdomain CONTAINS "cache-dns-preview.com" OR destinationntdomain CONTAINS "cache-docs.com" OR destinationntdomain CONTAINS "cache-pdf.com" OR destinationntdomain CONTAINS "cache-pdf.online" OR destinationntdomain CONTAINS "cache-services.live" OR destinationntdomain CONTAINS "cloud-docs.com" OR destinationntdomain CONTAINS "cloud-drive.live" OR destinationntdomain CONTAINS "cloud-storage.live" OR destinationntdomain CONTAINS "docs-cache.com" OR destinationntdomain CONTAINS "docs-forwarding.online" OR destinationntdomain CONTAINS "docs-info.com" OR destinationntdomain CONTAINS "docs-shared.com" OR destinationntdomain CONTAINS "docs-shared.online" OR destinationntdomain CONTAINS "docs-view.online" OR destinationntdomain CONTAINS "document-forwarding.com" OR destinationntdomain CONTAINS "document-online.live" OR destinationntdomain CONTAINS "document-preview.com" OR destinationntdomain CONTAINS "documents-cloud.com" OR destinationntdomain CONTAINS "documents-cloud.online" OR destinationntdomain CONTAINS "documents-forwarding.com" OR destinationntdomain CONTAINS "document-share.live" OR destinationntdomain CONTAINS "documents-online.live" OR destinationntdomain CONTAINS "documents-pdf.online" OR destinationntdomain CONTAINS "documents-preview.com" OR destinationntdomain CONTAINS "documents-view.live" OR destinationntdomain CONTAINS "document-view.live" OR destinationntdomain CONTAINS "drive-docs.com" OR destinationntdomain CONTAINS "drive-share.live" OR destinationntdomain CONTAINS "goo-link.online" OR destinationntdomain CONTAINS "hypertextteches.com" OR destinationntdomain CONTAINS "mail-docs.online" OR destinationntdomain CONTAINS "officeonline365.live" OR destinationntdomain CONTAINS "online365-office.com" OR destinationntdomain CONTAINS "online-document.live" OR destinationntdomain CONTAINS "online-storage.live" OR destinationntdomain CONTAINS "pdf-cache.com" OR destinationntdomain CONTAINS "pdf-cache.online" OR destinationntdomain CONTAINS "pdf-docs.online" OR destinationntdomain CONTAINS "pdf-forwarding.online" OR destinationntdomain CONTAINS "protection-checklinks.xyz" OR destinationntdomain CONTAINS "protection-link.online" OR destinationntdomain CONTAINS "protectionmail.online" OR destinationntdomain CONTAINS "protection-office.live" OR destinationntdomain CONTAINS "protect-link.online" OR destinationntdomain CONTAINS "proton-docs.com" OR destinationntdomain CONTAINS "proton-reader.com" OR destinationntdomain CONTAINS "proton-viewer.com")
index=activity AND rg_functionality="Source Code Repository" AND requesturl NOT NULL AND (requesturl CONTAINS "cache-dns.com" OR requesturl CONTAINS "sekoia.io" OR requesturl CONTAINS "cache-dns-forwarding.com" OR requesturl CONTAINS "cache-dns-preview.com" OR requesturl CONTAINS "cache-docs.com" OR requesturl CONTAINS "cache-pdf.com" OR requesturl CONTAINS "cache-pdf.online" OR requesturl CONTAINS "cache-services.live" OR requesturl CONTAINS "cloud-docs.com" OR requesturl CONTAINS "cloud-drive.live" OR requesturl CONTAINS "cloud-storage.live" OR requesturl CONTAINS "docs-cache.com" OR requesturl CONTAINS "docs-forwarding.online" OR requesturl CONTAINS "docs-info.com" OR requesturl CONTAINS "docs-shared.com" OR requesturl CONTAINS "docs-shared.online" OR requesturl CONTAINS "docs-view.online" OR requesturl CONTAINS "document-forwarding.com" OR requesturl CONTAINS "document-online.live" OR requesturl CONTAINS "document-preview.com" OR requesturl CONTAINS "documents-cloud.com" OR requesturl CONTAINS "documents-cloud.online" OR requesturl CONTAINS "documents-forwarding.com" OR requesturl CONTAINS "document-share.live" OR requesturl CONTAINS "documents-online.live" OR requesturl CONTAINS "documents-pdf.online" OR requesturl CONTAINS "documents-preview.com" OR requesturl CONTAINS "documents-view.live" OR requesturl CONTAINS "document-view.live" OR requesturl CONTAINS "drive-docs.com" OR requesturl CONTAINS "drive-share.live" OR requesturl CONTAINS "goo-link.online" OR requesturl CONTAINS "hypertextteches.com" OR requesturl CONTAINS "mail-docs.online" OR requesturl CONTAINS "officeonline365.live" OR requesturl CONTAINS "online365-office.com" OR requesturl CONTAINS "online-document.live" OR requesturl CONTAINS "online-storage.live" OR requesturl CONTAINS "pdf-cache.com" OR requesturl CONTAINS "pdf-cache.online" OR requesturl CONTAINS "pdf-docs.online" OR requesturl CONTAINS "pdf-forwarding.online" OR requesturl CONTAINS "protection-checklinks.xyz" OR requesturl CONTAINS "protection-link.online" OR requesturl CONTAINS "protectionmail.online" OR requesturl CONTAINS "protection-office.live" OR requesturl CONTAINS "protect-link.online" OR requesturl CONTAINS "proton-docs.com" OR requesturl CONTAINS "proton-reader.com" OR requesturl CONTAINS "proton-viewer.com")
index=activity AND rg_functionality="Source Code Repository" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "relogin-dashboard.online" OR destinationhostname CONTAINS "safe-connection.online" OR destinationhostname CONTAINS "safelinks-protect.live" OR destinationhostname CONTAINS "secureoffice.live" OR destinationhostname CONTAINS "webresources.live" OR destinationhostname CONTAINS "word-yand.live" OR destinationhostname CONTAINS "yandx-online.cloud" OR destinationhostname CONTAINS "y-ml.co" OR destinationhostname CONTAINS "docs-drive.online" OR destinationhostname CONTAINS "docs-info.online" OR destinationhostname CONTAINS "cloud-mail.online" OR destinationhostname CONTAINS "onlinecloud365.live" OR destinationhostname CONTAINS "pdf-cloud.online" OR destinationhostname CONTAINS "pdf-shared.online" OR destinationhostname CONTAINS "proton-pdf.online" OR destinationhostname CONTAINS "proton-view.online" OR destinationhostname CONTAINS "office365-online.live" OR destinationhostname CONTAINS "doc-viewer.com" OR destinationhostname CONTAINS "file-milgov.systems" OR destinationhostname CONTAINS "office-protection.online")
index=activity AND rg_functionality="Source Code Repository" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "relogin-dashboard.online" OR sourcentdomain CONTAINS "safe-connection.online" OR sourcentdomain CONTAINS "safelinks-protect.live" OR sourcentdomain CONTAINS "secureoffice.live" OR sourcentdomain CONTAINS "webresources.live" OR sourcentdomain CONTAINS "word-yand.live" OR sourcentdomain CONTAINS "yandx-online.cloud" OR sourcentdomain CONTAINS "y-ml.co" OR sourcentdomain CONTAINS "docs-drive.online" OR sourcentdomain CONTAINS "docs-info.online" OR sourcentdomain CONTAINS "cloud-mail.online" OR sourcentdomain CONTAINS "onlinecloud365.live" OR sourcentdomain CONTAINS "pdf-cloud.online" OR sourcentdomain CONTAINS "pdf-shared.online" OR sourcentdomain CONTAINS "proton-pdf.online" OR sourcentdomain CONTAINS "proton-view.online" OR sourcentdomain CONTAINS "office365-online.live" OR sourcentdomain CONTAINS "doc-viewer.com" OR sourcentdomain CONTAINS "file-milgov.systems" OR sourcentdomain CONTAINS "office-protection.online")
index=activity AND rg_functionality="Source Code Repository" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "relogin-dashboard.online" OR sourcehostname CONTAINS "safe-connection.online" OR sourcehostname CONTAINS "safelinks-protect.live" OR sourcehostname CONTAINS "secureoffice.live" OR sourcehostname CONTAINS "webresources.live" OR sourcehostname CONTAINS "word-yand.live" OR sourcehostname CONTAINS "yandx-online.cloud" OR sourcehostname CONTAINS "y-ml.co" OR sourcehostname CONTAINS "docs-drive.online" OR sourcehostname CONTAINS "docs-info.online" OR sourcehostname CONTAINS "cloud-mail.online" OR sourcehostname CONTAINS "onlinecloud365.live" OR sourcehostname CONTAINS "pdf-cloud.online" OR sourcehostname CONTAINS "pdf-shared.online" OR sourcehostname CONTAINS "proton-pdf.online" OR sourcehostname CONTAINS "proton-view.online" OR sourcehostname CONTAINS "office365-online.live" OR sourcehostname CONTAINS "doc-viewer.com" OR sourcehostname CONTAINS "file-milgov.systems" OR sourcehostname CONTAINS "office-protection.online")
index=activity AND rg_functionality="Source Code Repository" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "relogin-dashboard.online" OR destinationntdomain CONTAINS "safe-connection.online" OR destinationntdomain CONTAINS "safelinks-protect.live" OR destinationntdomain CONTAINS "secureoffice.live" OR destinationntdomain CONTAINS "webresources.live" OR destinationntdomain CONTAINS "word-yand.live" OR destinationntdomain CONTAINS "yandx-online.cloud" OR destinationntdomain CONTAINS "y-ml.co" OR destinationntdomain CONTAINS "docs-drive.online" OR destinationntdomain CONTAINS "docs-info.online" OR destinationntdomain CONTAINS "cloud-mail.online" OR destinationntdomain CONTAINS "onlinecloud365.live" OR destinationntdomain CONTAINS "pdf-cloud.online" OR destinationntdomain CONTAINS "pdf-shared.online" OR destinationntdomain CONTAINS "proton-pdf.online" OR destinationntdomain CONTAINS "proton-view.online" OR destinationntdomain CONTAINS "office365-online.live" OR destinationntdomain CONTAINS "doc-viewer.com" OR destinationntdomain CONTAINS "file-milgov.systems" OR destinationntdomain CONTAINS "office-protection.online")
index=activity AND rg_functionality="Source Code Repository" AND requesturl NOT NULL AND (requesturl CONTAINS "relogin-dashboard.online" OR requesturl CONTAINS "safe-connection.online" OR requesturl CONTAINS "safelinks-protect.live" OR requesturl CONTAINS "secureoffice.live" OR requesturl CONTAINS "webresources.live" OR requesturl CONTAINS "word-yand.live" OR requesturl CONTAINS "yandx-online.cloud" OR requesturl CONTAINS "y-ml.co" OR requesturl CONTAINS "docs-drive.online" OR requesturl CONTAINS "docs-info.online" OR requesturl CONTAINS "cloud-mail.online" OR requesturl CONTAINS "onlinecloud365.live" OR requesturl CONTAINS "pdf-cloud.online" OR requesturl CONTAINS "pdf-shared.online" OR requesturl CONTAINS "proton-pdf.online" OR requesturl CONTAINS "proton-view.online" OR requesturl CONTAINS "office365-online.live" OR requesturl CONTAINS "doc-viewer.com" OR requesturl CONTAINS "file-milgov.systems" OR requesturl CONTAINS "office-protection.online")
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "cache-dns.com" OR destinationhostname CONTAINS "sekoia.io" OR destinationhostname CONTAINS "cache-dns-forwarding.com" OR destinationhostname CONTAINS "cache-dns-preview.com" OR destinationhostname CONTAINS "cache-docs.com" OR destinationhostname CONTAINS "cache-pdf.com" OR destinationhostname CONTAINS "cache-pdf.online" OR destinationhostname CONTAINS "cache-services.live" OR destinationhostname CONTAINS "cloud-docs.com" OR destinationhostname CONTAINS "cloud-drive.live" OR destinationhostname CONTAINS "cloud-storage.live" OR destinationhostname CONTAINS "docs-cache.com" OR destinationhostname CONTAINS "docs-forwarding.online" OR destinationhostname CONTAINS "docs-info.com" OR destinationhostname CONTAINS "docs-shared.com" OR destinationhostname CONTAINS "docs-shared.online" OR destinationhostname CONTAINS "docs-view.online" OR destinationhostname CONTAINS "document-forwarding.com" OR destinationhostname CONTAINS "document-online.live" OR destinationhostname CONTAINS "document-preview.com" OR destinationhostname CONTAINS "documents-cloud.com" OR destinationhostname CONTAINS "documents-cloud.online" OR destinationhostname CONTAINS "documents-forwarding.com" OR destinationhostname CONTAINS "document-share.live" OR destinationhostname CONTAINS "documents-online.live" OR destinationhostname CONTAINS "documents-pdf.online" OR destinationhostname CONTAINS "documents-preview.com" OR destinationhostname CONTAINS "documents-view.live" OR destinationhostname CONTAINS "document-view.live" OR destinationhostname CONTAINS "drive-docs.com" OR destinationhostname CONTAINS "drive-share.live" OR destinationhostname CONTAINS "goo-link.online" OR destinationhostname CONTAINS "hypertextteches.com" OR destinationhostname CONTAINS "mail-docs.online" OR destinationhostname CONTAINS "officeonline365.live" OR destinationhostname CONTAINS "online365-office.com" OR destinationhostname CONTAINS "online-document.live" OR destinationhostname CONTAINS "online-storage.live" OR destinationhostname CONTAINS "pdf-cache.com" OR destinationhostname CONTAINS "pdf-cache.online" OR destinationhostname CONTAINS "pdf-docs.online" OR destinationhostname CONTAINS "pdf-forwarding.online" OR destinationhostname CONTAINS "protection-checklinks.xyz" OR destinationhostname CONTAINS "protection-link.online" OR destinationhostname CONTAINS "protectionmail.online" OR destinationhostname CONTAINS "protection-office.live" OR destinationhostname CONTAINS "protect-link.online" OR destinationhostname CONTAINS "proton-docs.com" OR destinationhostname CONTAINS "proton-reader.com" OR destinationhostname CONTAINS "proton-viewer.com")
index=activity AND rg_functionality="Cloud Email / Email Security" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "cache-dns.com" OR sourcentdomain CONTAINS "sekoia.io" OR sourcentdomain CONTAINS "cache-dns-forwarding.com" OR sourcentdomain CONTAINS "cache-dns-preview.com" OR sourcentdomain CONTAINS "cache-docs.com" OR sourcentdomain CONTAINS "cache-pdf.com" OR sourcentdomain CONTAINS "cache-pdf.online" OR sourcentdomain CONTAINS "cache-services.live" OR sourcentdomain CONTAINS "cloud-docs.com" OR sourcentdomain CONTAINS "cloud-drive.live" OR sourcentdomain CONTAINS "cloud-storage.live" OR sourcentdomain CONTAINS "docs-cache.com" OR sourcentdomain CONTAINS "docs-forwarding.online" OR sourcentdomain CONTAINS "docs-info.com" OR sourcentdomain CONTAINS "docs-shared.com" OR sourcentdomain CONTAINS "docs-shared.online" OR sourcentdomain CONTAINS "docs-view.online" OR sourcentdomain CONTAINS "document-forwarding.com" OR sourcentdomain CONTAINS "document-online.live" OR sourcentdomain CONTAINS "document-preview.com" OR sourcentdomain CONTAINS "documents-cloud.com" OR sourcentdomain CONTAINS "documents-cloud.online" OR sourcentdomain CONTAINS "documents-forwarding.com" OR sourcentdomain CONTAINS "document-share.live" OR sourcentdomain CONTAINS "documents-online.live" OR sourcentdomain CONTAINS "documents-pdf.online" OR sourcentdomain CONTAINS "documents-preview.com" OR sourcentdomain CONTAINS "documents-view.live" OR sourcentdomain CONTAINS "document-view.live" OR sourcentdomain CONTAINS "drive-docs.com" OR sourcentdomain CONTAINS "drive-share.live" OR sourcentdomain CONTAINS "goo-link.online" OR sourcentdomain CONTAINS "hypertextteches.com" OR sourcentdomain CONTAINS "mail-docs.online" OR sourcentdomain CONTAINS "officeonline365.live" OR sourcentdomain CONTAINS "online365-office.com" OR sourcentdomain CONTAINS "online-document.live" OR sourcentdomain CONTAINS "online-storage.live" OR sourcentdomain CONTAINS "pdf-cache.com" OR sourcentdomain CONTAINS "pdf-cache.online" OR sourcentdomain CONTAINS "pdf-docs.online" OR sourcentdomain CONTAINS "pdf-forwarding.online" OR sourcentdomain CONTAINS "protection-checklinks.xyz" OR sourcentdomain CONTAINS "protection-link.online" OR sourcentdomain CONTAINS "protectionmail.online" OR sourcentdomain CONTAINS "protection-office.live" OR sourcentdomain CONTAINS "protect-link.online" OR sourcentdomain CONTAINS "proton-docs.com" OR sourcentdomain CONTAINS "proton-reader.com" OR sourcentdomain CONTAINS "proton-viewer.com")
index=activity AND rg_functionality="Cloud Email / Email Security" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "cache-dns.com" OR sourcehostname CONTAINS "sekoia.io" OR sourcehostname CONTAINS "cache-dns-forwarding.com" OR sourcehostname CONTAINS "cache-dns-preview.com" OR sourcehostname CONTAINS "cache-docs.com" OR sourcehostname CONTAINS "cache-pdf.com" OR sourcehostname CONTAINS "cache-pdf.online" OR sourcehostname CONTAINS "cache-services.live" OR sourcehostname CONTAINS "cloud-docs.com" OR sourcehostname CONTAINS "cloud-drive.live" OR sourcehostname CONTAINS "cloud-storage.live" OR sourcehostname CONTAINS "docs-cache.com" OR sourcehostname CONTAINS "docs-forwarding.online" OR sourcehostname CONTAINS "docs-info.com" OR sourcehostname CONTAINS "docs-shared.com" OR sourcehostname CONTAINS "docs-shared.online" OR sourcehostname CONTAINS "docs-view.online" OR sourcehostname CONTAINS "document-forwarding.com" OR sourcehostname CONTAINS "document-online.live" OR sourcehostname CONTAINS "document-preview.com" OR sourcehostname CONTAINS "documents-cloud.com" OR sourcehostname CONTAINS "documents-cloud.online" OR sourcehostname CONTAINS "documents-forwarding.com" OR sourcehostname CONTAINS "document-share.live" OR sourcehostname CONTAINS "documents-online.live" OR sourcehostname CONTAINS "documents-pdf.online" OR sourcehostname CONTAINS "documents-preview.com" OR sourcehostname CONTAINS "documents-view.live" OR sourcehostname CONTAINS "document-view.live" OR sourcehostname CONTAINS "drive-docs.com" OR sourcehostname CONTAINS "drive-share.live" OR sourcehostname CONTAINS "goo-link.online" OR sourcehostname CONTAINS "hypertextteches.com" OR sourcehostname CONTAINS "mail-docs.online" OR sourcehostname CONTAINS "officeonline365.live" OR sourcehostname CONTAINS "online365-office.com" OR sourcehostname CONTAINS "online-document.live" OR sourcehostname CONTAINS "online-storage.live" OR sourcehostname CONTAINS "pdf-cache.com" OR sourcehostname CONTAINS "pdf-cache.online" OR sourcehostname CONTAINS "pdf-docs.online" OR sourcehostname CONTAINS "pdf-forwarding.online" OR sourcehostname CONTAINS "protection-checklinks.xyz" OR sourcehostname CONTAINS "protection-link.online" OR sourcehostname CONTAINS "protectionmail.online" OR sourcehostname CONTAINS "protection-office.live" OR sourcehostname CONTAINS "protect-link.online" OR sourcehostname CONTAINS "proton-docs.com" OR sourcehostname CONTAINS "proton-reader.com" OR sourcehostname CONTAINS "proton-viewer.com")
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "cache-dns.com" OR destinationntdomain CONTAINS "sekoia.io" OR destinationntdomain CONTAINS "cache-dns-forwarding.com" OR destinationntdomain CONTAINS "cache-dns-preview.com" OR destinationntdomain CONTAINS "cache-docs.com" OR destinationntdomain CONTAINS "cache-pdf.com" OR destinationntdomain CONTAINS "cache-pdf.online" OR destinationntdomain CONTAINS "cache-services.live" OR destinationntdomain CONTAINS "cloud-docs.com" OR destinationntdomain CONTAINS "cloud-drive.live" OR destinationntdomain CONTAINS "cloud-storage.live" OR destinationntdomain CONTAINS "docs-cache.com" OR destinationntdomain CONTAINS "docs-forwarding.online" OR destinationntdomain CONTAINS "docs-info.com" OR destinationntdomain CONTAINS "docs-shared.com" OR destinationntdomain CONTAINS "docs-shared.online" OR destinationntdomain CONTAINS "docs-view.online" OR destinationntdomain CONTAINS "document-forwarding.com" OR destinationntdomain CONTAINS "document-online.live" OR destinationntdomain CONTAINS "document-preview.com" OR destinationntdomain CONTAINS "documents-cloud.com" OR destinationntdomain CONTAINS "documents-cloud.online" OR destinationntdomain CONTAINS "documents-forwarding.com" OR destinationntdomain CONTAINS "document-share.live" OR destinationntdomain CONTAINS "documents-online.live" OR destinationntdomain CONTAINS "documents-pdf.online" OR destinationntdomain CONTAINS "documents-preview.com" OR destinationntdomain CONTAINS "documents-view.live" OR destinationntdomain CONTAINS "document-view.live" OR destinationntdomain CONTAINS "drive-docs.com" OR destinationntdomain CONTAINS "drive-share.live" OR destinationntdomain CONTAINS "goo-link.online" OR destinationntdomain CONTAINS "hypertextteches.com" OR destinationntdomain CONTAINS "mail-docs.online" OR destinationntdomain CONTAINS "officeonline365.live" OR destinationntdomain CONTAINS "online365-office.com" OR destinationntdomain CONTAINS "online-document.live" OR destinationntdomain CONTAINS "online-storage.live" OR destinationntdomain CONTAINS "pdf-cache.com" OR destinationntdomain CONTAINS "pdf-cache.online" OR destinationntdomain CONTAINS "pdf-docs.online" OR destinationntdomain CONTAINS "pdf-forwarding.online" OR destinationntdomain CONTAINS "protection-checklinks.xyz" OR destinationntdomain CONTAINS "protection-link.online" OR destinationntdomain CONTAINS "protectionmail.online" OR destinationntdomain CONTAINS "protection-office.live" OR destinationntdomain CONTAINS "protect-link.online" OR destinationntdomain CONTAINS "proton-docs.com" OR destinationntdomain CONTAINS "proton-reader.com" OR destinationntdomain CONTAINS "proton-viewer.com")
index=activity AND rg_functionality="Cloud Email / Email Security" AND requesturl NOT NULL AND (requesturl CONTAINS "cache-dns.com" OR requesturl CONTAINS "sekoia.io" OR requesturl CONTAINS "cache-dns-forwarding.com" OR requesturl CONTAINS "cache-dns-preview.com" OR requesturl CONTAINS "cache-docs.com" OR requesturl CONTAINS "cache-pdf.com" OR requesturl CONTAINS "cache-pdf.online" OR requesturl CONTAINS "cache-services.live" OR requesturl CONTAINS "cloud-docs.com" OR requesturl CONTAINS "cloud-drive.live" OR requesturl CONTAINS "cloud-storage.live" OR requesturl CONTAINS "docs-cache.com" OR requesturl CONTAINS "docs-forwarding.online" OR requesturl CONTAINS "docs-info.com" OR requesturl CONTAINS "docs-shared.com" OR requesturl CONTAINS "docs-shared.online" OR requesturl CONTAINS "docs-view.online" OR requesturl CONTAINS "document-forwarding.com" OR requesturl CONTAINS "document-online.live" OR requesturl CONTAINS "document-preview.com" OR requesturl CONTAINS "documents-cloud.com" OR requesturl CONTAINS "documents-cloud.online" OR requesturl CONTAINS "documents-forwarding.com" OR requesturl CONTAINS "document-share.live" OR requesturl CONTAINS "documents-online.live" OR requesturl CONTAINS "documents-pdf.online" OR requesturl CONTAINS "documents-preview.com" OR requesturl CONTAINS "documents-view.live" OR requesturl CONTAINS "document-view.live" OR requesturl CONTAINS "drive-docs.com" OR requesturl CONTAINS "drive-share.live" OR requesturl CONTAINS "goo-link.online" OR requesturl CONTAINS "hypertextteches.com" OR requesturl CONTAINS "mail-docs.online" OR requesturl CONTAINS "officeonline365.live" OR requesturl CONTAINS "online365-office.com" OR requesturl CONTAINS "online-document.live" OR requesturl CONTAINS "online-storage.live" OR requesturl CONTAINS "pdf-cache.com" OR requesturl CONTAINS "pdf-cache.online" OR requesturl CONTAINS "pdf-docs.online" OR requesturl CONTAINS "pdf-forwarding.online" OR requesturl CONTAINS "protection-checklinks.xyz" OR requesturl CONTAINS "protection-link.online" OR requesturl CONTAINS "protectionmail.online" OR requesturl CONTAINS "protection-office.live" OR requesturl CONTAINS "protect-link.online" OR requesturl CONTAINS "proton-docs.com" OR requesturl CONTAINS "proton-reader.com" OR requesturl CONTAINS "proton-viewer.com")
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "relogin-dashboard.online" OR destinationhostname CONTAINS "safe-connection.online" OR destinationhostname CONTAINS "safelinks-protect.live" OR destinationhostname CONTAINS "secureoffice.live" OR destinationhostname CONTAINS "webresources.live" OR destinationhostname CONTAINS "word-yand.live" OR destinationhostname CONTAINS "yandx-online.cloud" OR destinationhostname CONTAINS "y-ml.co" OR destinationhostname CONTAINS "docs-drive.online" OR destinationhostname CONTAINS "docs-info.online" OR destinationhostname CONTAINS "cloud-mail.online" OR destinationhostname CONTAINS "onlinecloud365.live" OR destinationhostname CONTAINS "pdf-cloud.online" OR destinationhostname CONTAINS "pdf-shared.online" OR destinationhostname CONTAINS "proton-pdf.online" OR destinationhostname CONTAINS "proton-view.online" OR destinationhostname CONTAINS "office365-online.live" OR destinationhostname CONTAINS "doc-viewer.com" OR destinationhostname CONTAINS "file-milgov.systems" OR destinationhostname CONTAINS "office-protection.online")
index=activity AND rg_functionality="Cloud Email / Email Security" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "relogin-dashboard.online" OR sourcentdomain CONTAINS "safe-connection.online" OR sourcentdomain CONTAINS "safelinks-protect.live" OR sourcentdomain CONTAINS "secureoffice.live" OR sourcentdomain CONTAINS "webresources.live" OR sourcentdomain CONTAINS "word-yand.live" OR sourcentdomain CONTAINS "yandx-online.cloud" OR sourcentdomain CONTAINS "y-ml.co" OR sourcentdomain CONTAINS "docs-drive.online" OR sourcentdomain CONTAINS "docs-info.online" OR sourcentdomain CONTAINS "cloud-mail.online" OR sourcentdomain CONTAINS "onlinecloud365.live" OR sourcentdomain CONTAINS "pdf-cloud.online" OR sourcentdomain CONTAINS "pdf-shared.online" OR sourcentdomain CONTAINS "proton-pdf.online" OR sourcentdomain CONTAINS "proton-view.online" OR sourcentdomain CONTAINS "office365-online.live" OR sourcentdomain CONTAINS "doc-viewer.com" OR sourcentdomain CONTAINS "file-milgov.systems" OR sourcentdomain CONTAINS "office-protection.online")
index=activity AND rg_functionality="Cloud Email / Email Security" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "relogin-dashboard.online" OR sourcehostname CONTAINS "safe-connection.online" OR sourcehostname CONTAINS "safelinks-protect.live" OR sourcehostname CONTAINS "secureoffice.live" OR sourcehostname CONTAINS "webresources.live" OR sourcehostname CONTAINS "word-yand.live" OR sourcehostname CONTAINS "yandx-online.cloud" OR sourcehostname CONTAINS "y-ml.co" OR sourcehostname CONTAINS "docs-drive.online" OR sourcehostname CONTAINS "docs-info.online" OR sourcehostname CONTAINS "cloud-mail.online" OR sourcehostname CONTAINS "onlinecloud365.live" OR sourcehostname CONTAINS "pdf-cloud.online" OR sourcehostname CONTAINS "pdf-shared.online" OR sourcehostname CONTAINS "proton-pdf.online" OR sourcehostname CONTAINS "proton-view.online" OR sourcehostname CONTAINS "office365-online.live" OR sourcehostname CONTAINS "doc-viewer.com" OR sourcehostname CONTAINS "file-milgov.systems" OR sourcehostname CONTAINS "office-protection.online")
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "relogin-dashboard.online" OR destinationntdomain CONTAINS "safe-connection.online" OR destinationntdomain CONTAINS "safelinks-protect.live" OR destinationntdomain CONTAINS "secureoffice.live" OR destinationntdomain CONTAINS "webresources.live" OR destinationntdomain CONTAINS "word-yand.live" OR destinationntdomain CONTAINS "yandx-online.cloud" OR destinationntdomain CONTAINS "y-ml.co" OR destinationntdomain CONTAINS "docs-drive.online" OR destinationntdomain CONTAINS "docs-info.online" OR destinationntdomain CONTAINS "cloud-mail.online" OR destinationntdomain CONTAINS "onlinecloud365.live" OR destinationntdomain CONTAINS "pdf-cloud.online" OR destinationntdomain CONTAINS "pdf-shared.online" OR destinationntdomain CONTAINS "proton-pdf.online" OR destinationntdomain CONTAINS "proton-view.online" OR destinationntdomain CONTAINS "office365-online.live" OR destinationntdomain CONTAINS "doc-viewer.com" OR destinationntdomain CONTAINS "file-milgov.systems" OR destinationntdomain CONTAINS "office-protection.online")
index=activity AND rg_functionality="Cloud Email / Email Security" AND requesturl NOT NULL AND (requesturl CONTAINS "relogin-dashboard.online" OR requesturl CONTAINS "safe-connection.online" OR requesturl CONTAINS "safelinks-protect.live" OR requesturl CONTAINS "secureoffice.live" OR requesturl CONTAINS "webresources.live" OR requesturl CONTAINS "word-yand.live" OR requesturl CONTAINS "yandx-online.cloud" OR requesturl CONTAINS "y-ml.co" OR requesturl CONTAINS "docs-drive.online" OR requesturl CONTAINS "docs-info.online" OR requesturl CONTAINS "cloud-mail.online" OR requesturl CONTAINS "onlinecloud365.live" OR requesturl CONTAINS "pdf-cloud.online" OR requesturl CONTAINS "pdf-shared.online" OR requesturl CONTAINS "proton-pdf.online" OR requesturl CONTAINS "proton-view.online" OR requesturl CONTAINS "office365-online.live" OR requesturl CONTAINS "doc-viewer.com" OR requesturl CONTAINS "file-milgov.systems" OR requesturl CONTAINS "office-protection.online")
index=activity AND rg_functionality="DNS / DHCP" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "cache-dns.com" OR destinationhostname CONTAINS "sekoia.io" OR destinationhostname CONTAINS "cache-dns-forwarding.com" OR destinationhostname CONTAINS "cache-dns-preview.com" OR destinationhostname CONTAINS "cache-docs.com" OR destinationhostname CONTAINS "cache-pdf.com" OR destinationhostname CONTAINS "cache-pdf.online" OR destinationhostname CONTAINS "cache-services.live" OR destinationhostname CONTAINS "cloud-docs.com" OR destinationhostname CONTAINS "cloud-drive.live" OR destinationhostname CONTAINS "cloud-storage.live" OR destinationhostname CONTAINS "docs-cache.com" OR destinationhostname CONTAINS "docs-forwarding.online" OR destinationhostname CONTAINS "docs-info.com" OR destinationhostname CONTAINS "docs-shared.com" OR destinationhostname CONTAINS "docs-shared.online" OR destinationhostname CONTAINS "docs-view.online" OR destinationhostname CONTAINS "document-forwarding.com" OR destinationhostname CONTAINS "document-online.live" OR destinationhostname CONTAINS "document-preview.com" OR destinationhostname CONTAINS "documents-cloud.com" OR destinationhostname CONTAINS "documents-cloud.online" OR destinationhostname CONTAINS "documents-forwarding.com" OR destinationhostname CONTAINS "document-share.live" OR destinationhostname CONTAINS "documents-online.live" OR destinationhostname CONTAINS "documents-pdf.online" OR destinationhostname CONTAINS "documents-preview.com" OR destinationhostname CONTAINS "documents-view.live" OR destinationhostname CONTAINS "document-view.live" OR destinationhostname CONTAINS "drive-docs.com" OR destinationhostname CONTAINS "drive-share.live" OR destinationhostname CONTAINS "goo-link.online" OR destinationhostname CONTAINS "hypertextteches.com" OR destinationhostname CONTAINS "mail-docs.online" OR destinationhostname CONTAINS "officeonline365.live" OR destinationhostname CONTAINS "online365-office.com" OR destinationhostname CONTAINS "online-document.live" OR destinationhostname CONTAINS "online-storage.live" OR destinationhostname CONTAINS "pdf-cache.com" OR destinationhostname CONTAINS "pdf-cache.online" OR destinationhostname CONTAINS "pdf-docs.online" OR destinationhostname CONTAINS "pdf-forwarding.online" OR destinationhostname CONTAINS "protection-checklinks.xyz" OR destinationhostname CONTAINS "protection-link.online" OR destinationhostname CONTAINS "protectionmail.online" OR destinationhostname CONTAINS "protection-office.live" OR destinationhostname CONTAINS "protect-link.online" OR destinationhostname CONTAINS "proton-docs.com" OR destinationhostname CONTAINS "proton-reader.com" OR destinationhostname CONTAINS "proton-viewer.com")
index=activity AND rg_functionality="DNS / DHCP" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "cache-dns.com" OR sourcentdomain CONTAINS "sekoia.io" OR sourcentdomain CONTAINS "cache-dns-forwarding.com" OR sourcentdomain CONTAINS "cache-dns-preview.com" OR sourcentdomain CONTAINS "cache-docs.com" OR sourcentdomain CONTAINS "cache-pdf.com" OR sourcentdomain CONTAINS "cache-pdf.online" OR sourcentdomain CONTAINS "cache-services.live" OR sourcentdomain CONTAINS "cloud-docs.com" OR sourcentdomain CONTAINS "cloud-drive.live" OR sourcentdomain CONTAINS "cloud-storage.live" OR sourcentdomain CONTAINS "docs-cache.com" OR sourcentdomain CONTAINS "docs-forwarding.online" OR sourcentdomain CONTAINS "docs-info.com" OR sourcentdomain CONTAINS "docs-shared.com" OR sourcentdomain CONTAINS "docs-shared.online" OR sourcentdomain CONTAINS "docs-view.online" OR sourcentdomain CONTAINS "document-forwarding.com" OR sourcentdomain CONTAINS "document-online.live" OR sourcentdomain CONTAINS "document-preview.com" OR sourcentdomain CONTAINS "documents-cloud.com" OR sourcentdomain CONTAINS "documents-cloud.online" OR sourcentdomain CONTAINS "documents-forwarding.com" OR sourcentdomain CONTAINS "document-share.live" OR sourcentdomain CONTAINS "documents-online.live" OR sourcentdomain CONTAINS "documents-pdf.online" OR sourcentdomain CONTAINS "documents-preview.com" OR sourcentdomain CONTAINS "documents-view.live" OR sourcentdomain CONTAINS "document-view.live" OR sourcentdomain CONTAINS "drive-docs.com" OR sourcentdomain CONTAINS "drive-share.live" OR sourcentdomain CONTAINS "goo-link.online" OR sourcentdomain CONTAINS "hypertextteches.com" OR sourcentdomain CONTAINS "mail-docs.online" OR sourcentdomain CONTAINS "officeonline365.live" OR sourcentdomain CONTAINS "online365-office.com" OR sourcentdomain CONTAINS "online-document.live" OR sourcentdomain CONTAINS "online-storage.live" OR sourcentdomain CONTAINS "pdf-cache.com" OR sourcentdomain CONTAINS "pdf-cache.online" OR sourcentdomain CONTAINS "pdf-docs.online" OR sourcentdomain CONTAINS "pdf-forwarding.online" OR sourcentdomain CONTAINS "protection-checklinks.xyz" OR sourcentdomain CONTAINS "protection-link.online" OR sourcentdomain CONTAINS "protectionmail.online" OR sourcentdomain CONTAINS "protection-office.live" OR sourcentdomain CONTAINS "protect-link.online" OR sourcentdomain CONTAINS "proton-docs.com" OR sourcentdomain CONTAINS "proton-reader.com" OR sourcentdomain CONTAINS "proton-viewer.com")
index=activity AND rg_functionality="DNS / DHCP" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "cache-dns.com" OR sourcehostname CONTAINS "sekoia.io" OR sourcehostname CONTAINS "cache-dns-forwarding.com" OR sourcehostname CONTAINS "cache-dns-preview.com" OR sourcehostname CONTAINS "cache-docs.com" OR sourcehostname CONTAINS "cache-pdf.com" OR sourcehostname CONTAINS "cache-pdf.online" OR sourcehostname CONTAINS "cache-services.live" OR sourcehostname CONTAINS "cloud-docs.com" OR sourcehostname CONTAINS "cloud-drive.live" OR sourcehostname CONTAINS "cloud-storage.live" OR sourcehostname CONTAINS "docs-cache.com" OR sourcehostname CONTAINS "docs-forwarding.online" OR sourcehostname CONTAINS "docs-info.com" OR sourcehostname CONTAINS "docs-shared.com" OR sourcehostname CONTAINS "docs-shared.online" OR sourcehostname CONTAINS "docs-view.online" OR sourcehostname CONTAINS "document-forwarding.com" OR sourcehostname CONTAINS "document-online.live" OR sourcehostname CONTAINS "document-preview.com" OR sourcehostname CONTAINS "documents-cloud.com" OR sourcehostname CONTAINS "documents-cloud.online" OR sourcehostname CONTAINS "documents-forwarding.com" OR sourcehostname CONTAINS "document-share.live" OR sourcehostname CONTAINS "documents-online.live" OR sourcehostname CONTAINS "documents-pdf.online" OR sourcehostname CONTAINS "documents-preview.com" OR sourcehostname CONTAINS "documents-view.live" OR sourcehostname CONTAINS "document-view.live" OR sourcehostname CONTAINS "drive-docs.com" OR sourcehostname CONTAINS "drive-share.live" OR sourcehostname CONTAINS "goo-link.online" OR sourcehostname CONTAINS "hypertextteches.com" OR sourcehostname CONTAINS "mail-docs.online" OR sourcehostname CONTAINS "officeonline365.live" OR sourcehostname CONTAINS "online365-office.com" OR sourcehostname CONTAINS "online-document.live" OR sourcehostname CONTAINS "online-storage.live" OR sourcehostname CONTAINS "pdf-cache.com" OR sourcehostname CONTAINS "pdf-cache.online" OR sourcehostname CONTAINS "pdf-docs.online" OR sourcehostname CONTAINS "pdf-forwarding.online" OR sourcehostname CONTAINS "protection-checklinks.xyz" OR sourcehostname CONTAINS "protection-link.online" OR sourcehostname CONTAINS "protectionmail.online" OR sourcehostname CONTAINS "protection-office.live" OR sourcehostname CONTAINS "protect-link.online" OR sourcehostname CONTAINS "proton-docs.com" OR sourcehostname CONTAINS "proton-reader.com" OR sourcehostname CONTAINS "proton-viewer.com")
index=activity AND rg_functionality="DNS / DHCP" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "cache-dns.com" OR destinationntdomain CONTAINS "sekoia.io" OR destinationntdomain CONTAINS "cache-dns-forwarding.com" OR destinationntdomain CONTAINS "cache-dns-preview.com" OR destinationntdomain CONTAINS "cache-docs.com" OR destinationntdomain CONTAINS "cache-pdf.com" OR destinationntdomain CONTAINS "cache-pdf.online" OR destinationntdomain CONTAINS "cache-services.live" OR destinationntdomain CONTAINS "cloud-docs.com" OR destinationntdomain CONTAINS "cloud-drive.live" OR destinationntdomain CONTAINS "cloud-storage.live" OR destinationntdomain CONTAINS "docs-cache.com" OR destinationntdomain CONTAINS "docs-forwarding.online" OR destinationntdomain CONTAINS "docs-info.com" OR destinationntdomain CONTAINS "docs-shared.com" OR destinationntdomain CONTAINS "docs-shared.online" OR destinationntdomain CONTAINS "docs-view.online" OR destinationntdomain CONTAINS "document-forwarding.com" OR destinationntdomain CONTAINS "document-online.live" OR destinationntdomain CONTAINS "document-preview.com" OR destinationntdomain CONTAINS "documents-cloud.com" OR destinationntdomain CONTAINS "documents-cloud.online" OR destinationntdomain CONTAINS "documents-forwarding.com" OR destinationntdomain CONTAINS "document-share.live" OR destinationntdomain CONTAINS "documents-online.live" OR destinationntdomain CONTAINS "documents-pdf.online" OR destinationntdomain CONTAINS "documents-preview.com" OR destinationntdomain CONTAINS "documents-view.live" OR destinationntdomain CONTAINS "document-view.live" OR destinationntdomain CONTAINS "drive-docs.com" OR destinationntdomain CONTAINS "drive-share.live" OR destinationntdomain CONTAINS "goo-link.online" OR destinationntdomain CONTAINS "hypertextteches.com" OR destinationntdomain CONTAINS "mail-docs.online" OR destinationntdomain CONTAINS "officeonline365.live" OR destinationntdomain CONTAINS "online365-office.com" OR destinationntdomain CONTAINS "online-document.live" OR destinationntdomain CONTAINS "online-storage.live" OR destinationntdomain CONTAINS "pdf-cache.com" OR destinationntdomain CONTAINS "pdf-cache.online" OR destinationntdomain CONTAINS "pdf-docs.online" OR destinationntdomain CONTAINS "pdf-forwarding.online" OR destinationntdomain CONTAINS "protection-checklinks.xyz" OR destinationntdomain CONTAINS "protection-link.online" OR destinationntdomain CONTAINS "protectionmail.online" OR destinationntdomain CONTAINS "protection-office.live" OR destinationntdomain CONTAINS "protect-link.online" OR destinationntdomain CONTAINS "proton-docs.com" OR destinationntdomain CONTAINS "proton-reader.com" OR destinationntdomain CONTAINS "proton-viewer.com")
index=activity AND rg_functionality="DNS / DHCP" AND requesturl NOT NULL AND (requesturl CONTAINS "cache-dns.com" OR requesturl CONTAINS "sekoia.io" OR requesturl CONTAINS "cache-dns-forwarding.com" OR requesturl CONTAINS "cache-dns-preview.com" OR requesturl CONTAINS "cache-docs.com" OR requesturl CONTAINS "cache-pdf.com" OR requesturl CONTAINS "cache-pdf.online" OR requesturl CONTAINS "cache-services.live" OR requesturl CONTAINS "cloud-docs.com" OR requesturl CONTAINS "cloud-drive.live" OR requesturl CONTAINS "cloud-storage.live" OR requesturl CONTAINS "docs-cache.com" OR requesturl CONTAINS "docs-forwarding.online" OR requesturl CONTAINS "docs-info.com" OR requesturl CONTAINS "docs-shared.com" OR requesturl CONTAINS "docs-shared.online" OR requesturl CONTAINS "docs-view.online" OR requesturl CONTAINS "document-forwarding.com" OR requesturl CONTAINS "document-online.live" OR requesturl CONTAINS "document-preview.com" OR requesturl CONTAINS "documents-cloud.com" OR requesturl CONTAINS "documents-cloud.online" OR requesturl CONTAINS "documents-forwarding.com" OR requesturl CONTAINS "document-share.live" OR requesturl CONTAINS "documents-online.live" OR requesturl CONTAINS "documents-pdf.online" OR requesturl CONTAINS "documents-preview.com" OR requesturl CONTAINS "documents-view.live" OR requesturl CONTAINS "document-view.live" OR requesturl CONTAINS "drive-docs.com" OR requesturl CONTAINS "drive-share.live" OR requesturl CONTAINS "goo-link.online" OR requesturl CONTAINS "hypertextteches.com" OR requesturl CONTAINS "mail-docs.online" OR requesturl CONTAINS "officeonline365.live" OR requesturl CONTAINS "online365-office.com" OR requesturl CONTAINS "online-document.live" OR requesturl CONTAINS "online-storage.live" OR requesturl CONTAINS "pdf-cache.com" OR requesturl CONTAINS "pdf-cache.online" OR requesturl CONTAINS "pdf-docs.online" OR requesturl CONTAINS "pdf-forwarding.online" OR requesturl CONTAINS "protection-checklinks.xyz" OR requesturl CONTAINS "protection-link.online" OR requesturl CONTAINS "protectionmail.online" OR requesturl CONTAINS "protection-office.live" OR requesturl CONTAINS "protect-link.online" OR requesturl CONTAINS "proton-docs.com" OR requesturl CONTAINS "proton-reader.com" OR requesturl CONTAINS "proton-viewer.com")
index=activity AND rg_functionality="DNS / DHCP" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "relogin-dashboard.online" OR destinationhostname CONTAINS "safe-connection.online" OR destinationhostname CONTAINS "safelinks-protect.live" OR destinationhostname CONTAINS "secureoffice.live" OR destinationhostname CONTAINS "webresources.live" OR destinationhostname CONTAINS "word-yand.live" OR destinationhostname CONTAINS "yandx-online.cloud" OR destinationhostname CONTAINS "y-ml.co" OR destinationhostname CONTAINS "docs-drive.online" OR destinationhostname CONTAINS "docs-info.online" OR destinationhostname CONTAINS "cloud-mail.online" OR destinationhostname CONTAINS "onlinecloud365.live" OR destinationhostname CONTAINS "pdf-cloud.online" OR destinationhostname CONTAINS "pdf-shared.online" OR destinationhostname CONTAINS "proton-pdf.online" OR destinationhostname CONTAINS "proton-view.online" OR destinationhostname CONTAINS "office365-online.live" OR destinationhostname CONTAINS "doc-viewer.com" OR destinationhostname CONTAINS "file-milgov.systems" OR destinationhostname CONTAINS "office-protection.online")
index=activity AND rg_functionality="DNS / DHCP" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "relogin-dashboard.online" OR sourcentdomain CONTAINS "safe-connection.online" OR sourcentdomain CONTAINS "safelinks-protect.live" OR sourcentdomain CONTAINS "secureoffice.live" OR sourcentdomain CONTAINS "webresources.live" OR sourcentdomain CONTAINS "word-yand.live" OR sourcentdomain CONTAINS "yandx-online.cloud" OR sourcentdomain CONTAINS "y-ml.co" OR sourcentdomain CONTAINS "docs-drive.online" OR sourcentdomain CONTAINS "docs-info.online" OR sourcentdomain CONTAINS "cloud-mail.online" OR sourcentdomain CONTAINS "onlinecloud365.live" OR sourcentdomain CONTAINS "pdf-cloud.online" OR sourcentdomain CONTAINS "pdf-shared.online" OR sourcentdomain CONTAINS "proton-pdf.online" OR sourcentdomain CONTAINS "proton-view.online" OR sourcentdomain CONTAINS "office365-online.live" OR sourcentdomain CONTAINS "doc-viewer.com" OR sourcentdomain CONTAINS "file-milgov.systems" OR sourcentdomain CONTAINS "office-protection.online")
index=activity AND rg_functionality="DNS / DHCP" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "relogin-dashboard.online" OR sourcehostname CONTAINS "safe-connection.online" OR sourcehostname CONTAINS "safelinks-protect.live" OR sourcehostname CONTAINS "secureoffice.live" OR sourcehostname CONTAINS "webresources.live" OR sourcehostname CONTAINS "word-yand.live" OR sourcehostname CONTAINS "yandx-online.cloud" OR sourcehostname CONTAINS "y-ml.co" OR sourcehostname CONTAINS "docs-drive.online" OR sourcehostname CONTAINS "docs-info.online" OR sourcehostname CONTAINS "cloud-mail.online" OR sourcehostname CONTAINS "onlinecloud365.live" OR sourcehostname CONTAINS "pdf-cloud.online" OR sourcehostname CONTAINS "pdf-shared.online" OR sourcehostname CONTAINS "proton-pdf.online" OR sourcehostname CONTAINS "proton-view.online" OR sourcehostname CONTAINS "office365-online.live" OR sourcehostname CONTAINS "doc-viewer.com" OR sourcehostname CONTAINS "file-milgov.systems" OR sourcehostname CONTAINS "office-protection.online")
index=activity AND rg_functionality="DNS / DHCP" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "relogin-dashboard.online" OR destinationntdomain CONTAINS "safe-connection.online" OR destinationntdomain CONTAINS "safelinks-protect.live" OR destinationntdomain CONTAINS "secureoffice.live" OR destinationntdomain CONTAINS "webresources.live" OR destinationntdomain CONTAINS "word-yand.live" OR destinationntdomain CONTAINS "yandx-online.cloud" OR destinationntdomain CONTAINS "y-ml.co" OR destinationntdomain CONTAINS "docs-drive.online" OR destinationntdomain CONTAINS "docs-info.online" OR destinationntdomain CONTAINS "cloud-mail.online" OR destinationntdomain CONTAINS "onlinecloud365.live" OR destinationntdomain CONTAINS "pdf-cloud.online" OR destinationntdomain CONTAINS "pdf-shared.online" OR destinationntdomain CONTAINS "proton-pdf.online" OR destinationntdomain CONTAINS "proton-view.online" OR destinationntdomain CONTAINS "office365-online.live" OR destinationntdomain CONTAINS "doc-viewer.com" OR destinationntdomain CONTAINS "file-milgov.systems" OR destinationntdomain CONTAINS "office-protection.online")
index=activity AND rg_functionality="DNS / DHCP" AND requesturl NOT NULL AND (requesturl CONTAINS "relogin-dashboard.online" OR requesturl CONTAINS "safe-connection.online" OR requesturl CONTAINS "safelinks-protect.live" OR requesturl CONTAINS "secureoffice.live" OR requesturl CONTAINS "webresources.live" OR requesturl CONTAINS "word-yand.live" OR requesturl CONTAINS "yandx-online.cloud" OR requesturl CONTAINS "y-ml.co" OR requesturl CONTAINS "docs-drive.online" OR requesturl CONTAINS "docs-info.online" OR requesturl CONTAINS "cloud-mail.online" OR requesturl CONTAINS "onlinecloud365.live" OR requesturl CONTAINS "pdf-cloud.online" OR requesturl CONTAINS "pdf-shared.online" OR requesturl CONTAINS "proton-pdf.online" OR requesturl CONTAINS "proton-view.online" OR requesturl CONTAINS "office365-online.live" OR requesturl CONTAINS "doc-viewer.com" OR requesturl CONTAINS "file-milgov.systems" OR requesturl CONTAINS "office-protection.online")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "cache-dns.com" OR destinationhostname CONTAINS "sekoia.io" OR destinationhostname CONTAINS "cache-dns-forwarding.com" OR destinationhostname CONTAINS "cache-dns-preview.com" OR destinationhostname CONTAINS "cache-docs.com" OR destinationhostname CONTAINS "cache-pdf.com" OR destinationhostname CONTAINS "cache-pdf.online" OR destinationhostname CONTAINS "cache-services.live" OR destinationhostname CONTAINS "cloud-docs.com" OR destinationhostname CONTAINS "cloud-drive.live" OR destinationhostname CONTAINS "cloud-storage.live" OR destinationhostname CONTAINS "docs-cache.com" OR destinationhostname CONTAINS "docs-forwarding.online" OR destinationhostname CONTAINS "docs-info.com" OR destinationhostname CONTAINS "docs-shared.com" OR destinationhostname CONTAINS "docs-shared.online" OR destinationhostname CONTAINS "docs-view.online" OR destinationhostname CONTAINS "document-forwarding.com" OR destinationhostname CONTAINS "document-online.live" OR destinationhostname CONTAINS "document-preview.com" OR destinationhostname CONTAINS "documents-cloud.com" OR destinationhostname CONTAINS "documents-cloud.online" OR destinationhostname CONTAINS "documents-forwarding.com" OR destinationhostname CONTAINS "document-share.live" OR destinationhostname CONTAINS "documents-online.live" OR destinationhostname CONTAINS "documents-pdf.online" OR destinationhostname CONTAINS "documents-preview.com" OR destinationhostname CONTAINS "documents-view.live" OR destinationhostname CONTAINS "document-view.live" OR destinationhostname CONTAINS "drive-docs.com" OR destinationhostname CONTAINS "drive-share.live" OR destinationhostname CONTAINS "goo-link.online" OR destinationhostname CONTAINS "hypertextteches.com" OR destinationhostname CONTAINS "mail-docs.online" OR destinationhostname CONTAINS "officeonline365.live" OR destinationhostname CONTAINS "online365-office.com" OR destinationhostname CONTAINS "online-document.live" OR destinationhostname CONTAINS "online-storage.live" OR destinationhostname CONTAINS "pdf-cache.com" OR destinationhostname CONTAINS "pdf-cache.online" OR destinationhostname CONTAINS "pdf-docs.online" OR destinationhostname CONTAINS "pdf-forwarding.online" OR destinationhostname CONTAINS "protection-checklinks.xyz" OR destinationhostname CONTAINS "protection-link.online" OR destinationhostname CONTAINS "protectionmail.online" OR destinationhostname CONTAINS "protection-office.live" OR destinationhostname CONTAINS "protect-link.online" OR destinationhostname CONTAINS "proton-docs.com" OR destinationhostname CONTAINS "proton-reader.com" OR destinationhostname CONTAINS "proton-viewer.com")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "cache-dns.com" OR sourcentdomain CONTAINS "sekoia.io" OR sourcentdomain CONTAINS "cache-dns-forwarding.com" OR sourcentdomain CONTAINS "cache-dns-preview.com" OR sourcentdomain CONTAINS "cache-docs.com" OR sourcentdomain CONTAINS "cache-pdf.com" OR sourcentdomain CONTAINS "cache-pdf.online" OR sourcentdomain CONTAINS "cache-services.live" OR sourcentdomain CONTAINS "cloud-docs.com" OR sourcentdomain CONTAINS "cloud-drive.live" OR sourcentdomain CONTAINS "cloud-storage.live" OR sourcentdomain CONTAINS "docs-cache.com" OR sourcentdomain CONTAINS "docs-forwarding.online" OR sourcentdomain CONTAINS "docs-info.com" OR sourcentdomain CONTAINS "docs-shared.com" OR sourcentdomain CONTAINS "docs-shared.online" OR sourcentdomain CONTAINS "docs-view.online" OR sourcentdomain CONTAINS "document-forwarding.com" OR sourcentdomain CONTAINS "document-online.live" OR sourcentdomain CONTAINS "document-preview.com" OR sourcentdomain CONTAINS "documents-cloud.com" OR sourcentdomain CONTAINS "documents-cloud.online" OR sourcentdomain CONTAINS "documents-forwarding.com" OR sourcentdomain CONTAINS "document-share.live" OR sourcentdomain CONTAINS "documents-online.live" OR sourcentdomain CONTAINS "documents-pdf.online" OR sourcentdomain CONTAINS "documents-preview.com" OR sourcentdomain CONTAINS "documents-view.live" OR sourcentdomain CONTAINS "document-view.live" OR sourcentdomain CONTAINS "drive-docs.com" OR sourcentdomain CONTAINS "drive-share.live" OR sourcentdomain CONTAINS "goo-link.online" OR sourcentdomain CONTAINS "hypertextteches.com" OR sourcentdomain CONTAINS "mail-docs.online" OR sourcentdomain CONTAINS "officeonline365.live" OR sourcentdomain CONTAINS "online365-office.com" OR sourcentdomain CONTAINS "online-document.live" OR sourcentdomain CONTAINS "online-storage.live" OR sourcentdomain CONTAINS "pdf-cache.com" OR sourcentdomain CONTAINS "pdf-cache.online" OR sourcentdomain CONTAINS "pdf-docs.online" OR sourcentdomain CONTAINS "pdf-forwarding.online" OR sourcentdomain CONTAINS "protection-checklinks.xyz" OR sourcentdomain CONTAINS "protection-link.online" OR sourcentdomain CONTAINS "protectionmail.online" OR sourcentdomain CONTAINS "protection-office.live" OR sourcentdomain CONTAINS "protect-link.online" OR sourcentdomain CONTAINS "proton-docs.com" OR sourcentdomain CONTAINS "proton-reader.com" OR sourcentdomain CONTAINS "proton-viewer.com")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "cache-dns.com" OR sourcehostname CONTAINS "sekoia.io" OR sourcehostname CONTAINS "cache-dns-forwarding.com" OR sourcehostname CONTAINS "cache-dns-preview.com" OR sourcehostname CONTAINS "cache-docs.com" OR sourcehostname CONTAINS "cache-pdf.com" OR sourcehostname CONTAINS "cache-pdf.online" OR sourcehostname CONTAINS "cache-services.live" OR sourcehostname CONTAINS "cloud-docs.com" OR sourcehostname CONTAINS "cloud-drive.live" OR sourcehostname CONTAINS "cloud-storage.live" OR sourcehostname CONTAINS "docs-cache.com" OR sourcehostname CONTAINS "docs-forwarding.online" OR sourcehostname CONTAINS "docs-info.com" OR sourcehostname CONTAINS "docs-shared.com" OR sourcehostname CONTAINS "docs-shared.online" OR sourcehostname CONTAINS "docs-view.online" OR sourcehostname CONTAINS "document-forwarding.com" OR sourcehostname CONTAINS "document-online.live" OR sourcehostname CONTAINS "document-preview.com" OR sourcehostname CONTAINS "documents-cloud.com" OR sourcehostname CONTAINS "documents-cloud.online" OR sourcehostname CONTAINS "documents-forwarding.com" OR sourcehostname CONTAINS "document-share.live" OR sourcehostname CONTAINS "documents-online.live" OR sourcehostname CONTAINS "documents-pdf.online" OR sourcehostname CONTAINS "documents-preview.com" OR sourcehostname CONTAINS "documents-view.live" OR sourcehostname CONTAINS "document-view.live" OR sourcehostname CONTAINS "drive-docs.com" OR sourcehostname CONTAINS "drive-share.live" OR sourcehostname CONTAINS "goo-link.online" OR sourcehostname CONTAINS "hypertextteches.com" OR sourcehostname CONTAINS "mail-docs.online" OR sourcehostname CONTAINS "officeonline365.live" OR sourcehostname CONTAINS "online365-office.com" OR sourcehostname CONTAINS "online-document.live" OR sourcehostname CONTAINS "online-storage.live" OR sourcehostname CONTAINS "pdf-cache.com" OR sourcehostname CONTAINS "pdf-cache.online" OR sourcehostname CONTAINS "pdf-docs.online" OR sourcehostname CONTAINS "pdf-forwarding.online" OR sourcehostname CONTAINS "protection-checklinks.xyz" OR sourcehostname CONTAINS "protection-link.online" OR sourcehostname CONTAINS "protectionmail.online" OR sourcehostname CONTAINS "protection-office.live" OR sourcehostname CONTAINS "protect-link.online" OR sourcehostname CONTAINS "proton-docs.com" OR sourcehostname CONTAINS "proton-reader.com" OR sourcehostname CONTAINS "proton-viewer.com")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "cache-dns.com" OR destinationntdomain CONTAINS "sekoia.io" OR destinationntdomain CONTAINS "cache-dns-forwarding.com" OR destinationntdomain CONTAINS "cache-dns-preview.com" OR destinationntdomain CONTAINS "cache-docs.com" OR destinationntdomain CONTAINS "cache-pdf.com" OR destinationntdomain CONTAINS "cache-pdf.online" OR destinationntdomain CONTAINS "cache-services.live" OR destinationntdomain CONTAINS "cloud-docs.com" OR destinationntdomain CONTAINS "cloud-drive.live" OR destinationntdomain CONTAINS "cloud-storage.live" OR destinationntdomain CONTAINS "docs-cache.com" OR destinationntdomain CONTAINS "docs-forwarding.online" OR destinationntdomain CONTAINS "docs-info.com" OR destinationntdomain CONTAINS "docs-shared.com" OR destinationntdomain CONTAINS "docs-shared.online" OR destinationntdomain CONTAINS "docs-view.online" OR destinationntdomain CONTAINS "document-forwarding.com" OR destinationntdomain CONTAINS "document-online.live" OR destinationntdomain CONTAINS "document-preview.com" OR destinationntdomain CONTAINS "documents-cloud.com" OR destinationntdomain CONTAINS "documents-cloud.online" OR destinationntdomain CONTAINS "documents-forwarding.com" OR destinationntdomain CONTAINS "document-share.live" OR destinationntdomain CONTAINS "documents-online.live" OR destinationntdomain CONTAINS "documents-pdf.online" OR destinationntdomain CONTAINS "documents-preview.com" OR destinationntdomain CONTAINS "documents-view.live" OR destinationntdomain CONTAINS "document-view.live" OR destinationntdomain CONTAINS "drive-docs.com" OR destinationntdomain CONTAINS "drive-share.live" OR destinationntdomain CONTAINS "goo-link.online" OR destinationntdomain CONTAINS "hypertextteches.com" OR destinationntdomain CONTAINS "mail-docs.online" OR destinationntdomain CONTAINS "officeonline365.live" OR destinationntdomain CONTAINS "online365-office.com" OR destinationntdomain CONTAINS "online-document.live" OR destinationntdomain CONTAINS "online-storage.live" OR destinationntdomain CONTAINS "pdf-cache.com" OR destinationntdomain CONTAINS "pdf-cache.online" OR destinationntdomain CONTAINS "pdf-docs.online" OR destinationntdomain CONTAINS "pdf-forwarding.online" OR destinationntdomain CONTAINS "protection-checklinks.xyz" OR destinationntdomain CONTAINS "protection-link.online" OR destinationntdomain CONTAINS "protectionmail.online" OR destinationntdomain CONTAINS "protection-office.live" OR destinationntdomain CONTAINS "protect-link.online" OR destinationntdomain CONTAINS "proton-docs.com" OR destinationntdomain CONTAINS "proton-reader.com" OR destinationntdomain CONTAINS "proton-viewer.com")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND requesturl NOT NULL AND (requesturl CONTAINS "cache-dns.com" OR requesturl CONTAINS "sekoia.io" OR requesturl CONTAINS "cache-dns-forwarding.com" OR requesturl CONTAINS "cache-dns-preview.com" OR requesturl CONTAINS "cache-docs.com" OR requesturl CONTAINS "cache-pdf.com" OR requesturl CONTAINS "cache-pdf.online" OR requesturl CONTAINS "cache-services.live" OR requesturl CONTAINS "cloud-docs.com" OR requesturl CONTAINS "cloud-drive.live" OR requesturl CONTAINS "cloud-storage.live" OR requesturl CONTAINS "docs-cache.com" OR requesturl CONTAINS "docs-forwarding.online" OR requesturl CONTAINS "docs-info.com" OR requesturl CONTAINS "docs-shared.com" OR requesturl CONTAINS "docs-shared.online" OR requesturl CONTAINS "docs-view.online" OR requesturl CONTAINS "document-forwarding.com" OR requesturl CONTAINS "document-online.live" OR requesturl CONTAINS "document-preview.com" OR requesturl CONTAINS "documents-cloud.com" OR requesturl CONTAINS "documents-cloud.online" OR requesturl CONTAINS "documents-forwarding.com" OR requesturl CONTAINS "document-share.live" OR requesturl CONTAINS "documents-online.live" OR requesturl CONTAINS "documents-pdf.online" OR requesturl CONTAINS "documents-preview.com" OR requesturl CONTAINS "documents-view.live" OR requesturl CONTAINS "document-view.live" OR requesturl CONTAINS "drive-docs.com" OR requesturl CONTAINS "drive-share.live" OR requesturl CONTAINS "goo-link.online" OR requesturl CONTAINS "hypertextteches.com" OR requesturl CONTAINS "mail-docs.online" OR requesturl CONTAINS "officeonline365.live" OR requesturl CONTAINS "online365-office.com" OR requesturl CONTAINS "online-document.live" OR requesturl CONTAINS "online-storage.live" OR requesturl CONTAINS "pdf-cache.com" OR requesturl CONTAINS "pdf-cache.online" OR requesturl CONTAINS "pdf-docs.online" OR requesturl CONTAINS "pdf-forwarding.online" OR requesturl CONTAINS "protection-checklinks.xyz" OR requesturl CONTAINS "protection-link.online" OR requesturl CONTAINS "protectionmail.online" OR requesturl CONTAINS "protection-office.live" OR requesturl CONTAINS "protect-link.online" OR requesturl CONTAINS "proton-docs.com" OR requesturl CONTAINS "proton-reader.com" OR requesturl CONTAINS "proton-viewer.com")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "relogin-dashboard.online" OR destinationhostname CONTAINS "safe-connection.online" OR destinationhostname CONTAINS "safelinks-protect.live" OR destinationhostname CONTAINS "secureoffice.live" OR destinationhostname CONTAINS "webresources.live" OR destinationhostname CONTAINS "word-yand.live" OR destinationhostname CONTAINS "yandx-online.cloud" OR destinationhostname CONTAINS "y-ml.co" OR destinationhostname CONTAINS "docs-drive.online" OR destinationhostname CONTAINS "docs-info.online" OR destinationhostname CONTAINS "cloud-mail.online" OR destinationhostname CONTAINS "onlinecloud365.live" OR destinationhostname CONTAINS "pdf-cloud.online" OR destinationhostname CONTAINS "pdf-shared.online" OR destinationhostname CONTAINS "proton-pdf.online" OR destinationhostname CONTAINS "proton-view.online" OR destinationhostname CONTAINS "office365-online.live" OR destinationhostname CONTAINS "doc-viewer.com" OR destinationhostname CONTAINS "file-milgov.systems" OR destinationhostname CONTAINS "office-protection.online")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "relogin-dashboard.online" OR sourcentdomain CONTAINS "safe-connection.online" OR sourcentdomain CONTAINS "safelinks-protect.live" OR sourcentdomain CONTAINS "secureoffice.live" OR sourcentdomain CONTAINS "webresources.live" OR sourcentdomain CONTAINS "word-yand.live" OR sourcentdomain CONTAINS "yandx-online.cloud" OR sourcentdomain CONTAINS "y-ml.co" OR sourcentdomain CONTAINS "docs-drive.online" OR sourcentdomain CONTAINS "docs-info.online" OR sourcentdomain CONTAINS "cloud-mail.online" OR sourcentdomain CONTAINS "onlinecloud365.live" OR sourcentdomain CONTAINS "pdf-cloud.online" OR sourcentdomain CONTAINS "pdf-shared.online" OR sourcentdomain CONTAINS "proton-pdf.online" OR sourcentdomain CONTAINS "proton-view.online" OR sourcentdomain CONTAINS "office365-online.live" OR sourcentdomain CONTAINS "doc-viewer.com" OR sourcentdomain CONTAINS "file-milgov.systems" OR sourcentdomain CONTAINS "office-protection.online")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "relogin-dashboard.online" OR sourcehostname CONTAINS "safe-connection.online" OR sourcehostname CONTAINS "safelinks-protect.live" OR sourcehostname CONTAINS "secureoffice.live" OR sourcehostname CONTAINS "webresources.live" OR sourcehostname CONTAINS "word-yand.live" OR sourcehostname CONTAINS "yandx-online.cloud" OR sourcehostname CONTAINS "y-ml.co" OR sourcehostname CONTAINS "docs-drive.online" OR sourcehostname CONTAINS "docs-info.online" OR sourcehostname CONTAINS "cloud-mail.online" OR sourcehostname CONTAINS "onlinecloud365.live" OR sourcehostname CONTAINS "pdf-cloud.online" OR sourcehostname CONTAINS "pdf-shared.online" OR sourcehostname CONTAINS "proton-pdf.online" OR sourcehostname CONTAINS "proton-view.online" OR sourcehostname CONTAINS "office365-online.live" OR sourcehostname CONTAINS "doc-viewer.com" OR sourcehostname CONTAINS "file-milgov.systems" OR sourcehostname CONTAINS "office-protection.online")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "relogin-dashboard.online" OR destinationntdomain CONTAINS "safe-connection.online" OR destinationntdomain CONTAINS "safelinks-protect.live" OR destinationntdomain CONTAINS "secureoffice.live" OR destinationntdomain CONTAINS "webresources.live" OR destinationntdomain CONTAINS "word-yand.live" OR destinationntdomain CONTAINS "yandx-online.cloud" OR destinationntdomain CONTAINS "y-ml.co" OR destinationntdomain CONTAINS "docs-drive.online" OR destinationntdomain CONTAINS "docs-info.online" OR destinationntdomain CONTAINS "cloud-mail.online" OR destinationntdomain CONTAINS "onlinecloud365.live" OR destinationntdomain CONTAINS "pdf-cloud.online" OR destinationntdomain CONTAINS "pdf-shared.online" OR destinationntdomain CONTAINS "proton-pdf.online" OR destinationntdomain CONTAINS "proton-view.online" OR destinationntdomain CONTAINS "office365-online.live" OR destinationntdomain CONTAINS "doc-viewer.com" OR destinationntdomain CONTAINS "file-milgov.systems" OR destinationntdomain CONTAINS "office-protection.online")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND requesturl NOT NULL AND (requesturl CONTAINS "relogin-dashboard.online" OR requesturl CONTAINS "safe-connection.online" OR requesturl CONTAINS "safelinks-protect.live" OR requesturl CONTAINS "secureoffice.live" OR requesturl CONTAINS "webresources.live" OR requesturl CONTAINS "word-yand.live" OR requesturl CONTAINS "yandx-online.cloud" OR requesturl CONTAINS "y-ml.co" OR requesturl CONTAINS "docs-drive.online" OR requesturl CONTAINS "docs-info.online" OR requesturl CONTAINS "cloud-mail.online" OR requesturl CONTAINS "onlinecloud365.live" OR requesturl CONTAINS "pdf-cloud.online" OR requesturl CONTAINS "pdf-shared.online" OR requesturl CONTAINS "proton-pdf.online" OR requesturl CONTAINS "proton-view.online" OR requesturl CONTAINS "office365-online.live" OR requesturl CONTAINS "doc-viewer.com" OR requesturl CONTAINS "file-milgov.systems" OR requesturl CONTAINS "office-protection.online")
