index=activity AND rg_functionality="Next Generation Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "soft-dns.sejilod748.workers.dev" OR destinationhostname CONTAINS "cdn1.poyag17470.workers.dev" OR destinationhostname CONTAINS "cdn1.cowivat156.workers.dev" OR destinationhostname CONTAINS "server-cdn.lafise2419.workers.dev" OR destinationhostname CONTAINS "server-web-cdn.rojotoc516.workers.dev" OR destinationhostname CONTAINS "server-cdn.lecoc56350.workers.dev" OR destinationhostname CONTAINS "server-cdn.xohahey822.workers.dev" OR destinationhostname CONTAINS "server-web-cdn.vosax32455.workers.dev" OR destinationhostname CONTAINS "cdn-server-1.xiren77418.workers.dev" OR destinationhostname CONTAINS "soft-base-01.ginigiy117.workers.dev" OR destinationhostname CONTAINS "work-server-1.picalob750.workers.dev" OR destinationhostname CONTAINS "cdn-web-server1.techserver01.workers.dev" OR destinationhostname CONTAINS "server-web-cdn.detocim498.workers.dev" OR destinationhostname CONTAINS "server-web-cdn.pixece7948.workers.dev" OR destinationhostname CONTAINS "server-cdn.virej10913.workers.dev" OR destinationhostname CONTAINS "server-web-cdn.kagoli5215.workers.dev" OR destinationhostname CONTAINS "dash-server.servertech03.workers.dev" OR destinationhostname CONTAINS "cdn-server-2.wesoc40288.workers.dev" OR destinationhostname CONTAINS "server-web-cdn.nefixeg373.workers.dev" OR destinationhostname CONTAINS "cdn-server-full.taros12579.workers.dev" OR destinationhostname CONTAINS "server-cdn.sidoke9822.workers.dev" OR destinationhostname CONTAINS "server-cdn.jawigaw383.workers.dev")
index=activity AND rg_functionality="Next Generation Firewall" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "soft-dns.sejilod748.workers.dev" OR sourcentdomain CONTAINS "cdn1.poyag17470.workers.dev" OR sourcentdomain CONTAINS "cdn1.cowivat156.workers.dev" OR sourcentdomain CONTAINS "server-cdn.lafise2419.workers.dev" OR sourcentdomain CONTAINS "server-web-cdn.rojotoc516.workers.dev" OR sourcentdomain CONTAINS "server-cdn.lecoc56350.workers.dev" OR sourcentdomain CONTAINS "server-cdn.xohahey822.workers.dev" OR sourcentdomain CONTAINS "server-web-cdn.vosax32455.workers.dev" OR sourcentdomain CONTAINS "cdn-server-1.xiren77418.workers.dev" OR sourcentdomain CONTAINS "soft-base-01.ginigiy117.workers.dev" OR sourcentdomain CONTAINS "work-server-1.picalob750.workers.dev" OR sourcentdomain CONTAINS "cdn-web-server1.techserver01.workers.dev" OR sourcentdomain CONTAINS "server-web-cdn.detocim498.workers.dev" OR sourcentdomain CONTAINS "server-web-cdn.pixece7948.workers.dev" OR sourcentdomain CONTAINS "server-cdn.virej10913.workers.dev" OR sourcentdomain CONTAINS "server-web-cdn.kagoli5215.workers.dev" OR sourcentdomain CONTAINS "dash-server.servertech03.workers.dev" OR sourcentdomain CONTAINS "cdn-server-2.wesoc40288.workers.dev" OR sourcentdomain CONTAINS "server-web-cdn.nefixeg373.workers.dev" OR sourcentdomain CONTAINS "cdn-server-full.taros12579.workers.dev" OR sourcentdomain CONTAINS "server-cdn.sidoke9822.workers.dev" OR sourcentdomain CONTAINS "server-cdn.jawigaw383.workers.dev")
index=activity AND rg_functionality="Next Generation Firewall" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "soft-dns.sejilod748.workers.dev" OR sourcehostname CONTAINS "cdn1.poyag17470.workers.dev" OR sourcehostname CONTAINS "cdn1.cowivat156.workers.dev" OR sourcehostname CONTAINS "server-cdn.lafise2419.workers.dev" OR sourcehostname CONTAINS "server-web-cdn.rojotoc516.workers.dev" OR sourcehostname CONTAINS "server-cdn.lecoc56350.workers.dev" OR sourcehostname CONTAINS "server-cdn.xohahey822.workers.dev" OR sourcehostname CONTAINS "server-web-cdn.vosax32455.workers.dev" OR sourcehostname CONTAINS "cdn-server-1.xiren77418.workers.dev" OR sourcehostname CONTAINS "soft-base-01.ginigiy117.workers.dev" OR sourcehostname CONTAINS "work-server-1.picalob750.workers.dev" OR sourcehostname CONTAINS "cdn-web-server1.techserver01.workers.dev" OR sourcehostname CONTAINS "server-web-cdn.detocim498.workers.dev" OR sourcehostname CONTAINS "server-web-cdn.pixece7948.workers.dev" OR sourcehostname CONTAINS "server-cdn.virej10913.workers.dev" OR sourcehostname CONTAINS "server-web-cdn.kagoli5215.workers.dev" OR sourcehostname CONTAINS "dash-server.servertech03.workers.dev" OR sourcehostname CONTAINS "cdn-server-2.wesoc40288.workers.dev" OR sourcehostname CONTAINS "server-web-cdn.nefixeg373.workers.dev" OR sourcehostname CONTAINS "cdn-server-full.taros12579.workers.dev" OR sourcehostname CONTAINS "server-cdn.sidoke9822.workers.dev" OR sourcehostname CONTAINS "server-cdn.jawigaw383.workers.dev")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "soft-dns.sejilod748.workers.dev" OR destinationntdomain CONTAINS "cdn1.poyag17470.workers.dev" OR destinationntdomain CONTAINS "cdn1.cowivat156.workers.dev" OR destinationntdomain CONTAINS "server-cdn.lafise2419.workers.dev" OR destinationntdomain CONTAINS "server-web-cdn.rojotoc516.workers.dev" OR destinationntdomain CONTAINS "server-cdn.lecoc56350.workers.dev" OR destinationntdomain CONTAINS "server-cdn.xohahey822.workers.dev" OR destinationntdomain CONTAINS "server-web-cdn.vosax32455.workers.dev" OR destinationntdomain CONTAINS "cdn-server-1.xiren77418.workers.dev" OR destinationntdomain CONTAINS "soft-base-01.ginigiy117.workers.dev" OR destinationntdomain CONTAINS "work-server-1.picalob750.workers.dev" OR destinationntdomain CONTAINS "cdn-web-server1.techserver01.workers.dev" OR destinationntdomain CONTAINS "server-web-cdn.detocim498.workers.dev" OR destinationntdomain CONTAINS "server-web-cdn.pixece7948.workers.dev" OR destinationntdomain CONTAINS "server-cdn.virej10913.workers.dev" OR destinationntdomain CONTAINS "server-web-cdn.kagoli5215.workers.dev" OR destinationntdomain CONTAINS "dash-server.servertech03.workers.dev" OR destinationntdomain CONTAINS "cdn-server-2.wesoc40288.workers.dev" OR destinationntdomain CONTAINS "server-web-cdn.nefixeg373.workers.dev" OR destinationntdomain CONTAINS "cdn-server-full.taros12579.workers.dev" OR destinationntdomain CONTAINS "server-cdn.sidoke9822.workers.dev" OR destinationntdomain CONTAINS "server-cdn.jawigaw383.workers.dev")
index=activity AND rg_functionality="Next Generation Firewall" AND requesturl NOT NULL AND (requesturl CONTAINS "soft-dns.sejilod748.workers.dev" OR requesturl CONTAINS "cdn1.poyag17470.workers.dev" OR requesturl CONTAINS "cdn1.cowivat156.workers.dev" OR requesturl CONTAINS "server-cdn.lafise2419.workers.dev" OR requesturl CONTAINS "server-web-cdn.rojotoc516.workers.dev" OR requesturl CONTAINS "server-cdn.lecoc56350.workers.dev" OR requesturl CONTAINS "server-cdn.xohahey822.workers.dev" OR requesturl CONTAINS "server-web-cdn.vosax32455.workers.dev" OR requesturl CONTAINS "cdn-server-1.xiren77418.workers.dev" OR requesturl CONTAINS "soft-base-01.ginigiy117.workers.dev" OR requesturl CONTAINS "work-server-1.picalob750.workers.dev" OR requesturl CONTAINS "cdn-web-server1.techserver01.workers.dev" OR requesturl CONTAINS "server-web-cdn.detocim498.workers.dev" OR requesturl CONTAINS "server-web-cdn.pixece7948.workers.dev" OR requesturl CONTAINS "server-cdn.virej10913.workers.dev" OR requesturl CONTAINS "server-web-cdn.kagoli5215.workers.dev" OR requesturl CONTAINS "dash-server.servertech03.workers.dev" OR requesturl CONTAINS "cdn-server-2.wesoc40288.workers.dev" OR requesturl CONTAINS "server-web-cdn.nefixeg373.workers.dev" OR requesturl CONTAINS "cdn-server-full.taros12579.workers.dev" OR requesturl CONTAINS "server-cdn.sidoke9822.workers.dev" OR requesturl CONTAINS "server-cdn.jawigaw383.workers.dev")
index=activity AND rg_functionality="Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "soft-dns.sejilod748.workers.dev" OR destinationhostname CONTAINS "cdn1.poyag17470.workers.dev" OR destinationhostname CONTAINS "cdn1.cowivat156.workers.dev" OR destinationhostname CONTAINS "server-cdn.lafise2419.workers.dev" OR destinationhostname CONTAINS "server-web-cdn.rojotoc516.workers.dev" OR destinationhostname CONTAINS "server-cdn.lecoc56350.workers.dev" OR destinationhostname CONTAINS "server-cdn.xohahey822.workers.dev" OR destinationhostname CONTAINS "server-web-cdn.vosax32455.workers.dev" OR destinationhostname CONTAINS "cdn-server-1.xiren77418.workers.dev" OR destinationhostname CONTAINS "soft-base-01.ginigiy117.workers.dev" OR destinationhostname CONTAINS "work-server-1.picalob750.workers.dev" OR destinationhostname CONTAINS "cdn-web-server1.techserver01.workers.dev" OR destinationhostname CONTAINS "server-web-cdn.detocim498.workers.dev" OR destinationhostname CONTAINS "server-web-cdn.pixece7948.workers.dev" OR destinationhostname CONTAINS "server-cdn.virej10913.workers.dev" OR destinationhostname CONTAINS "server-web-cdn.kagoli5215.workers.dev" OR destinationhostname CONTAINS "dash-server.servertech03.workers.dev" OR destinationhostname CONTAINS "cdn-server-2.wesoc40288.workers.dev" OR destinationhostname CONTAINS "server-web-cdn.nefixeg373.workers.dev" OR destinationhostname CONTAINS "cdn-server-full.taros12579.workers.dev" OR destinationhostname CONTAINS "server-cdn.sidoke9822.workers.dev" OR destinationhostname CONTAINS "server-cdn.jawigaw383.workers.dev")
index=activity AND rg_functionality="Firewall" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "soft-dns.sejilod748.workers.dev" OR sourcentdomain CONTAINS "cdn1.poyag17470.workers.dev" OR sourcentdomain CONTAINS "cdn1.cowivat156.workers.dev" OR sourcentdomain CONTAINS "server-cdn.lafise2419.workers.dev" OR sourcentdomain CONTAINS "server-web-cdn.rojotoc516.workers.dev" OR sourcentdomain CONTAINS "server-cdn.lecoc56350.workers.dev" OR sourcentdomain CONTAINS "server-cdn.xohahey822.workers.dev" OR sourcentdomain CONTAINS "server-web-cdn.vosax32455.workers.dev" OR sourcentdomain CONTAINS "cdn-server-1.xiren77418.workers.dev" OR sourcentdomain CONTAINS "soft-base-01.ginigiy117.workers.dev" OR sourcentdomain CONTAINS "work-server-1.picalob750.workers.dev" OR sourcentdomain CONTAINS "cdn-web-server1.techserver01.workers.dev" OR sourcentdomain CONTAINS "server-web-cdn.detocim498.workers.dev" OR sourcentdomain CONTAINS "server-web-cdn.pixece7948.workers.dev" OR sourcentdomain CONTAINS "server-cdn.virej10913.workers.dev" OR sourcentdomain CONTAINS "server-web-cdn.kagoli5215.workers.dev" OR sourcentdomain CONTAINS "dash-server.servertech03.workers.dev" OR sourcentdomain CONTAINS "cdn-server-2.wesoc40288.workers.dev" OR sourcentdomain CONTAINS "server-web-cdn.nefixeg373.workers.dev" OR sourcentdomain CONTAINS "cdn-server-full.taros12579.workers.dev" OR sourcentdomain CONTAINS "server-cdn.sidoke9822.workers.dev" OR sourcentdomain CONTAINS "server-cdn.jawigaw383.workers.dev")
index=activity AND rg_functionality="Firewall" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "soft-dns.sejilod748.workers.dev" OR sourcehostname CONTAINS "cdn1.poyag17470.workers.dev" OR sourcehostname CONTAINS "cdn1.cowivat156.workers.dev" OR sourcehostname CONTAINS "server-cdn.lafise2419.workers.dev" OR sourcehostname CONTAINS "server-web-cdn.rojotoc516.workers.dev" OR sourcehostname CONTAINS "server-cdn.lecoc56350.workers.dev" OR sourcehostname CONTAINS "server-cdn.xohahey822.workers.dev" OR sourcehostname CONTAINS "server-web-cdn.vosax32455.workers.dev" OR sourcehostname CONTAINS "cdn-server-1.xiren77418.workers.dev" OR sourcehostname CONTAINS "soft-base-01.ginigiy117.workers.dev" OR sourcehostname CONTAINS "work-server-1.picalob750.workers.dev" OR sourcehostname CONTAINS "cdn-web-server1.techserver01.workers.dev" OR sourcehostname CONTAINS "server-web-cdn.detocim498.workers.dev" OR sourcehostname CONTAINS "server-web-cdn.pixece7948.workers.dev" OR sourcehostname CONTAINS "server-cdn.virej10913.workers.dev" OR sourcehostname CONTAINS "server-web-cdn.kagoli5215.workers.dev" OR sourcehostname CONTAINS "dash-server.servertech03.workers.dev" OR sourcehostname CONTAINS "cdn-server-2.wesoc40288.workers.dev" OR sourcehostname CONTAINS "server-web-cdn.nefixeg373.workers.dev" OR sourcehostname CONTAINS "cdn-server-full.taros12579.workers.dev" OR sourcehostname CONTAINS "server-cdn.sidoke9822.workers.dev" OR sourcehostname CONTAINS "server-cdn.jawigaw383.workers.dev")
index=activity AND rg_functionality="Firewall" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "soft-dns.sejilod748.workers.dev" OR destinationntdomain CONTAINS "cdn1.poyag17470.workers.dev" OR destinationntdomain CONTAINS "cdn1.cowivat156.workers.dev" OR destinationntdomain CONTAINS "server-cdn.lafise2419.workers.dev" OR destinationntdomain CONTAINS "server-web-cdn.rojotoc516.workers.dev" OR destinationntdomain CONTAINS "server-cdn.lecoc56350.workers.dev" OR destinationntdomain CONTAINS "server-cdn.xohahey822.workers.dev" OR destinationntdomain CONTAINS "server-web-cdn.vosax32455.workers.dev" OR destinationntdomain CONTAINS "cdn-server-1.xiren77418.workers.dev" OR destinationntdomain CONTAINS "soft-base-01.ginigiy117.workers.dev" OR destinationntdomain CONTAINS "work-server-1.picalob750.workers.dev" OR destinationntdomain CONTAINS "cdn-web-server1.techserver01.workers.dev" OR destinationntdomain CONTAINS "server-web-cdn.detocim498.workers.dev" OR destinationntdomain CONTAINS "server-web-cdn.pixece7948.workers.dev" OR destinationntdomain CONTAINS "server-cdn.virej10913.workers.dev" OR destinationntdomain CONTAINS "server-web-cdn.kagoli5215.workers.dev" OR destinationntdomain CONTAINS "dash-server.servertech03.workers.dev" OR destinationntdomain CONTAINS "cdn-server-2.wesoc40288.workers.dev" OR destinationntdomain CONTAINS "server-web-cdn.nefixeg373.workers.dev" OR destinationntdomain CONTAINS "cdn-server-full.taros12579.workers.dev" OR destinationntdomain CONTAINS "server-cdn.sidoke9822.workers.dev" OR destinationntdomain CONTAINS "server-cdn.jawigaw383.workers.dev")
index=activity AND rg_functionality="Firewall" AND requesturl NOT NULL AND (requesturl CONTAINS "soft-dns.sejilod748.workers.dev" OR requesturl CONTAINS "cdn1.poyag17470.workers.dev" OR requesturl CONTAINS "cdn1.cowivat156.workers.dev" OR requesturl CONTAINS "server-cdn.lafise2419.workers.dev" OR requesturl CONTAINS "server-web-cdn.rojotoc516.workers.dev" OR requesturl CONTAINS "server-cdn.lecoc56350.workers.dev" OR requesturl CONTAINS "server-cdn.xohahey822.workers.dev" OR requesturl CONTAINS "server-web-cdn.vosax32455.workers.dev" OR requesturl CONTAINS "cdn-server-1.xiren77418.workers.dev" OR requesturl CONTAINS "soft-base-01.ginigiy117.workers.dev" OR requesturl CONTAINS "work-server-1.picalob750.workers.dev" OR requesturl CONTAINS "cdn-web-server1.techserver01.workers.dev" OR requesturl CONTAINS "server-web-cdn.detocim498.workers.dev" OR requesturl CONTAINS "server-web-cdn.pixece7948.workers.dev" OR requesturl CONTAINS "server-cdn.virej10913.workers.dev" OR requesturl CONTAINS "server-web-cdn.kagoli5215.workers.dev" OR requesturl CONTAINS "dash-server.servertech03.workers.dev" OR requesturl CONTAINS "cdn-server-2.wesoc40288.workers.dev" OR requesturl CONTAINS "server-web-cdn.nefixeg373.workers.dev" OR requesturl CONTAINS "cdn-server-full.taros12579.workers.dev" OR requesturl CONTAINS "server-cdn.sidoke9822.workers.dev" OR requesturl CONTAINS "server-cdn.jawigaw383.workers.dev")
index=activity AND rg_functionality="Web Proxy" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "soft-dns.sejilod748.workers.dev" OR destinationhostname CONTAINS "cdn1.poyag17470.workers.dev" OR destinationhostname CONTAINS "cdn1.cowivat156.workers.dev" OR destinationhostname CONTAINS "server-cdn.lafise2419.workers.dev" OR destinationhostname CONTAINS "server-web-cdn.rojotoc516.workers.dev" OR destinationhostname CONTAINS "server-cdn.lecoc56350.workers.dev" OR destinationhostname CONTAINS "server-cdn.xohahey822.workers.dev" OR destinationhostname CONTAINS "server-web-cdn.vosax32455.workers.dev" OR destinationhostname CONTAINS "cdn-server-1.xiren77418.workers.dev" OR destinationhostname CONTAINS "soft-base-01.ginigiy117.workers.dev" OR destinationhostname CONTAINS "work-server-1.picalob750.workers.dev" OR destinationhostname CONTAINS "cdn-web-server1.techserver01.workers.dev" OR destinationhostname CONTAINS "server-web-cdn.detocim498.workers.dev" OR destinationhostname CONTAINS "server-web-cdn.pixece7948.workers.dev" OR destinationhostname CONTAINS "server-cdn.virej10913.workers.dev" OR destinationhostname CONTAINS "server-web-cdn.kagoli5215.workers.dev" OR destinationhostname CONTAINS "dash-server.servertech03.workers.dev" OR destinationhostname CONTAINS "cdn-server-2.wesoc40288.workers.dev" OR destinationhostname CONTAINS "server-web-cdn.nefixeg373.workers.dev" OR destinationhostname CONTAINS "cdn-server-full.taros12579.workers.dev" OR destinationhostname CONTAINS "server-cdn.sidoke9822.workers.dev" OR destinationhostname CONTAINS "server-cdn.jawigaw383.workers.dev")
index=activity AND rg_functionality="Web Proxy" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "soft-dns.sejilod748.workers.dev" OR sourcentdomain CONTAINS "cdn1.poyag17470.workers.dev" OR sourcentdomain CONTAINS "cdn1.cowivat156.workers.dev" OR sourcentdomain CONTAINS "server-cdn.lafise2419.workers.dev" OR sourcentdomain CONTAINS "server-web-cdn.rojotoc516.workers.dev" OR sourcentdomain CONTAINS "server-cdn.lecoc56350.workers.dev" OR sourcentdomain CONTAINS "server-cdn.xohahey822.workers.dev" OR sourcentdomain CONTAINS "server-web-cdn.vosax32455.workers.dev" OR sourcentdomain CONTAINS "cdn-server-1.xiren77418.workers.dev" OR sourcentdomain CONTAINS "soft-base-01.ginigiy117.workers.dev" OR sourcentdomain CONTAINS "work-server-1.picalob750.workers.dev" OR sourcentdomain CONTAINS "cdn-web-server1.techserver01.workers.dev" OR sourcentdomain CONTAINS "server-web-cdn.detocim498.workers.dev" OR sourcentdomain CONTAINS "server-web-cdn.pixece7948.workers.dev" OR sourcentdomain CONTAINS "server-cdn.virej10913.workers.dev" OR sourcentdomain CONTAINS "server-web-cdn.kagoli5215.workers.dev" OR sourcentdomain CONTAINS "dash-server.servertech03.workers.dev" OR sourcentdomain CONTAINS "cdn-server-2.wesoc40288.workers.dev" OR sourcentdomain CONTAINS "server-web-cdn.nefixeg373.workers.dev" OR sourcentdomain CONTAINS "cdn-server-full.taros12579.workers.dev" OR sourcentdomain CONTAINS "server-cdn.sidoke9822.workers.dev" OR sourcentdomain CONTAINS "server-cdn.jawigaw383.workers.dev")
index=activity AND rg_functionality="Web Proxy" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "soft-dns.sejilod748.workers.dev" OR sourcehostname CONTAINS "cdn1.poyag17470.workers.dev" OR sourcehostname CONTAINS "cdn1.cowivat156.workers.dev" OR sourcehostname CONTAINS "server-cdn.lafise2419.workers.dev" OR sourcehostname CONTAINS "server-web-cdn.rojotoc516.workers.dev" OR sourcehostname CONTAINS "server-cdn.lecoc56350.workers.dev" OR sourcehostname CONTAINS "server-cdn.xohahey822.workers.dev" OR sourcehostname CONTAINS "server-web-cdn.vosax32455.workers.dev" OR sourcehostname CONTAINS "cdn-server-1.xiren77418.workers.dev" OR sourcehostname CONTAINS "soft-base-01.ginigiy117.workers.dev" OR sourcehostname CONTAINS "work-server-1.picalob750.workers.dev" OR sourcehostname CONTAINS "cdn-web-server1.techserver01.workers.dev" OR sourcehostname CONTAINS "server-web-cdn.detocim498.workers.dev" OR sourcehostname CONTAINS "server-web-cdn.pixece7948.workers.dev" OR sourcehostname CONTAINS "server-cdn.virej10913.workers.dev" OR sourcehostname CONTAINS "server-web-cdn.kagoli5215.workers.dev" OR sourcehostname CONTAINS "dash-server.servertech03.workers.dev" OR sourcehostname CONTAINS "cdn-server-2.wesoc40288.workers.dev" OR sourcehostname CONTAINS "server-web-cdn.nefixeg373.workers.dev" OR sourcehostname CONTAINS "cdn-server-full.taros12579.workers.dev" OR sourcehostname CONTAINS "server-cdn.sidoke9822.workers.dev" OR sourcehostname CONTAINS "server-cdn.jawigaw383.workers.dev")
index=activity AND rg_functionality="Web Proxy" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "soft-dns.sejilod748.workers.dev" OR destinationntdomain CONTAINS "cdn1.poyag17470.workers.dev" OR destinationntdomain CONTAINS "cdn1.cowivat156.workers.dev" OR destinationntdomain CONTAINS "server-cdn.lafise2419.workers.dev" OR destinationntdomain CONTAINS "server-web-cdn.rojotoc516.workers.dev" OR destinationntdomain CONTAINS "server-cdn.lecoc56350.workers.dev" OR destinationntdomain CONTAINS "server-cdn.xohahey822.workers.dev" OR destinationntdomain CONTAINS "server-web-cdn.vosax32455.workers.dev" OR destinationntdomain CONTAINS "cdn-server-1.xiren77418.workers.dev" OR destinationntdomain CONTAINS "soft-base-01.ginigiy117.workers.dev" OR destinationntdomain CONTAINS "work-server-1.picalob750.workers.dev" OR destinationntdomain CONTAINS "cdn-web-server1.techserver01.workers.dev" OR destinationntdomain CONTAINS "server-web-cdn.detocim498.workers.dev" OR destinationntdomain CONTAINS "server-web-cdn.pixece7948.workers.dev" OR destinationntdomain CONTAINS "server-cdn.virej10913.workers.dev" OR destinationntdomain CONTAINS "server-web-cdn.kagoli5215.workers.dev" OR destinationntdomain CONTAINS "dash-server.servertech03.workers.dev" OR destinationntdomain CONTAINS "cdn-server-2.wesoc40288.workers.dev" OR destinationntdomain CONTAINS "server-web-cdn.nefixeg373.workers.dev" OR destinationntdomain CONTAINS "cdn-server-full.taros12579.workers.dev" OR destinationntdomain CONTAINS "server-cdn.sidoke9822.workers.dev" OR destinationntdomain CONTAINS "server-cdn.jawigaw383.workers.dev")
index=activity AND rg_functionality="Web Proxy" AND requesturl NOT NULL AND (requesturl CONTAINS "soft-dns.sejilod748.workers.dev" OR requesturl CONTAINS "cdn1.poyag17470.workers.dev" OR requesturl CONTAINS "cdn1.cowivat156.workers.dev" OR requesturl CONTAINS "server-cdn.lafise2419.workers.dev" OR requesturl CONTAINS "server-web-cdn.rojotoc516.workers.dev" OR requesturl CONTAINS "server-cdn.lecoc56350.workers.dev" OR requesturl CONTAINS "server-cdn.xohahey822.workers.dev" OR requesturl CONTAINS "server-web-cdn.vosax32455.workers.dev" OR requesturl CONTAINS "cdn-server-1.xiren77418.workers.dev" OR requesturl CONTAINS "soft-base-01.ginigiy117.workers.dev" OR requesturl CONTAINS "work-server-1.picalob750.workers.dev" OR requesturl CONTAINS "cdn-web-server1.techserver01.workers.dev" OR requesturl CONTAINS "server-web-cdn.detocim498.workers.dev" OR requesturl CONTAINS "server-web-cdn.pixece7948.workers.dev" OR requesturl CONTAINS "server-cdn.virej10913.workers.dev" OR requesturl CONTAINS "server-web-cdn.kagoli5215.workers.dev" OR requesturl CONTAINS "dash-server.servertech03.workers.dev" OR requesturl CONTAINS "cdn-server-2.wesoc40288.workers.dev" OR requesturl CONTAINS "server-web-cdn.nefixeg373.workers.dev" OR requesturl CONTAINS "cdn-server-full.taros12579.workers.dev" OR requesturl CONTAINS "server-cdn.sidoke9822.workers.dev" OR requesturl CONTAINS "server-cdn.jawigaw383.workers.dev")
index=activity AND rg_functionality="Flow" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "soft-dns.sejilod748.workers.dev" OR destinationhostname CONTAINS "cdn1.poyag17470.workers.dev" OR destinationhostname CONTAINS "cdn1.cowivat156.workers.dev" OR destinationhostname CONTAINS "server-cdn.lafise2419.workers.dev" OR destinationhostname CONTAINS "server-web-cdn.rojotoc516.workers.dev" OR destinationhostname CONTAINS "server-cdn.lecoc56350.workers.dev" OR destinationhostname CONTAINS "server-cdn.xohahey822.workers.dev" OR destinationhostname CONTAINS "server-web-cdn.vosax32455.workers.dev" OR destinationhostname CONTAINS "cdn-server-1.xiren77418.workers.dev" OR destinationhostname CONTAINS "soft-base-01.ginigiy117.workers.dev" OR destinationhostname CONTAINS "work-server-1.picalob750.workers.dev" OR destinationhostname CONTAINS "cdn-web-server1.techserver01.workers.dev" OR destinationhostname CONTAINS "server-web-cdn.detocim498.workers.dev" OR destinationhostname CONTAINS "server-web-cdn.pixece7948.workers.dev" OR destinationhostname CONTAINS "server-cdn.virej10913.workers.dev" OR destinationhostname CONTAINS "server-web-cdn.kagoli5215.workers.dev" OR destinationhostname CONTAINS "dash-server.servertech03.workers.dev" OR destinationhostname CONTAINS "cdn-server-2.wesoc40288.workers.dev" OR destinationhostname CONTAINS "server-web-cdn.nefixeg373.workers.dev" OR destinationhostname CONTAINS "cdn-server-full.taros12579.workers.dev" OR destinationhostname CONTAINS "server-cdn.sidoke9822.workers.dev" OR destinationhostname CONTAINS "server-cdn.jawigaw383.workers.dev")
index=activity AND rg_functionality="Flow" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "soft-dns.sejilod748.workers.dev" OR sourcentdomain CONTAINS "cdn1.poyag17470.workers.dev" OR sourcentdomain CONTAINS "cdn1.cowivat156.workers.dev" OR sourcentdomain CONTAINS "server-cdn.lafise2419.workers.dev" OR sourcentdomain CONTAINS "server-web-cdn.rojotoc516.workers.dev" OR sourcentdomain CONTAINS "server-cdn.lecoc56350.workers.dev" OR sourcentdomain CONTAINS "server-cdn.xohahey822.workers.dev" OR sourcentdomain CONTAINS "server-web-cdn.vosax32455.workers.dev" OR sourcentdomain CONTAINS "cdn-server-1.xiren77418.workers.dev" OR sourcentdomain CONTAINS "soft-base-01.ginigiy117.workers.dev" OR sourcentdomain CONTAINS "work-server-1.picalob750.workers.dev" OR sourcentdomain CONTAINS "cdn-web-server1.techserver01.workers.dev" OR sourcentdomain CONTAINS "server-web-cdn.detocim498.workers.dev" OR sourcentdomain CONTAINS "server-web-cdn.pixece7948.workers.dev" OR sourcentdomain CONTAINS "server-cdn.virej10913.workers.dev" OR sourcentdomain CONTAINS "server-web-cdn.kagoli5215.workers.dev" OR sourcentdomain CONTAINS "dash-server.servertech03.workers.dev" OR sourcentdomain CONTAINS "cdn-server-2.wesoc40288.workers.dev" OR sourcentdomain CONTAINS "server-web-cdn.nefixeg373.workers.dev" OR sourcentdomain CONTAINS "cdn-server-full.taros12579.workers.dev" OR sourcentdomain CONTAINS "server-cdn.sidoke9822.workers.dev" OR sourcentdomain CONTAINS "server-cdn.jawigaw383.workers.dev")
index=activity AND rg_functionality="Flow" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "soft-dns.sejilod748.workers.dev" OR sourcehostname CONTAINS "cdn1.poyag17470.workers.dev" OR sourcehostname CONTAINS "cdn1.cowivat156.workers.dev" OR sourcehostname CONTAINS "server-cdn.lafise2419.workers.dev" OR sourcehostname CONTAINS "server-web-cdn.rojotoc516.workers.dev" OR sourcehostname CONTAINS "server-cdn.lecoc56350.workers.dev" OR sourcehostname CONTAINS "server-cdn.xohahey822.workers.dev" OR sourcehostname CONTAINS "server-web-cdn.vosax32455.workers.dev" OR sourcehostname CONTAINS "cdn-server-1.xiren77418.workers.dev" OR sourcehostname CONTAINS "soft-base-01.ginigiy117.workers.dev" OR sourcehostname CONTAINS "work-server-1.picalob750.workers.dev" OR sourcehostname CONTAINS "cdn-web-server1.techserver01.workers.dev" OR sourcehostname CONTAINS "server-web-cdn.detocim498.workers.dev" OR sourcehostname CONTAINS "server-web-cdn.pixece7948.workers.dev" OR sourcehostname CONTAINS "server-cdn.virej10913.workers.dev" OR sourcehostname CONTAINS "server-web-cdn.kagoli5215.workers.dev" OR sourcehostname CONTAINS "dash-server.servertech03.workers.dev" OR sourcehostname CONTAINS "cdn-server-2.wesoc40288.workers.dev" OR sourcehostname CONTAINS "server-web-cdn.nefixeg373.workers.dev" OR sourcehostname CONTAINS "cdn-server-full.taros12579.workers.dev" OR sourcehostname CONTAINS "server-cdn.sidoke9822.workers.dev" OR sourcehostname CONTAINS "server-cdn.jawigaw383.workers.dev")
index=activity AND rg_functionality="Flow" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "soft-dns.sejilod748.workers.dev" OR destinationntdomain CONTAINS "cdn1.poyag17470.workers.dev" OR destinationntdomain CONTAINS "cdn1.cowivat156.workers.dev" OR destinationntdomain CONTAINS "server-cdn.lafise2419.workers.dev" OR destinationntdomain CONTAINS "server-web-cdn.rojotoc516.workers.dev" OR destinationntdomain CONTAINS "server-cdn.lecoc56350.workers.dev" OR destinationntdomain CONTAINS "server-cdn.xohahey822.workers.dev" OR destinationntdomain CONTAINS "server-web-cdn.vosax32455.workers.dev" OR destinationntdomain CONTAINS "cdn-server-1.xiren77418.workers.dev" OR destinationntdomain CONTAINS "soft-base-01.ginigiy117.workers.dev" OR destinationntdomain CONTAINS "work-server-1.picalob750.workers.dev" OR destinationntdomain CONTAINS "cdn-web-server1.techserver01.workers.dev" OR destinationntdomain CONTAINS "server-web-cdn.detocim498.workers.dev" OR destinationntdomain CONTAINS "server-web-cdn.pixece7948.workers.dev" OR destinationntdomain CONTAINS "server-cdn.virej10913.workers.dev" OR destinationntdomain CONTAINS "server-web-cdn.kagoli5215.workers.dev" OR destinationntdomain CONTAINS "dash-server.servertech03.workers.dev" OR destinationntdomain CONTAINS "cdn-server-2.wesoc40288.workers.dev" OR destinationntdomain CONTAINS "server-web-cdn.nefixeg373.workers.dev" OR destinationntdomain CONTAINS "cdn-server-full.taros12579.workers.dev" OR destinationntdomain CONTAINS "server-cdn.sidoke9822.workers.dev" OR destinationntdomain CONTAINS "server-cdn.jawigaw383.workers.dev")
index=activity AND rg_functionality="Flow" AND requesturl NOT NULL AND (requesturl CONTAINS "soft-dns.sejilod748.workers.dev" OR requesturl CONTAINS "cdn1.poyag17470.workers.dev" OR requesturl CONTAINS "cdn1.cowivat156.workers.dev" OR requesturl CONTAINS "server-cdn.lafise2419.workers.dev" OR requesturl CONTAINS "server-web-cdn.rojotoc516.workers.dev" OR requesturl CONTAINS "server-cdn.lecoc56350.workers.dev" OR requesturl CONTAINS "server-cdn.xohahey822.workers.dev" OR requesturl CONTAINS "server-web-cdn.vosax32455.workers.dev" OR requesturl CONTAINS "cdn-server-1.xiren77418.workers.dev" OR requesturl CONTAINS "soft-base-01.ginigiy117.workers.dev" OR requesturl CONTAINS "work-server-1.picalob750.workers.dev" OR requesturl CONTAINS "cdn-web-server1.techserver01.workers.dev" OR requesturl CONTAINS "server-web-cdn.detocim498.workers.dev" OR requesturl CONTAINS "server-web-cdn.pixece7948.workers.dev" OR requesturl CONTAINS "server-cdn.virej10913.workers.dev" OR requesturl CONTAINS "server-web-cdn.kagoli5215.workers.dev" OR requesturl CONTAINS "dash-server.servertech03.workers.dev" OR requesturl CONTAINS "cdn-server-2.wesoc40288.workers.dev" OR requesturl CONTAINS "server-web-cdn.nefixeg373.workers.dev" OR requesturl CONTAINS "cdn-server-full.taros12579.workers.dev" OR requesturl CONTAINS "server-cdn.sidoke9822.workers.dev" OR requesturl CONTAINS "server-cdn.jawigaw383.workers.dev")
index=activity AND rg_functionality="Web Server" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "soft-dns.sejilod748.workers.dev" OR destinationhostname CONTAINS "cdn1.poyag17470.workers.dev" OR destinationhostname CONTAINS "cdn1.cowivat156.workers.dev" OR destinationhostname CONTAINS "server-cdn.lafise2419.workers.dev" OR destinationhostname CONTAINS "server-web-cdn.rojotoc516.workers.dev" OR destinationhostname CONTAINS "server-cdn.lecoc56350.workers.dev" OR destinationhostname CONTAINS "server-cdn.xohahey822.workers.dev" OR destinationhostname CONTAINS "server-web-cdn.vosax32455.workers.dev" OR destinationhostname CONTAINS "cdn-server-1.xiren77418.workers.dev" OR destinationhostname CONTAINS "soft-base-01.ginigiy117.workers.dev" OR destinationhostname CONTAINS "work-server-1.picalob750.workers.dev" OR destinationhostname CONTAINS "cdn-web-server1.techserver01.workers.dev" OR destinationhostname CONTAINS "server-web-cdn.detocim498.workers.dev" OR destinationhostname CONTAINS "server-web-cdn.pixece7948.workers.dev" OR destinationhostname CONTAINS "server-cdn.virej10913.workers.dev" OR destinationhostname CONTAINS "server-web-cdn.kagoli5215.workers.dev" OR destinationhostname CONTAINS "dash-server.servertech03.workers.dev" OR destinationhostname CONTAINS "cdn-server-2.wesoc40288.workers.dev" OR destinationhostname CONTAINS "server-web-cdn.nefixeg373.workers.dev" OR destinationhostname CONTAINS "cdn-server-full.taros12579.workers.dev" OR destinationhostname CONTAINS "server-cdn.sidoke9822.workers.dev" OR destinationhostname CONTAINS "server-cdn.jawigaw383.workers.dev")
index=activity AND rg_functionality="Web Server" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "soft-dns.sejilod748.workers.dev" OR sourcentdomain CONTAINS "cdn1.poyag17470.workers.dev" OR sourcentdomain CONTAINS "cdn1.cowivat156.workers.dev" OR sourcentdomain CONTAINS "server-cdn.lafise2419.workers.dev" OR sourcentdomain CONTAINS "server-web-cdn.rojotoc516.workers.dev" OR sourcentdomain CONTAINS "server-cdn.lecoc56350.workers.dev" OR sourcentdomain CONTAINS "server-cdn.xohahey822.workers.dev" OR sourcentdomain CONTAINS "server-web-cdn.vosax32455.workers.dev" OR sourcentdomain CONTAINS "cdn-server-1.xiren77418.workers.dev" OR sourcentdomain CONTAINS "soft-base-01.ginigiy117.workers.dev" OR sourcentdomain CONTAINS "work-server-1.picalob750.workers.dev" OR sourcentdomain CONTAINS "cdn-web-server1.techserver01.workers.dev" OR sourcentdomain CONTAINS "server-web-cdn.detocim498.workers.dev" OR sourcentdomain CONTAINS "server-web-cdn.pixece7948.workers.dev" OR sourcentdomain CONTAINS "server-cdn.virej10913.workers.dev" OR sourcentdomain CONTAINS "server-web-cdn.kagoli5215.workers.dev" OR sourcentdomain CONTAINS "dash-server.servertech03.workers.dev" OR sourcentdomain CONTAINS "cdn-server-2.wesoc40288.workers.dev" OR sourcentdomain CONTAINS "server-web-cdn.nefixeg373.workers.dev" OR sourcentdomain CONTAINS "cdn-server-full.taros12579.workers.dev" OR sourcentdomain CONTAINS "server-cdn.sidoke9822.workers.dev" OR sourcentdomain CONTAINS "server-cdn.jawigaw383.workers.dev")
index=activity AND rg_functionality="Web Server" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "soft-dns.sejilod748.workers.dev" OR sourcehostname CONTAINS "cdn1.poyag17470.workers.dev" OR sourcehostname CONTAINS "cdn1.cowivat156.workers.dev" OR sourcehostname CONTAINS "server-cdn.lafise2419.workers.dev" OR sourcehostname CONTAINS "server-web-cdn.rojotoc516.workers.dev" OR sourcehostname CONTAINS "server-cdn.lecoc56350.workers.dev" OR sourcehostname CONTAINS "server-cdn.xohahey822.workers.dev" OR sourcehostname CONTAINS "server-web-cdn.vosax32455.workers.dev" OR sourcehostname CONTAINS "cdn-server-1.xiren77418.workers.dev" OR sourcehostname CONTAINS "soft-base-01.ginigiy117.workers.dev" OR sourcehostname CONTAINS "work-server-1.picalob750.workers.dev" OR sourcehostname CONTAINS "cdn-web-server1.techserver01.workers.dev" OR sourcehostname CONTAINS "server-web-cdn.detocim498.workers.dev" OR sourcehostname CONTAINS "server-web-cdn.pixece7948.workers.dev" OR sourcehostname CONTAINS "server-cdn.virej10913.workers.dev" OR sourcehostname CONTAINS "server-web-cdn.kagoli5215.workers.dev" OR sourcehostname CONTAINS "dash-server.servertech03.workers.dev" OR sourcehostname CONTAINS "cdn-server-2.wesoc40288.workers.dev" OR sourcehostname CONTAINS "server-web-cdn.nefixeg373.workers.dev" OR sourcehostname CONTAINS "cdn-server-full.taros12579.workers.dev" OR sourcehostname CONTAINS "server-cdn.sidoke9822.workers.dev" OR sourcehostname CONTAINS "server-cdn.jawigaw383.workers.dev")
index=activity AND rg_functionality="Web Server" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "soft-dns.sejilod748.workers.dev" OR destinationntdomain CONTAINS "cdn1.poyag17470.workers.dev" OR destinationntdomain CONTAINS "cdn1.cowivat156.workers.dev" OR destinationntdomain CONTAINS "server-cdn.lafise2419.workers.dev" OR destinationntdomain CONTAINS "server-web-cdn.rojotoc516.workers.dev" OR destinationntdomain CONTAINS "server-cdn.lecoc56350.workers.dev" OR destinationntdomain CONTAINS "server-cdn.xohahey822.workers.dev" OR destinationntdomain CONTAINS "server-web-cdn.vosax32455.workers.dev" OR destinationntdomain CONTAINS "cdn-server-1.xiren77418.workers.dev" OR destinationntdomain CONTAINS "soft-base-01.ginigiy117.workers.dev" OR destinationntdomain CONTAINS "work-server-1.picalob750.workers.dev" OR destinationntdomain CONTAINS "cdn-web-server1.techserver01.workers.dev" OR destinationntdomain CONTAINS "server-web-cdn.detocim498.workers.dev" OR destinationntdomain CONTAINS "server-web-cdn.pixece7948.workers.dev" OR destinationntdomain CONTAINS "server-cdn.virej10913.workers.dev" OR destinationntdomain CONTAINS "server-web-cdn.kagoli5215.workers.dev" OR destinationntdomain CONTAINS "dash-server.servertech03.workers.dev" OR destinationntdomain CONTAINS "cdn-server-2.wesoc40288.workers.dev" OR destinationntdomain CONTAINS "server-web-cdn.nefixeg373.workers.dev" OR destinationntdomain CONTAINS "cdn-server-full.taros12579.workers.dev" OR destinationntdomain CONTAINS "server-cdn.sidoke9822.workers.dev" OR destinationntdomain CONTAINS "server-cdn.jawigaw383.workers.dev")
index=activity AND rg_functionality="Web Server" AND requesturl NOT NULL AND (requesturl CONTAINS "soft-dns.sejilod748.workers.dev" OR requesturl CONTAINS "cdn1.poyag17470.workers.dev" OR requesturl CONTAINS "cdn1.cowivat156.workers.dev" OR requesturl CONTAINS "server-cdn.lafise2419.workers.dev" OR requesturl CONTAINS "server-web-cdn.rojotoc516.workers.dev" OR requesturl CONTAINS "server-cdn.lecoc56350.workers.dev" OR requesturl CONTAINS "server-cdn.xohahey822.workers.dev" OR requesturl CONTAINS "server-web-cdn.vosax32455.workers.dev" OR requesturl CONTAINS "cdn-server-1.xiren77418.workers.dev" OR requesturl CONTAINS "soft-base-01.ginigiy117.workers.dev" OR requesturl CONTAINS "work-server-1.picalob750.workers.dev" OR requesturl CONTAINS "cdn-web-server1.techserver01.workers.dev" OR requesturl CONTAINS "server-web-cdn.detocim498.workers.dev" OR requesturl CONTAINS "server-web-cdn.pixece7948.workers.dev" OR requesturl CONTAINS "server-cdn.virej10913.workers.dev" OR requesturl CONTAINS "server-web-cdn.kagoli5215.workers.dev" OR requesturl CONTAINS "dash-server.servertech03.workers.dev" OR requesturl CONTAINS "cdn-server-2.wesoc40288.workers.dev" OR requesturl CONTAINS "server-web-cdn.nefixeg373.workers.dev" OR requesturl CONTAINS "cdn-server-full.taros12579.workers.dev" OR requesturl CONTAINS "server-cdn.sidoke9822.workers.dev" OR requesturl CONTAINS "server-cdn.jawigaw383.workers.dev")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "soft-dns.sejilod748.workers.dev" OR destinationhostname CONTAINS "cdn1.poyag17470.workers.dev" OR destinationhostname CONTAINS "cdn1.cowivat156.workers.dev" OR destinationhostname CONTAINS "server-cdn.lafise2419.workers.dev" OR destinationhostname CONTAINS "server-web-cdn.rojotoc516.workers.dev" OR destinationhostname CONTAINS "server-cdn.lecoc56350.workers.dev" OR destinationhostname CONTAINS "server-cdn.xohahey822.workers.dev" OR destinationhostname CONTAINS "server-web-cdn.vosax32455.workers.dev" OR destinationhostname CONTAINS "cdn-server-1.xiren77418.workers.dev" OR destinationhostname CONTAINS "soft-base-01.ginigiy117.workers.dev" OR destinationhostname CONTAINS "work-server-1.picalob750.workers.dev" OR destinationhostname CONTAINS "cdn-web-server1.techserver01.workers.dev" OR destinationhostname CONTAINS "server-web-cdn.detocim498.workers.dev" OR destinationhostname CONTAINS "server-web-cdn.pixece7948.workers.dev" OR destinationhostname CONTAINS "server-cdn.virej10913.workers.dev" OR destinationhostname CONTAINS "server-web-cdn.kagoli5215.workers.dev" OR destinationhostname CONTAINS "dash-server.servertech03.workers.dev" OR destinationhostname CONTAINS "cdn-server-2.wesoc40288.workers.dev" OR destinationhostname CONTAINS "server-web-cdn.nefixeg373.workers.dev" OR destinationhostname CONTAINS "cdn-server-full.taros12579.workers.dev" OR destinationhostname CONTAINS "server-cdn.sidoke9822.workers.dev" OR destinationhostname CONTAINS "server-cdn.jawigaw383.workers.dev")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "soft-dns.sejilod748.workers.dev" OR sourcentdomain CONTAINS "cdn1.poyag17470.workers.dev" OR sourcentdomain CONTAINS "cdn1.cowivat156.workers.dev" OR sourcentdomain CONTAINS "server-cdn.lafise2419.workers.dev" OR sourcentdomain CONTAINS "server-web-cdn.rojotoc516.workers.dev" OR sourcentdomain CONTAINS "server-cdn.lecoc56350.workers.dev" OR sourcentdomain CONTAINS "server-cdn.xohahey822.workers.dev" OR sourcentdomain CONTAINS "server-web-cdn.vosax32455.workers.dev" OR sourcentdomain CONTAINS "cdn-server-1.xiren77418.workers.dev" OR sourcentdomain CONTAINS "soft-base-01.ginigiy117.workers.dev" OR sourcentdomain CONTAINS "work-server-1.picalob750.workers.dev" OR sourcentdomain CONTAINS "cdn-web-server1.techserver01.workers.dev" OR sourcentdomain CONTAINS "server-web-cdn.detocim498.workers.dev" OR sourcentdomain CONTAINS "server-web-cdn.pixece7948.workers.dev" OR sourcentdomain CONTAINS "server-cdn.virej10913.workers.dev" OR sourcentdomain CONTAINS "server-web-cdn.kagoli5215.workers.dev" OR sourcentdomain CONTAINS "dash-server.servertech03.workers.dev" OR sourcentdomain CONTAINS "cdn-server-2.wesoc40288.workers.dev" OR sourcentdomain CONTAINS "server-web-cdn.nefixeg373.workers.dev" OR sourcentdomain CONTAINS "cdn-server-full.taros12579.workers.dev" OR sourcentdomain CONTAINS "server-cdn.sidoke9822.workers.dev" OR sourcentdomain CONTAINS "server-cdn.jawigaw383.workers.dev")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "soft-dns.sejilod748.workers.dev" OR sourcehostname CONTAINS "cdn1.poyag17470.workers.dev" OR sourcehostname CONTAINS "cdn1.cowivat156.workers.dev" OR sourcehostname CONTAINS "server-cdn.lafise2419.workers.dev" OR sourcehostname CONTAINS "server-web-cdn.rojotoc516.workers.dev" OR sourcehostname CONTAINS "server-cdn.lecoc56350.workers.dev" OR sourcehostname CONTAINS "server-cdn.xohahey822.workers.dev" OR sourcehostname CONTAINS "server-web-cdn.vosax32455.workers.dev" OR sourcehostname CONTAINS "cdn-server-1.xiren77418.workers.dev" OR sourcehostname CONTAINS "soft-base-01.ginigiy117.workers.dev" OR sourcehostname CONTAINS "work-server-1.picalob750.workers.dev" OR sourcehostname CONTAINS "cdn-web-server1.techserver01.workers.dev" OR sourcehostname CONTAINS "server-web-cdn.detocim498.workers.dev" OR sourcehostname CONTAINS "server-web-cdn.pixece7948.workers.dev" OR sourcehostname CONTAINS "server-cdn.virej10913.workers.dev" OR sourcehostname CONTAINS "server-web-cdn.kagoli5215.workers.dev" OR sourcehostname CONTAINS "dash-server.servertech03.workers.dev" OR sourcehostname CONTAINS "cdn-server-2.wesoc40288.workers.dev" OR sourcehostname CONTAINS "server-web-cdn.nefixeg373.workers.dev" OR sourcehostname CONTAINS "cdn-server-full.taros12579.workers.dev" OR sourcehostname CONTAINS "server-cdn.sidoke9822.workers.dev" OR sourcehostname CONTAINS "server-cdn.jawigaw383.workers.dev")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "soft-dns.sejilod748.workers.dev" OR destinationntdomain CONTAINS "cdn1.poyag17470.workers.dev" OR destinationntdomain CONTAINS "cdn1.cowivat156.workers.dev" OR destinationntdomain CONTAINS "server-cdn.lafise2419.workers.dev" OR destinationntdomain CONTAINS "server-web-cdn.rojotoc516.workers.dev" OR destinationntdomain CONTAINS "server-cdn.lecoc56350.workers.dev" OR destinationntdomain CONTAINS "server-cdn.xohahey822.workers.dev" OR destinationntdomain CONTAINS "server-web-cdn.vosax32455.workers.dev" OR destinationntdomain CONTAINS "cdn-server-1.xiren77418.workers.dev" OR destinationntdomain CONTAINS "soft-base-01.ginigiy117.workers.dev" OR destinationntdomain CONTAINS "work-server-1.picalob750.workers.dev" OR destinationntdomain CONTAINS "cdn-web-server1.techserver01.workers.dev" OR destinationntdomain CONTAINS "server-web-cdn.detocim498.workers.dev" OR destinationntdomain CONTAINS "server-web-cdn.pixece7948.workers.dev" OR destinationntdomain CONTAINS "server-cdn.virej10913.workers.dev" OR destinationntdomain CONTAINS "server-web-cdn.kagoli5215.workers.dev" OR destinationntdomain CONTAINS "dash-server.servertech03.workers.dev" OR destinationntdomain CONTAINS "cdn-server-2.wesoc40288.workers.dev" OR destinationntdomain CONTAINS "server-web-cdn.nefixeg373.workers.dev" OR destinationntdomain CONTAINS "cdn-server-full.taros12579.workers.dev" OR destinationntdomain CONTAINS "server-cdn.sidoke9822.workers.dev" OR destinationntdomain CONTAINS "server-cdn.jawigaw383.workers.dev")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND requesturl NOT NULL AND (requesturl CONTAINS "soft-dns.sejilod748.workers.dev" OR requesturl CONTAINS "cdn1.poyag17470.workers.dev" OR requesturl CONTAINS "cdn1.cowivat156.workers.dev" OR requesturl CONTAINS "server-cdn.lafise2419.workers.dev" OR requesturl CONTAINS "server-web-cdn.rojotoc516.workers.dev" OR requesturl CONTAINS "server-cdn.lecoc56350.workers.dev" OR requesturl CONTAINS "server-cdn.xohahey822.workers.dev" OR requesturl CONTAINS "server-web-cdn.vosax32455.workers.dev" OR requesturl CONTAINS "cdn-server-1.xiren77418.workers.dev" OR requesturl CONTAINS "soft-base-01.ginigiy117.workers.dev" OR requesturl CONTAINS "work-server-1.picalob750.workers.dev" OR requesturl CONTAINS "cdn-web-server1.techserver01.workers.dev" OR requesturl CONTAINS "server-web-cdn.detocim498.workers.dev" OR requesturl CONTAINS "server-web-cdn.pixece7948.workers.dev" OR requesturl CONTAINS "server-cdn.virej10913.workers.dev" OR requesturl CONTAINS "server-web-cdn.kagoli5215.workers.dev" OR requesturl CONTAINS "dash-server.servertech03.workers.dev" OR requesturl CONTAINS "cdn-server-2.wesoc40288.workers.dev" OR requesturl CONTAINS "server-web-cdn.nefixeg373.workers.dev" OR requesturl CONTAINS "cdn-server-full.taros12579.workers.dev" OR requesturl CONTAINS "server-cdn.sidoke9822.workers.dev" OR requesturl CONTAINS "server-cdn.jawigaw383.workers.dev")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "soft-dns.sejilod748.workers.dev" OR destinationhostname CONTAINS "cdn1.poyag17470.workers.dev" OR destinationhostname CONTAINS "cdn1.cowivat156.workers.dev" OR destinationhostname CONTAINS "server-cdn.lafise2419.workers.dev" OR destinationhostname CONTAINS "server-web-cdn.rojotoc516.workers.dev" OR destinationhostname CONTAINS "server-cdn.lecoc56350.workers.dev" OR destinationhostname CONTAINS "server-cdn.xohahey822.workers.dev" OR destinationhostname CONTAINS "server-web-cdn.vosax32455.workers.dev" OR destinationhostname CONTAINS "cdn-server-1.xiren77418.workers.dev" OR destinationhostname CONTAINS "soft-base-01.ginigiy117.workers.dev" OR destinationhostname CONTAINS "work-server-1.picalob750.workers.dev" OR destinationhostname CONTAINS "cdn-web-server1.techserver01.workers.dev" OR destinationhostname CONTAINS "server-web-cdn.detocim498.workers.dev" OR destinationhostname CONTAINS "server-web-cdn.pixece7948.workers.dev" OR destinationhostname CONTAINS "server-cdn.virej10913.workers.dev" OR destinationhostname CONTAINS "server-web-cdn.kagoli5215.workers.dev" OR destinationhostname CONTAINS "dash-server.servertech03.workers.dev" OR destinationhostname CONTAINS "cdn-server-2.wesoc40288.workers.dev" OR destinationhostname CONTAINS "server-web-cdn.nefixeg373.workers.dev" OR destinationhostname CONTAINS "cdn-server-full.taros12579.workers.dev" OR destinationhostname CONTAINS "server-cdn.sidoke9822.workers.dev" OR destinationhostname CONTAINS "server-cdn.jawigaw383.workers.dev")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "soft-dns.sejilod748.workers.dev" OR sourcentdomain CONTAINS "cdn1.poyag17470.workers.dev" OR sourcentdomain CONTAINS "cdn1.cowivat156.workers.dev" OR sourcentdomain CONTAINS "server-cdn.lafise2419.workers.dev" OR sourcentdomain CONTAINS "server-web-cdn.rojotoc516.workers.dev" OR sourcentdomain CONTAINS "server-cdn.lecoc56350.workers.dev" OR sourcentdomain CONTAINS "server-cdn.xohahey822.workers.dev" OR sourcentdomain CONTAINS "server-web-cdn.vosax32455.workers.dev" OR sourcentdomain CONTAINS "cdn-server-1.xiren77418.workers.dev" OR sourcentdomain CONTAINS "soft-base-01.ginigiy117.workers.dev" OR sourcentdomain CONTAINS "work-server-1.picalob750.workers.dev" OR sourcentdomain CONTAINS "cdn-web-server1.techserver01.workers.dev" OR sourcentdomain CONTAINS "server-web-cdn.detocim498.workers.dev" OR sourcentdomain CONTAINS "server-web-cdn.pixece7948.workers.dev" OR sourcentdomain CONTAINS "server-cdn.virej10913.workers.dev" OR sourcentdomain CONTAINS "server-web-cdn.kagoli5215.workers.dev" OR sourcentdomain CONTAINS "dash-server.servertech03.workers.dev" OR sourcentdomain CONTAINS "cdn-server-2.wesoc40288.workers.dev" OR sourcentdomain CONTAINS "server-web-cdn.nefixeg373.workers.dev" OR sourcentdomain CONTAINS "cdn-server-full.taros12579.workers.dev" OR sourcentdomain CONTAINS "server-cdn.sidoke9822.workers.dev" OR sourcentdomain CONTAINS "server-cdn.jawigaw383.workers.dev")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "soft-dns.sejilod748.workers.dev" OR sourcehostname CONTAINS "cdn1.poyag17470.workers.dev" OR sourcehostname CONTAINS "cdn1.cowivat156.workers.dev" OR sourcehostname CONTAINS "server-cdn.lafise2419.workers.dev" OR sourcehostname CONTAINS "server-web-cdn.rojotoc516.workers.dev" OR sourcehostname CONTAINS "server-cdn.lecoc56350.workers.dev" OR sourcehostname CONTAINS "server-cdn.xohahey822.workers.dev" OR sourcehostname CONTAINS "server-web-cdn.vosax32455.workers.dev" OR sourcehostname CONTAINS "cdn-server-1.xiren77418.workers.dev" OR sourcehostname CONTAINS "soft-base-01.ginigiy117.workers.dev" OR sourcehostname CONTAINS "work-server-1.picalob750.workers.dev" OR sourcehostname CONTAINS "cdn-web-server1.techserver01.workers.dev" OR sourcehostname CONTAINS "server-web-cdn.detocim498.workers.dev" OR sourcehostname CONTAINS "server-web-cdn.pixece7948.workers.dev" OR sourcehostname CONTAINS "server-cdn.virej10913.workers.dev" OR sourcehostname CONTAINS "server-web-cdn.kagoli5215.workers.dev" OR sourcehostname CONTAINS "dash-server.servertech03.workers.dev" OR sourcehostname CONTAINS "cdn-server-2.wesoc40288.workers.dev" OR sourcehostname CONTAINS "server-web-cdn.nefixeg373.workers.dev" OR sourcehostname CONTAINS "cdn-server-full.taros12579.workers.dev" OR sourcehostname CONTAINS "server-cdn.sidoke9822.workers.dev" OR sourcehostname CONTAINS "server-cdn.jawigaw383.workers.dev")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "soft-dns.sejilod748.workers.dev" OR destinationntdomain CONTAINS "cdn1.poyag17470.workers.dev" OR destinationntdomain CONTAINS "cdn1.cowivat156.workers.dev" OR destinationntdomain CONTAINS "server-cdn.lafise2419.workers.dev" OR destinationntdomain CONTAINS "server-web-cdn.rojotoc516.workers.dev" OR destinationntdomain CONTAINS "server-cdn.lecoc56350.workers.dev" OR destinationntdomain CONTAINS "server-cdn.xohahey822.workers.dev" OR destinationntdomain CONTAINS "server-web-cdn.vosax32455.workers.dev" OR destinationntdomain CONTAINS "cdn-server-1.xiren77418.workers.dev" OR destinationntdomain CONTAINS "soft-base-01.ginigiy117.workers.dev" OR destinationntdomain CONTAINS "work-server-1.picalob750.workers.dev" OR destinationntdomain CONTAINS "cdn-web-server1.techserver01.workers.dev" OR destinationntdomain CONTAINS "server-web-cdn.detocim498.workers.dev" OR destinationntdomain CONTAINS "server-web-cdn.pixece7948.workers.dev" OR destinationntdomain CONTAINS "server-cdn.virej10913.workers.dev" OR destinationntdomain CONTAINS "server-web-cdn.kagoli5215.workers.dev" OR destinationntdomain CONTAINS "dash-server.servertech03.workers.dev" OR destinationntdomain CONTAINS "cdn-server-2.wesoc40288.workers.dev" OR destinationntdomain CONTAINS "server-web-cdn.nefixeg373.workers.dev" OR destinationntdomain CONTAINS "cdn-server-full.taros12579.workers.dev" OR destinationntdomain CONTAINS "server-cdn.sidoke9822.workers.dev" OR destinationntdomain CONTAINS "server-cdn.jawigaw383.workers.dev")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND requesturl NOT NULL AND (requesturl CONTAINS "soft-dns.sejilod748.workers.dev" OR requesturl CONTAINS "cdn1.poyag17470.workers.dev" OR requesturl CONTAINS "cdn1.cowivat156.workers.dev" OR requesturl CONTAINS "server-cdn.lafise2419.workers.dev" OR requesturl CONTAINS "server-web-cdn.rojotoc516.workers.dev" OR requesturl CONTAINS "server-cdn.lecoc56350.workers.dev" OR requesturl CONTAINS "server-cdn.xohahey822.workers.dev" OR requesturl CONTAINS "server-web-cdn.vosax32455.workers.dev" OR requesturl CONTAINS "cdn-server-1.xiren77418.workers.dev" OR requesturl CONTAINS "soft-base-01.ginigiy117.workers.dev" OR requesturl CONTAINS "work-server-1.picalob750.workers.dev" OR requesturl CONTAINS "cdn-web-server1.techserver01.workers.dev" OR requesturl CONTAINS "server-web-cdn.detocim498.workers.dev" OR requesturl CONTAINS "server-web-cdn.pixece7948.workers.dev" OR requesturl CONTAINS "server-cdn.virej10913.workers.dev" OR requesturl CONTAINS "server-web-cdn.kagoli5215.workers.dev" OR requesturl CONTAINS "dash-server.servertech03.workers.dev" OR requesturl CONTAINS "cdn-server-2.wesoc40288.workers.dev" OR requesturl CONTAINS "server-web-cdn.nefixeg373.workers.dev" OR requesturl CONTAINS "cdn-server-full.taros12579.workers.dev" OR requesturl CONTAINS "server-cdn.sidoke9822.workers.dev" OR requesturl CONTAINS "server-cdn.jawigaw383.workers.dev")
index=activity AND rg_functionality="Web Application Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "soft-dns.sejilod748.workers.dev" OR destinationhostname CONTAINS "cdn1.poyag17470.workers.dev" OR destinationhostname CONTAINS "cdn1.cowivat156.workers.dev" OR destinationhostname CONTAINS "server-cdn.lafise2419.workers.dev" OR destinationhostname CONTAINS "server-web-cdn.rojotoc516.workers.dev" OR destinationhostname CONTAINS "server-cdn.lecoc56350.workers.dev" OR destinationhostname CONTAINS "server-cdn.xohahey822.workers.dev" OR destinationhostname CONTAINS "server-web-cdn.vosax32455.workers.dev" OR destinationhostname CONTAINS "cdn-server-1.xiren77418.workers.dev" OR destinationhostname CONTAINS "soft-base-01.ginigiy117.workers.dev" OR destinationhostname CONTAINS "work-server-1.picalob750.workers.dev" OR destinationhostname CONTAINS "cdn-web-server1.techserver01.workers.dev" OR destinationhostname CONTAINS "server-web-cdn.detocim498.workers.dev" OR destinationhostname CONTAINS "server-web-cdn.pixece7948.workers.dev" OR destinationhostname CONTAINS "server-cdn.virej10913.workers.dev" OR destinationhostname CONTAINS "server-web-cdn.kagoli5215.workers.dev" OR destinationhostname CONTAINS "dash-server.servertech03.workers.dev" OR destinationhostname CONTAINS "cdn-server-2.wesoc40288.workers.dev" OR destinationhostname CONTAINS "server-web-cdn.nefixeg373.workers.dev" OR destinationhostname CONTAINS "cdn-server-full.taros12579.workers.dev" OR destinationhostname CONTAINS "server-cdn.sidoke9822.workers.dev" OR destinationhostname CONTAINS "server-cdn.jawigaw383.workers.dev")
index=activity AND rg_functionality="Web Application Firewall" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "soft-dns.sejilod748.workers.dev" OR sourcentdomain CONTAINS "cdn1.poyag17470.workers.dev" OR sourcentdomain CONTAINS "cdn1.cowivat156.workers.dev" OR sourcentdomain CONTAINS "server-cdn.lafise2419.workers.dev" OR sourcentdomain CONTAINS "server-web-cdn.rojotoc516.workers.dev" OR sourcentdomain CONTAINS "server-cdn.lecoc56350.workers.dev" OR sourcentdomain CONTAINS "server-cdn.xohahey822.workers.dev" OR sourcentdomain CONTAINS "server-web-cdn.vosax32455.workers.dev" OR sourcentdomain CONTAINS "cdn-server-1.xiren77418.workers.dev" OR sourcentdomain CONTAINS "soft-base-01.ginigiy117.workers.dev" OR sourcentdomain CONTAINS "work-server-1.picalob750.workers.dev" OR sourcentdomain CONTAINS "cdn-web-server1.techserver01.workers.dev" OR sourcentdomain CONTAINS "server-web-cdn.detocim498.workers.dev" OR sourcentdomain CONTAINS "server-web-cdn.pixece7948.workers.dev" OR sourcentdomain CONTAINS "server-cdn.virej10913.workers.dev" OR sourcentdomain CONTAINS "server-web-cdn.kagoli5215.workers.dev" OR sourcentdomain CONTAINS "dash-server.servertech03.workers.dev" OR sourcentdomain CONTAINS "cdn-server-2.wesoc40288.workers.dev" OR sourcentdomain CONTAINS "server-web-cdn.nefixeg373.workers.dev" OR sourcentdomain CONTAINS "cdn-server-full.taros12579.workers.dev" OR sourcentdomain CONTAINS "server-cdn.sidoke9822.workers.dev" OR sourcentdomain CONTAINS "server-cdn.jawigaw383.workers.dev")
index=activity AND rg_functionality="Web Application Firewall" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "soft-dns.sejilod748.workers.dev" OR sourcehostname CONTAINS "cdn1.poyag17470.workers.dev" OR sourcehostname CONTAINS "cdn1.cowivat156.workers.dev" OR sourcehostname CONTAINS "server-cdn.lafise2419.workers.dev" OR sourcehostname CONTAINS "server-web-cdn.rojotoc516.workers.dev" OR sourcehostname CONTAINS "server-cdn.lecoc56350.workers.dev" OR sourcehostname CONTAINS "server-cdn.xohahey822.workers.dev" OR sourcehostname CONTAINS "server-web-cdn.vosax32455.workers.dev" OR sourcehostname CONTAINS "cdn-server-1.xiren77418.workers.dev" OR sourcehostname CONTAINS "soft-base-01.ginigiy117.workers.dev" OR sourcehostname CONTAINS "work-server-1.picalob750.workers.dev" OR sourcehostname CONTAINS "cdn-web-server1.techserver01.workers.dev" OR sourcehostname CONTAINS "server-web-cdn.detocim498.workers.dev" OR sourcehostname CONTAINS "server-web-cdn.pixece7948.workers.dev" OR sourcehostname CONTAINS "server-cdn.virej10913.workers.dev" OR sourcehostname CONTAINS "server-web-cdn.kagoli5215.workers.dev" OR sourcehostname CONTAINS "dash-server.servertech03.workers.dev" OR sourcehostname CONTAINS "cdn-server-2.wesoc40288.workers.dev" OR sourcehostname CONTAINS "server-web-cdn.nefixeg373.workers.dev" OR sourcehostname CONTAINS "cdn-server-full.taros12579.workers.dev" OR sourcehostname CONTAINS "server-cdn.sidoke9822.workers.dev" OR sourcehostname CONTAINS "server-cdn.jawigaw383.workers.dev")
index=activity AND rg_functionality="Web Application Firewall" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "soft-dns.sejilod748.workers.dev" OR destinationntdomain CONTAINS "cdn1.poyag17470.workers.dev" OR destinationntdomain CONTAINS "cdn1.cowivat156.workers.dev" OR destinationntdomain CONTAINS "server-cdn.lafise2419.workers.dev" OR destinationntdomain CONTAINS "server-web-cdn.rojotoc516.workers.dev" OR destinationntdomain CONTAINS "server-cdn.lecoc56350.workers.dev" OR destinationntdomain CONTAINS "server-cdn.xohahey822.workers.dev" OR destinationntdomain CONTAINS "server-web-cdn.vosax32455.workers.dev" OR destinationntdomain CONTAINS "cdn-server-1.xiren77418.workers.dev" OR destinationntdomain CONTAINS "soft-base-01.ginigiy117.workers.dev" OR destinationntdomain CONTAINS "work-server-1.picalob750.workers.dev" OR destinationntdomain CONTAINS "cdn-web-server1.techserver01.workers.dev" OR destinationntdomain CONTAINS "server-web-cdn.detocim498.workers.dev" OR destinationntdomain CONTAINS "server-web-cdn.pixece7948.workers.dev" OR destinationntdomain CONTAINS "server-cdn.virej10913.workers.dev" OR destinationntdomain CONTAINS "server-web-cdn.kagoli5215.workers.dev" OR destinationntdomain CONTAINS "dash-server.servertech03.workers.dev" OR destinationntdomain CONTAINS "cdn-server-2.wesoc40288.workers.dev" OR destinationntdomain CONTAINS "server-web-cdn.nefixeg373.workers.dev" OR destinationntdomain CONTAINS "cdn-server-full.taros12579.workers.dev" OR destinationntdomain CONTAINS "server-cdn.sidoke9822.workers.dev" OR destinationntdomain CONTAINS "server-cdn.jawigaw383.workers.dev")
index=activity AND rg_functionality="Web Application Firewall" AND requesturl NOT NULL AND (requesturl CONTAINS "soft-dns.sejilod748.workers.dev" OR requesturl CONTAINS "cdn1.poyag17470.workers.dev" OR requesturl CONTAINS "cdn1.cowivat156.workers.dev" OR requesturl CONTAINS "server-cdn.lafise2419.workers.dev" OR requesturl CONTAINS "server-web-cdn.rojotoc516.workers.dev" OR requesturl CONTAINS "server-cdn.lecoc56350.workers.dev" OR requesturl CONTAINS "server-cdn.xohahey822.workers.dev" OR requesturl CONTAINS "server-web-cdn.vosax32455.workers.dev" OR requesturl CONTAINS "cdn-server-1.xiren77418.workers.dev" OR requesturl CONTAINS "soft-base-01.ginigiy117.workers.dev" OR requesturl CONTAINS "work-server-1.picalob750.workers.dev" OR requesturl CONTAINS "cdn-web-server1.techserver01.workers.dev" OR requesturl CONTAINS "server-web-cdn.detocim498.workers.dev" OR requesturl CONTAINS "server-web-cdn.pixece7948.workers.dev" OR requesturl CONTAINS "server-cdn.virej10913.workers.dev" OR requesturl CONTAINS "server-web-cdn.kagoli5215.workers.dev" OR requesturl CONTAINS "dash-server.servertech03.workers.dev" OR requesturl CONTAINS "cdn-server-2.wesoc40288.workers.dev" OR requesturl CONTAINS "server-web-cdn.nefixeg373.workers.dev" OR requesturl CONTAINS "cdn-server-full.taros12579.workers.dev" OR requesturl CONTAINS "server-cdn.sidoke9822.workers.dev" OR requesturl CONTAINS "server-cdn.jawigaw383.workers.dev")
index=activity AND rg_functionality="Endpoint management systems" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "soft-dns.sejilod748.workers.dev" OR destinationhostname CONTAINS "cdn1.poyag17470.workers.dev" OR destinationhostname CONTAINS "cdn1.cowivat156.workers.dev" OR destinationhostname CONTAINS "server-cdn.lafise2419.workers.dev" OR destinationhostname CONTAINS "server-web-cdn.rojotoc516.workers.dev" OR destinationhostname CONTAINS "server-cdn.lecoc56350.workers.dev" OR destinationhostname CONTAINS "server-cdn.xohahey822.workers.dev" OR destinationhostname CONTAINS "server-web-cdn.vosax32455.workers.dev" OR destinationhostname CONTAINS "cdn-server-1.xiren77418.workers.dev" OR destinationhostname CONTAINS "soft-base-01.ginigiy117.workers.dev" OR destinationhostname CONTAINS "work-server-1.picalob750.workers.dev" OR destinationhostname CONTAINS "cdn-web-server1.techserver01.workers.dev" OR destinationhostname CONTAINS "server-web-cdn.detocim498.workers.dev" OR destinationhostname CONTAINS "server-web-cdn.pixece7948.workers.dev" OR destinationhostname CONTAINS "server-cdn.virej10913.workers.dev" OR destinationhostname CONTAINS "server-web-cdn.kagoli5215.workers.dev" OR destinationhostname CONTAINS "dash-server.servertech03.workers.dev" OR destinationhostname CONTAINS "cdn-server-2.wesoc40288.workers.dev" OR destinationhostname CONTAINS "server-web-cdn.nefixeg373.workers.dev" OR destinationhostname CONTAINS "cdn-server-full.taros12579.workers.dev" OR destinationhostname CONTAINS "server-cdn.sidoke9822.workers.dev" OR destinationhostname CONTAINS "server-cdn.jawigaw383.workers.dev")
index=activity AND rg_functionality="Endpoint management systems" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "soft-dns.sejilod748.workers.dev" OR sourcentdomain CONTAINS "cdn1.poyag17470.workers.dev" OR sourcentdomain CONTAINS "cdn1.cowivat156.workers.dev" OR sourcentdomain CONTAINS "server-cdn.lafise2419.workers.dev" OR sourcentdomain CONTAINS "server-web-cdn.rojotoc516.workers.dev" OR sourcentdomain CONTAINS "server-cdn.lecoc56350.workers.dev" OR sourcentdomain CONTAINS "server-cdn.xohahey822.workers.dev" OR sourcentdomain CONTAINS "server-web-cdn.vosax32455.workers.dev" OR sourcentdomain CONTAINS "cdn-server-1.xiren77418.workers.dev" OR sourcentdomain CONTAINS "soft-base-01.ginigiy117.workers.dev" OR sourcentdomain CONTAINS "work-server-1.picalob750.workers.dev" OR sourcentdomain CONTAINS "cdn-web-server1.techserver01.workers.dev" OR sourcentdomain CONTAINS "server-web-cdn.detocim498.workers.dev" OR sourcentdomain CONTAINS "server-web-cdn.pixece7948.workers.dev" OR sourcentdomain CONTAINS "server-cdn.virej10913.workers.dev" OR sourcentdomain CONTAINS "server-web-cdn.kagoli5215.workers.dev" OR sourcentdomain CONTAINS "dash-server.servertech03.workers.dev" OR sourcentdomain CONTAINS "cdn-server-2.wesoc40288.workers.dev" OR sourcentdomain CONTAINS "server-web-cdn.nefixeg373.workers.dev" OR sourcentdomain CONTAINS "cdn-server-full.taros12579.workers.dev" OR sourcentdomain CONTAINS "server-cdn.sidoke9822.workers.dev" OR sourcentdomain CONTAINS "server-cdn.jawigaw383.workers.dev")
index=activity AND rg_functionality="Endpoint management systems" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "soft-dns.sejilod748.workers.dev" OR sourcehostname CONTAINS "cdn1.poyag17470.workers.dev" OR sourcehostname CONTAINS "cdn1.cowivat156.workers.dev" OR sourcehostname CONTAINS "server-cdn.lafise2419.workers.dev" OR sourcehostname CONTAINS "server-web-cdn.rojotoc516.workers.dev" OR sourcehostname CONTAINS "server-cdn.lecoc56350.workers.dev" OR sourcehostname CONTAINS "server-cdn.xohahey822.workers.dev" OR sourcehostname CONTAINS "server-web-cdn.vosax32455.workers.dev" OR sourcehostname CONTAINS "cdn-server-1.xiren77418.workers.dev" OR sourcehostname CONTAINS "soft-base-01.ginigiy117.workers.dev" OR sourcehostname CONTAINS "work-server-1.picalob750.workers.dev" OR sourcehostname CONTAINS "cdn-web-server1.techserver01.workers.dev" OR sourcehostname CONTAINS "server-web-cdn.detocim498.workers.dev" OR sourcehostname CONTAINS "server-web-cdn.pixece7948.workers.dev" OR sourcehostname CONTAINS "server-cdn.virej10913.workers.dev" OR sourcehostname CONTAINS "server-web-cdn.kagoli5215.workers.dev" OR sourcehostname CONTAINS "dash-server.servertech03.workers.dev" OR sourcehostname CONTAINS "cdn-server-2.wesoc40288.workers.dev" OR sourcehostname CONTAINS "server-web-cdn.nefixeg373.workers.dev" OR sourcehostname CONTAINS "cdn-server-full.taros12579.workers.dev" OR sourcehostname CONTAINS "server-cdn.sidoke9822.workers.dev" OR sourcehostname CONTAINS "server-cdn.jawigaw383.workers.dev")
index=activity AND rg_functionality="Endpoint management systems" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "soft-dns.sejilod748.workers.dev" OR destinationntdomain CONTAINS "cdn1.poyag17470.workers.dev" OR destinationntdomain CONTAINS "cdn1.cowivat156.workers.dev" OR destinationntdomain CONTAINS "server-cdn.lafise2419.workers.dev" OR destinationntdomain CONTAINS "server-web-cdn.rojotoc516.workers.dev" OR destinationntdomain CONTAINS "server-cdn.lecoc56350.workers.dev" OR destinationntdomain CONTAINS "server-cdn.xohahey822.workers.dev" OR destinationntdomain CONTAINS "server-web-cdn.vosax32455.workers.dev" OR destinationntdomain CONTAINS "cdn-server-1.xiren77418.workers.dev" OR destinationntdomain CONTAINS "soft-base-01.ginigiy117.workers.dev" OR destinationntdomain CONTAINS "work-server-1.picalob750.workers.dev" OR destinationntdomain CONTAINS "cdn-web-server1.techserver01.workers.dev" OR destinationntdomain CONTAINS "server-web-cdn.detocim498.workers.dev" OR destinationntdomain CONTAINS "server-web-cdn.pixece7948.workers.dev" OR destinationntdomain CONTAINS "server-cdn.virej10913.workers.dev" OR destinationntdomain CONTAINS "server-web-cdn.kagoli5215.workers.dev" OR destinationntdomain CONTAINS "dash-server.servertech03.workers.dev" OR destinationntdomain CONTAINS "cdn-server-2.wesoc40288.workers.dev" OR destinationntdomain CONTAINS "server-web-cdn.nefixeg373.workers.dev" OR destinationntdomain CONTAINS "cdn-server-full.taros12579.workers.dev" OR destinationntdomain CONTAINS "server-cdn.sidoke9822.workers.dev" OR destinationntdomain CONTAINS "server-cdn.jawigaw383.workers.dev")
index=activity AND rg_functionality="Endpoint management systems" AND requesturl NOT NULL AND (requesturl CONTAINS "soft-dns.sejilod748.workers.dev" OR requesturl CONTAINS "cdn1.poyag17470.workers.dev" OR requesturl CONTAINS "cdn1.cowivat156.workers.dev" OR requesturl CONTAINS "server-cdn.lafise2419.workers.dev" OR requesturl CONTAINS "server-web-cdn.rojotoc516.workers.dev" OR requesturl CONTAINS "server-cdn.lecoc56350.workers.dev" OR requesturl CONTAINS "server-cdn.xohahey822.workers.dev" OR requesturl CONTAINS "server-web-cdn.vosax32455.workers.dev" OR requesturl CONTAINS "cdn-server-1.xiren77418.workers.dev" OR requesturl CONTAINS "soft-base-01.ginigiy117.workers.dev" OR requesturl CONTAINS "work-server-1.picalob750.workers.dev" OR requesturl CONTAINS "cdn-web-server1.techserver01.workers.dev" OR requesturl CONTAINS "server-web-cdn.detocim498.workers.dev" OR requesturl CONTAINS "server-web-cdn.pixece7948.workers.dev" OR requesturl CONTAINS "server-cdn.virej10913.workers.dev" OR requesturl CONTAINS "server-web-cdn.kagoli5215.workers.dev" OR requesturl CONTAINS "dash-server.servertech03.workers.dev" OR requesturl CONTAINS "cdn-server-2.wesoc40288.workers.dev" OR requesturl CONTAINS "server-web-cdn.nefixeg373.workers.dev" OR requesturl CONTAINS "cdn-server-full.taros12579.workers.dev" OR requesturl CONTAINS "server-cdn.sidoke9822.workers.dev" OR requesturl CONTAINS "server-cdn.jawigaw383.workers.dev")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "soft-dns.sejilod748.workers.dev" OR destinationhostname CONTAINS "cdn1.poyag17470.workers.dev" OR destinationhostname CONTAINS "cdn1.cowivat156.workers.dev" OR destinationhostname CONTAINS "server-cdn.lafise2419.workers.dev" OR destinationhostname CONTAINS "server-web-cdn.rojotoc516.workers.dev" OR destinationhostname CONTAINS "server-cdn.lecoc56350.workers.dev" OR destinationhostname CONTAINS "server-cdn.xohahey822.workers.dev" OR destinationhostname CONTAINS "server-web-cdn.vosax32455.workers.dev" OR destinationhostname CONTAINS "cdn-server-1.xiren77418.workers.dev" OR destinationhostname CONTAINS "soft-base-01.ginigiy117.workers.dev" OR destinationhostname CONTAINS "work-server-1.picalob750.workers.dev" OR destinationhostname CONTAINS "cdn-web-server1.techserver01.workers.dev" OR destinationhostname CONTAINS "server-web-cdn.detocim498.workers.dev" OR destinationhostname CONTAINS "server-web-cdn.pixece7948.workers.dev" OR destinationhostname CONTAINS "server-cdn.virej10913.workers.dev" OR destinationhostname CONTAINS "server-web-cdn.kagoli5215.workers.dev" OR destinationhostname CONTAINS "dash-server.servertech03.workers.dev" OR destinationhostname CONTAINS "cdn-server-2.wesoc40288.workers.dev" OR destinationhostname CONTAINS "server-web-cdn.nefixeg373.workers.dev" OR destinationhostname CONTAINS "cdn-server-full.taros12579.workers.dev" OR destinationhostname CONTAINS "server-cdn.sidoke9822.workers.dev" OR destinationhostname CONTAINS "server-cdn.jawigaw383.workers.dev")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "soft-dns.sejilod748.workers.dev" OR sourcentdomain CONTAINS "cdn1.poyag17470.workers.dev" OR sourcentdomain CONTAINS "cdn1.cowivat156.workers.dev" OR sourcentdomain CONTAINS "server-cdn.lafise2419.workers.dev" OR sourcentdomain CONTAINS "server-web-cdn.rojotoc516.workers.dev" OR sourcentdomain CONTAINS "server-cdn.lecoc56350.workers.dev" OR sourcentdomain CONTAINS "server-cdn.xohahey822.workers.dev" OR sourcentdomain CONTAINS "server-web-cdn.vosax32455.workers.dev" OR sourcentdomain CONTAINS "cdn-server-1.xiren77418.workers.dev" OR sourcentdomain CONTAINS "soft-base-01.ginigiy117.workers.dev" OR sourcentdomain CONTAINS "work-server-1.picalob750.workers.dev" OR sourcentdomain CONTAINS "cdn-web-server1.techserver01.workers.dev" OR sourcentdomain CONTAINS "server-web-cdn.detocim498.workers.dev" OR sourcentdomain CONTAINS "server-web-cdn.pixece7948.workers.dev" OR sourcentdomain CONTAINS "server-cdn.virej10913.workers.dev" OR sourcentdomain CONTAINS "server-web-cdn.kagoli5215.workers.dev" OR sourcentdomain CONTAINS "dash-server.servertech03.workers.dev" OR sourcentdomain CONTAINS "cdn-server-2.wesoc40288.workers.dev" OR sourcentdomain CONTAINS "server-web-cdn.nefixeg373.workers.dev" OR sourcentdomain CONTAINS "cdn-server-full.taros12579.workers.dev" OR sourcentdomain CONTAINS "server-cdn.sidoke9822.workers.dev" OR sourcentdomain CONTAINS "server-cdn.jawigaw383.workers.dev")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "soft-dns.sejilod748.workers.dev" OR sourcehostname CONTAINS "cdn1.poyag17470.workers.dev" OR sourcehostname CONTAINS "cdn1.cowivat156.workers.dev" OR sourcehostname CONTAINS "server-cdn.lafise2419.workers.dev" OR sourcehostname CONTAINS "server-web-cdn.rojotoc516.workers.dev" OR sourcehostname CONTAINS "server-cdn.lecoc56350.workers.dev" OR sourcehostname CONTAINS "server-cdn.xohahey822.workers.dev" OR sourcehostname CONTAINS "server-web-cdn.vosax32455.workers.dev" OR sourcehostname CONTAINS "cdn-server-1.xiren77418.workers.dev" OR sourcehostname CONTAINS "soft-base-01.ginigiy117.workers.dev" OR sourcehostname CONTAINS "work-server-1.picalob750.workers.dev" OR sourcehostname CONTAINS "cdn-web-server1.techserver01.workers.dev" OR sourcehostname CONTAINS "server-web-cdn.detocim498.workers.dev" OR sourcehostname CONTAINS "server-web-cdn.pixece7948.workers.dev" OR sourcehostname CONTAINS "server-cdn.virej10913.workers.dev" OR sourcehostname CONTAINS "server-web-cdn.kagoli5215.workers.dev" OR sourcehostname CONTAINS "dash-server.servertech03.workers.dev" OR sourcehostname CONTAINS "cdn-server-2.wesoc40288.workers.dev" OR sourcehostname CONTAINS "server-web-cdn.nefixeg373.workers.dev" OR sourcehostname CONTAINS "cdn-server-full.taros12579.workers.dev" OR sourcehostname CONTAINS "server-cdn.sidoke9822.workers.dev" OR sourcehostname CONTAINS "server-cdn.jawigaw383.workers.dev")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "soft-dns.sejilod748.workers.dev" OR destinationntdomain CONTAINS "cdn1.poyag17470.workers.dev" OR destinationntdomain CONTAINS "cdn1.cowivat156.workers.dev" OR destinationntdomain CONTAINS "server-cdn.lafise2419.workers.dev" OR destinationntdomain CONTAINS "server-web-cdn.rojotoc516.workers.dev" OR destinationntdomain CONTAINS "server-cdn.lecoc56350.workers.dev" OR destinationntdomain CONTAINS "server-cdn.xohahey822.workers.dev" OR destinationntdomain CONTAINS "server-web-cdn.vosax32455.workers.dev" OR destinationntdomain CONTAINS "cdn-server-1.xiren77418.workers.dev" OR destinationntdomain CONTAINS "soft-base-01.ginigiy117.workers.dev" OR destinationntdomain CONTAINS "work-server-1.picalob750.workers.dev" OR destinationntdomain CONTAINS "cdn-web-server1.techserver01.workers.dev" OR destinationntdomain CONTAINS "server-web-cdn.detocim498.workers.dev" OR destinationntdomain CONTAINS "server-web-cdn.pixece7948.workers.dev" OR destinationntdomain CONTAINS "server-cdn.virej10913.workers.dev" OR destinationntdomain CONTAINS "server-web-cdn.kagoli5215.workers.dev" OR destinationntdomain CONTAINS "dash-server.servertech03.workers.dev" OR destinationntdomain CONTAINS "cdn-server-2.wesoc40288.workers.dev" OR destinationntdomain CONTAINS "server-web-cdn.nefixeg373.workers.dev" OR destinationntdomain CONTAINS "cdn-server-full.taros12579.workers.dev" OR destinationntdomain CONTAINS "server-cdn.sidoke9822.workers.dev" OR destinationntdomain CONTAINS "server-cdn.jawigaw383.workers.dev")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND requesturl NOT NULL AND (requesturl CONTAINS "soft-dns.sejilod748.workers.dev" OR requesturl CONTAINS "cdn1.poyag17470.workers.dev" OR requesturl CONTAINS "cdn1.cowivat156.workers.dev" OR requesturl CONTAINS "server-cdn.lafise2419.workers.dev" OR requesturl CONTAINS "server-web-cdn.rojotoc516.workers.dev" OR requesturl CONTAINS "server-cdn.lecoc56350.workers.dev" OR requesturl CONTAINS "server-cdn.xohahey822.workers.dev" OR requesturl CONTAINS "server-web-cdn.vosax32455.workers.dev" OR requesturl CONTAINS "cdn-server-1.xiren77418.workers.dev" OR requesturl CONTAINS "soft-base-01.ginigiy117.workers.dev" OR requesturl CONTAINS "work-server-1.picalob750.workers.dev" OR requesturl CONTAINS "cdn-web-server1.techserver01.workers.dev" OR requesturl CONTAINS "server-web-cdn.detocim498.workers.dev" OR requesturl CONTAINS "server-web-cdn.pixece7948.workers.dev" OR requesturl CONTAINS "server-cdn.virej10913.workers.dev" OR requesturl CONTAINS "server-web-cdn.kagoli5215.workers.dev" OR requesturl CONTAINS "dash-server.servertech03.workers.dev" OR requesturl CONTAINS "cdn-server-2.wesoc40288.workers.dev" OR requesturl CONTAINS "server-web-cdn.nefixeg373.workers.dev" OR requesturl CONTAINS "cdn-server-full.taros12579.workers.dev" OR requesturl CONTAINS "server-cdn.sidoke9822.workers.dev" OR requesturl CONTAINS "server-cdn.jawigaw383.workers.dev")
index=activity AND rg_functionality="Cloud Application Audit" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "soft-dns.sejilod748.workers.dev" OR destinationhostname CONTAINS "cdn1.poyag17470.workers.dev" OR destinationhostname CONTAINS "cdn1.cowivat156.workers.dev" OR destinationhostname CONTAINS "server-cdn.lafise2419.workers.dev" OR destinationhostname CONTAINS "server-web-cdn.rojotoc516.workers.dev" OR destinationhostname CONTAINS "server-cdn.lecoc56350.workers.dev" OR destinationhostname CONTAINS "server-cdn.xohahey822.workers.dev" OR destinationhostname CONTAINS "server-web-cdn.vosax32455.workers.dev" OR destinationhostname CONTAINS "cdn-server-1.xiren77418.workers.dev" OR destinationhostname CONTAINS "soft-base-01.ginigiy117.workers.dev" OR destinationhostname CONTAINS "work-server-1.picalob750.workers.dev" OR destinationhostname CONTAINS "cdn-web-server1.techserver01.workers.dev" OR destinationhostname CONTAINS "server-web-cdn.detocim498.workers.dev" OR destinationhostname CONTAINS "server-web-cdn.pixece7948.workers.dev" OR destinationhostname CONTAINS "server-cdn.virej10913.workers.dev" OR destinationhostname CONTAINS "server-web-cdn.kagoli5215.workers.dev" OR destinationhostname CONTAINS "dash-server.servertech03.workers.dev" OR destinationhostname CONTAINS "cdn-server-2.wesoc40288.workers.dev" OR destinationhostname CONTAINS "server-web-cdn.nefixeg373.workers.dev" OR destinationhostname CONTAINS "cdn-server-full.taros12579.workers.dev" OR destinationhostname CONTAINS "server-cdn.sidoke9822.workers.dev" OR destinationhostname CONTAINS "server-cdn.jawigaw383.workers.dev")
index=activity AND rg_functionality="Cloud Application Audit" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "soft-dns.sejilod748.workers.dev" OR sourcentdomain CONTAINS "cdn1.poyag17470.workers.dev" OR sourcentdomain CONTAINS "cdn1.cowivat156.workers.dev" OR sourcentdomain CONTAINS "server-cdn.lafise2419.workers.dev" OR sourcentdomain CONTAINS "server-web-cdn.rojotoc516.workers.dev" OR sourcentdomain CONTAINS "server-cdn.lecoc56350.workers.dev" OR sourcentdomain CONTAINS "server-cdn.xohahey822.workers.dev" OR sourcentdomain CONTAINS "server-web-cdn.vosax32455.workers.dev" OR sourcentdomain CONTAINS "cdn-server-1.xiren77418.workers.dev" OR sourcentdomain CONTAINS "soft-base-01.ginigiy117.workers.dev" OR sourcentdomain CONTAINS "work-server-1.picalob750.workers.dev" OR sourcentdomain CONTAINS "cdn-web-server1.techserver01.workers.dev" OR sourcentdomain CONTAINS "server-web-cdn.detocim498.workers.dev" OR sourcentdomain CONTAINS "server-web-cdn.pixece7948.workers.dev" OR sourcentdomain CONTAINS "server-cdn.virej10913.workers.dev" OR sourcentdomain CONTAINS "server-web-cdn.kagoli5215.workers.dev" OR sourcentdomain CONTAINS "dash-server.servertech03.workers.dev" OR sourcentdomain CONTAINS "cdn-server-2.wesoc40288.workers.dev" OR sourcentdomain CONTAINS "server-web-cdn.nefixeg373.workers.dev" OR sourcentdomain CONTAINS "cdn-server-full.taros12579.workers.dev" OR sourcentdomain CONTAINS "server-cdn.sidoke9822.workers.dev" OR sourcentdomain CONTAINS "server-cdn.jawigaw383.workers.dev")
index=activity AND rg_functionality="Cloud Application Audit" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "soft-dns.sejilod748.workers.dev" OR sourcehostname CONTAINS "cdn1.poyag17470.workers.dev" OR sourcehostname CONTAINS "cdn1.cowivat156.workers.dev" OR sourcehostname CONTAINS "server-cdn.lafise2419.workers.dev" OR sourcehostname CONTAINS "server-web-cdn.rojotoc516.workers.dev" OR sourcehostname CONTAINS "server-cdn.lecoc56350.workers.dev" OR sourcehostname CONTAINS "server-cdn.xohahey822.workers.dev" OR sourcehostname CONTAINS "server-web-cdn.vosax32455.workers.dev" OR sourcehostname CONTAINS "cdn-server-1.xiren77418.workers.dev" OR sourcehostname CONTAINS "soft-base-01.ginigiy117.workers.dev" OR sourcehostname CONTAINS "work-server-1.picalob750.workers.dev" OR sourcehostname CONTAINS "cdn-web-server1.techserver01.workers.dev" OR sourcehostname CONTAINS "server-web-cdn.detocim498.workers.dev" OR sourcehostname CONTAINS "server-web-cdn.pixece7948.workers.dev" OR sourcehostname CONTAINS "server-cdn.virej10913.workers.dev" OR sourcehostname CONTAINS "server-web-cdn.kagoli5215.workers.dev" OR sourcehostname CONTAINS "dash-server.servertech03.workers.dev" OR sourcehostname CONTAINS "cdn-server-2.wesoc40288.workers.dev" OR sourcehostname CONTAINS "server-web-cdn.nefixeg373.workers.dev" OR sourcehostname CONTAINS "cdn-server-full.taros12579.workers.dev" OR sourcehostname CONTAINS "server-cdn.sidoke9822.workers.dev" OR sourcehostname CONTAINS "server-cdn.jawigaw383.workers.dev")
index=activity AND rg_functionality="Cloud Application Audit" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "soft-dns.sejilod748.workers.dev" OR destinationntdomain CONTAINS "cdn1.poyag17470.workers.dev" OR destinationntdomain CONTAINS "cdn1.cowivat156.workers.dev" OR destinationntdomain CONTAINS "server-cdn.lafise2419.workers.dev" OR destinationntdomain CONTAINS "server-web-cdn.rojotoc516.workers.dev" OR destinationntdomain CONTAINS "server-cdn.lecoc56350.workers.dev" OR destinationntdomain CONTAINS "server-cdn.xohahey822.workers.dev" OR destinationntdomain CONTAINS "server-web-cdn.vosax32455.workers.dev" OR destinationntdomain CONTAINS "cdn-server-1.xiren77418.workers.dev" OR destinationntdomain CONTAINS "soft-base-01.ginigiy117.workers.dev" OR destinationntdomain CONTAINS "work-server-1.picalob750.workers.dev" OR destinationntdomain CONTAINS "cdn-web-server1.techserver01.workers.dev" OR destinationntdomain CONTAINS "server-web-cdn.detocim498.workers.dev" OR destinationntdomain CONTAINS "server-web-cdn.pixece7948.workers.dev" OR destinationntdomain CONTAINS "server-cdn.virej10913.workers.dev" OR destinationntdomain CONTAINS "server-web-cdn.kagoli5215.workers.dev" OR destinationntdomain CONTAINS "dash-server.servertech03.workers.dev" OR destinationntdomain CONTAINS "cdn-server-2.wesoc40288.workers.dev" OR destinationntdomain CONTAINS "server-web-cdn.nefixeg373.workers.dev" OR destinationntdomain CONTAINS "cdn-server-full.taros12579.workers.dev" OR destinationntdomain CONTAINS "server-cdn.sidoke9822.workers.dev" OR destinationntdomain CONTAINS "server-cdn.jawigaw383.workers.dev")
index=activity AND rg_functionality="Cloud Application Audit" AND requesturl NOT NULL AND (requesturl CONTAINS "soft-dns.sejilod748.workers.dev" OR requesturl CONTAINS "cdn1.poyag17470.workers.dev" OR requesturl CONTAINS "cdn1.cowivat156.workers.dev" OR requesturl CONTAINS "server-cdn.lafise2419.workers.dev" OR requesturl CONTAINS "server-web-cdn.rojotoc516.workers.dev" OR requesturl CONTAINS "server-cdn.lecoc56350.workers.dev" OR requesturl CONTAINS "server-cdn.xohahey822.workers.dev" OR requesturl CONTAINS "server-web-cdn.vosax32455.workers.dev" OR requesturl CONTAINS "cdn-server-1.xiren77418.workers.dev" OR requesturl CONTAINS "soft-base-01.ginigiy117.workers.dev" OR requesturl CONTAINS "work-server-1.picalob750.workers.dev" OR requesturl CONTAINS "cdn-web-server1.techserver01.workers.dev" OR requesturl CONTAINS "server-web-cdn.detocim498.workers.dev" OR requesturl CONTAINS "server-web-cdn.pixece7948.workers.dev" OR requesturl CONTAINS "server-cdn.virej10913.workers.dev" OR requesturl CONTAINS "server-web-cdn.kagoli5215.workers.dev" OR requesturl CONTAINS "dash-server.servertech03.workers.dev" OR requesturl CONTAINS "cdn-server-2.wesoc40288.workers.dev" OR requesturl CONTAINS "server-web-cdn.nefixeg373.workers.dev" OR requesturl CONTAINS "cdn-server-full.taros12579.workers.dev" OR requesturl CONTAINS "server-cdn.sidoke9822.workers.dev" OR requesturl CONTAINS "server-cdn.jawigaw383.workers.dev")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "soft-dns.sejilod748.workers.dev" OR destinationhostname CONTAINS "cdn1.poyag17470.workers.dev" OR destinationhostname CONTAINS "cdn1.cowivat156.workers.dev" OR destinationhostname CONTAINS "server-cdn.lafise2419.workers.dev" OR destinationhostname CONTAINS "server-web-cdn.rojotoc516.workers.dev" OR destinationhostname CONTAINS "server-cdn.lecoc56350.workers.dev" OR destinationhostname CONTAINS "server-cdn.xohahey822.workers.dev" OR destinationhostname CONTAINS "server-web-cdn.vosax32455.workers.dev" OR destinationhostname CONTAINS "cdn-server-1.xiren77418.workers.dev" OR destinationhostname CONTAINS "soft-base-01.ginigiy117.workers.dev" OR destinationhostname CONTAINS "work-server-1.picalob750.workers.dev" OR destinationhostname CONTAINS "cdn-web-server1.techserver01.workers.dev" OR destinationhostname CONTAINS "server-web-cdn.detocim498.workers.dev" OR destinationhostname CONTAINS "server-web-cdn.pixece7948.workers.dev" OR destinationhostname CONTAINS "server-cdn.virej10913.workers.dev" OR destinationhostname CONTAINS "server-web-cdn.kagoli5215.workers.dev" OR destinationhostname CONTAINS "dash-server.servertech03.workers.dev" OR destinationhostname CONTAINS "cdn-server-2.wesoc40288.workers.dev" OR destinationhostname CONTAINS "server-web-cdn.nefixeg373.workers.dev" OR destinationhostname CONTAINS "cdn-server-full.taros12579.workers.dev" OR destinationhostname CONTAINS "server-cdn.sidoke9822.workers.dev" OR destinationhostname CONTAINS "server-cdn.jawigaw383.workers.dev")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "soft-dns.sejilod748.workers.dev" OR sourcentdomain CONTAINS "cdn1.poyag17470.workers.dev" OR sourcentdomain CONTAINS "cdn1.cowivat156.workers.dev" OR sourcentdomain CONTAINS "server-cdn.lafise2419.workers.dev" OR sourcentdomain CONTAINS "server-web-cdn.rojotoc516.workers.dev" OR sourcentdomain CONTAINS "server-cdn.lecoc56350.workers.dev" OR sourcentdomain CONTAINS "server-cdn.xohahey822.workers.dev" OR sourcentdomain CONTAINS "server-web-cdn.vosax32455.workers.dev" OR sourcentdomain CONTAINS "cdn-server-1.xiren77418.workers.dev" OR sourcentdomain CONTAINS "soft-base-01.ginigiy117.workers.dev" OR sourcentdomain CONTAINS "work-server-1.picalob750.workers.dev" OR sourcentdomain CONTAINS "cdn-web-server1.techserver01.workers.dev" OR sourcentdomain CONTAINS "server-web-cdn.detocim498.workers.dev" OR sourcentdomain CONTAINS "server-web-cdn.pixece7948.workers.dev" OR sourcentdomain CONTAINS "server-cdn.virej10913.workers.dev" OR sourcentdomain CONTAINS "server-web-cdn.kagoli5215.workers.dev" OR sourcentdomain CONTAINS "dash-server.servertech03.workers.dev" OR sourcentdomain CONTAINS "cdn-server-2.wesoc40288.workers.dev" OR sourcentdomain CONTAINS "server-web-cdn.nefixeg373.workers.dev" OR sourcentdomain CONTAINS "cdn-server-full.taros12579.workers.dev" OR sourcentdomain CONTAINS "server-cdn.sidoke9822.workers.dev" OR sourcentdomain CONTAINS "server-cdn.jawigaw383.workers.dev")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "soft-dns.sejilod748.workers.dev" OR sourcehostname CONTAINS "cdn1.poyag17470.workers.dev" OR sourcehostname CONTAINS "cdn1.cowivat156.workers.dev" OR sourcehostname CONTAINS "server-cdn.lafise2419.workers.dev" OR sourcehostname CONTAINS "server-web-cdn.rojotoc516.workers.dev" OR sourcehostname CONTAINS "server-cdn.lecoc56350.workers.dev" OR sourcehostname CONTAINS "server-cdn.xohahey822.workers.dev" OR sourcehostname CONTAINS "server-web-cdn.vosax32455.workers.dev" OR sourcehostname CONTAINS "cdn-server-1.xiren77418.workers.dev" OR sourcehostname CONTAINS "soft-base-01.ginigiy117.workers.dev" OR sourcehostname CONTAINS "work-server-1.picalob750.workers.dev" OR sourcehostname CONTAINS "cdn-web-server1.techserver01.workers.dev" OR sourcehostname CONTAINS "server-web-cdn.detocim498.workers.dev" OR sourcehostname CONTAINS "server-web-cdn.pixece7948.workers.dev" OR sourcehostname CONTAINS "server-cdn.virej10913.workers.dev" OR sourcehostname CONTAINS "server-web-cdn.kagoli5215.workers.dev" OR sourcehostname CONTAINS "dash-server.servertech03.workers.dev" OR sourcehostname CONTAINS "cdn-server-2.wesoc40288.workers.dev" OR sourcehostname CONTAINS "server-web-cdn.nefixeg373.workers.dev" OR sourcehostname CONTAINS "cdn-server-full.taros12579.workers.dev" OR sourcehostname CONTAINS "server-cdn.sidoke9822.workers.dev" OR sourcehostname CONTAINS "server-cdn.jawigaw383.workers.dev")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "soft-dns.sejilod748.workers.dev" OR destinationntdomain CONTAINS "cdn1.poyag17470.workers.dev" OR destinationntdomain CONTAINS "cdn1.cowivat156.workers.dev" OR destinationntdomain CONTAINS "server-cdn.lafise2419.workers.dev" OR destinationntdomain CONTAINS "server-web-cdn.rojotoc516.workers.dev" OR destinationntdomain CONTAINS "server-cdn.lecoc56350.workers.dev" OR destinationntdomain CONTAINS "server-cdn.xohahey822.workers.dev" OR destinationntdomain CONTAINS "server-web-cdn.vosax32455.workers.dev" OR destinationntdomain CONTAINS "cdn-server-1.xiren77418.workers.dev" OR destinationntdomain CONTAINS "soft-base-01.ginigiy117.workers.dev" OR destinationntdomain CONTAINS "work-server-1.picalob750.workers.dev" OR destinationntdomain CONTAINS "cdn-web-server1.techserver01.workers.dev" OR destinationntdomain CONTAINS "server-web-cdn.detocim498.workers.dev" OR destinationntdomain CONTAINS "server-web-cdn.pixece7948.workers.dev" OR destinationntdomain CONTAINS "server-cdn.virej10913.workers.dev" OR destinationntdomain CONTAINS "server-web-cdn.kagoli5215.workers.dev" OR destinationntdomain CONTAINS "dash-server.servertech03.workers.dev" OR destinationntdomain CONTAINS "cdn-server-2.wesoc40288.workers.dev" OR destinationntdomain CONTAINS "server-web-cdn.nefixeg373.workers.dev" OR destinationntdomain CONTAINS "cdn-server-full.taros12579.workers.dev" OR destinationntdomain CONTAINS "server-cdn.sidoke9822.workers.dev" OR destinationntdomain CONTAINS "server-cdn.jawigaw383.workers.dev")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND requesturl NOT NULL AND (requesturl CONTAINS "soft-dns.sejilod748.workers.dev" OR requesturl CONTAINS "cdn1.poyag17470.workers.dev" OR requesturl CONTAINS "cdn1.cowivat156.workers.dev" OR requesturl CONTAINS "server-cdn.lafise2419.workers.dev" OR requesturl CONTAINS "server-web-cdn.rojotoc516.workers.dev" OR requesturl CONTAINS "server-cdn.lecoc56350.workers.dev" OR requesturl CONTAINS "server-cdn.xohahey822.workers.dev" OR requesturl CONTAINS "server-web-cdn.vosax32455.workers.dev" OR requesturl CONTAINS "cdn-server-1.xiren77418.workers.dev" OR requesturl CONTAINS "soft-base-01.ginigiy117.workers.dev" OR requesturl CONTAINS "work-server-1.picalob750.workers.dev" OR requesturl CONTAINS "cdn-web-server1.techserver01.workers.dev" OR requesturl CONTAINS "server-web-cdn.detocim498.workers.dev" OR requesturl CONTAINS "server-web-cdn.pixece7948.workers.dev" OR requesturl CONTAINS "server-cdn.virej10913.workers.dev" OR requesturl CONTAINS "server-web-cdn.kagoli5215.workers.dev" OR requesturl CONTAINS "dash-server.servertech03.workers.dev" OR requesturl CONTAINS "cdn-server-2.wesoc40288.workers.dev" OR requesturl CONTAINS "server-web-cdn.nefixeg373.workers.dev" OR requesturl CONTAINS "cdn-server-full.taros12579.workers.dev" OR requesturl CONTAINS "server-cdn.sidoke9822.workers.dev" OR requesturl CONTAINS "server-cdn.jawigaw383.workers.dev")
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "soft-dns.sejilod748.workers.dev" OR destinationhostname CONTAINS "cdn1.poyag17470.workers.dev" OR destinationhostname CONTAINS "cdn1.cowivat156.workers.dev" OR destinationhostname CONTAINS "server-cdn.lafise2419.workers.dev" OR destinationhostname CONTAINS "server-web-cdn.rojotoc516.workers.dev" OR destinationhostname CONTAINS "server-cdn.lecoc56350.workers.dev" OR destinationhostname CONTAINS "server-cdn.xohahey822.workers.dev" OR destinationhostname CONTAINS "server-web-cdn.vosax32455.workers.dev" OR destinationhostname CONTAINS "cdn-server-1.xiren77418.workers.dev" OR destinationhostname CONTAINS "soft-base-01.ginigiy117.workers.dev" OR destinationhostname CONTAINS "work-server-1.picalob750.workers.dev" OR destinationhostname CONTAINS "cdn-web-server1.techserver01.workers.dev" OR destinationhostname CONTAINS "server-web-cdn.detocim498.workers.dev" OR destinationhostname CONTAINS "server-web-cdn.pixece7948.workers.dev" OR destinationhostname CONTAINS "server-cdn.virej10913.workers.dev" OR destinationhostname CONTAINS "server-web-cdn.kagoli5215.workers.dev" OR destinationhostname CONTAINS "dash-server.servertech03.workers.dev" OR destinationhostname CONTAINS "cdn-server-2.wesoc40288.workers.dev" OR destinationhostname CONTAINS "server-web-cdn.nefixeg373.workers.dev" OR destinationhostname CONTAINS "cdn-server-full.taros12579.workers.dev" OR destinationhostname CONTAINS "server-cdn.sidoke9822.workers.dev" OR destinationhostname CONTAINS "server-cdn.jawigaw383.workers.dev")
index=activity AND rg_functionality="Unix / Linux / AIX" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "soft-dns.sejilod748.workers.dev" OR sourcentdomain CONTAINS "cdn1.poyag17470.workers.dev" OR sourcentdomain CONTAINS "cdn1.cowivat156.workers.dev" OR sourcentdomain CONTAINS "server-cdn.lafise2419.workers.dev" OR sourcentdomain CONTAINS "server-web-cdn.rojotoc516.workers.dev" OR sourcentdomain CONTAINS "server-cdn.lecoc56350.workers.dev" OR sourcentdomain CONTAINS "server-cdn.xohahey822.workers.dev" OR sourcentdomain CONTAINS "server-web-cdn.vosax32455.workers.dev" OR sourcentdomain CONTAINS "cdn-server-1.xiren77418.workers.dev" OR sourcentdomain CONTAINS "soft-base-01.ginigiy117.workers.dev" OR sourcentdomain CONTAINS "work-server-1.picalob750.workers.dev" OR sourcentdomain CONTAINS "cdn-web-server1.techserver01.workers.dev" OR sourcentdomain CONTAINS "server-web-cdn.detocim498.workers.dev" OR sourcentdomain CONTAINS "server-web-cdn.pixece7948.workers.dev" OR sourcentdomain CONTAINS "server-cdn.virej10913.workers.dev" OR sourcentdomain CONTAINS "server-web-cdn.kagoli5215.workers.dev" OR sourcentdomain CONTAINS "dash-server.servertech03.workers.dev" OR sourcentdomain CONTAINS "cdn-server-2.wesoc40288.workers.dev" OR sourcentdomain CONTAINS "server-web-cdn.nefixeg373.workers.dev" OR sourcentdomain CONTAINS "cdn-server-full.taros12579.workers.dev" OR sourcentdomain CONTAINS "server-cdn.sidoke9822.workers.dev" OR sourcentdomain CONTAINS "server-cdn.jawigaw383.workers.dev")
index=activity AND rg_functionality="Unix / Linux / AIX" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "soft-dns.sejilod748.workers.dev" OR sourcehostname CONTAINS "cdn1.poyag17470.workers.dev" OR sourcehostname CONTAINS "cdn1.cowivat156.workers.dev" OR sourcehostname CONTAINS "server-cdn.lafise2419.workers.dev" OR sourcehostname CONTAINS "server-web-cdn.rojotoc516.workers.dev" OR sourcehostname CONTAINS "server-cdn.lecoc56350.workers.dev" OR sourcehostname CONTAINS "server-cdn.xohahey822.workers.dev" OR sourcehostname CONTAINS "server-web-cdn.vosax32455.workers.dev" OR sourcehostname CONTAINS "cdn-server-1.xiren77418.workers.dev" OR sourcehostname CONTAINS "soft-base-01.ginigiy117.workers.dev" OR sourcehostname CONTAINS "work-server-1.picalob750.workers.dev" OR sourcehostname CONTAINS "cdn-web-server1.techserver01.workers.dev" OR sourcehostname CONTAINS "server-web-cdn.detocim498.workers.dev" OR sourcehostname CONTAINS "server-web-cdn.pixece7948.workers.dev" OR sourcehostname CONTAINS "server-cdn.virej10913.workers.dev" OR sourcehostname CONTAINS "server-web-cdn.kagoli5215.workers.dev" OR sourcehostname CONTAINS "dash-server.servertech03.workers.dev" OR sourcehostname CONTAINS "cdn-server-2.wesoc40288.workers.dev" OR sourcehostname CONTAINS "server-web-cdn.nefixeg373.workers.dev" OR sourcehostname CONTAINS "cdn-server-full.taros12579.workers.dev" OR sourcehostname CONTAINS "server-cdn.sidoke9822.workers.dev" OR sourcehostname CONTAINS "server-cdn.jawigaw383.workers.dev")
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "soft-dns.sejilod748.workers.dev" OR destinationntdomain CONTAINS "cdn1.poyag17470.workers.dev" OR destinationntdomain CONTAINS "cdn1.cowivat156.workers.dev" OR destinationntdomain CONTAINS "server-cdn.lafise2419.workers.dev" OR destinationntdomain CONTAINS "server-web-cdn.rojotoc516.workers.dev" OR destinationntdomain CONTAINS "server-cdn.lecoc56350.workers.dev" OR destinationntdomain CONTAINS "server-cdn.xohahey822.workers.dev" OR destinationntdomain CONTAINS "server-web-cdn.vosax32455.workers.dev" OR destinationntdomain CONTAINS "cdn-server-1.xiren77418.workers.dev" OR destinationntdomain CONTAINS "soft-base-01.ginigiy117.workers.dev" OR destinationntdomain CONTAINS "work-server-1.picalob750.workers.dev" OR destinationntdomain CONTAINS "cdn-web-server1.techserver01.workers.dev" OR destinationntdomain CONTAINS "server-web-cdn.detocim498.workers.dev" OR destinationntdomain CONTAINS "server-web-cdn.pixece7948.workers.dev" OR destinationntdomain CONTAINS "server-cdn.virej10913.workers.dev" OR destinationntdomain CONTAINS "server-web-cdn.kagoli5215.workers.dev" OR destinationntdomain CONTAINS "dash-server.servertech03.workers.dev" OR destinationntdomain CONTAINS "cdn-server-2.wesoc40288.workers.dev" OR destinationntdomain CONTAINS "server-web-cdn.nefixeg373.workers.dev" OR destinationntdomain CONTAINS "cdn-server-full.taros12579.workers.dev" OR destinationntdomain CONTAINS "server-cdn.sidoke9822.workers.dev" OR destinationntdomain CONTAINS "server-cdn.jawigaw383.workers.dev")
index=activity AND rg_functionality="Unix / Linux / AIX" AND requesturl NOT NULL AND (requesturl CONTAINS "soft-dns.sejilod748.workers.dev" OR requesturl CONTAINS "cdn1.poyag17470.workers.dev" OR requesturl CONTAINS "cdn1.cowivat156.workers.dev" OR requesturl CONTAINS "server-cdn.lafise2419.workers.dev" OR requesturl CONTAINS "server-web-cdn.rojotoc516.workers.dev" OR requesturl CONTAINS "server-cdn.lecoc56350.workers.dev" OR requesturl CONTAINS "server-cdn.xohahey822.workers.dev" OR requesturl CONTAINS "server-web-cdn.vosax32455.workers.dev" OR requesturl CONTAINS "cdn-server-1.xiren77418.workers.dev" OR requesturl CONTAINS "soft-base-01.ginigiy117.workers.dev" OR requesturl CONTAINS "work-server-1.picalob750.workers.dev" OR requesturl CONTAINS "cdn-web-server1.techserver01.workers.dev" OR requesturl CONTAINS "server-web-cdn.detocim498.workers.dev" OR requesturl CONTAINS "server-web-cdn.pixece7948.workers.dev" OR requesturl CONTAINS "server-cdn.virej10913.workers.dev" OR requesturl CONTAINS "server-web-cdn.kagoli5215.workers.dev" OR requesturl CONTAINS "dash-server.servertech03.workers.dev" OR requesturl CONTAINS "cdn-server-2.wesoc40288.workers.dev" OR requesturl CONTAINS "server-web-cdn.nefixeg373.workers.dev" OR requesturl CONTAINS "cdn-server-full.taros12579.workers.dev" OR requesturl CONTAINS "server-cdn.sidoke9822.workers.dev" OR requesturl CONTAINS "server-cdn.jawigaw383.workers.dev")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "soft-dns.sejilod748.workers.dev" OR destinationhostname CONTAINS "cdn1.poyag17470.workers.dev" OR destinationhostname CONTAINS "cdn1.cowivat156.workers.dev" OR destinationhostname CONTAINS "server-cdn.lafise2419.workers.dev" OR destinationhostname CONTAINS "server-web-cdn.rojotoc516.workers.dev" OR destinationhostname CONTAINS "server-cdn.lecoc56350.workers.dev" OR destinationhostname CONTAINS "server-cdn.xohahey822.workers.dev" OR destinationhostname CONTAINS "server-web-cdn.vosax32455.workers.dev" OR destinationhostname CONTAINS "cdn-server-1.xiren77418.workers.dev" OR destinationhostname CONTAINS "soft-base-01.ginigiy117.workers.dev" OR destinationhostname CONTAINS "work-server-1.picalob750.workers.dev" OR destinationhostname CONTAINS "cdn-web-server1.techserver01.workers.dev" OR destinationhostname CONTAINS "server-web-cdn.detocim498.workers.dev" OR destinationhostname CONTAINS "server-web-cdn.pixece7948.workers.dev" OR destinationhostname CONTAINS "server-cdn.virej10913.workers.dev" OR destinationhostname CONTAINS "server-web-cdn.kagoli5215.workers.dev" OR destinationhostname CONTAINS "dash-server.servertech03.workers.dev" OR destinationhostname CONTAINS "cdn-server-2.wesoc40288.workers.dev" OR destinationhostname CONTAINS "server-web-cdn.nefixeg373.workers.dev" OR destinationhostname CONTAINS "cdn-server-full.taros12579.workers.dev" OR destinationhostname CONTAINS "server-cdn.sidoke9822.workers.dev" OR destinationhostname CONTAINS "server-cdn.jawigaw383.workers.dev")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "soft-dns.sejilod748.workers.dev" OR sourcentdomain CONTAINS "cdn1.poyag17470.workers.dev" OR sourcentdomain CONTAINS "cdn1.cowivat156.workers.dev" OR sourcentdomain CONTAINS "server-cdn.lafise2419.workers.dev" OR sourcentdomain CONTAINS "server-web-cdn.rojotoc516.workers.dev" OR sourcentdomain CONTAINS "server-cdn.lecoc56350.workers.dev" OR sourcentdomain CONTAINS "server-cdn.xohahey822.workers.dev" OR sourcentdomain CONTAINS "server-web-cdn.vosax32455.workers.dev" OR sourcentdomain CONTAINS "cdn-server-1.xiren77418.workers.dev" OR sourcentdomain CONTAINS "soft-base-01.ginigiy117.workers.dev" OR sourcentdomain CONTAINS "work-server-1.picalob750.workers.dev" OR sourcentdomain CONTAINS "cdn-web-server1.techserver01.workers.dev" OR sourcentdomain CONTAINS "server-web-cdn.detocim498.workers.dev" OR sourcentdomain CONTAINS "server-web-cdn.pixece7948.workers.dev" OR sourcentdomain CONTAINS "server-cdn.virej10913.workers.dev" OR sourcentdomain CONTAINS "server-web-cdn.kagoli5215.workers.dev" OR sourcentdomain CONTAINS "dash-server.servertech03.workers.dev" OR sourcentdomain CONTAINS "cdn-server-2.wesoc40288.workers.dev" OR sourcentdomain CONTAINS "server-web-cdn.nefixeg373.workers.dev" OR sourcentdomain CONTAINS "cdn-server-full.taros12579.workers.dev" OR sourcentdomain CONTAINS "server-cdn.sidoke9822.workers.dev" OR sourcentdomain CONTAINS "server-cdn.jawigaw383.workers.dev")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "soft-dns.sejilod748.workers.dev" OR sourcehostname CONTAINS "cdn1.poyag17470.workers.dev" OR sourcehostname CONTAINS "cdn1.cowivat156.workers.dev" OR sourcehostname CONTAINS "server-cdn.lafise2419.workers.dev" OR sourcehostname CONTAINS "server-web-cdn.rojotoc516.workers.dev" OR sourcehostname CONTAINS "server-cdn.lecoc56350.workers.dev" OR sourcehostname CONTAINS "server-cdn.xohahey822.workers.dev" OR sourcehostname CONTAINS "server-web-cdn.vosax32455.workers.dev" OR sourcehostname CONTAINS "cdn-server-1.xiren77418.workers.dev" OR sourcehostname CONTAINS "soft-base-01.ginigiy117.workers.dev" OR sourcehostname CONTAINS "work-server-1.picalob750.workers.dev" OR sourcehostname CONTAINS "cdn-web-server1.techserver01.workers.dev" OR sourcehostname CONTAINS "server-web-cdn.detocim498.workers.dev" OR sourcehostname CONTAINS "server-web-cdn.pixece7948.workers.dev" OR sourcehostname CONTAINS "server-cdn.virej10913.workers.dev" OR sourcehostname CONTAINS "server-web-cdn.kagoli5215.workers.dev" OR sourcehostname CONTAINS "dash-server.servertech03.workers.dev" OR sourcehostname CONTAINS "cdn-server-2.wesoc40288.workers.dev" OR sourcehostname CONTAINS "server-web-cdn.nefixeg373.workers.dev" OR sourcehostname CONTAINS "cdn-server-full.taros12579.workers.dev" OR sourcehostname CONTAINS "server-cdn.sidoke9822.workers.dev" OR sourcehostname CONTAINS "server-cdn.jawigaw383.workers.dev")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "soft-dns.sejilod748.workers.dev" OR destinationntdomain CONTAINS "cdn1.poyag17470.workers.dev" OR destinationntdomain CONTAINS "cdn1.cowivat156.workers.dev" OR destinationntdomain CONTAINS "server-cdn.lafise2419.workers.dev" OR destinationntdomain CONTAINS "server-web-cdn.rojotoc516.workers.dev" OR destinationntdomain CONTAINS "server-cdn.lecoc56350.workers.dev" OR destinationntdomain CONTAINS "server-cdn.xohahey822.workers.dev" OR destinationntdomain CONTAINS "server-web-cdn.vosax32455.workers.dev" OR destinationntdomain CONTAINS "cdn-server-1.xiren77418.workers.dev" OR destinationntdomain CONTAINS "soft-base-01.ginigiy117.workers.dev" OR destinationntdomain CONTAINS "work-server-1.picalob750.workers.dev" OR destinationntdomain CONTAINS "cdn-web-server1.techserver01.workers.dev" OR destinationntdomain CONTAINS "server-web-cdn.detocim498.workers.dev" OR destinationntdomain CONTAINS "server-web-cdn.pixece7948.workers.dev" OR destinationntdomain CONTAINS "server-cdn.virej10913.workers.dev" OR destinationntdomain CONTAINS "server-web-cdn.kagoli5215.workers.dev" OR destinationntdomain CONTAINS "dash-server.servertech03.workers.dev" OR destinationntdomain CONTAINS "cdn-server-2.wesoc40288.workers.dev" OR destinationntdomain CONTAINS "server-web-cdn.nefixeg373.workers.dev" OR destinationntdomain CONTAINS "cdn-server-full.taros12579.workers.dev" OR destinationntdomain CONTAINS "server-cdn.sidoke9822.workers.dev" OR destinationntdomain CONTAINS "server-cdn.jawigaw383.workers.dev")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND requesturl NOT NULL AND (requesturl CONTAINS "soft-dns.sejilod748.workers.dev" OR requesturl CONTAINS "cdn1.poyag17470.workers.dev" OR requesturl CONTAINS "cdn1.cowivat156.workers.dev" OR requesturl CONTAINS "server-cdn.lafise2419.workers.dev" OR requesturl CONTAINS "server-web-cdn.rojotoc516.workers.dev" OR requesturl CONTAINS "server-cdn.lecoc56350.workers.dev" OR requesturl CONTAINS "server-cdn.xohahey822.workers.dev" OR requesturl CONTAINS "server-web-cdn.vosax32455.workers.dev" OR requesturl CONTAINS "cdn-server-1.xiren77418.workers.dev" OR requesturl CONTAINS "soft-base-01.ginigiy117.workers.dev" OR requesturl CONTAINS "work-server-1.picalob750.workers.dev" OR requesturl CONTAINS "cdn-web-server1.techserver01.workers.dev" OR requesturl CONTAINS "server-web-cdn.detocim498.workers.dev" OR requesturl CONTAINS "server-web-cdn.pixece7948.workers.dev" OR requesturl CONTAINS "server-cdn.virej10913.workers.dev" OR requesturl CONTAINS "server-web-cdn.kagoli5215.workers.dev" OR requesturl CONTAINS "dash-server.servertech03.workers.dev" OR requesturl CONTAINS "cdn-server-2.wesoc40288.workers.dev" OR requesturl CONTAINS "server-web-cdn.nefixeg373.workers.dev" OR requesturl CONTAINS "cdn-server-full.taros12579.workers.dev" OR requesturl CONTAINS "server-cdn.sidoke9822.workers.dev" OR requesturl CONTAINS "server-cdn.jawigaw383.workers.dev")
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "soft-dns.sejilod748.workers.dev" OR destinationhostname CONTAINS "cdn1.poyag17470.workers.dev" OR destinationhostname CONTAINS "cdn1.cowivat156.workers.dev" OR destinationhostname CONTAINS "server-cdn.lafise2419.workers.dev" OR destinationhostname CONTAINS "server-web-cdn.rojotoc516.workers.dev" OR destinationhostname CONTAINS "server-cdn.lecoc56350.workers.dev" OR destinationhostname CONTAINS "server-cdn.xohahey822.workers.dev" OR destinationhostname CONTAINS "server-web-cdn.vosax32455.workers.dev" OR destinationhostname CONTAINS "cdn-server-1.xiren77418.workers.dev" OR destinationhostname CONTAINS "soft-base-01.ginigiy117.workers.dev" OR destinationhostname CONTAINS "work-server-1.picalob750.workers.dev" OR destinationhostname CONTAINS "cdn-web-server1.techserver01.workers.dev" OR destinationhostname CONTAINS "server-web-cdn.detocim498.workers.dev" OR destinationhostname CONTAINS "server-web-cdn.pixece7948.workers.dev" OR destinationhostname CONTAINS "server-cdn.virej10913.workers.dev" OR destinationhostname CONTAINS "server-web-cdn.kagoli5215.workers.dev" OR destinationhostname CONTAINS "dash-server.servertech03.workers.dev" OR destinationhostname CONTAINS "cdn-server-2.wesoc40288.workers.dev" OR destinationhostname CONTAINS "server-web-cdn.nefixeg373.workers.dev" OR destinationhostname CONTAINS "cdn-server-full.taros12579.workers.dev" OR destinationhostname CONTAINS "server-cdn.sidoke9822.workers.dev" OR destinationhostname CONTAINS "server-cdn.jawigaw383.workers.dev")
index=activity AND rg_functionality="Cloud Application Security Broker" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "soft-dns.sejilod748.workers.dev" OR sourcentdomain CONTAINS "cdn1.poyag17470.workers.dev" OR sourcentdomain CONTAINS "cdn1.cowivat156.workers.dev" OR sourcentdomain CONTAINS "server-cdn.lafise2419.workers.dev" OR sourcentdomain CONTAINS "server-web-cdn.rojotoc516.workers.dev" OR sourcentdomain CONTAINS "server-cdn.lecoc56350.workers.dev" OR sourcentdomain CONTAINS "server-cdn.xohahey822.workers.dev" OR sourcentdomain CONTAINS "server-web-cdn.vosax32455.workers.dev" OR sourcentdomain CONTAINS "cdn-server-1.xiren77418.workers.dev" OR sourcentdomain CONTAINS "soft-base-01.ginigiy117.workers.dev" OR sourcentdomain CONTAINS "work-server-1.picalob750.workers.dev" OR sourcentdomain CONTAINS "cdn-web-server1.techserver01.workers.dev" OR sourcentdomain CONTAINS "server-web-cdn.detocim498.workers.dev" OR sourcentdomain CONTAINS "server-web-cdn.pixece7948.workers.dev" OR sourcentdomain CONTAINS "server-cdn.virej10913.workers.dev" OR sourcentdomain CONTAINS "server-web-cdn.kagoli5215.workers.dev" OR sourcentdomain CONTAINS "dash-server.servertech03.workers.dev" OR sourcentdomain CONTAINS "cdn-server-2.wesoc40288.workers.dev" OR sourcentdomain CONTAINS "server-web-cdn.nefixeg373.workers.dev" OR sourcentdomain CONTAINS "cdn-server-full.taros12579.workers.dev" OR sourcentdomain CONTAINS "server-cdn.sidoke9822.workers.dev" OR sourcentdomain CONTAINS "server-cdn.jawigaw383.workers.dev")
index=activity AND rg_functionality="Cloud Application Security Broker" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "soft-dns.sejilod748.workers.dev" OR sourcehostname CONTAINS "cdn1.poyag17470.workers.dev" OR sourcehostname CONTAINS "cdn1.cowivat156.workers.dev" OR sourcehostname CONTAINS "server-cdn.lafise2419.workers.dev" OR sourcehostname CONTAINS "server-web-cdn.rojotoc516.workers.dev" OR sourcehostname CONTAINS "server-cdn.lecoc56350.workers.dev" OR sourcehostname CONTAINS "server-cdn.xohahey822.workers.dev" OR sourcehostname CONTAINS "server-web-cdn.vosax32455.workers.dev" OR sourcehostname CONTAINS "cdn-server-1.xiren77418.workers.dev" OR sourcehostname CONTAINS "soft-base-01.ginigiy117.workers.dev" OR sourcehostname CONTAINS "work-server-1.picalob750.workers.dev" OR sourcehostname CONTAINS "cdn-web-server1.techserver01.workers.dev" OR sourcehostname CONTAINS "server-web-cdn.detocim498.workers.dev" OR sourcehostname CONTAINS "server-web-cdn.pixece7948.workers.dev" OR sourcehostname CONTAINS "server-cdn.virej10913.workers.dev" OR sourcehostname CONTAINS "server-web-cdn.kagoli5215.workers.dev" OR sourcehostname CONTAINS "dash-server.servertech03.workers.dev" OR sourcehostname CONTAINS "cdn-server-2.wesoc40288.workers.dev" OR sourcehostname CONTAINS "server-web-cdn.nefixeg373.workers.dev" OR sourcehostname CONTAINS "cdn-server-full.taros12579.workers.dev" OR sourcehostname CONTAINS "server-cdn.sidoke9822.workers.dev" OR sourcehostname CONTAINS "server-cdn.jawigaw383.workers.dev")
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "soft-dns.sejilod748.workers.dev" OR destinationntdomain CONTAINS "cdn1.poyag17470.workers.dev" OR destinationntdomain CONTAINS "cdn1.cowivat156.workers.dev" OR destinationntdomain CONTAINS "server-cdn.lafise2419.workers.dev" OR destinationntdomain CONTAINS "server-web-cdn.rojotoc516.workers.dev" OR destinationntdomain CONTAINS "server-cdn.lecoc56350.workers.dev" OR destinationntdomain CONTAINS "server-cdn.xohahey822.workers.dev" OR destinationntdomain CONTAINS "server-web-cdn.vosax32455.workers.dev" OR destinationntdomain CONTAINS "cdn-server-1.xiren77418.workers.dev" OR destinationntdomain CONTAINS "soft-base-01.ginigiy117.workers.dev" OR destinationntdomain CONTAINS "work-server-1.picalob750.workers.dev" OR destinationntdomain CONTAINS "cdn-web-server1.techserver01.workers.dev" OR destinationntdomain CONTAINS "server-web-cdn.detocim498.workers.dev" OR destinationntdomain CONTAINS "server-web-cdn.pixece7948.workers.dev" OR destinationntdomain CONTAINS "server-cdn.virej10913.workers.dev" OR destinationntdomain CONTAINS "server-web-cdn.kagoli5215.workers.dev" OR destinationntdomain CONTAINS "dash-server.servertech03.workers.dev" OR destinationntdomain CONTAINS "cdn-server-2.wesoc40288.workers.dev" OR destinationntdomain CONTAINS "server-web-cdn.nefixeg373.workers.dev" OR destinationntdomain CONTAINS "cdn-server-full.taros12579.workers.dev" OR destinationntdomain CONTAINS "server-cdn.sidoke9822.workers.dev" OR destinationntdomain CONTAINS "server-cdn.jawigaw383.workers.dev")
index=activity AND rg_functionality="Cloud Application Security Broker" AND requesturl NOT NULL AND (requesturl CONTAINS "soft-dns.sejilod748.workers.dev" OR requesturl CONTAINS "cdn1.poyag17470.workers.dev" OR requesturl CONTAINS "cdn1.cowivat156.workers.dev" OR requesturl CONTAINS "server-cdn.lafise2419.workers.dev" OR requesturl CONTAINS "server-web-cdn.rojotoc516.workers.dev" OR requesturl CONTAINS "server-cdn.lecoc56350.workers.dev" OR requesturl CONTAINS "server-cdn.xohahey822.workers.dev" OR requesturl CONTAINS "server-web-cdn.vosax32455.workers.dev" OR requesturl CONTAINS "cdn-server-1.xiren77418.workers.dev" OR requesturl CONTAINS "soft-base-01.ginigiy117.workers.dev" OR requesturl CONTAINS "work-server-1.picalob750.workers.dev" OR requesturl CONTAINS "cdn-web-server1.techserver01.workers.dev" OR requesturl CONTAINS "server-web-cdn.detocim498.workers.dev" OR requesturl CONTAINS "server-web-cdn.pixece7948.workers.dev" OR requesturl CONTAINS "server-cdn.virej10913.workers.dev" OR requesturl CONTAINS "server-web-cdn.kagoli5215.workers.dev" OR requesturl CONTAINS "dash-server.servertech03.workers.dev" OR requesturl CONTAINS "cdn-server-2.wesoc40288.workers.dev" OR requesturl CONTAINS "server-web-cdn.nefixeg373.workers.dev" OR requesturl CONTAINS "cdn-server-full.taros12579.workers.dev" OR requesturl CONTAINS "server-cdn.sidoke9822.workers.dev" OR requesturl CONTAINS "server-cdn.jawigaw383.workers.dev")
index=activity AND rg_functionality="Source Code Repository" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "soft-dns.sejilod748.workers.dev" OR destinationhostname CONTAINS "cdn1.poyag17470.workers.dev" OR destinationhostname CONTAINS "cdn1.cowivat156.workers.dev" OR destinationhostname CONTAINS "server-cdn.lafise2419.workers.dev" OR destinationhostname CONTAINS "server-web-cdn.rojotoc516.workers.dev" OR destinationhostname CONTAINS "server-cdn.lecoc56350.workers.dev" OR destinationhostname CONTAINS "server-cdn.xohahey822.workers.dev" OR destinationhostname CONTAINS "server-web-cdn.vosax32455.workers.dev" OR destinationhostname CONTAINS "cdn-server-1.xiren77418.workers.dev" OR destinationhostname CONTAINS "soft-base-01.ginigiy117.workers.dev" OR destinationhostname CONTAINS "work-server-1.picalob750.workers.dev" OR destinationhostname CONTAINS "cdn-web-server1.techserver01.workers.dev" OR destinationhostname CONTAINS "server-web-cdn.detocim498.workers.dev" OR destinationhostname CONTAINS "server-web-cdn.pixece7948.workers.dev" OR destinationhostname CONTAINS "server-cdn.virej10913.workers.dev" OR destinationhostname CONTAINS "server-web-cdn.kagoli5215.workers.dev" OR destinationhostname CONTAINS "dash-server.servertech03.workers.dev" OR destinationhostname CONTAINS "cdn-server-2.wesoc40288.workers.dev" OR destinationhostname CONTAINS "server-web-cdn.nefixeg373.workers.dev" OR destinationhostname CONTAINS "cdn-server-full.taros12579.workers.dev" OR destinationhostname CONTAINS "server-cdn.sidoke9822.workers.dev" OR destinationhostname CONTAINS "server-cdn.jawigaw383.workers.dev")
index=activity AND rg_functionality="Source Code Repository" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "soft-dns.sejilod748.workers.dev" OR sourcentdomain CONTAINS "cdn1.poyag17470.workers.dev" OR sourcentdomain CONTAINS "cdn1.cowivat156.workers.dev" OR sourcentdomain CONTAINS "server-cdn.lafise2419.workers.dev" OR sourcentdomain CONTAINS "server-web-cdn.rojotoc516.workers.dev" OR sourcentdomain CONTAINS "server-cdn.lecoc56350.workers.dev" OR sourcentdomain CONTAINS "server-cdn.xohahey822.workers.dev" OR sourcentdomain CONTAINS "server-web-cdn.vosax32455.workers.dev" OR sourcentdomain CONTAINS "cdn-server-1.xiren77418.workers.dev" OR sourcentdomain CONTAINS "soft-base-01.ginigiy117.workers.dev" OR sourcentdomain CONTAINS "work-server-1.picalob750.workers.dev" OR sourcentdomain CONTAINS "cdn-web-server1.techserver01.workers.dev" OR sourcentdomain CONTAINS "server-web-cdn.detocim498.workers.dev" OR sourcentdomain CONTAINS "server-web-cdn.pixece7948.workers.dev" OR sourcentdomain CONTAINS "server-cdn.virej10913.workers.dev" OR sourcentdomain CONTAINS "server-web-cdn.kagoli5215.workers.dev" OR sourcentdomain CONTAINS "dash-server.servertech03.workers.dev" OR sourcentdomain CONTAINS "cdn-server-2.wesoc40288.workers.dev" OR sourcentdomain CONTAINS "server-web-cdn.nefixeg373.workers.dev" OR sourcentdomain CONTAINS "cdn-server-full.taros12579.workers.dev" OR sourcentdomain CONTAINS "server-cdn.sidoke9822.workers.dev" OR sourcentdomain CONTAINS "server-cdn.jawigaw383.workers.dev")
index=activity AND rg_functionality="Source Code Repository" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "soft-dns.sejilod748.workers.dev" OR sourcehostname CONTAINS "cdn1.poyag17470.workers.dev" OR sourcehostname CONTAINS "cdn1.cowivat156.workers.dev" OR sourcehostname CONTAINS "server-cdn.lafise2419.workers.dev" OR sourcehostname CONTAINS "server-web-cdn.rojotoc516.workers.dev" OR sourcehostname CONTAINS "server-cdn.lecoc56350.workers.dev" OR sourcehostname CONTAINS "server-cdn.xohahey822.workers.dev" OR sourcehostname CONTAINS "server-web-cdn.vosax32455.workers.dev" OR sourcehostname CONTAINS "cdn-server-1.xiren77418.workers.dev" OR sourcehostname CONTAINS "soft-base-01.ginigiy117.workers.dev" OR sourcehostname CONTAINS "work-server-1.picalob750.workers.dev" OR sourcehostname CONTAINS "cdn-web-server1.techserver01.workers.dev" OR sourcehostname CONTAINS "server-web-cdn.detocim498.workers.dev" OR sourcehostname CONTAINS "server-web-cdn.pixece7948.workers.dev" OR sourcehostname CONTAINS "server-cdn.virej10913.workers.dev" OR sourcehostname CONTAINS "server-web-cdn.kagoli5215.workers.dev" OR sourcehostname CONTAINS "dash-server.servertech03.workers.dev" OR sourcehostname CONTAINS "cdn-server-2.wesoc40288.workers.dev" OR sourcehostname CONTAINS "server-web-cdn.nefixeg373.workers.dev" OR sourcehostname CONTAINS "cdn-server-full.taros12579.workers.dev" OR sourcehostname CONTAINS "server-cdn.sidoke9822.workers.dev" OR sourcehostname CONTAINS "server-cdn.jawigaw383.workers.dev")
index=activity AND rg_functionality="Source Code Repository" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "soft-dns.sejilod748.workers.dev" OR destinationntdomain CONTAINS "cdn1.poyag17470.workers.dev" OR destinationntdomain CONTAINS "cdn1.cowivat156.workers.dev" OR destinationntdomain CONTAINS "server-cdn.lafise2419.workers.dev" OR destinationntdomain CONTAINS "server-web-cdn.rojotoc516.workers.dev" OR destinationntdomain CONTAINS "server-cdn.lecoc56350.workers.dev" OR destinationntdomain CONTAINS "server-cdn.xohahey822.workers.dev" OR destinationntdomain CONTAINS "server-web-cdn.vosax32455.workers.dev" OR destinationntdomain CONTAINS "cdn-server-1.xiren77418.workers.dev" OR destinationntdomain CONTAINS "soft-base-01.ginigiy117.workers.dev" OR destinationntdomain CONTAINS "work-server-1.picalob750.workers.dev" OR destinationntdomain CONTAINS "cdn-web-server1.techserver01.workers.dev" OR destinationntdomain CONTAINS "server-web-cdn.detocim498.workers.dev" OR destinationntdomain CONTAINS "server-web-cdn.pixece7948.workers.dev" OR destinationntdomain CONTAINS "server-cdn.virej10913.workers.dev" OR destinationntdomain CONTAINS "server-web-cdn.kagoli5215.workers.dev" OR destinationntdomain CONTAINS "dash-server.servertech03.workers.dev" OR destinationntdomain CONTAINS "cdn-server-2.wesoc40288.workers.dev" OR destinationntdomain CONTAINS "server-web-cdn.nefixeg373.workers.dev" OR destinationntdomain CONTAINS "cdn-server-full.taros12579.workers.dev" OR destinationntdomain CONTAINS "server-cdn.sidoke9822.workers.dev" OR destinationntdomain CONTAINS "server-cdn.jawigaw383.workers.dev")
index=activity AND rg_functionality="Source Code Repository" AND requesturl NOT NULL AND (requesturl CONTAINS "soft-dns.sejilod748.workers.dev" OR requesturl CONTAINS "cdn1.poyag17470.workers.dev" OR requesturl CONTAINS "cdn1.cowivat156.workers.dev" OR requesturl CONTAINS "server-cdn.lafise2419.workers.dev" OR requesturl CONTAINS "server-web-cdn.rojotoc516.workers.dev" OR requesturl CONTAINS "server-cdn.lecoc56350.workers.dev" OR requesturl CONTAINS "server-cdn.xohahey822.workers.dev" OR requesturl CONTAINS "server-web-cdn.vosax32455.workers.dev" OR requesturl CONTAINS "cdn-server-1.xiren77418.workers.dev" OR requesturl CONTAINS "soft-base-01.ginigiy117.workers.dev" OR requesturl CONTAINS "work-server-1.picalob750.workers.dev" OR requesturl CONTAINS "cdn-web-server1.techserver01.workers.dev" OR requesturl CONTAINS "server-web-cdn.detocim498.workers.dev" OR requesturl CONTAINS "server-web-cdn.pixece7948.workers.dev" OR requesturl CONTAINS "server-cdn.virej10913.workers.dev" OR requesturl CONTAINS "server-web-cdn.kagoli5215.workers.dev" OR requesturl CONTAINS "dash-server.servertech03.workers.dev" OR requesturl CONTAINS "cdn-server-2.wesoc40288.workers.dev" OR requesturl CONTAINS "server-web-cdn.nefixeg373.workers.dev" OR requesturl CONTAINS "cdn-server-full.taros12579.workers.dev" OR requesturl CONTAINS "server-cdn.sidoke9822.workers.dev" OR requesturl CONTAINS "server-cdn.jawigaw383.workers.dev")
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "soft-dns.sejilod748.workers.dev" OR destinationhostname CONTAINS "cdn1.poyag17470.workers.dev" OR destinationhostname CONTAINS "cdn1.cowivat156.workers.dev" OR destinationhostname CONTAINS "server-cdn.lafise2419.workers.dev" OR destinationhostname CONTAINS "server-web-cdn.rojotoc516.workers.dev" OR destinationhostname CONTAINS "server-cdn.lecoc56350.workers.dev" OR destinationhostname CONTAINS "server-cdn.xohahey822.workers.dev" OR destinationhostname CONTAINS "server-web-cdn.vosax32455.workers.dev" OR destinationhostname CONTAINS "cdn-server-1.xiren77418.workers.dev" OR destinationhostname CONTAINS "soft-base-01.ginigiy117.workers.dev" OR destinationhostname CONTAINS "work-server-1.picalob750.workers.dev" OR destinationhostname CONTAINS "cdn-web-server1.techserver01.workers.dev" OR destinationhostname CONTAINS "server-web-cdn.detocim498.workers.dev" OR destinationhostname CONTAINS "server-web-cdn.pixece7948.workers.dev" OR destinationhostname CONTAINS "server-cdn.virej10913.workers.dev" OR destinationhostname CONTAINS "server-web-cdn.kagoli5215.workers.dev" OR destinationhostname CONTAINS "dash-server.servertech03.workers.dev" OR destinationhostname CONTAINS "cdn-server-2.wesoc40288.workers.dev" OR destinationhostname CONTAINS "server-web-cdn.nefixeg373.workers.dev" OR destinationhostname CONTAINS "cdn-server-full.taros12579.workers.dev" OR destinationhostname CONTAINS "server-cdn.sidoke9822.workers.dev" OR destinationhostname CONTAINS "server-cdn.jawigaw383.workers.dev")
index=activity AND rg_functionality="Cloud Email / Email Security" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "soft-dns.sejilod748.workers.dev" OR sourcentdomain CONTAINS "cdn1.poyag17470.workers.dev" OR sourcentdomain CONTAINS "cdn1.cowivat156.workers.dev" OR sourcentdomain CONTAINS "server-cdn.lafise2419.workers.dev" OR sourcentdomain CONTAINS "server-web-cdn.rojotoc516.workers.dev" OR sourcentdomain CONTAINS "server-cdn.lecoc56350.workers.dev" OR sourcentdomain CONTAINS "server-cdn.xohahey822.workers.dev" OR sourcentdomain CONTAINS "server-web-cdn.vosax32455.workers.dev" OR sourcentdomain CONTAINS "cdn-server-1.xiren77418.workers.dev" OR sourcentdomain CONTAINS "soft-base-01.ginigiy117.workers.dev" OR sourcentdomain CONTAINS "work-server-1.picalob750.workers.dev" OR sourcentdomain CONTAINS "cdn-web-server1.techserver01.workers.dev" OR sourcentdomain CONTAINS "server-web-cdn.detocim498.workers.dev" OR sourcentdomain CONTAINS "server-web-cdn.pixece7948.workers.dev" OR sourcentdomain CONTAINS "server-cdn.virej10913.workers.dev" OR sourcentdomain CONTAINS "server-web-cdn.kagoli5215.workers.dev" OR sourcentdomain CONTAINS "dash-server.servertech03.workers.dev" OR sourcentdomain CONTAINS "cdn-server-2.wesoc40288.workers.dev" OR sourcentdomain CONTAINS "server-web-cdn.nefixeg373.workers.dev" OR sourcentdomain CONTAINS "cdn-server-full.taros12579.workers.dev" OR sourcentdomain CONTAINS "server-cdn.sidoke9822.workers.dev" OR sourcentdomain CONTAINS "server-cdn.jawigaw383.workers.dev")
index=activity AND rg_functionality="Cloud Email / Email Security" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "soft-dns.sejilod748.workers.dev" OR sourcehostname CONTAINS "cdn1.poyag17470.workers.dev" OR sourcehostname CONTAINS "cdn1.cowivat156.workers.dev" OR sourcehostname CONTAINS "server-cdn.lafise2419.workers.dev" OR sourcehostname CONTAINS "server-web-cdn.rojotoc516.workers.dev" OR sourcehostname CONTAINS "server-cdn.lecoc56350.workers.dev" OR sourcehostname CONTAINS "server-cdn.xohahey822.workers.dev" OR sourcehostname CONTAINS "server-web-cdn.vosax32455.workers.dev" OR sourcehostname CONTAINS "cdn-server-1.xiren77418.workers.dev" OR sourcehostname CONTAINS "soft-base-01.ginigiy117.workers.dev" OR sourcehostname CONTAINS "work-server-1.picalob750.workers.dev" OR sourcehostname CONTAINS "cdn-web-server1.techserver01.workers.dev" OR sourcehostname CONTAINS "server-web-cdn.detocim498.workers.dev" OR sourcehostname CONTAINS "server-web-cdn.pixece7948.workers.dev" OR sourcehostname CONTAINS "server-cdn.virej10913.workers.dev" OR sourcehostname CONTAINS "server-web-cdn.kagoli5215.workers.dev" OR sourcehostname CONTAINS "dash-server.servertech03.workers.dev" OR sourcehostname CONTAINS "cdn-server-2.wesoc40288.workers.dev" OR sourcehostname CONTAINS "server-web-cdn.nefixeg373.workers.dev" OR sourcehostname CONTAINS "cdn-server-full.taros12579.workers.dev" OR sourcehostname CONTAINS "server-cdn.sidoke9822.workers.dev" OR sourcehostname CONTAINS "server-cdn.jawigaw383.workers.dev")
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "soft-dns.sejilod748.workers.dev" OR destinationntdomain CONTAINS "cdn1.poyag17470.workers.dev" OR destinationntdomain CONTAINS "cdn1.cowivat156.workers.dev" OR destinationntdomain CONTAINS "server-cdn.lafise2419.workers.dev" OR destinationntdomain CONTAINS "server-web-cdn.rojotoc516.workers.dev" OR destinationntdomain CONTAINS "server-cdn.lecoc56350.workers.dev" OR destinationntdomain CONTAINS "server-cdn.xohahey822.workers.dev" OR destinationntdomain CONTAINS "server-web-cdn.vosax32455.workers.dev" OR destinationntdomain CONTAINS "cdn-server-1.xiren77418.workers.dev" OR destinationntdomain CONTAINS "soft-base-01.ginigiy117.workers.dev" OR destinationntdomain CONTAINS "work-server-1.picalob750.workers.dev" OR destinationntdomain CONTAINS "cdn-web-server1.techserver01.workers.dev" OR destinationntdomain CONTAINS "server-web-cdn.detocim498.workers.dev" OR destinationntdomain CONTAINS "server-web-cdn.pixece7948.workers.dev" OR destinationntdomain CONTAINS "server-cdn.virej10913.workers.dev" OR destinationntdomain CONTAINS "server-web-cdn.kagoli5215.workers.dev" OR destinationntdomain CONTAINS "dash-server.servertech03.workers.dev" OR destinationntdomain CONTAINS "cdn-server-2.wesoc40288.workers.dev" OR destinationntdomain CONTAINS "server-web-cdn.nefixeg373.workers.dev" OR destinationntdomain CONTAINS "cdn-server-full.taros12579.workers.dev" OR destinationntdomain CONTAINS "server-cdn.sidoke9822.workers.dev" OR destinationntdomain CONTAINS "server-cdn.jawigaw383.workers.dev")
index=activity AND rg_functionality="Cloud Email / Email Security" AND requesturl NOT NULL AND (requesturl CONTAINS "soft-dns.sejilod748.workers.dev" OR requesturl CONTAINS "cdn1.poyag17470.workers.dev" OR requesturl CONTAINS "cdn1.cowivat156.workers.dev" OR requesturl CONTAINS "server-cdn.lafise2419.workers.dev" OR requesturl CONTAINS "server-web-cdn.rojotoc516.workers.dev" OR requesturl CONTAINS "server-cdn.lecoc56350.workers.dev" OR requesturl CONTAINS "server-cdn.xohahey822.workers.dev" OR requesturl CONTAINS "server-web-cdn.vosax32455.workers.dev" OR requesturl CONTAINS "cdn-server-1.xiren77418.workers.dev" OR requesturl CONTAINS "soft-base-01.ginigiy117.workers.dev" OR requesturl CONTAINS "work-server-1.picalob750.workers.dev" OR requesturl CONTAINS "cdn-web-server1.techserver01.workers.dev" OR requesturl CONTAINS "server-web-cdn.detocim498.workers.dev" OR requesturl CONTAINS "server-web-cdn.pixece7948.workers.dev" OR requesturl CONTAINS "server-cdn.virej10913.workers.dev" OR requesturl CONTAINS "server-web-cdn.kagoli5215.workers.dev" OR requesturl CONTAINS "dash-server.servertech03.workers.dev" OR requesturl CONTAINS "cdn-server-2.wesoc40288.workers.dev" OR requesturl CONTAINS "server-web-cdn.nefixeg373.workers.dev" OR requesturl CONTAINS "cdn-server-full.taros12579.workers.dev" OR requesturl CONTAINS "server-cdn.sidoke9822.workers.dev" OR requesturl CONTAINS "server-cdn.jawigaw383.workers.dev")
index=activity AND rg_functionality="DNS / DHCP" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "soft-dns.sejilod748.workers.dev" OR destinationhostname CONTAINS "cdn1.poyag17470.workers.dev" OR destinationhostname CONTAINS "cdn1.cowivat156.workers.dev" OR destinationhostname CONTAINS "server-cdn.lafise2419.workers.dev" OR destinationhostname CONTAINS "server-web-cdn.rojotoc516.workers.dev" OR destinationhostname CONTAINS "server-cdn.lecoc56350.workers.dev" OR destinationhostname CONTAINS "server-cdn.xohahey822.workers.dev" OR destinationhostname CONTAINS "server-web-cdn.vosax32455.workers.dev" OR destinationhostname CONTAINS "cdn-server-1.xiren77418.workers.dev" OR destinationhostname CONTAINS "soft-base-01.ginigiy117.workers.dev" OR destinationhostname CONTAINS "work-server-1.picalob750.workers.dev" OR destinationhostname CONTAINS "cdn-web-server1.techserver01.workers.dev" OR destinationhostname CONTAINS "server-web-cdn.detocim498.workers.dev" OR destinationhostname CONTAINS "server-web-cdn.pixece7948.workers.dev" OR destinationhostname CONTAINS "server-cdn.virej10913.workers.dev" OR destinationhostname CONTAINS "server-web-cdn.kagoli5215.workers.dev" OR destinationhostname CONTAINS "dash-server.servertech03.workers.dev" OR destinationhostname CONTAINS "cdn-server-2.wesoc40288.workers.dev" OR destinationhostname CONTAINS "server-web-cdn.nefixeg373.workers.dev" OR destinationhostname CONTAINS "cdn-server-full.taros12579.workers.dev" OR destinationhostname CONTAINS "server-cdn.sidoke9822.workers.dev" OR destinationhostname CONTAINS "server-cdn.jawigaw383.workers.dev")
index=activity AND rg_functionality="DNS / DHCP" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "soft-dns.sejilod748.workers.dev" OR sourcentdomain CONTAINS "cdn1.poyag17470.workers.dev" OR sourcentdomain CONTAINS "cdn1.cowivat156.workers.dev" OR sourcentdomain CONTAINS "server-cdn.lafise2419.workers.dev" OR sourcentdomain CONTAINS "server-web-cdn.rojotoc516.workers.dev" OR sourcentdomain CONTAINS "server-cdn.lecoc56350.workers.dev" OR sourcentdomain CONTAINS "server-cdn.xohahey822.workers.dev" OR sourcentdomain CONTAINS "server-web-cdn.vosax32455.workers.dev" OR sourcentdomain CONTAINS "cdn-server-1.xiren77418.workers.dev" OR sourcentdomain CONTAINS "soft-base-01.ginigiy117.workers.dev" OR sourcentdomain CONTAINS "work-server-1.picalob750.workers.dev" OR sourcentdomain CONTAINS "cdn-web-server1.techserver01.workers.dev" OR sourcentdomain CONTAINS "server-web-cdn.detocim498.workers.dev" OR sourcentdomain CONTAINS "server-web-cdn.pixece7948.workers.dev" OR sourcentdomain CONTAINS "server-cdn.virej10913.workers.dev" OR sourcentdomain CONTAINS "server-web-cdn.kagoli5215.workers.dev" OR sourcentdomain CONTAINS "dash-server.servertech03.workers.dev" OR sourcentdomain CONTAINS "cdn-server-2.wesoc40288.workers.dev" OR sourcentdomain CONTAINS "server-web-cdn.nefixeg373.workers.dev" OR sourcentdomain CONTAINS "cdn-server-full.taros12579.workers.dev" OR sourcentdomain CONTAINS "server-cdn.sidoke9822.workers.dev" OR sourcentdomain CONTAINS "server-cdn.jawigaw383.workers.dev")
index=activity AND rg_functionality="DNS / DHCP" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "soft-dns.sejilod748.workers.dev" OR sourcehostname CONTAINS "cdn1.poyag17470.workers.dev" OR sourcehostname CONTAINS "cdn1.cowivat156.workers.dev" OR sourcehostname CONTAINS "server-cdn.lafise2419.workers.dev" OR sourcehostname CONTAINS "server-web-cdn.rojotoc516.workers.dev" OR sourcehostname CONTAINS "server-cdn.lecoc56350.workers.dev" OR sourcehostname CONTAINS "server-cdn.xohahey822.workers.dev" OR sourcehostname CONTAINS "server-web-cdn.vosax32455.workers.dev" OR sourcehostname CONTAINS "cdn-server-1.xiren77418.workers.dev" OR sourcehostname CONTAINS "soft-base-01.ginigiy117.workers.dev" OR sourcehostname CONTAINS "work-server-1.picalob750.workers.dev" OR sourcehostname CONTAINS "cdn-web-server1.techserver01.workers.dev" OR sourcehostname CONTAINS "server-web-cdn.detocim498.workers.dev" OR sourcehostname CONTAINS "server-web-cdn.pixece7948.workers.dev" OR sourcehostname CONTAINS "server-cdn.virej10913.workers.dev" OR sourcehostname CONTAINS "server-web-cdn.kagoli5215.workers.dev" OR sourcehostname CONTAINS "dash-server.servertech03.workers.dev" OR sourcehostname CONTAINS "cdn-server-2.wesoc40288.workers.dev" OR sourcehostname CONTAINS "server-web-cdn.nefixeg373.workers.dev" OR sourcehostname CONTAINS "cdn-server-full.taros12579.workers.dev" OR sourcehostname CONTAINS "server-cdn.sidoke9822.workers.dev" OR sourcehostname CONTAINS "server-cdn.jawigaw383.workers.dev")
index=activity AND rg_functionality="DNS / DHCP" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "soft-dns.sejilod748.workers.dev" OR destinationntdomain CONTAINS "cdn1.poyag17470.workers.dev" OR destinationntdomain CONTAINS "cdn1.cowivat156.workers.dev" OR destinationntdomain CONTAINS "server-cdn.lafise2419.workers.dev" OR destinationntdomain CONTAINS "server-web-cdn.rojotoc516.workers.dev" OR destinationntdomain CONTAINS "server-cdn.lecoc56350.workers.dev" OR destinationntdomain CONTAINS "server-cdn.xohahey822.workers.dev" OR destinationntdomain CONTAINS "server-web-cdn.vosax32455.workers.dev" OR destinationntdomain CONTAINS "cdn-server-1.xiren77418.workers.dev" OR destinationntdomain CONTAINS "soft-base-01.ginigiy117.workers.dev" OR destinationntdomain CONTAINS "work-server-1.picalob750.workers.dev" OR destinationntdomain CONTAINS "cdn-web-server1.techserver01.workers.dev" OR destinationntdomain CONTAINS "server-web-cdn.detocim498.workers.dev" OR destinationntdomain CONTAINS "server-web-cdn.pixece7948.workers.dev" OR destinationntdomain CONTAINS "server-cdn.virej10913.workers.dev" OR destinationntdomain CONTAINS "server-web-cdn.kagoli5215.workers.dev" OR destinationntdomain CONTAINS "dash-server.servertech03.workers.dev" OR destinationntdomain CONTAINS "cdn-server-2.wesoc40288.workers.dev" OR destinationntdomain CONTAINS "server-web-cdn.nefixeg373.workers.dev" OR destinationntdomain CONTAINS "cdn-server-full.taros12579.workers.dev" OR destinationntdomain CONTAINS "server-cdn.sidoke9822.workers.dev" OR destinationntdomain CONTAINS "server-cdn.jawigaw383.workers.dev")
index=activity AND rg_functionality="DNS / DHCP" AND requesturl NOT NULL AND (requesturl CONTAINS "soft-dns.sejilod748.workers.dev" OR requesturl CONTAINS "cdn1.poyag17470.workers.dev" OR requesturl CONTAINS "cdn1.cowivat156.workers.dev" OR requesturl CONTAINS "server-cdn.lafise2419.workers.dev" OR requesturl CONTAINS "server-web-cdn.rojotoc516.workers.dev" OR requesturl CONTAINS "server-cdn.lecoc56350.workers.dev" OR requesturl CONTAINS "server-cdn.xohahey822.workers.dev" OR requesturl CONTAINS "server-web-cdn.vosax32455.workers.dev" OR requesturl CONTAINS "cdn-server-1.xiren77418.workers.dev" OR requesturl CONTAINS "soft-base-01.ginigiy117.workers.dev" OR requesturl CONTAINS "work-server-1.picalob750.workers.dev" OR requesturl CONTAINS "cdn-web-server1.techserver01.workers.dev" OR requesturl CONTAINS "server-web-cdn.detocim498.workers.dev" OR requesturl CONTAINS "server-web-cdn.pixece7948.workers.dev" OR requesturl CONTAINS "server-cdn.virej10913.workers.dev" OR requesturl CONTAINS "server-web-cdn.kagoli5215.workers.dev" OR requesturl CONTAINS "dash-server.servertech03.workers.dev" OR requesturl CONTAINS "cdn-server-2.wesoc40288.workers.dev" OR requesturl CONTAINS "server-web-cdn.nefixeg373.workers.dev" OR requesturl CONTAINS "cdn-server-full.taros12579.workers.dev" OR requesturl CONTAINS "server-cdn.sidoke9822.workers.dev" OR requesturl CONTAINS "server-cdn.jawigaw383.workers.dev")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "soft-dns.sejilod748.workers.dev" OR destinationhostname CONTAINS "cdn1.poyag17470.workers.dev" OR destinationhostname CONTAINS "cdn1.cowivat156.workers.dev" OR destinationhostname CONTAINS "server-cdn.lafise2419.workers.dev" OR destinationhostname CONTAINS "server-web-cdn.rojotoc516.workers.dev" OR destinationhostname CONTAINS "server-cdn.lecoc56350.workers.dev" OR destinationhostname CONTAINS "server-cdn.xohahey822.workers.dev" OR destinationhostname CONTAINS "server-web-cdn.vosax32455.workers.dev" OR destinationhostname CONTAINS "cdn-server-1.xiren77418.workers.dev" OR destinationhostname CONTAINS "soft-base-01.ginigiy117.workers.dev" OR destinationhostname CONTAINS "work-server-1.picalob750.workers.dev" OR destinationhostname CONTAINS "cdn-web-server1.techserver01.workers.dev" OR destinationhostname CONTAINS "server-web-cdn.detocim498.workers.dev" OR destinationhostname CONTAINS "server-web-cdn.pixece7948.workers.dev" OR destinationhostname CONTAINS "server-cdn.virej10913.workers.dev" OR destinationhostname CONTAINS "server-web-cdn.kagoli5215.workers.dev" OR destinationhostname CONTAINS "dash-server.servertech03.workers.dev" OR destinationhostname CONTAINS "cdn-server-2.wesoc40288.workers.dev" OR destinationhostname CONTAINS "server-web-cdn.nefixeg373.workers.dev" OR destinationhostname CONTAINS "cdn-server-full.taros12579.workers.dev" OR destinationhostname CONTAINS "server-cdn.sidoke9822.workers.dev" OR destinationhostname CONTAINS "server-cdn.jawigaw383.workers.dev")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "soft-dns.sejilod748.workers.dev" OR sourcentdomain CONTAINS "cdn1.poyag17470.workers.dev" OR sourcentdomain CONTAINS "cdn1.cowivat156.workers.dev" OR sourcentdomain CONTAINS "server-cdn.lafise2419.workers.dev" OR sourcentdomain CONTAINS "server-web-cdn.rojotoc516.workers.dev" OR sourcentdomain CONTAINS "server-cdn.lecoc56350.workers.dev" OR sourcentdomain CONTAINS "server-cdn.xohahey822.workers.dev" OR sourcentdomain CONTAINS "server-web-cdn.vosax32455.workers.dev" OR sourcentdomain CONTAINS "cdn-server-1.xiren77418.workers.dev" OR sourcentdomain CONTAINS "soft-base-01.ginigiy117.workers.dev" OR sourcentdomain CONTAINS "work-server-1.picalob750.workers.dev" OR sourcentdomain CONTAINS "cdn-web-server1.techserver01.workers.dev" OR sourcentdomain CONTAINS "server-web-cdn.detocim498.workers.dev" OR sourcentdomain CONTAINS "server-web-cdn.pixece7948.workers.dev" OR sourcentdomain CONTAINS "server-cdn.virej10913.workers.dev" OR sourcentdomain CONTAINS "server-web-cdn.kagoli5215.workers.dev" OR sourcentdomain CONTAINS "dash-server.servertech03.workers.dev" OR sourcentdomain CONTAINS "cdn-server-2.wesoc40288.workers.dev" OR sourcentdomain CONTAINS "server-web-cdn.nefixeg373.workers.dev" OR sourcentdomain CONTAINS "cdn-server-full.taros12579.workers.dev" OR sourcentdomain CONTAINS "server-cdn.sidoke9822.workers.dev" OR sourcentdomain CONTAINS "server-cdn.jawigaw383.workers.dev")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "soft-dns.sejilod748.workers.dev" OR sourcehostname CONTAINS "cdn1.poyag17470.workers.dev" OR sourcehostname CONTAINS "cdn1.cowivat156.workers.dev" OR sourcehostname CONTAINS "server-cdn.lafise2419.workers.dev" OR sourcehostname CONTAINS "server-web-cdn.rojotoc516.workers.dev" OR sourcehostname CONTAINS "server-cdn.lecoc56350.workers.dev" OR sourcehostname CONTAINS "server-cdn.xohahey822.workers.dev" OR sourcehostname CONTAINS "server-web-cdn.vosax32455.workers.dev" OR sourcehostname CONTAINS "cdn-server-1.xiren77418.workers.dev" OR sourcehostname CONTAINS "soft-base-01.ginigiy117.workers.dev" OR sourcehostname CONTAINS "work-server-1.picalob750.workers.dev" OR sourcehostname CONTAINS "cdn-web-server1.techserver01.workers.dev" OR sourcehostname CONTAINS "server-web-cdn.detocim498.workers.dev" OR sourcehostname CONTAINS "server-web-cdn.pixece7948.workers.dev" OR sourcehostname CONTAINS "server-cdn.virej10913.workers.dev" OR sourcehostname CONTAINS "server-web-cdn.kagoli5215.workers.dev" OR sourcehostname CONTAINS "dash-server.servertech03.workers.dev" OR sourcehostname CONTAINS "cdn-server-2.wesoc40288.workers.dev" OR sourcehostname CONTAINS "server-web-cdn.nefixeg373.workers.dev" OR sourcehostname CONTAINS "cdn-server-full.taros12579.workers.dev" OR sourcehostname CONTAINS "server-cdn.sidoke9822.workers.dev" OR sourcehostname CONTAINS "server-cdn.jawigaw383.workers.dev")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "soft-dns.sejilod748.workers.dev" OR destinationntdomain CONTAINS "cdn1.poyag17470.workers.dev" OR destinationntdomain CONTAINS "cdn1.cowivat156.workers.dev" OR destinationntdomain CONTAINS "server-cdn.lafise2419.workers.dev" OR destinationntdomain CONTAINS "server-web-cdn.rojotoc516.workers.dev" OR destinationntdomain CONTAINS "server-cdn.lecoc56350.workers.dev" OR destinationntdomain CONTAINS "server-cdn.xohahey822.workers.dev" OR destinationntdomain CONTAINS "server-web-cdn.vosax32455.workers.dev" OR destinationntdomain CONTAINS "cdn-server-1.xiren77418.workers.dev" OR destinationntdomain CONTAINS "soft-base-01.ginigiy117.workers.dev" OR destinationntdomain CONTAINS "work-server-1.picalob750.workers.dev" OR destinationntdomain CONTAINS "cdn-web-server1.techserver01.workers.dev" OR destinationntdomain CONTAINS "server-web-cdn.detocim498.workers.dev" OR destinationntdomain CONTAINS "server-web-cdn.pixece7948.workers.dev" OR destinationntdomain CONTAINS "server-cdn.virej10913.workers.dev" OR destinationntdomain CONTAINS "server-web-cdn.kagoli5215.workers.dev" OR destinationntdomain CONTAINS "dash-server.servertech03.workers.dev" OR destinationntdomain CONTAINS "cdn-server-2.wesoc40288.workers.dev" OR destinationntdomain CONTAINS "server-web-cdn.nefixeg373.workers.dev" OR destinationntdomain CONTAINS "cdn-server-full.taros12579.workers.dev" OR destinationntdomain CONTAINS "server-cdn.sidoke9822.workers.dev" OR destinationntdomain CONTAINS "server-cdn.jawigaw383.workers.dev")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND requesturl NOT NULL AND (requesturl CONTAINS "soft-dns.sejilod748.workers.dev" OR requesturl CONTAINS "cdn1.poyag17470.workers.dev" OR requesturl CONTAINS "cdn1.cowivat156.workers.dev" OR requesturl CONTAINS "server-cdn.lafise2419.workers.dev" OR requesturl CONTAINS "server-web-cdn.rojotoc516.workers.dev" OR requesturl CONTAINS "server-cdn.lecoc56350.workers.dev" OR requesturl CONTAINS "server-cdn.xohahey822.workers.dev" OR requesturl CONTAINS "server-web-cdn.vosax32455.workers.dev" OR requesturl CONTAINS "cdn-server-1.xiren77418.workers.dev" OR requesturl CONTAINS "soft-base-01.ginigiy117.workers.dev" OR requesturl CONTAINS "work-server-1.picalob750.workers.dev" OR requesturl CONTAINS "cdn-web-server1.techserver01.workers.dev" OR requesturl CONTAINS "server-web-cdn.detocim498.workers.dev" OR requesturl CONTAINS "server-web-cdn.pixece7948.workers.dev" OR requesturl CONTAINS "server-cdn.virej10913.workers.dev" OR requesturl CONTAINS "server-web-cdn.kagoli5215.workers.dev" OR requesturl CONTAINS "dash-server.servertech03.workers.dev" OR requesturl CONTAINS "cdn-server-2.wesoc40288.workers.dev" OR requesturl CONTAINS "server-web-cdn.nefixeg373.workers.dev" OR requesturl CONTAINS "cdn-server-full.taros12579.workers.dev" OR requesturl CONTAINS "server-cdn.sidoke9822.workers.dev" OR requesturl CONTAINS "server-cdn.jawigaw383.workers.dev")
index=activity AND rg_functionality="Next Generation Firewall" AND filehash NOT NULL AND filehash IN ("556d3dcea423e658a53cdbd43cde2ddd1c29590706f926b4d8f210c4f17b4670","ff2b734ec870927a19bf61106cd2f2383ec66e79c1bce369fbd1fb234527b888","b2b953bb7424b73af385615ceece9742f75f3954b81b30163402b15bada8c18e","2acda6ddcd8fecf5d922259b43d20556b7a5982a876ae50df68d09d3dae0d066","6dc87438c968c8d530372fb3c777bab94dd69e4186474380eef0d8b31176f136","34602ec363f0fe18ae324ff46d523819d65d38dd989fa0640a01fbfd3673f797","09b5e780227caa97a042be17450ead0242fd7f58f513158e26678c811d67e264","e6665cdbad676582b7dd959d6893738e1be3c5fa4698af99b5a081fca9918497","09aa9a74d7488a5a26ddf29305b40282a3ab3645f75e09a74365560bb5ece4dd","b7be5e44c1ab0ef4ebd3b43c19ef61809beaba5eb92f6cf2667bf7652cea326b","bcfc72748479693b517a0825f174629a465832e1030c54da9e09a6fdcb01b708")
index=activity AND rg_functionality="Next Generation Firewall" AND oldfilehash NOT NULL AND oldfilehash IN ("556d3dcea423e658a53cdbd43cde2ddd1c29590706f926b4d8f210c4f17b4670","ff2b734ec870927a19bf61106cd2f2383ec66e79c1bce369fbd1fb234527b888","b2b953bb7424b73af385615ceece9742f75f3954b81b30163402b15bada8c18e","2acda6ddcd8fecf5d922259b43d20556b7a5982a876ae50df68d09d3dae0d066","6dc87438c968c8d530372fb3c777bab94dd69e4186474380eef0d8b31176f136","34602ec363f0fe18ae324ff46d523819d65d38dd989fa0640a01fbfd3673f797","09b5e780227caa97a042be17450ead0242fd7f58f513158e26678c811d67e264","e6665cdbad676582b7dd959d6893738e1be3c5fa4698af99b5a081fca9918497","09aa9a74d7488a5a26ddf29305b40282a3ab3645f75e09a74365560bb5ece4dd","b7be5e44c1ab0ef4ebd3b43c19ef61809beaba5eb92f6cf2667bf7652cea326b","bcfc72748479693b517a0825f174629a465832e1030c54da9e09a6fdcb01b708")
index=activity AND rg_functionality="Next Generation Firewall" AND customstring3 NOT NULL AND customstring3 IN ("556d3dcea423e658a53cdbd43cde2ddd1c29590706f926b4d8f210c4f17b4670","ff2b734ec870927a19bf61106cd2f2383ec66e79c1bce369fbd1fb234527b888","b2b953bb7424b73af385615ceece9742f75f3954b81b30163402b15bada8c18e","2acda6ddcd8fecf5d922259b43d20556b7a5982a876ae50df68d09d3dae0d066","6dc87438c968c8d530372fb3c777bab94dd69e4186474380eef0d8b31176f136","34602ec363f0fe18ae324ff46d523819d65d38dd989fa0640a01fbfd3673f797","09b5e780227caa97a042be17450ead0242fd7f58f513158e26678c811d67e264","e6665cdbad676582b7dd959d6893738e1be3c5fa4698af99b5a081fca9918497","09aa9a74d7488a5a26ddf29305b40282a3ab3645f75e09a74365560bb5ece4dd","b7be5e44c1ab0ef4ebd3b43c19ef61809beaba5eb92f6cf2667bf7652cea326b","bcfc72748479693b517a0825f174629a465832e1030c54da9e09a6fdcb01b708")
index=activity AND rg_functionality="Next Generation Firewall" AND customstring64 NOT NULL AND customstring64 IN ("556d3dcea423e658a53cdbd43cde2ddd1c29590706f926b4d8f210c4f17b4670","ff2b734ec870927a19bf61106cd2f2383ec66e79c1bce369fbd1fb234527b888","b2b953bb7424b73af385615ceece9742f75f3954b81b30163402b15bada8c18e","2acda6ddcd8fecf5d922259b43d20556b7a5982a876ae50df68d09d3dae0d066","6dc87438c968c8d530372fb3c777bab94dd69e4186474380eef0d8b31176f136","34602ec363f0fe18ae324ff46d523819d65d38dd989fa0640a01fbfd3673f797","09b5e780227caa97a042be17450ead0242fd7f58f513158e26678c811d67e264","e6665cdbad676582b7dd959d6893738e1be3c5fa4698af99b5a081fca9918497","09aa9a74d7488a5a26ddf29305b40282a3ab3645f75e09a74365560bb5ece4dd","b7be5e44c1ab0ef4ebd3b43c19ef61809beaba5eb92f6cf2667bf7652cea326b","bcfc72748479693b517a0825f174629a465832e1030c54da9e09a6fdcb01b708")
index=activity AND rg_functionality="Firewall" AND filehash NOT NULL AND filehash IN ("556d3dcea423e658a53cdbd43cde2ddd1c29590706f926b4d8f210c4f17b4670","ff2b734ec870927a19bf61106cd2f2383ec66e79c1bce369fbd1fb234527b888","b2b953bb7424b73af385615ceece9742f75f3954b81b30163402b15bada8c18e","2acda6ddcd8fecf5d922259b43d20556b7a5982a876ae50df68d09d3dae0d066","6dc87438c968c8d530372fb3c777bab94dd69e4186474380eef0d8b31176f136","34602ec363f0fe18ae324ff46d523819d65d38dd989fa0640a01fbfd3673f797","09b5e780227caa97a042be17450ead0242fd7f58f513158e26678c811d67e264","e6665cdbad676582b7dd959d6893738e1be3c5fa4698af99b5a081fca9918497","09aa9a74d7488a5a26ddf29305b40282a3ab3645f75e09a74365560bb5ece4dd","b7be5e44c1ab0ef4ebd3b43c19ef61809beaba5eb92f6cf2667bf7652cea326b","bcfc72748479693b517a0825f174629a465832e1030c54da9e09a6fdcb01b708")
index=activity AND rg_functionality="Firewall" AND oldfilehash NOT NULL AND oldfilehash IN ("556d3dcea423e658a53cdbd43cde2ddd1c29590706f926b4d8f210c4f17b4670","ff2b734ec870927a19bf61106cd2f2383ec66e79c1bce369fbd1fb234527b888","b2b953bb7424b73af385615ceece9742f75f3954b81b30163402b15bada8c18e","2acda6ddcd8fecf5d922259b43d20556b7a5982a876ae50df68d09d3dae0d066","6dc87438c968c8d530372fb3c777bab94dd69e4186474380eef0d8b31176f136","34602ec363f0fe18ae324ff46d523819d65d38dd989fa0640a01fbfd3673f797","09b5e780227caa97a042be17450ead0242fd7f58f513158e26678c811d67e264","e6665cdbad676582b7dd959d6893738e1be3c5fa4698af99b5a081fca9918497","09aa9a74d7488a5a26ddf29305b40282a3ab3645f75e09a74365560bb5ece4dd","b7be5e44c1ab0ef4ebd3b43c19ef61809beaba5eb92f6cf2667bf7652cea326b","bcfc72748479693b517a0825f174629a465832e1030c54da9e09a6fdcb01b708")
index=activity AND rg_functionality="Firewall" AND customstring3 NOT NULL AND customstring3 IN ("556d3dcea423e658a53cdbd43cde2ddd1c29590706f926b4d8f210c4f17b4670","ff2b734ec870927a19bf61106cd2f2383ec66e79c1bce369fbd1fb234527b888","b2b953bb7424b73af385615ceece9742f75f3954b81b30163402b15bada8c18e","2acda6ddcd8fecf5d922259b43d20556b7a5982a876ae50df68d09d3dae0d066","6dc87438c968c8d530372fb3c777bab94dd69e4186474380eef0d8b31176f136","34602ec363f0fe18ae324ff46d523819d65d38dd989fa0640a01fbfd3673f797","09b5e780227caa97a042be17450ead0242fd7f58f513158e26678c811d67e264","e6665cdbad676582b7dd959d6893738e1be3c5fa4698af99b5a081fca9918497","09aa9a74d7488a5a26ddf29305b40282a3ab3645f75e09a74365560bb5ece4dd","b7be5e44c1ab0ef4ebd3b43c19ef61809beaba5eb92f6cf2667bf7652cea326b","bcfc72748479693b517a0825f174629a465832e1030c54da9e09a6fdcb01b708")
index=activity AND rg_functionality="Firewall" AND customstring64 NOT NULL AND customstring64 IN ("556d3dcea423e658a53cdbd43cde2ddd1c29590706f926b4d8f210c4f17b4670","ff2b734ec870927a19bf61106cd2f2383ec66e79c1bce369fbd1fb234527b888","b2b953bb7424b73af385615ceece9742f75f3954b81b30163402b15bada8c18e","2acda6ddcd8fecf5d922259b43d20556b7a5982a876ae50df68d09d3dae0d066","6dc87438c968c8d530372fb3c777bab94dd69e4186474380eef0d8b31176f136","34602ec363f0fe18ae324ff46d523819d65d38dd989fa0640a01fbfd3673f797","09b5e780227caa97a042be17450ead0242fd7f58f513158e26678c811d67e264","e6665cdbad676582b7dd959d6893738e1be3c5fa4698af99b5a081fca9918497","09aa9a74d7488a5a26ddf29305b40282a3ab3645f75e09a74365560bb5ece4dd","b7be5e44c1ab0ef4ebd3b43c19ef61809beaba5eb92f6cf2667bf7652cea326b","bcfc72748479693b517a0825f174629a465832e1030c54da9e09a6fdcb01b708")
index=activity AND rg_functionality="Web Proxy" AND filehash NOT NULL AND filehash IN ("556d3dcea423e658a53cdbd43cde2ddd1c29590706f926b4d8f210c4f17b4670","ff2b734ec870927a19bf61106cd2f2383ec66e79c1bce369fbd1fb234527b888","b2b953bb7424b73af385615ceece9742f75f3954b81b30163402b15bada8c18e","2acda6ddcd8fecf5d922259b43d20556b7a5982a876ae50df68d09d3dae0d066","6dc87438c968c8d530372fb3c777bab94dd69e4186474380eef0d8b31176f136","34602ec363f0fe18ae324ff46d523819d65d38dd989fa0640a01fbfd3673f797","09b5e780227caa97a042be17450ead0242fd7f58f513158e26678c811d67e264","e6665cdbad676582b7dd959d6893738e1be3c5fa4698af99b5a081fca9918497","09aa9a74d7488a5a26ddf29305b40282a3ab3645f75e09a74365560bb5ece4dd","b7be5e44c1ab0ef4ebd3b43c19ef61809beaba5eb92f6cf2667bf7652cea326b","bcfc72748479693b517a0825f174629a465832e1030c54da9e09a6fdcb01b708")
index=activity AND rg_functionality="Web Proxy" AND oldfilehash NOT NULL AND oldfilehash IN ("556d3dcea423e658a53cdbd43cde2ddd1c29590706f926b4d8f210c4f17b4670","ff2b734ec870927a19bf61106cd2f2383ec66e79c1bce369fbd1fb234527b888","b2b953bb7424b73af385615ceece9742f75f3954b81b30163402b15bada8c18e","2acda6ddcd8fecf5d922259b43d20556b7a5982a876ae50df68d09d3dae0d066","6dc87438c968c8d530372fb3c777bab94dd69e4186474380eef0d8b31176f136","34602ec363f0fe18ae324ff46d523819d65d38dd989fa0640a01fbfd3673f797","09b5e780227caa97a042be17450ead0242fd7f58f513158e26678c811d67e264","e6665cdbad676582b7dd959d6893738e1be3c5fa4698af99b5a081fca9918497","09aa9a74d7488a5a26ddf29305b40282a3ab3645f75e09a74365560bb5ece4dd","b7be5e44c1ab0ef4ebd3b43c19ef61809beaba5eb92f6cf2667bf7652cea326b","bcfc72748479693b517a0825f174629a465832e1030c54da9e09a6fdcb01b708")
index=activity AND rg_functionality="Web Proxy" AND customstring3 NOT NULL AND customstring3 IN ("556d3dcea423e658a53cdbd43cde2ddd1c29590706f926b4d8f210c4f17b4670","ff2b734ec870927a19bf61106cd2f2383ec66e79c1bce369fbd1fb234527b888","b2b953bb7424b73af385615ceece9742f75f3954b81b30163402b15bada8c18e","2acda6ddcd8fecf5d922259b43d20556b7a5982a876ae50df68d09d3dae0d066","6dc87438c968c8d530372fb3c777bab94dd69e4186474380eef0d8b31176f136","34602ec363f0fe18ae324ff46d523819d65d38dd989fa0640a01fbfd3673f797","09b5e780227caa97a042be17450ead0242fd7f58f513158e26678c811d67e264","e6665cdbad676582b7dd959d6893738e1be3c5fa4698af99b5a081fca9918497","09aa9a74d7488a5a26ddf29305b40282a3ab3645f75e09a74365560bb5ece4dd","b7be5e44c1ab0ef4ebd3b43c19ef61809beaba5eb92f6cf2667bf7652cea326b","bcfc72748479693b517a0825f174629a465832e1030c54da9e09a6fdcb01b708")
index=activity AND rg_functionality="Web Proxy" AND customstring64 NOT NULL AND customstring64 IN ("556d3dcea423e658a53cdbd43cde2ddd1c29590706f926b4d8f210c4f17b4670","ff2b734ec870927a19bf61106cd2f2383ec66e79c1bce369fbd1fb234527b888","b2b953bb7424b73af385615ceece9742f75f3954b81b30163402b15bada8c18e","2acda6ddcd8fecf5d922259b43d20556b7a5982a876ae50df68d09d3dae0d066","6dc87438c968c8d530372fb3c777bab94dd69e4186474380eef0d8b31176f136","34602ec363f0fe18ae324ff46d523819d65d38dd989fa0640a01fbfd3673f797","09b5e780227caa97a042be17450ead0242fd7f58f513158e26678c811d67e264","e6665cdbad676582b7dd959d6893738e1be3c5fa4698af99b5a081fca9918497","09aa9a74d7488a5a26ddf29305b40282a3ab3645f75e09a74365560bb5ece4dd","b7be5e44c1ab0ef4ebd3b43c19ef61809beaba5eb92f6cf2667bf7652cea326b","bcfc72748479693b517a0825f174629a465832e1030c54da9e09a6fdcb01b708")
index=activity AND rg_functionality="Flow" AND filehash NOT NULL AND filehash IN ("556d3dcea423e658a53cdbd43cde2ddd1c29590706f926b4d8f210c4f17b4670","ff2b734ec870927a19bf61106cd2f2383ec66e79c1bce369fbd1fb234527b888","b2b953bb7424b73af385615ceece9742f75f3954b81b30163402b15bada8c18e","2acda6ddcd8fecf5d922259b43d20556b7a5982a876ae50df68d09d3dae0d066","6dc87438c968c8d530372fb3c777bab94dd69e4186474380eef0d8b31176f136","34602ec363f0fe18ae324ff46d523819d65d38dd989fa0640a01fbfd3673f797","09b5e780227caa97a042be17450ead0242fd7f58f513158e26678c811d67e264","e6665cdbad676582b7dd959d6893738e1be3c5fa4698af99b5a081fca9918497","09aa9a74d7488a5a26ddf29305b40282a3ab3645f75e09a74365560bb5ece4dd","b7be5e44c1ab0ef4ebd3b43c19ef61809beaba5eb92f6cf2667bf7652cea326b","bcfc72748479693b517a0825f174629a465832e1030c54da9e09a6fdcb01b708")
index=activity AND rg_functionality="Flow" AND oldfilehash NOT NULL AND oldfilehash IN ("556d3dcea423e658a53cdbd43cde2ddd1c29590706f926b4d8f210c4f17b4670","ff2b734ec870927a19bf61106cd2f2383ec66e79c1bce369fbd1fb234527b888","b2b953bb7424b73af385615ceece9742f75f3954b81b30163402b15bada8c18e","2acda6ddcd8fecf5d922259b43d20556b7a5982a876ae50df68d09d3dae0d066","6dc87438c968c8d530372fb3c777bab94dd69e4186474380eef0d8b31176f136","34602ec363f0fe18ae324ff46d523819d65d38dd989fa0640a01fbfd3673f797","09b5e780227caa97a042be17450ead0242fd7f58f513158e26678c811d67e264","e6665cdbad676582b7dd959d6893738e1be3c5fa4698af99b5a081fca9918497","09aa9a74d7488a5a26ddf29305b40282a3ab3645f75e09a74365560bb5ece4dd","b7be5e44c1ab0ef4ebd3b43c19ef61809beaba5eb92f6cf2667bf7652cea326b","bcfc72748479693b517a0825f174629a465832e1030c54da9e09a6fdcb01b708")
index=activity AND rg_functionality="Flow" AND customstring3 NOT NULL AND customstring3 IN ("556d3dcea423e658a53cdbd43cde2ddd1c29590706f926b4d8f210c4f17b4670","ff2b734ec870927a19bf61106cd2f2383ec66e79c1bce369fbd1fb234527b888","b2b953bb7424b73af385615ceece9742f75f3954b81b30163402b15bada8c18e","2acda6ddcd8fecf5d922259b43d20556b7a5982a876ae50df68d09d3dae0d066","6dc87438c968c8d530372fb3c777bab94dd69e4186474380eef0d8b31176f136","34602ec363f0fe18ae324ff46d523819d65d38dd989fa0640a01fbfd3673f797","09b5e780227caa97a042be17450ead0242fd7f58f513158e26678c811d67e264","e6665cdbad676582b7dd959d6893738e1be3c5fa4698af99b5a081fca9918497","09aa9a74d7488a5a26ddf29305b40282a3ab3645f75e09a74365560bb5ece4dd","b7be5e44c1ab0ef4ebd3b43c19ef61809beaba5eb92f6cf2667bf7652cea326b","bcfc72748479693b517a0825f174629a465832e1030c54da9e09a6fdcb01b708")
index=activity AND rg_functionality="Flow" AND customstring64 NOT NULL AND customstring64 IN ("556d3dcea423e658a53cdbd43cde2ddd1c29590706f926b4d8f210c4f17b4670","ff2b734ec870927a19bf61106cd2f2383ec66e79c1bce369fbd1fb234527b888","b2b953bb7424b73af385615ceece9742f75f3954b81b30163402b15bada8c18e","2acda6ddcd8fecf5d922259b43d20556b7a5982a876ae50df68d09d3dae0d066","6dc87438c968c8d530372fb3c777bab94dd69e4186474380eef0d8b31176f136","34602ec363f0fe18ae324ff46d523819d65d38dd989fa0640a01fbfd3673f797","09b5e780227caa97a042be17450ead0242fd7f58f513158e26678c811d67e264","e6665cdbad676582b7dd959d6893738e1be3c5fa4698af99b5a081fca9918497","09aa9a74d7488a5a26ddf29305b40282a3ab3645f75e09a74365560bb5ece4dd","b7be5e44c1ab0ef4ebd3b43c19ef61809beaba5eb92f6cf2667bf7652cea326b","bcfc72748479693b517a0825f174629a465832e1030c54da9e09a6fdcb01b708")
index=activity AND rg_functionality="Web Server" AND filehash NOT NULL AND filehash IN ("556d3dcea423e658a53cdbd43cde2ddd1c29590706f926b4d8f210c4f17b4670","ff2b734ec870927a19bf61106cd2f2383ec66e79c1bce369fbd1fb234527b888","b2b953bb7424b73af385615ceece9742f75f3954b81b30163402b15bada8c18e","2acda6ddcd8fecf5d922259b43d20556b7a5982a876ae50df68d09d3dae0d066","6dc87438c968c8d530372fb3c777bab94dd69e4186474380eef0d8b31176f136","34602ec363f0fe18ae324ff46d523819d65d38dd989fa0640a01fbfd3673f797","09b5e780227caa97a042be17450ead0242fd7f58f513158e26678c811d67e264","e6665cdbad676582b7dd959d6893738e1be3c5fa4698af99b5a081fca9918497","09aa9a74d7488a5a26ddf29305b40282a3ab3645f75e09a74365560bb5ece4dd","b7be5e44c1ab0ef4ebd3b43c19ef61809beaba5eb92f6cf2667bf7652cea326b","bcfc72748479693b517a0825f174629a465832e1030c54da9e09a6fdcb01b708")
index=activity AND rg_functionality="Web Server" AND oldfilehash NOT NULL AND oldfilehash IN ("556d3dcea423e658a53cdbd43cde2ddd1c29590706f926b4d8f210c4f17b4670","ff2b734ec870927a19bf61106cd2f2383ec66e79c1bce369fbd1fb234527b888","b2b953bb7424b73af385615ceece9742f75f3954b81b30163402b15bada8c18e","2acda6ddcd8fecf5d922259b43d20556b7a5982a876ae50df68d09d3dae0d066","6dc87438c968c8d530372fb3c777bab94dd69e4186474380eef0d8b31176f136","34602ec363f0fe18ae324ff46d523819d65d38dd989fa0640a01fbfd3673f797","09b5e780227caa97a042be17450ead0242fd7f58f513158e26678c811d67e264","e6665cdbad676582b7dd959d6893738e1be3c5fa4698af99b5a081fca9918497","09aa9a74d7488a5a26ddf29305b40282a3ab3645f75e09a74365560bb5ece4dd","b7be5e44c1ab0ef4ebd3b43c19ef61809beaba5eb92f6cf2667bf7652cea326b","bcfc72748479693b517a0825f174629a465832e1030c54da9e09a6fdcb01b708")
index=activity AND rg_functionality="Web Server" AND customstring3 NOT NULL AND customstring3 IN ("556d3dcea423e658a53cdbd43cde2ddd1c29590706f926b4d8f210c4f17b4670","ff2b734ec870927a19bf61106cd2f2383ec66e79c1bce369fbd1fb234527b888","b2b953bb7424b73af385615ceece9742f75f3954b81b30163402b15bada8c18e","2acda6ddcd8fecf5d922259b43d20556b7a5982a876ae50df68d09d3dae0d066","6dc87438c968c8d530372fb3c777bab94dd69e4186474380eef0d8b31176f136","34602ec363f0fe18ae324ff46d523819d65d38dd989fa0640a01fbfd3673f797","09b5e780227caa97a042be17450ead0242fd7f58f513158e26678c811d67e264","e6665cdbad676582b7dd959d6893738e1be3c5fa4698af99b5a081fca9918497","09aa9a74d7488a5a26ddf29305b40282a3ab3645f75e09a74365560bb5ece4dd","b7be5e44c1ab0ef4ebd3b43c19ef61809beaba5eb92f6cf2667bf7652cea326b","bcfc72748479693b517a0825f174629a465832e1030c54da9e09a6fdcb01b708")
index=activity AND rg_functionality="Web Server" AND customstring64 NOT NULL AND customstring64 IN ("556d3dcea423e658a53cdbd43cde2ddd1c29590706f926b4d8f210c4f17b4670","ff2b734ec870927a19bf61106cd2f2383ec66e79c1bce369fbd1fb234527b888","b2b953bb7424b73af385615ceece9742f75f3954b81b30163402b15bada8c18e","2acda6ddcd8fecf5d922259b43d20556b7a5982a876ae50df68d09d3dae0d066","6dc87438c968c8d530372fb3c777bab94dd69e4186474380eef0d8b31176f136","34602ec363f0fe18ae324ff46d523819d65d38dd989fa0640a01fbfd3673f797","09b5e780227caa97a042be17450ead0242fd7f58f513158e26678c811d67e264","e6665cdbad676582b7dd959d6893738e1be3c5fa4698af99b5a081fca9918497","09aa9a74d7488a5a26ddf29305b40282a3ab3645f75e09a74365560bb5ece4dd","b7be5e44c1ab0ef4ebd3b43c19ef61809beaba5eb92f6cf2667bf7652cea326b","bcfc72748479693b517a0825f174629a465832e1030c54da9e09a6fdcb01b708")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("556d3dcea423e658a53cdbd43cde2ddd1c29590706f926b4d8f210c4f17b4670","ff2b734ec870927a19bf61106cd2f2383ec66e79c1bce369fbd1fb234527b888","b2b953bb7424b73af385615ceece9742f75f3954b81b30163402b15bada8c18e","2acda6ddcd8fecf5d922259b43d20556b7a5982a876ae50df68d09d3dae0d066","6dc87438c968c8d530372fb3c777bab94dd69e4186474380eef0d8b31176f136","34602ec363f0fe18ae324ff46d523819d65d38dd989fa0640a01fbfd3673f797","09b5e780227caa97a042be17450ead0242fd7f58f513158e26678c811d67e264","e6665cdbad676582b7dd959d6893738e1be3c5fa4698af99b5a081fca9918497","09aa9a74d7488a5a26ddf29305b40282a3ab3645f75e09a74365560bb5ece4dd","b7be5e44c1ab0ef4ebd3b43c19ef61809beaba5eb92f6cf2667bf7652cea326b","bcfc72748479693b517a0825f174629a465832e1030c54da9e09a6fdcb01b708")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("556d3dcea423e658a53cdbd43cde2ddd1c29590706f926b4d8f210c4f17b4670","ff2b734ec870927a19bf61106cd2f2383ec66e79c1bce369fbd1fb234527b888","b2b953bb7424b73af385615ceece9742f75f3954b81b30163402b15bada8c18e","2acda6ddcd8fecf5d922259b43d20556b7a5982a876ae50df68d09d3dae0d066","6dc87438c968c8d530372fb3c777bab94dd69e4186474380eef0d8b31176f136","34602ec363f0fe18ae324ff46d523819d65d38dd989fa0640a01fbfd3673f797","09b5e780227caa97a042be17450ead0242fd7f58f513158e26678c811d67e264","e6665cdbad676582b7dd959d6893738e1be3c5fa4698af99b5a081fca9918497","09aa9a74d7488a5a26ddf29305b40282a3ab3645f75e09a74365560bb5ece4dd","b7be5e44c1ab0ef4ebd3b43c19ef61809beaba5eb92f6cf2667bf7652cea326b","bcfc72748479693b517a0825f174629a465832e1030c54da9e09a6fdcb01b708")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("556d3dcea423e658a53cdbd43cde2ddd1c29590706f926b4d8f210c4f17b4670","ff2b734ec870927a19bf61106cd2f2383ec66e79c1bce369fbd1fb234527b888","b2b953bb7424b73af385615ceece9742f75f3954b81b30163402b15bada8c18e","2acda6ddcd8fecf5d922259b43d20556b7a5982a876ae50df68d09d3dae0d066","6dc87438c968c8d530372fb3c777bab94dd69e4186474380eef0d8b31176f136","34602ec363f0fe18ae324ff46d523819d65d38dd989fa0640a01fbfd3673f797","09b5e780227caa97a042be17450ead0242fd7f58f513158e26678c811d67e264","e6665cdbad676582b7dd959d6893738e1be3c5fa4698af99b5a081fca9918497","09aa9a74d7488a5a26ddf29305b40282a3ab3645f75e09a74365560bb5ece4dd","b7be5e44c1ab0ef4ebd3b43c19ef61809beaba5eb92f6cf2667bf7652cea326b","bcfc72748479693b517a0825f174629a465832e1030c54da9e09a6fdcb01b708")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring64 NOT NULL AND customstring64 IN ("556d3dcea423e658a53cdbd43cde2ddd1c29590706f926b4d8f210c4f17b4670","ff2b734ec870927a19bf61106cd2f2383ec66e79c1bce369fbd1fb234527b888","b2b953bb7424b73af385615ceece9742f75f3954b81b30163402b15bada8c18e","2acda6ddcd8fecf5d922259b43d20556b7a5982a876ae50df68d09d3dae0d066","6dc87438c968c8d530372fb3c777bab94dd69e4186474380eef0d8b31176f136","34602ec363f0fe18ae324ff46d523819d65d38dd989fa0640a01fbfd3673f797","09b5e780227caa97a042be17450ead0242fd7f58f513158e26678c811d67e264","e6665cdbad676582b7dd959d6893738e1be3c5fa4698af99b5a081fca9918497","09aa9a74d7488a5a26ddf29305b40282a3ab3645f75e09a74365560bb5ece4dd","b7be5e44c1ab0ef4ebd3b43c19ef61809beaba5eb92f6cf2667bf7652cea326b","bcfc72748479693b517a0825f174629a465832e1030c54da9e09a6fdcb01b708")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("556d3dcea423e658a53cdbd43cde2ddd1c29590706f926b4d8f210c4f17b4670","ff2b734ec870927a19bf61106cd2f2383ec66e79c1bce369fbd1fb234527b888","b2b953bb7424b73af385615ceece9742f75f3954b81b30163402b15bada8c18e","2acda6ddcd8fecf5d922259b43d20556b7a5982a876ae50df68d09d3dae0d066","6dc87438c968c8d530372fb3c777bab94dd69e4186474380eef0d8b31176f136","34602ec363f0fe18ae324ff46d523819d65d38dd989fa0640a01fbfd3673f797","09b5e780227caa97a042be17450ead0242fd7f58f513158e26678c811d67e264","e6665cdbad676582b7dd959d6893738e1be3c5fa4698af99b5a081fca9918497","09aa9a74d7488a5a26ddf29305b40282a3ab3645f75e09a74365560bb5ece4dd","b7be5e44c1ab0ef4ebd3b43c19ef61809beaba5eb92f6cf2667bf7652cea326b","bcfc72748479693b517a0825f174629a465832e1030c54da9e09a6fdcb01b708")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("556d3dcea423e658a53cdbd43cde2ddd1c29590706f926b4d8f210c4f17b4670","ff2b734ec870927a19bf61106cd2f2383ec66e79c1bce369fbd1fb234527b888","b2b953bb7424b73af385615ceece9742f75f3954b81b30163402b15bada8c18e","2acda6ddcd8fecf5d922259b43d20556b7a5982a876ae50df68d09d3dae0d066","6dc87438c968c8d530372fb3c777bab94dd69e4186474380eef0d8b31176f136","34602ec363f0fe18ae324ff46d523819d65d38dd989fa0640a01fbfd3673f797","09b5e780227caa97a042be17450ead0242fd7f58f513158e26678c811d67e264","e6665cdbad676582b7dd959d6893738e1be3c5fa4698af99b5a081fca9918497","09aa9a74d7488a5a26ddf29305b40282a3ab3645f75e09a74365560bb5ece4dd","b7be5e44c1ab0ef4ebd3b43c19ef61809beaba5eb92f6cf2667bf7652cea326b","bcfc72748479693b517a0825f174629a465832e1030c54da9e09a6fdcb01b708")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("556d3dcea423e658a53cdbd43cde2ddd1c29590706f926b4d8f210c4f17b4670","ff2b734ec870927a19bf61106cd2f2383ec66e79c1bce369fbd1fb234527b888","b2b953bb7424b73af385615ceece9742f75f3954b81b30163402b15bada8c18e","2acda6ddcd8fecf5d922259b43d20556b7a5982a876ae50df68d09d3dae0d066","6dc87438c968c8d530372fb3c777bab94dd69e4186474380eef0d8b31176f136","34602ec363f0fe18ae324ff46d523819d65d38dd989fa0640a01fbfd3673f797","09b5e780227caa97a042be17450ead0242fd7f58f513158e26678c811d67e264","e6665cdbad676582b7dd959d6893738e1be3c5fa4698af99b5a081fca9918497","09aa9a74d7488a5a26ddf29305b40282a3ab3645f75e09a74365560bb5ece4dd","b7be5e44c1ab0ef4ebd3b43c19ef61809beaba5eb92f6cf2667bf7652cea326b","bcfc72748479693b517a0825f174629a465832e1030c54da9e09a6fdcb01b708")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring64 NOT NULL AND customstring64 IN ("556d3dcea423e658a53cdbd43cde2ddd1c29590706f926b4d8f210c4f17b4670","ff2b734ec870927a19bf61106cd2f2383ec66e79c1bce369fbd1fb234527b888","b2b953bb7424b73af385615ceece9742f75f3954b81b30163402b15bada8c18e","2acda6ddcd8fecf5d922259b43d20556b7a5982a876ae50df68d09d3dae0d066","6dc87438c968c8d530372fb3c777bab94dd69e4186474380eef0d8b31176f136","34602ec363f0fe18ae324ff46d523819d65d38dd989fa0640a01fbfd3673f797","09b5e780227caa97a042be17450ead0242fd7f58f513158e26678c811d67e264","e6665cdbad676582b7dd959d6893738e1be3c5fa4698af99b5a081fca9918497","09aa9a74d7488a5a26ddf29305b40282a3ab3645f75e09a74365560bb5ece4dd","b7be5e44c1ab0ef4ebd3b43c19ef61809beaba5eb92f6cf2667bf7652cea326b","bcfc72748479693b517a0825f174629a465832e1030c54da9e09a6fdcb01b708")
index=activity AND rg_functionality="Web Application Firewall" AND filehash NOT NULL AND filehash IN ("556d3dcea423e658a53cdbd43cde2ddd1c29590706f926b4d8f210c4f17b4670","ff2b734ec870927a19bf61106cd2f2383ec66e79c1bce369fbd1fb234527b888","b2b953bb7424b73af385615ceece9742f75f3954b81b30163402b15bada8c18e","2acda6ddcd8fecf5d922259b43d20556b7a5982a876ae50df68d09d3dae0d066","6dc87438c968c8d530372fb3c777bab94dd69e4186474380eef0d8b31176f136","34602ec363f0fe18ae324ff46d523819d65d38dd989fa0640a01fbfd3673f797","09b5e780227caa97a042be17450ead0242fd7f58f513158e26678c811d67e264","e6665cdbad676582b7dd959d6893738e1be3c5fa4698af99b5a081fca9918497","09aa9a74d7488a5a26ddf29305b40282a3ab3645f75e09a74365560bb5ece4dd","b7be5e44c1ab0ef4ebd3b43c19ef61809beaba5eb92f6cf2667bf7652cea326b","bcfc72748479693b517a0825f174629a465832e1030c54da9e09a6fdcb01b708")
index=activity AND rg_functionality="Web Application Firewall" AND oldfilehash NOT NULL AND oldfilehash IN ("556d3dcea423e658a53cdbd43cde2ddd1c29590706f926b4d8f210c4f17b4670","ff2b734ec870927a19bf61106cd2f2383ec66e79c1bce369fbd1fb234527b888","b2b953bb7424b73af385615ceece9742f75f3954b81b30163402b15bada8c18e","2acda6ddcd8fecf5d922259b43d20556b7a5982a876ae50df68d09d3dae0d066","6dc87438c968c8d530372fb3c777bab94dd69e4186474380eef0d8b31176f136","34602ec363f0fe18ae324ff46d523819d65d38dd989fa0640a01fbfd3673f797","09b5e780227caa97a042be17450ead0242fd7f58f513158e26678c811d67e264","e6665cdbad676582b7dd959d6893738e1be3c5fa4698af99b5a081fca9918497","09aa9a74d7488a5a26ddf29305b40282a3ab3645f75e09a74365560bb5ece4dd","b7be5e44c1ab0ef4ebd3b43c19ef61809beaba5eb92f6cf2667bf7652cea326b","bcfc72748479693b517a0825f174629a465832e1030c54da9e09a6fdcb01b708")
index=activity AND rg_functionality="Web Application Firewall" AND customstring3 NOT NULL AND customstring3 IN ("556d3dcea423e658a53cdbd43cde2ddd1c29590706f926b4d8f210c4f17b4670","ff2b734ec870927a19bf61106cd2f2383ec66e79c1bce369fbd1fb234527b888","b2b953bb7424b73af385615ceece9742f75f3954b81b30163402b15bada8c18e","2acda6ddcd8fecf5d922259b43d20556b7a5982a876ae50df68d09d3dae0d066","6dc87438c968c8d530372fb3c777bab94dd69e4186474380eef0d8b31176f136","34602ec363f0fe18ae324ff46d523819d65d38dd989fa0640a01fbfd3673f797","09b5e780227caa97a042be17450ead0242fd7f58f513158e26678c811d67e264","e6665cdbad676582b7dd959d6893738e1be3c5fa4698af99b5a081fca9918497","09aa9a74d7488a5a26ddf29305b40282a3ab3645f75e09a74365560bb5ece4dd","b7be5e44c1ab0ef4ebd3b43c19ef61809beaba5eb92f6cf2667bf7652cea326b","bcfc72748479693b517a0825f174629a465832e1030c54da9e09a6fdcb01b708")
index=activity AND rg_functionality="Web Application Firewall" AND customstring64 NOT NULL AND customstring64 IN ("556d3dcea423e658a53cdbd43cde2ddd1c29590706f926b4d8f210c4f17b4670","ff2b734ec870927a19bf61106cd2f2383ec66e79c1bce369fbd1fb234527b888","b2b953bb7424b73af385615ceece9742f75f3954b81b30163402b15bada8c18e","2acda6ddcd8fecf5d922259b43d20556b7a5982a876ae50df68d09d3dae0d066","6dc87438c968c8d530372fb3c777bab94dd69e4186474380eef0d8b31176f136","34602ec363f0fe18ae324ff46d523819d65d38dd989fa0640a01fbfd3673f797","09b5e780227caa97a042be17450ead0242fd7f58f513158e26678c811d67e264","e6665cdbad676582b7dd959d6893738e1be3c5fa4698af99b5a081fca9918497","09aa9a74d7488a5a26ddf29305b40282a3ab3645f75e09a74365560bb5ece4dd","b7be5e44c1ab0ef4ebd3b43c19ef61809beaba5eb92f6cf2667bf7652cea326b","bcfc72748479693b517a0825f174629a465832e1030c54da9e09a6fdcb01b708")
index=activity AND rg_functionality="Endpoint management systems" AND filehash NOT NULL AND filehash IN ("556d3dcea423e658a53cdbd43cde2ddd1c29590706f926b4d8f210c4f17b4670","ff2b734ec870927a19bf61106cd2f2383ec66e79c1bce369fbd1fb234527b888","b2b953bb7424b73af385615ceece9742f75f3954b81b30163402b15bada8c18e","2acda6ddcd8fecf5d922259b43d20556b7a5982a876ae50df68d09d3dae0d066","6dc87438c968c8d530372fb3c777bab94dd69e4186474380eef0d8b31176f136","34602ec363f0fe18ae324ff46d523819d65d38dd989fa0640a01fbfd3673f797","09b5e780227caa97a042be17450ead0242fd7f58f513158e26678c811d67e264","e6665cdbad676582b7dd959d6893738e1be3c5fa4698af99b5a081fca9918497","09aa9a74d7488a5a26ddf29305b40282a3ab3645f75e09a74365560bb5ece4dd","b7be5e44c1ab0ef4ebd3b43c19ef61809beaba5eb92f6cf2667bf7652cea326b","bcfc72748479693b517a0825f174629a465832e1030c54da9e09a6fdcb01b708")
index=activity AND rg_functionality="Endpoint management systems" AND oldfilehash NOT NULL AND oldfilehash IN ("556d3dcea423e658a53cdbd43cde2ddd1c29590706f926b4d8f210c4f17b4670","ff2b734ec870927a19bf61106cd2f2383ec66e79c1bce369fbd1fb234527b888","b2b953bb7424b73af385615ceece9742f75f3954b81b30163402b15bada8c18e","2acda6ddcd8fecf5d922259b43d20556b7a5982a876ae50df68d09d3dae0d066","6dc87438c968c8d530372fb3c777bab94dd69e4186474380eef0d8b31176f136","34602ec363f0fe18ae324ff46d523819d65d38dd989fa0640a01fbfd3673f797","09b5e780227caa97a042be17450ead0242fd7f58f513158e26678c811d67e264","e6665cdbad676582b7dd959d6893738e1be3c5fa4698af99b5a081fca9918497","09aa9a74d7488a5a26ddf29305b40282a3ab3645f75e09a74365560bb5ece4dd","b7be5e44c1ab0ef4ebd3b43c19ef61809beaba5eb92f6cf2667bf7652cea326b","bcfc72748479693b517a0825f174629a465832e1030c54da9e09a6fdcb01b708")
index=activity AND rg_functionality="Endpoint management systems" AND customstring3 NOT NULL AND customstring3 IN ("556d3dcea423e658a53cdbd43cde2ddd1c29590706f926b4d8f210c4f17b4670","ff2b734ec870927a19bf61106cd2f2383ec66e79c1bce369fbd1fb234527b888","b2b953bb7424b73af385615ceece9742f75f3954b81b30163402b15bada8c18e","2acda6ddcd8fecf5d922259b43d20556b7a5982a876ae50df68d09d3dae0d066","6dc87438c968c8d530372fb3c777bab94dd69e4186474380eef0d8b31176f136","34602ec363f0fe18ae324ff46d523819d65d38dd989fa0640a01fbfd3673f797","09b5e780227caa97a042be17450ead0242fd7f58f513158e26678c811d67e264","e6665cdbad676582b7dd959d6893738e1be3c5fa4698af99b5a081fca9918497","09aa9a74d7488a5a26ddf29305b40282a3ab3645f75e09a74365560bb5ece4dd","b7be5e44c1ab0ef4ebd3b43c19ef61809beaba5eb92f6cf2667bf7652cea326b","bcfc72748479693b517a0825f174629a465832e1030c54da9e09a6fdcb01b708")
index=activity AND rg_functionality="Endpoint management systems" AND customstring64 NOT NULL AND customstring64 IN ("556d3dcea423e658a53cdbd43cde2ddd1c29590706f926b4d8f210c4f17b4670","ff2b734ec870927a19bf61106cd2f2383ec66e79c1bce369fbd1fb234527b888","b2b953bb7424b73af385615ceece9742f75f3954b81b30163402b15bada8c18e","2acda6ddcd8fecf5d922259b43d20556b7a5982a876ae50df68d09d3dae0d066","6dc87438c968c8d530372fb3c777bab94dd69e4186474380eef0d8b31176f136","34602ec363f0fe18ae324ff46d523819d65d38dd989fa0640a01fbfd3673f797","09b5e780227caa97a042be17450ead0242fd7f58f513158e26678c811d67e264","e6665cdbad676582b7dd959d6893738e1be3c5fa4698af99b5a081fca9918497","09aa9a74d7488a5a26ddf29305b40282a3ab3645f75e09a74365560bb5ece4dd","b7be5e44c1ab0ef4ebd3b43c19ef61809beaba5eb92f6cf2667bf7652cea326b","bcfc72748479693b517a0825f174629a465832e1030c54da9e09a6fdcb01b708")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("556d3dcea423e658a53cdbd43cde2ddd1c29590706f926b4d8f210c4f17b4670","ff2b734ec870927a19bf61106cd2f2383ec66e79c1bce369fbd1fb234527b888","b2b953bb7424b73af385615ceece9742f75f3954b81b30163402b15bada8c18e","2acda6ddcd8fecf5d922259b43d20556b7a5982a876ae50df68d09d3dae0d066","6dc87438c968c8d530372fb3c777bab94dd69e4186474380eef0d8b31176f136","34602ec363f0fe18ae324ff46d523819d65d38dd989fa0640a01fbfd3673f797","09b5e780227caa97a042be17450ead0242fd7f58f513158e26678c811d67e264","e6665cdbad676582b7dd959d6893738e1be3c5fa4698af99b5a081fca9918497","09aa9a74d7488a5a26ddf29305b40282a3ab3645f75e09a74365560bb5ece4dd","b7be5e44c1ab0ef4ebd3b43c19ef61809beaba5eb92f6cf2667bf7652cea326b","bcfc72748479693b517a0825f174629a465832e1030c54da9e09a6fdcb01b708")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("556d3dcea423e658a53cdbd43cde2ddd1c29590706f926b4d8f210c4f17b4670","ff2b734ec870927a19bf61106cd2f2383ec66e79c1bce369fbd1fb234527b888","b2b953bb7424b73af385615ceece9742f75f3954b81b30163402b15bada8c18e","2acda6ddcd8fecf5d922259b43d20556b7a5982a876ae50df68d09d3dae0d066","6dc87438c968c8d530372fb3c777bab94dd69e4186474380eef0d8b31176f136","34602ec363f0fe18ae324ff46d523819d65d38dd989fa0640a01fbfd3673f797","09b5e780227caa97a042be17450ead0242fd7f58f513158e26678c811d67e264","e6665cdbad676582b7dd959d6893738e1be3c5fa4698af99b5a081fca9918497","09aa9a74d7488a5a26ddf29305b40282a3ab3645f75e09a74365560bb5ece4dd","b7be5e44c1ab0ef4ebd3b43c19ef61809beaba5eb92f6cf2667bf7652cea326b","bcfc72748479693b517a0825f174629a465832e1030c54da9e09a6fdcb01b708")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("556d3dcea423e658a53cdbd43cde2ddd1c29590706f926b4d8f210c4f17b4670","ff2b734ec870927a19bf61106cd2f2383ec66e79c1bce369fbd1fb234527b888","b2b953bb7424b73af385615ceece9742f75f3954b81b30163402b15bada8c18e","2acda6ddcd8fecf5d922259b43d20556b7a5982a876ae50df68d09d3dae0d066","6dc87438c968c8d530372fb3c777bab94dd69e4186474380eef0d8b31176f136","34602ec363f0fe18ae324ff46d523819d65d38dd989fa0640a01fbfd3673f797","09b5e780227caa97a042be17450ead0242fd7f58f513158e26678c811d67e264","e6665cdbad676582b7dd959d6893738e1be3c5fa4698af99b5a081fca9918497","09aa9a74d7488a5a26ddf29305b40282a3ab3645f75e09a74365560bb5ece4dd","b7be5e44c1ab0ef4ebd3b43c19ef61809beaba5eb92f6cf2667bf7652cea326b","bcfc72748479693b517a0825f174629a465832e1030c54da9e09a6fdcb01b708")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring64 NOT NULL AND customstring64 IN ("556d3dcea423e658a53cdbd43cde2ddd1c29590706f926b4d8f210c4f17b4670","ff2b734ec870927a19bf61106cd2f2383ec66e79c1bce369fbd1fb234527b888","b2b953bb7424b73af385615ceece9742f75f3954b81b30163402b15bada8c18e","2acda6ddcd8fecf5d922259b43d20556b7a5982a876ae50df68d09d3dae0d066","6dc87438c968c8d530372fb3c777bab94dd69e4186474380eef0d8b31176f136","34602ec363f0fe18ae324ff46d523819d65d38dd989fa0640a01fbfd3673f797","09b5e780227caa97a042be17450ead0242fd7f58f513158e26678c811d67e264","e6665cdbad676582b7dd959d6893738e1be3c5fa4698af99b5a081fca9918497","09aa9a74d7488a5a26ddf29305b40282a3ab3645f75e09a74365560bb5ece4dd","b7be5e44c1ab0ef4ebd3b43c19ef61809beaba5eb92f6cf2667bf7652cea326b","bcfc72748479693b517a0825f174629a465832e1030c54da9e09a6fdcb01b708")
index=activity AND rg_functionality="Cloud Application Audit" AND filehash NOT NULL AND filehash IN ("556d3dcea423e658a53cdbd43cde2ddd1c29590706f926b4d8f210c4f17b4670","ff2b734ec870927a19bf61106cd2f2383ec66e79c1bce369fbd1fb234527b888","b2b953bb7424b73af385615ceece9742f75f3954b81b30163402b15bada8c18e","2acda6ddcd8fecf5d922259b43d20556b7a5982a876ae50df68d09d3dae0d066","6dc87438c968c8d530372fb3c777bab94dd69e4186474380eef0d8b31176f136","34602ec363f0fe18ae324ff46d523819d65d38dd989fa0640a01fbfd3673f797","09b5e780227caa97a042be17450ead0242fd7f58f513158e26678c811d67e264","e6665cdbad676582b7dd959d6893738e1be3c5fa4698af99b5a081fca9918497","09aa9a74d7488a5a26ddf29305b40282a3ab3645f75e09a74365560bb5ece4dd","b7be5e44c1ab0ef4ebd3b43c19ef61809beaba5eb92f6cf2667bf7652cea326b","bcfc72748479693b517a0825f174629a465832e1030c54da9e09a6fdcb01b708")
index=activity AND rg_functionality="Cloud Application Audit" AND oldfilehash NOT NULL AND oldfilehash IN ("556d3dcea423e658a53cdbd43cde2ddd1c29590706f926b4d8f210c4f17b4670","ff2b734ec870927a19bf61106cd2f2383ec66e79c1bce369fbd1fb234527b888","b2b953bb7424b73af385615ceece9742f75f3954b81b30163402b15bada8c18e","2acda6ddcd8fecf5d922259b43d20556b7a5982a876ae50df68d09d3dae0d066","6dc87438c968c8d530372fb3c777bab94dd69e4186474380eef0d8b31176f136","34602ec363f0fe18ae324ff46d523819d65d38dd989fa0640a01fbfd3673f797","09b5e780227caa97a042be17450ead0242fd7f58f513158e26678c811d67e264","e6665cdbad676582b7dd959d6893738e1be3c5fa4698af99b5a081fca9918497","09aa9a74d7488a5a26ddf29305b40282a3ab3645f75e09a74365560bb5ece4dd","b7be5e44c1ab0ef4ebd3b43c19ef61809beaba5eb92f6cf2667bf7652cea326b","bcfc72748479693b517a0825f174629a465832e1030c54da9e09a6fdcb01b708")
index=activity AND rg_functionality="Cloud Application Audit" AND customstring3 NOT NULL AND customstring3 IN ("556d3dcea423e658a53cdbd43cde2ddd1c29590706f926b4d8f210c4f17b4670","ff2b734ec870927a19bf61106cd2f2383ec66e79c1bce369fbd1fb234527b888","b2b953bb7424b73af385615ceece9742f75f3954b81b30163402b15bada8c18e","2acda6ddcd8fecf5d922259b43d20556b7a5982a876ae50df68d09d3dae0d066","6dc87438c968c8d530372fb3c777bab94dd69e4186474380eef0d8b31176f136","34602ec363f0fe18ae324ff46d523819d65d38dd989fa0640a01fbfd3673f797","09b5e780227caa97a042be17450ead0242fd7f58f513158e26678c811d67e264","e6665cdbad676582b7dd959d6893738e1be3c5fa4698af99b5a081fca9918497","09aa9a74d7488a5a26ddf29305b40282a3ab3645f75e09a74365560bb5ece4dd","b7be5e44c1ab0ef4ebd3b43c19ef61809beaba5eb92f6cf2667bf7652cea326b","bcfc72748479693b517a0825f174629a465832e1030c54da9e09a6fdcb01b708")
index=activity AND rg_functionality="Cloud Application Audit" AND customstring64 NOT NULL AND customstring64 IN ("556d3dcea423e658a53cdbd43cde2ddd1c29590706f926b4d8f210c4f17b4670","ff2b734ec870927a19bf61106cd2f2383ec66e79c1bce369fbd1fb234527b888","b2b953bb7424b73af385615ceece9742f75f3954b81b30163402b15bada8c18e","2acda6ddcd8fecf5d922259b43d20556b7a5982a876ae50df68d09d3dae0d066","6dc87438c968c8d530372fb3c777bab94dd69e4186474380eef0d8b31176f136","34602ec363f0fe18ae324ff46d523819d65d38dd989fa0640a01fbfd3673f797","09b5e780227caa97a042be17450ead0242fd7f58f513158e26678c811d67e264","e6665cdbad676582b7dd959d6893738e1be3c5fa4698af99b5a081fca9918497","09aa9a74d7488a5a26ddf29305b40282a3ab3645f75e09a74365560bb5ece4dd","b7be5e44c1ab0ef4ebd3b43c19ef61809beaba5eb92f6cf2667bf7652cea326b","bcfc72748479693b517a0825f174629a465832e1030c54da9e09a6fdcb01b708")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND filehash NOT NULL AND filehash IN ("556d3dcea423e658a53cdbd43cde2ddd1c29590706f926b4d8f210c4f17b4670","ff2b734ec870927a19bf61106cd2f2383ec66e79c1bce369fbd1fb234527b888","b2b953bb7424b73af385615ceece9742f75f3954b81b30163402b15bada8c18e","2acda6ddcd8fecf5d922259b43d20556b7a5982a876ae50df68d09d3dae0d066","6dc87438c968c8d530372fb3c777bab94dd69e4186474380eef0d8b31176f136","34602ec363f0fe18ae324ff46d523819d65d38dd989fa0640a01fbfd3673f797","09b5e780227caa97a042be17450ead0242fd7f58f513158e26678c811d67e264","e6665cdbad676582b7dd959d6893738e1be3c5fa4698af99b5a081fca9918497","09aa9a74d7488a5a26ddf29305b40282a3ab3645f75e09a74365560bb5ece4dd","b7be5e44c1ab0ef4ebd3b43c19ef61809beaba5eb92f6cf2667bf7652cea326b","bcfc72748479693b517a0825f174629a465832e1030c54da9e09a6fdcb01b708")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND oldfilehash NOT NULL AND oldfilehash IN ("556d3dcea423e658a53cdbd43cde2ddd1c29590706f926b4d8f210c4f17b4670","ff2b734ec870927a19bf61106cd2f2383ec66e79c1bce369fbd1fb234527b888","b2b953bb7424b73af385615ceece9742f75f3954b81b30163402b15bada8c18e","2acda6ddcd8fecf5d922259b43d20556b7a5982a876ae50df68d09d3dae0d066","6dc87438c968c8d530372fb3c777bab94dd69e4186474380eef0d8b31176f136","34602ec363f0fe18ae324ff46d523819d65d38dd989fa0640a01fbfd3673f797","09b5e780227caa97a042be17450ead0242fd7f58f513158e26678c811d67e264","e6665cdbad676582b7dd959d6893738e1be3c5fa4698af99b5a081fca9918497","09aa9a74d7488a5a26ddf29305b40282a3ab3645f75e09a74365560bb5ece4dd","b7be5e44c1ab0ef4ebd3b43c19ef61809beaba5eb92f6cf2667bf7652cea326b","bcfc72748479693b517a0825f174629a465832e1030c54da9e09a6fdcb01b708")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND customstring3 NOT NULL AND customstring3 IN ("556d3dcea423e658a53cdbd43cde2ddd1c29590706f926b4d8f210c4f17b4670","ff2b734ec870927a19bf61106cd2f2383ec66e79c1bce369fbd1fb234527b888","b2b953bb7424b73af385615ceece9742f75f3954b81b30163402b15bada8c18e","2acda6ddcd8fecf5d922259b43d20556b7a5982a876ae50df68d09d3dae0d066","6dc87438c968c8d530372fb3c777bab94dd69e4186474380eef0d8b31176f136","34602ec363f0fe18ae324ff46d523819d65d38dd989fa0640a01fbfd3673f797","09b5e780227caa97a042be17450ead0242fd7f58f513158e26678c811d67e264","e6665cdbad676582b7dd959d6893738e1be3c5fa4698af99b5a081fca9918497","09aa9a74d7488a5a26ddf29305b40282a3ab3645f75e09a74365560bb5ece4dd","b7be5e44c1ab0ef4ebd3b43c19ef61809beaba5eb92f6cf2667bf7652cea326b","bcfc72748479693b517a0825f174629a465832e1030c54da9e09a6fdcb01b708")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND customstring64 NOT NULL AND customstring64 IN ("556d3dcea423e658a53cdbd43cde2ddd1c29590706f926b4d8f210c4f17b4670","ff2b734ec870927a19bf61106cd2f2383ec66e79c1bce369fbd1fb234527b888","b2b953bb7424b73af385615ceece9742f75f3954b81b30163402b15bada8c18e","2acda6ddcd8fecf5d922259b43d20556b7a5982a876ae50df68d09d3dae0d066","6dc87438c968c8d530372fb3c777bab94dd69e4186474380eef0d8b31176f136","34602ec363f0fe18ae324ff46d523819d65d38dd989fa0640a01fbfd3673f797","09b5e780227caa97a042be17450ead0242fd7f58f513158e26678c811d67e264","e6665cdbad676582b7dd959d6893738e1be3c5fa4698af99b5a081fca9918497","09aa9a74d7488a5a26ddf29305b40282a3ab3645f75e09a74365560bb5ece4dd","b7be5e44c1ab0ef4ebd3b43c19ef61809beaba5eb92f6cf2667bf7652cea326b","bcfc72748479693b517a0825f174629a465832e1030c54da9e09a6fdcb01b708")
index=activity AND rg_functionality="Unix / Linux / AIX" AND filehash NOT NULL AND filehash IN ("556d3dcea423e658a53cdbd43cde2ddd1c29590706f926b4d8f210c4f17b4670","ff2b734ec870927a19bf61106cd2f2383ec66e79c1bce369fbd1fb234527b888","b2b953bb7424b73af385615ceece9742f75f3954b81b30163402b15bada8c18e","2acda6ddcd8fecf5d922259b43d20556b7a5982a876ae50df68d09d3dae0d066","6dc87438c968c8d530372fb3c777bab94dd69e4186474380eef0d8b31176f136","34602ec363f0fe18ae324ff46d523819d65d38dd989fa0640a01fbfd3673f797","09b5e780227caa97a042be17450ead0242fd7f58f513158e26678c811d67e264","e6665cdbad676582b7dd959d6893738e1be3c5fa4698af99b5a081fca9918497","09aa9a74d7488a5a26ddf29305b40282a3ab3645f75e09a74365560bb5ece4dd","b7be5e44c1ab0ef4ebd3b43c19ef61809beaba5eb92f6cf2667bf7652cea326b","bcfc72748479693b517a0825f174629a465832e1030c54da9e09a6fdcb01b708")
index=activity AND rg_functionality="Unix / Linux / AIX" AND oldfilehash NOT NULL AND oldfilehash IN ("556d3dcea423e658a53cdbd43cde2ddd1c29590706f926b4d8f210c4f17b4670","ff2b734ec870927a19bf61106cd2f2383ec66e79c1bce369fbd1fb234527b888","b2b953bb7424b73af385615ceece9742f75f3954b81b30163402b15bada8c18e","2acda6ddcd8fecf5d922259b43d20556b7a5982a876ae50df68d09d3dae0d066","6dc87438c968c8d530372fb3c777bab94dd69e4186474380eef0d8b31176f136","34602ec363f0fe18ae324ff46d523819d65d38dd989fa0640a01fbfd3673f797","09b5e780227caa97a042be17450ead0242fd7f58f513158e26678c811d67e264","e6665cdbad676582b7dd959d6893738e1be3c5fa4698af99b5a081fca9918497","09aa9a74d7488a5a26ddf29305b40282a3ab3645f75e09a74365560bb5ece4dd","b7be5e44c1ab0ef4ebd3b43c19ef61809beaba5eb92f6cf2667bf7652cea326b","bcfc72748479693b517a0825f174629a465832e1030c54da9e09a6fdcb01b708")
index=activity AND rg_functionality="Unix / Linux / AIX" AND customstring3 NOT NULL AND customstring3 IN ("556d3dcea423e658a53cdbd43cde2ddd1c29590706f926b4d8f210c4f17b4670","ff2b734ec870927a19bf61106cd2f2383ec66e79c1bce369fbd1fb234527b888","b2b953bb7424b73af385615ceece9742f75f3954b81b30163402b15bada8c18e","2acda6ddcd8fecf5d922259b43d20556b7a5982a876ae50df68d09d3dae0d066","6dc87438c968c8d530372fb3c777bab94dd69e4186474380eef0d8b31176f136","34602ec363f0fe18ae324ff46d523819d65d38dd989fa0640a01fbfd3673f797","09b5e780227caa97a042be17450ead0242fd7f58f513158e26678c811d67e264","e6665cdbad676582b7dd959d6893738e1be3c5fa4698af99b5a081fca9918497","09aa9a74d7488a5a26ddf29305b40282a3ab3645f75e09a74365560bb5ece4dd","b7be5e44c1ab0ef4ebd3b43c19ef61809beaba5eb92f6cf2667bf7652cea326b","bcfc72748479693b517a0825f174629a465832e1030c54da9e09a6fdcb01b708")
index=activity AND rg_functionality="Unix / Linux / AIX" AND customstring64 NOT NULL AND customstring64 IN ("556d3dcea423e658a53cdbd43cde2ddd1c29590706f926b4d8f210c4f17b4670","ff2b734ec870927a19bf61106cd2f2383ec66e79c1bce369fbd1fb234527b888","b2b953bb7424b73af385615ceece9742f75f3954b81b30163402b15bada8c18e","2acda6ddcd8fecf5d922259b43d20556b7a5982a876ae50df68d09d3dae0d066","6dc87438c968c8d530372fb3c777bab94dd69e4186474380eef0d8b31176f136","34602ec363f0fe18ae324ff46d523819d65d38dd989fa0640a01fbfd3673f797","09b5e780227caa97a042be17450ead0242fd7f58f513158e26678c811d67e264","e6665cdbad676582b7dd959d6893738e1be3c5fa4698af99b5a081fca9918497","09aa9a74d7488a5a26ddf29305b40282a3ab3645f75e09a74365560bb5ece4dd","b7be5e44c1ab0ef4ebd3b43c19ef61809beaba5eb92f6cf2667bf7652cea326b","bcfc72748479693b517a0825f174629a465832e1030c54da9e09a6fdcb01b708")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND filehash NOT NULL AND filehash IN ("556d3dcea423e658a53cdbd43cde2ddd1c29590706f926b4d8f210c4f17b4670","ff2b734ec870927a19bf61106cd2f2383ec66e79c1bce369fbd1fb234527b888","b2b953bb7424b73af385615ceece9742f75f3954b81b30163402b15bada8c18e","2acda6ddcd8fecf5d922259b43d20556b7a5982a876ae50df68d09d3dae0d066","6dc87438c968c8d530372fb3c777bab94dd69e4186474380eef0d8b31176f136","34602ec363f0fe18ae324ff46d523819d65d38dd989fa0640a01fbfd3673f797","09b5e780227caa97a042be17450ead0242fd7f58f513158e26678c811d67e264","e6665cdbad676582b7dd959d6893738e1be3c5fa4698af99b5a081fca9918497","09aa9a74d7488a5a26ddf29305b40282a3ab3645f75e09a74365560bb5ece4dd","b7be5e44c1ab0ef4ebd3b43c19ef61809beaba5eb92f6cf2667bf7652cea326b","bcfc72748479693b517a0825f174629a465832e1030c54da9e09a6fdcb01b708")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND oldfilehash NOT NULL AND oldfilehash IN ("556d3dcea423e658a53cdbd43cde2ddd1c29590706f926b4d8f210c4f17b4670","ff2b734ec870927a19bf61106cd2f2383ec66e79c1bce369fbd1fb234527b888","b2b953bb7424b73af385615ceece9742f75f3954b81b30163402b15bada8c18e","2acda6ddcd8fecf5d922259b43d20556b7a5982a876ae50df68d09d3dae0d066","6dc87438c968c8d530372fb3c777bab94dd69e4186474380eef0d8b31176f136","34602ec363f0fe18ae324ff46d523819d65d38dd989fa0640a01fbfd3673f797","09b5e780227caa97a042be17450ead0242fd7f58f513158e26678c811d67e264","e6665cdbad676582b7dd959d6893738e1be3c5fa4698af99b5a081fca9918497","09aa9a74d7488a5a26ddf29305b40282a3ab3645f75e09a74365560bb5ece4dd","b7be5e44c1ab0ef4ebd3b43c19ef61809beaba5eb92f6cf2667bf7652cea326b","bcfc72748479693b517a0825f174629a465832e1030c54da9e09a6fdcb01b708")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND customstring3 NOT NULL AND customstring3 IN ("556d3dcea423e658a53cdbd43cde2ddd1c29590706f926b4d8f210c4f17b4670","ff2b734ec870927a19bf61106cd2f2383ec66e79c1bce369fbd1fb234527b888","b2b953bb7424b73af385615ceece9742f75f3954b81b30163402b15bada8c18e","2acda6ddcd8fecf5d922259b43d20556b7a5982a876ae50df68d09d3dae0d066","6dc87438c968c8d530372fb3c777bab94dd69e4186474380eef0d8b31176f136","34602ec363f0fe18ae324ff46d523819d65d38dd989fa0640a01fbfd3673f797","09b5e780227caa97a042be17450ead0242fd7f58f513158e26678c811d67e264","e6665cdbad676582b7dd959d6893738e1be3c5fa4698af99b5a081fca9918497","09aa9a74d7488a5a26ddf29305b40282a3ab3645f75e09a74365560bb5ece4dd","b7be5e44c1ab0ef4ebd3b43c19ef61809beaba5eb92f6cf2667bf7652cea326b","bcfc72748479693b517a0825f174629a465832e1030c54da9e09a6fdcb01b708")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND customstring64 NOT NULL AND customstring64 IN ("556d3dcea423e658a53cdbd43cde2ddd1c29590706f926b4d8f210c4f17b4670","ff2b734ec870927a19bf61106cd2f2383ec66e79c1bce369fbd1fb234527b888","b2b953bb7424b73af385615ceece9742f75f3954b81b30163402b15bada8c18e","2acda6ddcd8fecf5d922259b43d20556b7a5982a876ae50df68d09d3dae0d066","6dc87438c968c8d530372fb3c777bab94dd69e4186474380eef0d8b31176f136","34602ec363f0fe18ae324ff46d523819d65d38dd989fa0640a01fbfd3673f797","09b5e780227caa97a042be17450ead0242fd7f58f513158e26678c811d67e264","e6665cdbad676582b7dd959d6893738e1be3c5fa4698af99b5a081fca9918497","09aa9a74d7488a5a26ddf29305b40282a3ab3645f75e09a74365560bb5ece4dd","b7be5e44c1ab0ef4ebd3b43c19ef61809beaba5eb92f6cf2667bf7652cea326b","bcfc72748479693b517a0825f174629a465832e1030c54da9e09a6fdcb01b708")
index=activity AND rg_functionality="Cloud Application Security Broker" AND filehash NOT NULL AND filehash IN ("556d3dcea423e658a53cdbd43cde2ddd1c29590706f926b4d8f210c4f17b4670","ff2b734ec870927a19bf61106cd2f2383ec66e79c1bce369fbd1fb234527b888","b2b953bb7424b73af385615ceece9742f75f3954b81b30163402b15bada8c18e","2acda6ddcd8fecf5d922259b43d20556b7a5982a876ae50df68d09d3dae0d066","6dc87438c968c8d530372fb3c777bab94dd69e4186474380eef0d8b31176f136","34602ec363f0fe18ae324ff46d523819d65d38dd989fa0640a01fbfd3673f797","09b5e780227caa97a042be17450ead0242fd7f58f513158e26678c811d67e264","e6665cdbad676582b7dd959d6893738e1be3c5fa4698af99b5a081fca9918497","09aa9a74d7488a5a26ddf29305b40282a3ab3645f75e09a74365560bb5ece4dd","b7be5e44c1ab0ef4ebd3b43c19ef61809beaba5eb92f6cf2667bf7652cea326b","bcfc72748479693b517a0825f174629a465832e1030c54da9e09a6fdcb01b708")
index=activity AND rg_functionality="Cloud Application Security Broker" AND oldfilehash NOT NULL AND oldfilehash IN ("556d3dcea423e658a53cdbd43cde2ddd1c29590706f926b4d8f210c4f17b4670","ff2b734ec870927a19bf61106cd2f2383ec66e79c1bce369fbd1fb234527b888","b2b953bb7424b73af385615ceece9742f75f3954b81b30163402b15bada8c18e","2acda6ddcd8fecf5d922259b43d20556b7a5982a876ae50df68d09d3dae0d066","6dc87438c968c8d530372fb3c777bab94dd69e4186474380eef0d8b31176f136","34602ec363f0fe18ae324ff46d523819d65d38dd989fa0640a01fbfd3673f797","09b5e780227caa97a042be17450ead0242fd7f58f513158e26678c811d67e264","e6665cdbad676582b7dd959d6893738e1be3c5fa4698af99b5a081fca9918497","09aa9a74d7488a5a26ddf29305b40282a3ab3645f75e09a74365560bb5ece4dd","b7be5e44c1ab0ef4ebd3b43c19ef61809beaba5eb92f6cf2667bf7652cea326b","bcfc72748479693b517a0825f174629a465832e1030c54da9e09a6fdcb01b708")
index=activity AND rg_functionality="Cloud Application Security Broker" AND customstring3 NOT NULL AND customstring3 IN ("556d3dcea423e658a53cdbd43cde2ddd1c29590706f926b4d8f210c4f17b4670","ff2b734ec870927a19bf61106cd2f2383ec66e79c1bce369fbd1fb234527b888","b2b953bb7424b73af385615ceece9742f75f3954b81b30163402b15bada8c18e","2acda6ddcd8fecf5d922259b43d20556b7a5982a876ae50df68d09d3dae0d066","6dc87438c968c8d530372fb3c777bab94dd69e4186474380eef0d8b31176f136","34602ec363f0fe18ae324ff46d523819d65d38dd989fa0640a01fbfd3673f797","09b5e780227caa97a042be17450ead0242fd7f58f513158e26678c811d67e264","e6665cdbad676582b7dd959d6893738e1be3c5fa4698af99b5a081fca9918497","09aa9a74d7488a5a26ddf29305b40282a3ab3645f75e09a74365560bb5ece4dd","b7be5e44c1ab0ef4ebd3b43c19ef61809beaba5eb92f6cf2667bf7652cea326b","bcfc72748479693b517a0825f174629a465832e1030c54da9e09a6fdcb01b708")
index=activity AND rg_functionality="Cloud Application Security Broker" AND customstring64 NOT NULL AND customstring64 IN ("556d3dcea423e658a53cdbd43cde2ddd1c29590706f926b4d8f210c4f17b4670","ff2b734ec870927a19bf61106cd2f2383ec66e79c1bce369fbd1fb234527b888","b2b953bb7424b73af385615ceece9742f75f3954b81b30163402b15bada8c18e","2acda6ddcd8fecf5d922259b43d20556b7a5982a876ae50df68d09d3dae0d066","6dc87438c968c8d530372fb3c777bab94dd69e4186474380eef0d8b31176f136","34602ec363f0fe18ae324ff46d523819d65d38dd989fa0640a01fbfd3673f797","09b5e780227caa97a042be17450ead0242fd7f58f513158e26678c811d67e264","e6665cdbad676582b7dd959d6893738e1be3c5fa4698af99b5a081fca9918497","09aa9a74d7488a5a26ddf29305b40282a3ab3645f75e09a74365560bb5ece4dd","b7be5e44c1ab0ef4ebd3b43c19ef61809beaba5eb92f6cf2667bf7652cea326b","bcfc72748479693b517a0825f174629a465832e1030c54da9e09a6fdcb01b708")
index=activity AND rg_functionality="Source Code Repository" AND filehash NOT NULL AND filehash IN ("556d3dcea423e658a53cdbd43cde2ddd1c29590706f926b4d8f210c4f17b4670","ff2b734ec870927a19bf61106cd2f2383ec66e79c1bce369fbd1fb234527b888","b2b953bb7424b73af385615ceece9742f75f3954b81b30163402b15bada8c18e","2acda6ddcd8fecf5d922259b43d20556b7a5982a876ae50df68d09d3dae0d066","6dc87438c968c8d530372fb3c777bab94dd69e4186474380eef0d8b31176f136","34602ec363f0fe18ae324ff46d523819d65d38dd989fa0640a01fbfd3673f797","09b5e780227caa97a042be17450ead0242fd7f58f513158e26678c811d67e264","e6665cdbad676582b7dd959d6893738e1be3c5fa4698af99b5a081fca9918497","09aa9a74d7488a5a26ddf29305b40282a3ab3645f75e09a74365560bb5ece4dd","b7be5e44c1ab0ef4ebd3b43c19ef61809beaba5eb92f6cf2667bf7652cea326b","bcfc72748479693b517a0825f174629a465832e1030c54da9e09a6fdcb01b708")
index=activity AND rg_functionality="Source Code Repository" AND oldfilehash NOT NULL AND oldfilehash IN ("556d3dcea423e658a53cdbd43cde2ddd1c29590706f926b4d8f210c4f17b4670","ff2b734ec870927a19bf61106cd2f2383ec66e79c1bce369fbd1fb234527b888","b2b953bb7424b73af385615ceece9742f75f3954b81b30163402b15bada8c18e","2acda6ddcd8fecf5d922259b43d20556b7a5982a876ae50df68d09d3dae0d066","6dc87438c968c8d530372fb3c777bab94dd69e4186474380eef0d8b31176f136","34602ec363f0fe18ae324ff46d523819d65d38dd989fa0640a01fbfd3673f797","09b5e780227caa97a042be17450ead0242fd7f58f513158e26678c811d67e264","e6665cdbad676582b7dd959d6893738e1be3c5fa4698af99b5a081fca9918497","09aa9a74d7488a5a26ddf29305b40282a3ab3645f75e09a74365560bb5ece4dd","b7be5e44c1ab0ef4ebd3b43c19ef61809beaba5eb92f6cf2667bf7652cea326b","bcfc72748479693b517a0825f174629a465832e1030c54da9e09a6fdcb01b708")
index=activity AND rg_functionality="Source Code Repository" AND customstring3 NOT NULL AND customstring3 IN ("556d3dcea423e658a53cdbd43cde2ddd1c29590706f926b4d8f210c4f17b4670","ff2b734ec870927a19bf61106cd2f2383ec66e79c1bce369fbd1fb234527b888","b2b953bb7424b73af385615ceece9742f75f3954b81b30163402b15bada8c18e","2acda6ddcd8fecf5d922259b43d20556b7a5982a876ae50df68d09d3dae0d066","6dc87438c968c8d530372fb3c777bab94dd69e4186474380eef0d8b31176f136","34602ec363f0fe18ae324ff46d523819d65d38dd989fa0640a01fbfd3673f797","09b5e780227caa97a042be17450ead0242fd7f58f513158e26678c811d67e264","e6665cdbad676582b7dd959d6893738e1be3c5fa4698af99b5a081fca9918497","09aa9a74d7488a5a26ddf29305b40282a3ab3645f75e09a74365560bb5ece4dd","b7be5e44c1ab0ef4ebd3b43c19ef61809beaba5eb92f6cf2667bf7652cea326b","bcfc72748479693b517a0825f174629a465832e1030c54da9e09a6fdcb01b708")
index=activity AND rg_functionality="Source Code Repository" AND customstring64 NOT NULL AND customstring64 IN ("556d3dcea423e658a53cdbd43cde2ddd1c29590706f926b4d8f210c4f17b4670","ff2b734ec870927a19bf61106cd2f2383ec66e79c1bce369fbd1fb234527b888","b2b953bb7424b73af385615ceece9742f75f3954b81b30163402b15bada8c18e","2acda6ddcd8fecf5d922259b43d20556b7a5982a876ae50df68d09d3dae0d066","6dc87438c968c8d530372fb3c777bab94dd69e4186474380eef0d8b31176f136","34602ec363f0fe18ae324ff46d523819d65d38dd989fa0640a01fbfd3673f797","09b5e780227caa97a042be17450ead0242fd7f58f513158e26678c811d67e264","e6665cdbad676582b7dd959d6893738e1be3c5fa4698af99b5a081fca9918497","09aa9a74d7488a5a26ddf29305b40282a3ab3645f75e09a74365560bb5ece4dd","b7be5e44c1ab0ef4ebd3b43c19ef61809beaba5eb92f6cf2667bf7652cea326b","bcfc72748479693b517a0825f174629a465832e1030c54da9e09a6fdcb01b708")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("556d3dcea423e658a53cdbd43cde2ddd1c29590706f926b4d8f210c4f17b4670","ff2b734ec870927a19bf61106cd2f2383ec66e79c1bce369fbd1fb234527b888","b2b953bb7424b73af385615ceece9742f75f3954b81b30163402b15bada8c18e","2acda6ddcd8fecf5d922259b43d20556b7a5982a876ae50df68d09d3dae0d066","6dc87438c968c8d530372fb3c777bab94dd69e4186474380eef0d8b31176f136","34602ec363f0fe18ae324ff46d523819d65d38dd989fa0640a01fbfd3673f797","09b5e780227caa97a042be17450ead0242fd7f58f513158e26678c811d67e264","e6665cdbad676582b7dd959d6893738e1be3c5fa4698af99b5a081fca9918497","09aa9a74d7488a5a26ddf29305b40282a3ab3645f75e09a74365560bb5ece4dd","b7be5e44c1ab0ef4ebd3b43c19ef61809beaba5eb92f6cf2667bf7652cea326b","bcfc72748479693b517a0825f174629a465832e1030c54da9e09a6fdcb01b708")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("556d3dcea423e658a53cdbd43cde2ddd1c29590706f926b4d8f210c4f17b4670","ff2b734ec870927a19bf61106cd2f2383ec66e79c1bce369fbd1fb234527b888","b2b953bb7424b73af385615ceece9742f75f3954b81b30163402b15bada8c18e","2acda6ddcd8fecf5d922259b43d20556b7a5982a876ae50df68d09d3dae0d066","6dc87438c968c8d530372fb3c777bab94dd69e4186474380eef0d8b31176f136","34602ec363f0fe18ae324ff46d523819d65d38dd989fa0640a01fbfd3673f797","09b5e780227caa97a042be17450ead0242fd7f58f513158e26678c811d67e264","e6665cdbad676582b7dd959d6893738e1be3c5fa4698af99b5a081fca9918497","09aa9a74d7488a5a26ddf29305b40282a3ab3645f75e09a74365560bb5ece4dd","b7be5e44c1ab0ef4ebd3b43c19ef61809beaba5eb92f6cf2667bf7652cea326b","bcfc72748479693b517a0825f174629a465832e1030c54da9e09a6fdcb01b708")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("556d3dcea423e658a53cdbd43cde2ddd1c29590706f926b4d8f210c4f17b4670","ff2b734ec870927a19bf61106cd2f2383ec66e79c1bce369fbd1fb234527b888","b2b953bb7424b73af385615ceece9742f75f3954b81b30163402b15bada8c18e","2acda6ddcd8fecf5d922259b43d20556b7a5982a876ae50df68d09d3dae0d066","6dc87438c968c8d530372fb3c777bab94dd69e4186474380eef0d8b31176f136","34602ec363f0fe18ae324ff46d523819d65d38dd989fa0640a01fbfd3673f797","09b5e780227caa97a042be17450ead0242fd7f58f513158e26678c811d67e264","e6665cdbad676582b7dd959d6893738e1be3c5fa4698af99b5a081fca9918497","09aa9a74d7488a5a26ddf29305b40282a3ab3645f75e09a74365560bb5ece4dd","b7be5e44c1ab0ef4ebd3b43c19ef61809beaba5eb92f6cf2667bf7652cea326b","bcfc72748479693b517a0825f174629a465832e1030c54da9e09a6fdcb01b708")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("556d3dcea423e658a53cdbd43cde2ddd1c29590706f926b4d8f210c4f17b4670","ff2b734ec870927a19bf61106cd2f2383ec66e79c1bce369fbd1fb234527b888","b2b953bb7424b73af385615ceece9742f75f3954b81b30163402b15bada8c18e","2acda6ddcd8fecf5d922259b43d20556b7a5982a876ae50df68d09d3dae0d066","6dc87438c968c8d530372fb3c777bab94dd69e4186474380eef0d8b31176f136","34602ec363f0fe18ae324ff46d523819d65d38dd989fa0640a01fbfd3673f797","09b5e780227caa97a042be17450ead0242fd7f58f513158e26678c811d67e264","e6665cdbad676582b7dd959d6893738e1be3c5fa4698af99b5a081fca9918497","09aa9a74d7488a5a26ddf29305b40282a3ab3645f75e09a74365560bb5ece4dd","b7be5e44c1ab0ef4ebd3b43c19ef61809beaba5eb92f6cf2667bf7652cea326b","bcfc72748479693b517a0825f174629a465832e1030c54da9e09a6fdcb01b708")
index=activity AND rg_functionality="DNS / DHCP" AND filehash NOT NULL AND filehash IN ("556d3dcea423e658a53cdbd43cde2ddd1c29590706f926b4d8f210c4f17b4670","ff2b734ec870927a19bf61106cd2f2383ec66e79c1bce369fbd1fb234527b888","b2b953bb7424b73af385615ceece9742f75f3954b81b30163402b15bada8c18e","2acda6ddcd8fecf5d922259b43d20556b7a5982a876ae50df68d09d3dae0d066","6dc87438c968c8d530372fb3c777bab94dd69e4186474380eef0d8b31176f136","34602ec363f0fe18ae324ff46d523819d65d38dd989fa0640a01fbfd3673f797","09b5e780227caa97a042be17450ead0242fd7f58f513158e26678c811d67e264","e6665cdbad676582b7dd959d6893738e1be3c5fa4698af99b5a081fca9918497","09aa9a74d7488a5a26ddf29305b40282a3ab3645f75e09a74365560bb5ece4dd","b7be5e44c1ab0ef4ebd3b43c19ef61809beaba5eb92f6cf2667bf7652cea326b","bcfc72748479693b517a0825f174629a465832e1030c54da9e09a6fdcb01b708")
index=activity AND rg_functionality="DNS / DHCP" AND oldfilehash NOT NULL AND oldfilehash IN ("556d3dcea423e658a53cdbd43cde2ddd1c29590706f926b4d8f210c4f17b4670","ff2b734ec870927a19bf61106cd2f2383ec66e79c1bce369fbd1fb234527b888","b2b953bb7424b73af385615ceece9742f75f3954b81b30163402b15bada8c18e","2acda6ddcd8fecf5d922259b43d20556b7a5982a876ae50df68d09d3dae0d066","6dc87438c968c8d530372fb3c777bab94dd69e4186474380eef0d8b31176f136","34602ec363f0fe18ae324ff46d523819d65d38dd989fa0640a01fbfd3673f797","09b5e780227caa97a042be17450ead0242fd7f58f513158e26678c811d67e264","e6665cdbad676582b7dd959d6893738e1be3c5fa4698af99b5a081fca9918497","09aa9a74d7488a5a26ddf29305b40282a3ab3645f75e09a74365560bb5ece4dd","b7be5e44c1ab0ef4ebd3b43c19ef61809beaba5eb92f6cf2667bf7652cea326b","bcfc72748479693b517a0825f174629a465832e1030c54da9e09a6fdcb01b708")
index=activity AND rg_functionality="DNS / DHCP" AND customstring3 NOT NULL AND customstring3 IN ("556d3dcea423e658a53cdbd43cde2ddd1c29590706f926b4d8f210c4f17b4670","ff2b734ec870927a19bf61106cd2f2383ec66e79c1bce369fbd1fb234527b888","b2b953bb7424b73af385615ceece9742f75f3954b81b30163402b15bada8c18e","2acda6ddcd8fecf5d922259b43d20556b7a5982a876ae50df68d09d3dae0d066","6dc87438c968c8d530372fb3c777bab94dd69e4186474380eef0d8b31176f136","34602ec363f0fe18ae324ff46d523819d65d38dd989fa0640a01fbfd3673f797","09b5e780227caa97a042be17450ead0242fd7f58f513158e26678c811d67e264","e6665cdbad676582b7dd959d6893738e1be3c5fa4698af99b5a081fca9918497","09aa9a74d7488a5a26ddf29305b40282a3ab3645f75e09a74365560bb5ece4dd","b7be5e44c1ab0ef4ebd3b43c19ef61809beaba5eb92f6cf2667bf7652cea326b","bcfc72748479693b517a0825f174629a465832e1030c54da9e09a6fdcb01b708")
index=activity AND rg_functionality="DNS / DHCP" AND customstring64 NOT NULL AND customstring64 IN ("556d3dcea423e658a53cdbd43cde2ddd1c29590706f926b4d8f210c4f17b4670","ff2b734ec870927a19bf61106cd2f2383ec66e79c1bce369fbd1fb234527b888","b2b953bb7424b73af385615ceece9742f75f3954b81b30163402b15bada8c18e","2acda6ddcd8fecf5d922259b43d20556b7a5982a876ae50df68d09d3dae0d066","6dc87438c968c8d530372fb3c777bab94dd69e4186474380eef0d8b31176f136","34602ec363f0fe18ae324ff46d523819d65d38dd989fa0640a01fbfd3673f797","09b5e780227caa97a042be17450ead0242fd7f58f513158e26678c811d67e264","e6665cdbad676582b7dd959d6893738e1be3c5fa4698af99b5a081fca9918497","09aa9a74d7488a5a26ddf29305b40282a3ab3645f75e09a74365560bb5ece4dd","b7be5e44c1ab0ef4ebd3b43c19ef61809beaba5eb92f6cf2667bf7652cea326b","bcfc72748479693b517a0825f174629a465832e1030c54da9e09a6fdcb01b708")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND filehash NOT NULL AND filehash IN ("556d3dcea423e658a53cdbd43cde2ddd1c29590706f926b4d8f210c4f17b4670","ff2b734ec870927a19bf61106cd2f2383ec66e79c1bce369fbd1fb234527b888","b2b953bb7424b73af385615ceece9742f75f3954b81b30163402b15bada8c18e","2acda6ddcd8fecf5d922259b43d20556b7a5982a876ae50df68d09d3dae0d066","6dc87438c968c8d530372fb3c777bab94dd69e4186474380eef0d8b31176f136","34602ec363f0fe18ae324ff46d523819d65d38dd989fa0640a01fbfd3673f797","09b5e780227caa97a042be17450ead0242fd7f58f513158e26678c811d67e264","e6665cdbad676582b7dd959d6893738e1be3c5fa4698af99b5a081fca9918497","09aa9a74d7488a5a26ddf29305b40282a3ab3645f75e09a74365560bb5ece4dd","b7be5e44c1ab0ef4ebd3b43c19ef61809beaba5eb92f6cf2667bf7652cea326b","bcfc72748479693b517a0825f174629a465832e1030c54da9e09a6fdcb01b708")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND oldfilehash NOT NULL AND oldfilehash IN ("556d3dcea423e658a53cdbd43cde2ddd1c29590706f926b4d8f210c4f17b4670","ff2b734ec870927a19bf61106cd2f2383ec66e79c1bce369fbd1fb234527b888","b2b953bb7424b73af385615ceece9742f75f3954b81b30163402b15bada8c18e","2acda6ddcd8fecf5d922259b43d20556b7a5982a876ae50df68d09d3dae0d066","6dc87438c968c8d530372fb3c777bab94dd69e4186474380eef0d8b31176f136","34602ec363f0fe18ae324ff46d523819d65d38dd989fa0640a01fbfd3673f797","09b5e780227caa97a042be17450ead0242fd7f58f513158e26678c811d67e264","e6665cdbad676582b7dd959d6893738e1be3c5fa4698af99b5a081fca9918497","09aa9a74d7488a5a26ddf29305b40282a3ab3645f75e09a74365560bb5ece4dd","b7be5e44c1ab0ef4ebd3b43c19ef61809beaba5eb92f6cf2667bf7652cea326b","bcfc72748479693b517a0825f174629a465832e1030c54da9e09a6fdcb01b708")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND customstring3 NOT NULL AND customstring3 IN ("556d3dcea423e658a53cdbd43cde2ddd1c29590706f926b4d8f210c4f17b4670","ff2b734ec870927a19bf61106cd2f2383ec66e79c1bce369fbd1fb234527b888","b2b953bb7424b73af385615ceece9742f75f3954b81b30163402b15bada8c18e","2acda6ddcd8fecf5d922259b43d20556b7a5982a876ae50df68d09d3dae0d066","6dc87438c968c8d530372fb3c777bab94dd69e4186474380eef0d8b31176f136","34602ec363f0fe18ae324ff46d523819d65d38dd989fa0640a01fbfd3673f797","09b5e780227caa97a042be17450ead0242fd7f58f513158e26678c811d67e264","e6665cdbad676582b7dd959d6893738e1be3c5fa4698af99b5a081fca9918497","09aa9a74d7488a5a26ddf29305b40282a3ab3645f75e09a74365560bb5ece4dd","b7be5e44c1ab0ef4ebd3b43c19ef61809beaba5eb92f6cf2667bf7652cea326b","bcfc72748479693b517a0825f174629a465832e1030c54da9e09a6fdcb01b708")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND customstring64 NOT NULL AND customstring64 IN ("556d3dcea423e658a53cdbd43cde2ddd1c29590706f926b4d8f210c4f17b4670","ff2b734ec870927a19bf61106cd2f2383ec66e79c1bce369fbd1fb234527b888","b2b953bb7424b73af385615ceece9742f75f3954b81b30163402b15bada8c18e","2acda6ddcd8fecf5d922259b43d20556b7a5982a876ae50df68d09d3dae0d066","6dc87438c968c8d530372fb3c777bab94dd69e4186474380eef0d8b31176f136","34602ec363f0fe18ae324ff46d523819d65d38dd989fa0640a01fbfd3673f797","09b5e780227caa97a042be17450ead0242fd7f58f513158e26678c811d67e264","e6665cdbad676582b7dd959d6893738e1be3c5fa4698af99b5a081fca9918497","09aa9a74d7488a5a26ddf29305b40282a3ab3645f75e09a74365560bb5ece4dd","b7be5e44c1ab0ef4ebd3b43c19ef61809beaba5eb92f6cf2667bf7652cea326b","bcfc72748479693b517a0825f174629a465832e1030c54da9e09a6fdcb01b708")
index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("556d3dcea423e658a53cdbd43cde2ddd1c29590706f926b4d8f210c4f17b4670","ff2b734ec870927a19bf61106cd2f2383ec66e79c1bce369fbd1fb234527b888","b2b953bb7424b73af385615ceece9742f75f3954b81b30163402b15bada8c18e","2acda6ddcd8fecf5d922259b43d20556b7a5982a876ae50df68d09d3dae0d066","6dc87438c968c8d530372fb3c777bab94dd69e4186474380eef0d8b31176f136","34602ec363f0fe18ae324ff46d523819d65d38dd989fa0640a01fbfd3673f797","09b5e780227caa97a042be17450ead0242fd7f58f513158e26678c811d67e264","e6665cdbad676582b7dd959d6893738e1be3c5fa4698af99b5a081fca9918497","09aa9a74d7488a5a26ddf29305b40282a3ab3645f75e09a74365560bb5ece4dd","b7be5e44c1ab0ef4ebd3b43c19ef61809beaba5eb92f6cf2667bf7652cea326b","bcfc72748479693b517a0825f174629a465832e1030c54da9e09a6fdcb01b708")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("556d3dcea423e658a53cdbd43cde2ddd1c29590706f926b4d8f210c4f17b4670","ff2b734ec870927a19bf61106cd2f2383ec66e79c1bce369fbd1fb234527b888","b2b953bb7424b73af385615ceece9742f75f3954b81b30163402b15bada8c18e","2acda6ddcd8fecf5d922259b43d20556b7a5982a876ae50df68d09d3dae0d066","6dc87438c968c8d530372fb3c777bab94dd69e4186474380eef0d8b31176f136","34602ec363f0fe18ae324ff46d523819d65d38dd989fa0640a01fbfd3673f797","09b5e780227caa97a042be17450ead0242fd7f58f513158e26678c811d67e264","e6665cdbad676582b7dd959d6893738e1be3c5fa4698af99b5a081fca9918497","09aa9a74d7488a5a26ddf29305b40282a3ab3645f75e09a74365560bb5ece4dd","b7be5e44c1ab0ef4ebd3b43c19ef61809beaba5eb92f6cf2667bf7652cea326b","bcfc72748479693b517a0825f174629a465832e1030c54da9e09a6fdcb01b708")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("556d3dcea423e658a53cdbd43cde2ddd1c29590706f926b4d8f210c4f17b4670","ff2b734ec870927a19bf61106cd2f2383ec66e79c1bce369fbd1fb234527b888","b2b953bb7424b73af385615ceece9742f75f3954b81b30163402b15bada8c18e","2acda6ddcd8fecf5d922259b43d20556b7a5982a876ae50df68d09d3dae0d066","6dc87438c968c8d530372fb3c777bab94dd69e4186474380eef0d8b31176f136","34602ec363f0fe18ae324ff46d523819d65d38dd989fa0640a01fbfd3673f797","09b5e780227caa97a042be17450ead0242fd7f58f513158e26678c811d67e264","e6665cdbad676582b7dd959d6893738e1be3c5fa4698af99b5a081fca9918497","09aa9a74d7488a5a26ddf29305b40282a3ab3645f75e09a74365560bb5ece4dd","b7be5e44c1ab0ef4ebd3b43c19ef61809beaba5eb92f6cf2667bf7652cea326b","bcfc72748479693b517a0825f174629a465832e1030c54da9e09a6fdcb01b708")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring64 NOT NULL AND customstring64 IN ("556d3dcea423e658a53cdbd43cde2ddd1c29590706f926b4d8f210c4f17b4670","ff2b734ec870927a19bf61106cd2f2383ec66e79c1bce369fbd1fb234527b888","b2b953bb7424b73af385615ceece9742f75f3954b81b30163402b15bada8c18e","2acda6ddcd8fecf5d922259b43d20556b7a5982a876ae50df68d09d3dae0d066","6dc87438c968c8d530372fb3c777bab94dd69e4186474380eef0d8b31176f136","34602ec363f0fe18ae324ff46d523819d65d38dd989fa0640a01fbfd3673f797","09b5e780227caa97a042be17450ead0242fd7f58f513158e26678c811d67e264","e6665cdbad676582b7dd959d6893738e1be3c5fa4698af99b5a081fca9918497","09aa9a74d7488a5a26ddf29305b40282a3ab3645f75e09a74365560bb5ece4dd","b7be5e44c1ab0ef4ebd3b43c19ef61809beaba5eb92f6cf2667bf7652cea326b","bcfc72748479693b517a0825f174629a465832e1030c54da9e09a6fdcb01b708")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("556d3dcea423e658a53cdbd43cde2ddd1c29590706f926b4d8f210c4f17b4670","ff2b734ec870927a19bf61106cd2f2383ec66e79c1bce369fbd1fb234527b888","b2b953bb7424b73af385615ceece9742f75f3954b81b30163402b15bada8c18e","2acda6ddcd8fecf5d922259b43d20556b7a5982a876ae50df68d09d3dae0d066","6dc87438c968c8d530372fb3c777bab94dd69e4186474380eef0d8b31176f136","34602ec363f0fe18ae324ff46d523819d65d38dd989fa0640a01fbfd3673f797","09b5e780227caa97a042be17450ead0242fd7f58f513158e26678c811d67e264","e6665cdbad676582b7dd959d6893738e1be3c5fa4698af99b5a081fca9918497","09aa9a74d7488a5a26ddf29305b40282a3ab3645f75e09a74365560bb5ece4dd","b7be5e44c1ab0ef4ebd3b43c19ef61809beaba5eb92f6cf2667bf7652cea326b","bcfc72748479693b517a0825f174629a465832e1030c54da9e09a6fdcb01b708")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("556d3dcea423e658a53cdbd43cde2ddd1c29590706f926b4d8f210c4f17b4670","ff2b734ec870927a19bf61106cd2f2383ec66e79c1bce369fbd1fb234527b888","b2b953bb7424b73af385615ceece9742f75f3954b81b30163402b15bada8c18e","2acda6ddcd8fecf5d922259b43d20556b7a5982a876ae50df68d09d3dae0d066","6dc87438c968c8d530372fb3c777bab94dd69e4186474380eef0d8b31176f136","34602ec363f0fe18ae324ff46d523819d65d38dd989fa0640a01fbfd3673f797","09b5e780227caa97a042be17450ead0242fd7f58f513158e26678c811d67e264","e6665cdbad676582b7dd959d6893738e1be3c5fa4698af99b5a081fca9918497","09aa9a74d7488a5a26ddf29305b40282a3ab3645f75e09a74365560bb5ece4dd","b7be5e44c1ab0ef4ebd3b43c19ef61809beaba5eb92f6cf2667bf7652cea326b","bcfc72748479693b517a0825f174629a465832e1030c54da9e09a6fdcb01b708")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("556d3dcea423e658a53cdbd43cde2ddd1c29590706f926b4d8f210c4f17b4670","ff2b734ec870927a19bf61106cd2f2383ec66e79c1bce369fbd1fb234527b888","b2b953bb7424b73af385615ceece9742f75f3954b81b30163402b15bada8c18e","2acda6ddcd8fecf5d922259b43d20556b7a5982a876ae50df68d09d3dae0d066","6dc87438c968c8d530372fb3c777bab94dd69e4186474380eef0d8b31176f136","34602ec363f0fe18ae324ff46d523819d65d38dd989fa0640a01fbfd3673f797","09b5e780227caa97a042be17450ead0242fd7f58f513158e26678c811d67e264","e6665cdbad676582b7dd959d6893738e1be3c5fa4698af99b5a081fca9918497","09aa9a74d7488a5a26ddf29305b40282a3ab3645f75e09a74365560bb5ece4dd","b7be5e44c1ab0ef4ebd3b43c19ef61809beaba5eb92f6cf2667bf7652cea326b","bcfc72748479693b517a0825f174629a465832e1030c54da9e09a6fdcb01b708")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("556d3dcea423e658a53cdbd43cde2ddd1c29590706f926b4d8f210c4f17b4670","ff2b734ec870927a19bf61106cd2f2383ec66e79c1bce369fbd1fb234527b888","b2b953bb7424b73af385615ceece9742f75f3954b81b30163402b15bada8c18e","2acda6ddcd8fecf5d922259b43d20556b7a5982a876ae50df68d09d3dae0d066","6dc87438c968c8d530372fb3c777bab94dd69e4186474380eef0d8b31176f136","34602ec363f0fe18ae324ff46d523819d65d38dd989fa0640a01fbfd3673f797","09b5e780227caa97a042be17450ead0242fd7f58f513158e26678c811d67e264","e6665cdbad676582b7dd959d6893738e1be3c5fa4698af99b5a081fca9918497","09aa9a74d7488a5a26ddf29305b40282a3ab3645f75e09a74365560bb5ece4dd","b7be5e44c1ab0ef4ebd3b43c19ef61809beaba5eb92f6cf2667bf7652cea326b","bcfc72748479693b517a0825f174629a465832e1030c54da9e09a6fdcb01b708")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("556d3dcea423e658a53cdbd43cde2ddd1c29590706f926b4d8f210c4f17b4670","ff2b734ec870927a19bf61106cd2f2383ec66e79c1bce369fbd1fb234527b888","b2b953bb7424b73af385615ceece9742f75f3954b81b30163402b15bada8c18e","2acda6ddcd8fecf5d922259b43d20556b7a5982a876ae50df68d09d3dae0d066","6dc87438c968c8d530372fb3c777bab94dd69e4186474380eef0d8b31176f136","34602ec363f0fe18ae324ff46d523819d65d38dd989fa0640a01fbfd3673f797","09b5e780227caa97a042be17450ead0242fd7f58f513158e26678c811d67e264","e6665cdbad676582b7dd959d6893738e1be3c5fa4698af99b5a081fca9918497","09aa9a74d7488a5a26ddf29305b40282a3ab3645f75e09a74365560bb5ece4dd","b7be5e44c1ab0ef4ebd3b43c19ef61809beaba5eb92f6cf2667bf7652cea326b","bcfc72748479693b517a0825f174629a465832e1030c54da9e09a6fdcb01b708")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("556d3dcea423e658a53cdbd43cde2ddd1c29590706f926b4d8f210c4f17b4670","ff2b734ec870927a19bf61106cd2f2383ec66e79c1bce369fbd1fb234527b888","b2b953bb7424b73af385615ceece9742f75f3954b81b30163402b15bada8c18e","2acda6ddcd8fecf5d922259b43d20556b7a5982a876ae50df68d09d3dae0d066","6dc87438c968c8d530372fb3c777bab94dd69e4186474380eef0d8b31176f136","34602ec363f0fe18ae324ff46d523819d65d38dd989fa0640a01fbfd3673f797","09b5e780227caa97a042be17450ead0242fd7f58f513158e26678c811d67e264","e6665cdbad676582b7dd959d6893738e1be3c5fa4698af99b5a081fca9918497","09aa9a74d7488a5a26ddf29305b40282a3ab3645f75e09a74365560bb5ece4dd","b7be5e44c1ab0ef4ebd3b43c19ef61809beaba5eb92f6cf2667bf7652cea326b","bcfc72748479693b517a0825f174629a465832e1030c54da9e09a6fdcb01b708")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("556d3dcea423e658a53cdbd43cde2ddd1c29590706f926b4d8f210c4f17b4670","ff2b734ec870927a19bf61106cd2f2383ec66e79c1bce369fbd1fb234527b888","b2b953bb7424b73af385615ceece9742f75f3954b81b30163402b15bada8c18e","2acda6ddcd8fecf5d922259b43d20556b7a5982a876ae50df68d09d3dae0d066","6dc87438c968c8d530372fb3c777bab94dd69e4186474380eef0d8b31176f136","34602ec363f0fe18ae324ff46d523819d65d38dd989fa0640a01fbfd3673f797","09b5e780227caa97a042be17450ead0242fd7f58f513158e26678c811d67e264","e6665cdbad676582b7dd959d6893738e1be3c5fa4698af99b5a081fca9918497","09aa9a74d7488a5a26ddf29305b40282a3ab3645f75e09a74365560bb5ece4dd","b7be5e44c1ab0ef4ebd3b43c19ef61809beaba5eb92f6cf2667bf7652cea326b","bcfc72748479693b517a0825f174629a465832e1030c54da9e09a6fdcb01b708")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("556d3dcea423e658a53cdbd43cde2ddd1c29590706f926b4d8f210c4f17b4670","ff2b734ec870927a19bf61106cd2f2383ec66e79c1bce369fbd1fb234527b888","b2b953bb7424b73af385615ceece9742f75f3954b81b30163402b15bada8c18e","2acda6ddcd8fecf5d922259b43d20556b7a5982a876ae50df68d09d3dae0d066","6dc87438c968c8d530372fb3c777bab94dd69e4186474380eef0d8b31176f136","34602ec363f0fe18ae324ff46d523819d65d38dd989fa0640a01fbfd3673f797","09b5e780227caa97a042be17450ead0242fd7f58f513158e26678c811d67e264","e6665cdbad676582b7dd959d6893738e1be3c5fa4698af99b5a081fca9918497","09aa9a74d7488a5a26ddf29305b40282a3ab3645f75e09a74365560bb5ece4dd","b7be5e44c1ab0ef4ebd3b43c19ef61809beaba5eb92f6cf2667bf7652cea326b","bcfc72748479693b517a0825f174629a465832e1030c54da9e09a6fdcb01b708")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("556d3dcea423e658a53cdbd43cde2ddd1c29590706f926b4d8f210c4f17b4670","ff2b734ec870927a19bf61106cd2f2383ec66e79c1bce369fbd1fb234527b888","b2b953bb7424b73af385615ceece9742f75f3954b81b30163402b15bada8c18e","2acda6ddcd8fecf5d922259b43d20556b7a5982a876ae50df68d09d3dae0d066","6dc87438c968c8d530372fb3c777bab94dd69e4186474380eef0d8b31176f136","34602ec363f0fe18ae324ff46d523819d65d38dd989fa0640a01fbfd3673f797","09b5e780227caa97a042be17450ead0242fd7f58f513158e26678c811d67e264","e6665cdbad676582b7dd959d6893738e1be3c5fa4698af99b5a081fca9918497","09aa9a74d7488a5a26ddf29305b40282a3ab3645f75e09a74365560bb5ece4dd","b7be5e44c1ab0ef4ebd3b43c19ef61809beaba5eb92f6cf2667bf7652cea326b","bcfc72748479693b517a0825f174629a465832e1030c54da9e09a6fdcb01b708")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("556d3dcea423e658a53cdbd43cde2ddd1c29590706f926b4d8f210c4f17b4670","ff2b734ec870927a19bf61106cd2f2383ec66e79c1bce369fbd1fb234527b888","b2b953bb7424b73af385615ceece9742f75f3954b81b30163402b15bada8c18e","2acda6ddcd8fecf5d922259b43d20556b7a5982a876ae50df68d09d3dae0d066","6dc87438c968c8d530372fb3c777bab94dd69e4186474380eef0d8b31176f136","34602ec363f0fe18ae324ff46d523819d65d38dd989fa0640a01fbfd3673f797","09b5e780227caa97a042be17450ead0242fd7f58f513158e26678c811d67e264","e6665cdbad676582b7dd959d6893738e1be3c5fa4698af99b5a081fca9918497","09aa9a74d7488a5a26ddf29305b40282a3ab3645f75e09a74365560bb5ece4dd","b7be5e44c1ab0ef4ebd3b43c19ef61809beaba5eb92f6cf2667bf7652cea326b","bcfc72748479693b517a0825f174629a465832e1030c54da9e09a6fdcb01b708")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("556d3dcea423e658a53cdbd43cde2ddd1c29590706f926b4d8f210c4f17b4670","ff2b734ec870927a19bf61106cd2f2383ec66e79c1bce369fbd1fb234527b888","b2b953bb7424b73af385615ceece9742f75f3954b81b30163402b15bada8c18e","2acda6ddcd8fecf5d922259b43d20556b7a5982a876ae50df68d09d3dae0d066","6dc87438c968c8d530372fb3c777bab94dd69e4186474380eef0d8b31176f136","34602ec363f0fe18ae324ff46d523819d65d38dd989fa0640a01fbfd3673f797","09b5e780227caa97a042be17450ead0242fd7f58f513158e26678c811d67e264","e6665cdbad676582b7dd959d6893738e1be3c5fa4698af99b5a081fca9918497","09aa9a74d7488a5a26ddf29305b40282a3ab3645f75e09a74365560bb5ece4dd","b7be5e44c1ab0ef4ebd3b43c19ef61809beaba5eb92f6cf2667bf7652cea326b","bcfc72748479693b517a0825f174629a465832e1030c54da9e09a6fdcb01b708")
index=activity AND rg_functionality="Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("556d3dcea423e658a53cdbd43cde2ddd1c29590706f926b4d8f210c4f17b4670","ff2b734ec870927a19bf61106cd2f2383ec66e79c1bce369fbd1fb234527b888","b2b953bb7424b73af385615ceece9742f75f3954b81b30163402b15bada8c18e","2acda6ddcd8fecf5d922259b43d20556b7a5982a876ae50df68d09d3dae0d066","6dc87438c968c8d530372fb3c777bab94dd69e4186474380eef0d8b31176f136","34602ec363f0fe18ae324ff46d523819d65d38dd989fa0640a01fbfd3673f797","09b5e780227caa97a042be17450ead0242fd7f58f513158e26678c811d67e264","e6665cdbad676582b7dd959d6893738e1be3c5fa4698af99b5a081fca9918497","09aa9a74d7488a5a26ddf29305b40282a3ab3645f75e09a74365560bb5ece4dd","b7be5e44c1ab0ef4ebd3b43c19ef61809beaba5eb92f6cf2667bf7652cea326b","bcfc72748479693b517a0825f174629a465832e1030c54da9e09a6fdcb01b708")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("556d3dcea423e658a53cdbd43cde2ddd1c29590706f926b4d8f210c4f17b4670","ff2b734ec870927a19bf61106cd2f2383ec66e79c1bce369fbd1fb234527b888","b2b953bb7424b73af385615ceece9742f75f3954b81b30163402b15bada8c18e","2acda6ddcd8fecf5d922259b43d20556b7a5982a876ae50df68d09d3dae0d066","6dc87438c968c8d530372fb3c777bab94dd69e4186474380eef0d8b31176f136","34602ec363f0fe18ae324ff46d523819d65d38dd989fa0640a01fbfd3673f797","09b5e780227caa97a042be17450ead0242fd7f58f513158e26678c811d67e264","e6665cdbad676582b7dd959d6893738e1be3c5fa4698af99b5a081fca9918497","09aa9a74d7488a5a26ddf29305b40282a3ab3645f75e09a74365560bb5ece4dd","b7be5e44c1ab0ef4ebd3b43c19ef61809beaba5eb92f6cf2667bf7652cea326b","bcfc72748479693b517a0825f174629a465832e1030c54da9e09a6fdcb01b708")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("556d3dcea423e658a53cdbd43cde2ddd1c29590706f926b4d8f210c4f17b4670","ff2b734ec870927a19bf61106cd2f2383ec66e79c1bce369fbd1fb234527b888","b2b953bb7424b73af385615ceece9742f75f3954b81b30163402b15bada8c18e","2acda6ddcd8fecf5d922259b43d20556b7a5982a876ae50df68d09d3dae0d066","6dc87438c968c8d530372fb3c777bab94dd69e4186474380eef0d8b31176f136","34602ec363f0fe18ae324ff46d523819d65d38dd989fa0640a01fbfd3673f797","09b5e780227caa97a042be17450ead0242fd7f58f513158e26678c811d67e264","e6665cdbad676582b7dd959d6893738e1be3c5fa4698af99b5a081fca9918497","09aa9a74d7488a5a26ddf29305b40282a3ab3645f75e09a74365560bb5ece4dd","b7be5e44c1ab0ef4ebd3b43c19ef61809beaba5eb92f6cf2667bf7652cea326b","bcfc72748479693b517a0825f174629a465832e1030c54da9e09a6fdcb01b708")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("556d3dcea423e658a53cdbd43cde2ddd1c29590706f926b4d8f210c4f17b4670","ff2b734ec870927a19bf61106cd2f2383ec66e79c1bce369fbd1fb234527b888","b2b953bb7424b73af385615ceece9742f75f3954b81b30163402b15bada8c18e","2acda6ddcd8fecf5d922259b43d20556b7a5982a876ae50df68d09d3dae0d066","6dc87438c968c8d530372fb3c777bab94dd69e4186474380eef0d8b31176f136","34602ec363f0fe18ae324ff46d523819d65d38dd989fa0640a01fbfd3673f797","09b5e780227caa97a042be17450ead0242fd7f58f513158e26678c811d67e264","e6665cdbad676582b7dd959d6893738e1be3c5fa4698af99b5a081fca9918497","09aa9a74d7488a5a26ddf29305b40282a3ab3645f75e09a74365560bb5ece4dd","b7be5e44c1ab0ef4ebd3b43c19ef61809beaba5eb92f6cf2667bf7652cea326b","bcfc72748479693b517a0825f174629a465832e1030c54da9e09a6fdcb01b708")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("556d3dcea423e658a53cdbd43cde2ddd1c29590706f926b4d8f210c4f17b4670","ff2b734ec870927a19bf61106cd2f2383ec66e79c1bce369fbd1fb234527b888","b2b953bb7424b73af385615ceece9742f75f3954b81b30163402b15bada8c18e","2acda6ddcd8fecf5d922259b43d20556b7a5982a876ae50df68d09d3dae0d066","6dc87438c968c8d530372fb3c777bab94dd69e4186474380eef0d8b31176f136","34602ec363f0fe18ae324ff46d523819d65d38dd989fa0640a01fbfd3673f797","09b5e780227caa97a042be17450ead0242fd7f58f513158e26678c811d67e264","e6665cdbad676582b7dd959d6893738e1be3c5fa4698af99b5a081fca9918497","09aa9a74d7488a5a26ddf29305b40282a3ab3645f75e09a74365560bb5ece4dd","b7be5e44c1ab0ef4ebd3b43c19ef61809beaba5eb92f6cf2667bf7652cea326b","bcfc72748479693b517a0825f174629a465832e1030c54da9e09a6fdcb01b708")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("556d3dcea423e658a53cdbd43cde2ddd1c29590706f926b4d8f210c4f17b4670","ff2b734ec870927a19bf61106cd2f2383ec66e79c1bce369fbd1fb234527b888","b2b953bb7424b73af385615ceece9742f75f3954b81b30163402b15bada8c18e","2acda6ddcd8fecf5d922259b43d20556b7a5982a876ae50df68d09d3dae0d066","6dc87438c968c8d530372fb3c777bab94dd69e4186474380eef0d8b31176f136","34602ec363f0fe18ae324ff46d523819d65d38dd989fa0640a01fbfd3673f797","09b5e780227caa97a042be17450ead0242fd7f58f513158e26678c811d67e264","e6665cdbad676582b7dd959d6893738e1be3c5fa4698af99b5a081fca9918497","09aa9a74d7488a5a26ddf29305b40282a3ab3645f75e09a74365560bb5ece4dd","b7be5e44c1ab0ef4ebd3b43c19ef61809beaba5eb92f6cf2667bf7652cea326b","bcfc72748479693b517a0825f174629a465832e1030c54da9e09a6fdcb01b708")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("556d3dcea423e658a53cdbd43cde2ddd1c29590706f926b4d8f210c4f17b4670","ff2b734ec870927a19bf61106cd2f2383ec66e79c1bce369fbd1fb234527b888","b2b953bb7424b73af385615ceece9742f75f3954b81b30163402b15bada8c18e","2acda6ddcd8fecf5d922259b43d20556b7a5982a876ae50df68d09d3dae0d066","6dc87438c968c8d530372fb3c777bab94dd69e4186474380eef0d8b31176f136","34602ec363f0fe18ae324ff46d523819d65d38dd989fa0640a01fbfd3673f797","09b5e780227caa97a042be17450ead0242fd7f58f513158e26678c811d67e264","e6665cdbad676582b7dd959d6893738e1be3c5fa4698af99b5a081fca9918497","09aa9a74d7488a5a26ddf29305b40282a3ab3645f75e09a74365560bb5ece4dd","b7be5e44c1ab0ef4ebd3b43c19ef61809beaba5eb92f6cf2667bf7652cea326b","bcfc72748479693b517a0825f174629a465832e1030c54da9e09a6fdcb01b708")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("556d3dcea423e658a53cdbd43cde2ddd1c29590706f926b4d8f210c4f17b4670","ff2b734ec870927a19bf61106cd2f2383ec66e79c1bce369fbd1fb234527b888","b2b953bb7424b73af385615ceece9742f75f3954b81b30163402b15bada8c18e","2acda6ddcd8fecf5d922259b43d20556b7a5982a876ae50df68d09d3dae0d066","6dc87438c968c8d530372fb3c777bab94dd69e4186474380eef0d8b31176f136","34602ec363f0fe18ae324ff46d523819d65d38dd989fa0640a01fbfd3673f797","09b5e780227caa97a042be17450ead0242fd7f58f513158e26678c811d67e264","e6665cdbad676582b7dd959d6893738e1be3c5fa4698af99b5a081fca9918497","09aa9a74d7488a5a26ddf29305b40282a3ab3645f75e09a74365560bb5ece4dd","b7be5e44c1ab0ef4ebd3b43c19ef61809beaba5eb92f6cf2667bf7652cea326b","bcfc72748479693b517a0825f174629a465832e1030c54da9e09a6fdcb01b708")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring64 NOT NULL AND customstring64 IN ("556d3dcea423e658a53cdbd43cde2ddd1c29590706f926b4d8f210c4f17b4670","ff2b734ec870927a19bf61106cd2f2383ec66e79c1bce369fbd1fb234527b888","b2b953bb7424b73af385615ceece9742f75f3954b81b30163402b15bada8c18e","2acda6ddcd8fecf5d922259b43d20556b7a5982a876ae50df68d09d3dae0d066","6dc87438c968c8d530372fb3c777bab94dd69e4186474380eef0d8b31176f136","34602ec363f0fe18ae324ff46d523819d65d38dd989fa0640a01fbfd3673f797","09b5e780227caa97a042be17450ead0242fd7f58f513158e26678c811d67e264","e6665cdbad676582b7dd959d6893738e1be3c5fa4698af99b5a081fca9918497","09aa9a74d7488a5a26ddf29305b40282a3ab3645f75e09a74365560bb5ece4dd","b7be5e44c1ab0ef4ebd3b43c19ef61809beaba5eb92f6cf2667bf7652cea326b","bcfc72748479693b517a0825f174629a465832e1030c54da9e09a6fdcb01b708")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("556d3dcea423e658a53cdbd43cde2ddd1c29590706f926b4d8f210c4f17b4670","ff2b734ec870927a19bf61106cd2f2383ec66e79c1bce369fbd1fb234527b888","b2b953bb7424b73af385615ceece9742f75f3954b81b30163402b15bada8c18e","2acda6ddcd8fecf5d922259b43d20556b7a5982a876ae50df68d09d3dae0d066","6dc87438c968c8d530372fb3c777bab94dd69e4186474380eef0d8b31176f136","34602ec363f0fe18ae324ff46d523819d65d38dd989fa0640a01fbfd3673f797","09b5e780227caa97a042be17450ead0242fd7f58f513158e26678c811d67e264","e6665cdbad676582b7dd959d6893738e1be3c5fa4698af99b5a081fca9918497","09aa9a74d7488a5a26ddf29305b40282a3ab3645f75e09a74365560bb5ece4dd","b7be5e44c1ab0ef4ebd3b43c19ef61809beaba5eb92f6cf2667bf7652cea326b","bcfc72748479693b517a0825f174629a465832e1030c54da9e09a6fdcb01b708")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("556d3dcea423e658a53cdbd43cde2ddd1c29590706f926b4d8f210c4f17b4670","ff2b734ec870927a19bf61106cd2f2383ec66e79c1bce369fbd1fb234527b888","b2b953bb7424b73af385615ceece9742f75f3954b81b30163402b15bada8c18e","2acda6ddcd8fecf5d922259b43d20556b7a5982a876ae50df68d09d3dae0d066","6dc87438c968c8d530372fb3c777bab94dd69e4186474380eef0d8b31176f136","34602ec363f0fe18ae324ff46d523819d65d38dd989fa0640a01fbfd3673f797","09b5e780227caa97a042be17450ead0242fd7f58f513158e26678c811d67e264","e6665cdbad676582b7dd959d6893738e1be3c5fa4698af99b5a081fca9918497","09aa9a74d7488a5a26ddf29305b40282a3ab3645f75e09a74365560bb5ece4dd","b7be5e44c1ab0ef4ebd3b43c19ef61809beaba5eb92f6cf2667bf7652cea326b","bcfc72748479693b517a0825f174629a465832e1030c54da9e09a6fdcb01b708")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("556d3dcea423e658a53cdbd43cde2ddd1c29590706f926b4d8f210c4f17b4670","ff2b734ec870927a19bf61106cd2f2383ec66e79c1bce369fbd1fb234527b888","b2b953bb7424b73af385615ceece9742f75f3954b81b30163402b15bada8c18e","2acda6ddcd8fecf5d922259b43d20556b7a5982a876ae50df68d09d3dae0d066","6dc87438c968c8d530372fb3c777bab94dd69e4186474380eef0d8b31176f136","34602ec363f0fe18ae324ff46d523819d65d38dd989fa0640a01fbfd3673f797","09b5e780227caa97a042be17450ead0242fd7f58f513158e26678c811d67e264","e6665cdbad676582b7dd959d6893738e1be3c5fa4698af99b5a081fca9918497","09aa9a74d7488a5a26ddf29305b40282a3ab3645f75e09a74365560bb5ece4dd","b7be5e44c1ab0ef4ebd3b43c19ef61809beaba5eb92f6cf2667bf7652cea326b","bcfc72748479693b517a0825f174629a465832e1030c54da9e09a6fdcb01b708")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring64 NOT NULL AND customstring64 IN ("556d3dcea423e658a53cdbd43cde2ddd1c29590706f926b4d8f210c4f17b4670","ff2b734ec870927a19bf61106cd2f2383ec66e79c1bce369fbd1fb234527b888","b2b953bb7424b73af385615ceece9742f75f3954b81b30163402b15bada8c18e","2acda6ddcd8fecf5d922259b43d20556b7a5982a876ae50df68d09d3dae0d066","6dc87438c968c8d530372fb3c777bab94dd69e4186474380eef0d8b31176f136","34602ec363f0fe18ae324ff46d523819d65d38dd989fa0640a01fbfd3673f797","09b5e780227caa97a042be17450ead0242fd7f58f513158e26678c811d67e264","e6665cdbad676582b7dd959d6893738e1be3c5fa4698af99b5a081fca9918497","09aa9a74d7488a5a26ddf29305b40282a3ab3645f75e09a74365560bb5ece4dd","b7be5e44c1ab0ef4ebd3b43c19ef61809beaba5eb92f6cf2667bf7652cea326b","bcfc72748479693b517a0825f174629a465832e1030c54da9e09a6fdcb01b708")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("556d3dcea423e658a53cdbd43cde2ddd1c29590706f926b4d8f210c4f17b4670","ff2b734ec870927a19bf61106cd2f2383ec66e79c1bce369fbd1fb234527b888","b2b953bb7424b73af385615ceece9742f75f3954b81b30163402b15bada8c18e","2acda6ddcd8fecf5d922259b43d20556b7a5982a876ae50df68d09d3dae0d066","6dc87438c968c8d530372fb3c777bab94dd69e4186474380eef0d8b31176f136","34602ec363f0fe18ae324ff46d523819d65d38dd989fa0640a01fbfd3673f797","09b5e780227caa97a042be17450ead0242fd7f58f513158e26678c811d67e264","e6665cdbad676582b7dd959d6893738e1be3c5fa4698af99b5a081fca9918497","09aa9a74d7488a5a26ddf29305b40282a3ab3645f75e09a74365560bb5ece4dd","b7be5e44c1ab0ef4ebd3b43c19ef61809beaba5eb92f6cf2667bf7652cea326b","bcfc72748479693b517a0825f174629a465832e1030c54da9e09a6fdcb01b708")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("556d3dcea423e658a53cdbd43cde2ddd1c29590706f926b4d8f210c4f17b4670","ff2b734ec870927a19bf61106cd2f2383ec66e79c1bce369fbd1fb234527b888","b2b953bb7424b73af385615ceece9742f75f3954b81b30163402b15bada8c18e","2acda6ddcd8fecf5d922259b43d20556b7a5982a876ae50df68d09d3dae0d066","6dc87438c968c8d530372fb3c777bab94dd69e4186474380eef0d8b31176f136","34602ec363f0fe18ae324ff46d523819d65d38dd989fa0640a01fbfd3673f797","09b5e780227caa97a042be17450ead0242fd7f58f513158e26678c811d67e264","e6665cdbad676582b7dd959d6893738e1be3c5fa4698af99b5a081fca9918497","09aa9a74d7488a5a26ddf29305b40282a3ab3645f75e09a74365560bb5ece4dd","b7be5e44c1ab0ef4ebd3b43c19ef61809beaba5eb92f6cf2667bf7652cea326b","bcfc72748479693b517a0825f174629a465832e1030c54da9e09a6fdcb01b708")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("556d3dcea423e658a53cdbd43cde2ddd1c29590706f926b4d8f210c4f17b4670","ff2b734ec870927a19bf61106cd2f2383ec66e79c1bce369fbd1fb234527b888","b2b953bb7424b73af385615ceece9742f75f3954b81b30163402b15bada8c18e","2acda6ddcd8fecf5d922259b43d20556b7a5982a876ae50df68d09d3dae0d066","6dc87438c968c8d530372fb3c777bab94dd69e4186474380eef0d8b31176f136","34602ec363f0fe18ae324ff46d523819d65d38dd989fa0640a01fbfd3673f797","09b5e780227caa97a042be17450ead0242fd7f58f513158e26678c811d67e264","e6665cdbad676582b7dd959d6893738e1be3c5fa4698af99b5a081fca9918497","09aa9a74d7488a5a26ddf29305b40282a3ab3645f75e09a74365560bb5ece4dd","b7be5e44c1ab0ef4ebd3b43c19ef61809beaba5eb92f6cf2667bf7652cea326b","bcfc72748479693b517a0825f174629a465832e1030c54da9e09a6fdcb01b708")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring64 NOT NULL AND customstring64 IN ("556d3dcea423e658a53cdbd43cde2ddd1c29590706f926b4d8f210c4f17b4670","ff2b734ec870927a19bf61106cd2f2383ec66e79c1bce369fbd1fb234527b888","b2b953bb7424b73af385615ceece9742f75f3954b81b30163402b15bada8c18e","2acda6ddcd8fecf5d922259b43d20556b7a5982a876ae50df68d09d3dae0d066","6dc87438c968c8d530372fb3c777bab94dd69e4186474380eef0d8b31176f136","34602ec363f0fe18ae324ff46d523819d65d38dd989fa0640a01fbfd3673f797","09b5e780227caa97a042be17450ead0242fd7f58f513158e26678c811d67e264","e6665cdbad676582b7dd959d6893738e1be3c5fa4698af99b5a081fca9918497","09aa9a74d7488a5a26ddf29305b40282a3ab3645f75e09a74365560bb5ece4dd","b7be5e44c1ab0ef4ebd3b43c19ef61809beaba5eb92f6cf2667bf7652cea326b","bcfc72748479693b517a0825f174629a465832e1030c54da9e09a6fdcb01b708")
index=activity AND rg_functionality="Next Generation Firewall" AND requesturl NOT NULL AND requesturl IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Next Generation Firewall" AND Message NOT NULL AND Message IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Next Generation Firewall" AND Requestcontext NOT NULL AND Requestcontext IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Next Generation Firewall" AND customstring3 NOT NULL AND customstring3 IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Firewall" AND requesturl NOT NULL AND requesturl IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Firewall" AND Message NOT NULL AND Message IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Firewall" AND Requestcontext NOT NULL AND Requestcontext IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Firewall" AND customstring3 NOT NULL AND customstring3 IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Web Proxy" AND requesturl NOT NULL AND requesturl IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Web Proxy" AND Message NOT NULL AND Message IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Web Proxy" AND Requestcontext NOT NULL AND Requestcontext IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Web Proxy" AND customstring3 NOT NULL AND customstring3 IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Flow" AND requesturl NOT NULL AND requesturl IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Flow" AND Message NOT NULL AND Message IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Flow" AND Requestcontext NOT NULL AND Requestcontext IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Flow" AND customstring3 NOT NULL AND customstring3 IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Web Server" AND requesturl NOT NULL AND requesturl IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Web Server" AND Message NOT NULL AND Message IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Web Server" AND Requestcontext NOT NULL AND Requestcontext IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Web Server" AND customstring3 NOT NULL AND customstring3 IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND requesturl NOT NULL AND requesturl IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND Message NOT NULL AND Message IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND Requestcontext NOT NULL AND Requestcontext IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND requesturl NOT NULL AND requesturl IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND Message NOT NULL AND Message IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND Requestcontext NOT NULL AND Requestcontext IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Web Application Firewall" AND requesturl NOT NULL AND requesturl IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Web Application Firewall" AND Message NOT NULL AND Message IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Web Application Firewall" AND Requestcontext NOT NULL AND Requestcontext IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Web Application Firewall" AND customstring3 NOT NULL AND customstring3 IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Endpoint management systems" AND requesturl NOT NULL AND requesturl IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Endpoint management systems" AND Message NOT NULL AND Message IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Endpoint management systems" AND Requestcontext NOT NULL AND Requestcontext IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Endpoint management systems" AND customstring3 NOT NULL AND customstring3 IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND requesturl NOT NULL AND requesturl IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND Message NOT NULL AND Message IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND Requestcontext NOT NULL AND Requestcontext IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Cloud Application Audit" AND requesturl NOT NULL AND requesturl IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Cloud Application Audit" AND Message NOT NULL AND Message IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Cloud Application Audit" AND Requestcontext NOT NULL AND Requestcontext IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Cloud Application Audit" AND customstring3 NOT NULL AND customstring3 IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND requesturl NOT NULL AND requesturl IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND Message NOT NULL AND Message IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND Requestcontext NOT NULL AND Requestcontext IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND customstring3 NOT NULL AND customstring3 IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Unix / Linux / AIX" AND requesturl NOT NULL AND requesturl IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Unix / Linux / AIX" AND Message NOT NULL AND Message IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Unix / Linux / AIX" AND Requestcontext NOT NULL AND Requestcontext IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Unix / Linux / AIX" AND customstring3 NOT NULL AND customstring3 IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND requesturl NOT NULL AND requesturl IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND Message NOT NULL AND Message IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND Requestcontext NOT NULL AND Requestcontext IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND customstring3 NOT NULL AND customstring3 IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Cloud Application Security Broker" AND requesturl NOT NULL AND requesturl IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Cloud Application Security Broker" AND Message NOT NULL AND Message IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Cloud Application Security Broker" AND Requestcontext NOT NULL AND Requestcontext IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Cloud Application Security Broker" AND customstring3 NOT NULL AND customstring3 IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Source Code Repository" AND requesturl NOT NULL AND requesturl IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Source Code Repository" AND Message NOT NULL AND Message IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Source Code Repository" AND Requestcontext NOT NULL AND Requestcontext IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Source Code Repository" AND customstring3 NOT NULL AND customstring3 IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Cloud Email / Email Security" AND requesturl NOT NULL AND requesturl IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Cloud Email / Email Security" AND Message NOT NULL AND Message IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Cloud Email / Email Security" AND Requestcontext NOT NULL AND Requestcontext IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="DNS / DHCP" AND requesturl NOT NULL AND requesturl IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="DNS / DHCP" AND Message NOT NULL AND Message IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="DNS / DHCP" AND Requestcontext NOT NULL AND Requestcontext IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="DNS / DHCP" AND customstring3 NOT NULL AND customstring3 IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND requesturl NOT NULL AND requesturl IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND Message NOT NULL AND Message IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND Requestcontext NOT NULL AND Requestcontext IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND customstring3 NOT NULL AND customstring3 IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Endpoint Management Systems" AND requesturl NOT NULL AND requesturl IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Endpoint Management Systems" AND Message NOT NULL AND Message IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Endpoint Management Systems" AND Requestcontext NOT NULL AND Requestcontext IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND requesturl NOT NULL AND requesturl IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND Message NOT NULL AND Message IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND Requestcontext NOT NULL AND Requestcontext IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND requesturl NOT NULL AND requesturl IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND Message NOT NULL AND Message IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND Requestcontext NOT NULL AND Requestcontext IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Email / Email Security" AND requesturl NOT NULL AND requesturl IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Email / Email Security" AND Message NOT NULL AND Message IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Email / Email Security" AND Requestcontext NOT NULL AND Requestcontext IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Cloud Email / Email Security" AND requesturl NOT NULL AND requesturl IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Cloud Email / Email Security" AND Message NOT NULL AND Message IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Cloud Email / Email Security" AND Requestcontext NOT NULL AND Requestcontext IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND requesturl NOT NULL AND requesturl IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND Message NOT NULL AND Message IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND Requestcontext NOT NULL AND Requestcontext IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND requesturl NOT NULL AND requesturl IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND Message NOT NULL AND Message IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND Requestcontext NOT NULL AND Requestcontext IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND requesturl NOT NULL AND requesturl IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND Message NOT NULL AND Message IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND Requestcontext NOT NULL AND Requestcontext IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Web Proxy" AND requesturl NOT NULL AND requesturl IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Web Proxy" AND Message NOT NULL AND Message IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Web Proxy" AND Requestcontext NOT NULL AND Requestcontext IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Web Proxy" AND customstring3 NOT NULL AND customstring3 IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Next Generation Firewall" AND requesturl NOT NULL AND requesturl IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Next Generation Firewall" AND Message NOT NULL AND Message IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Next Generation Firewall" AND Requestcontext NOT NULL AND Requestcontext IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Next Generation Firewall" AND customstring3 NOT NULL AND customstring3 IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Flow" AND requesturl NOT NULL AND requesturl IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Flow" AND Message NOT NULL AND Message IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Flow" AND Requestcontext NOT NULL AND Requestcontext IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Flow" AND customstring3 NOT NULL AND customstring3 IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Web Server" AND requesturl NOT NULL AND requesturl IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Web Server" AND Message NOT NULL AND Message IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Web Server" AND Requestcontext NOT NULL AND Requestcontext IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Web Server" AND customstring3 NOT NULL AND customstring3 IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Email / Email Security" AND requesturl NOT NULL AND requesturl IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Email / Email Security" AND Message NOT NULL AND Message IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Email / Email Security" AND Requestcontext NOT NULL AND Requestcontext IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Cloud Email / Email Security" AND requesturl NOT NULL AND requesturl IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Cloud Email / Email Security" AND Message NOT NULL AND Message IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Cloud Email / Email Security" AND Requestcontext NOT NULL AND Requestcontext IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Web Application Firewall" AND requesturl NOT NULL AND requesturl IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Web Application Firewall" AND Message NOT NULL AND Message IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Web Application Firewall" AND Requestcontext NOT NULL AND Requestcontext IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Web Application Firewall" AND customstring3 NOT NULL AND customstring3 IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND requesturl NOT NULL AND requesturl IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND Message NOT NULL AND Message IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND Requestcontext NOT NULL AND Requestcontext IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND requesturl NOT NULL AND requesturl IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND Message NOT NULL AND Message IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND Requestcontext NOT NULL AND Requestcontext IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND customstring3 NOT NULL AND customstring3 IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND requesturl NOT NULL AND requesturl IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND Message NOT NULL AND Message IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND Requestcontext NOT NULL AND Requestcontext IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND customstring3 NOT NULL AND customstring3 IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Cloud Application Security Broker" AND requesturl NOT NULL AND requesturl IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Cloud Application Security Broker" AND Message NOT NULL AND Message IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Cloud Application Security Broker" AND Requestcontext NOT NULL AND Requestcontext IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Cloud Application Security Broker" AND customstring3 NOT NULL AND customstring3 IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Source Code Repository" AND requesturl NOT NULL AND requesturl IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Source Code Repository" AND Message NOT NULL AND Message IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Source Code Repository" AND Requestcontext NOT NULL AND Requestcontext IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Source Code Repository" AND customstring3 NOT NULL AND customstring3 IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Authentication / VPN" AND requesturl NOT NULL AND requesturl IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Authentication / VPN" AND Message NOT NULL AND Message IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Authentication / VPN" AND Requestcontext NOT NULL AND Requestcontext IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Authentication / VPN" AND customstring3 NOT NULL AND customstring3 IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Cloud Content Management System" AND requesturl NOT NULL AND requesturl IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Cloud Content Management System" AND Message NOT NULL AND Message IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Cloud Content Management System" AND Requestcontext NOT NULL AND Requestcontext IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Cloud Content Management System" AND customstring3 NOT NULL AND customstring3 IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Cloud Services / Applications" AND requesturl NOT NULL AND requesturl IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Cloud Services / Applications" AND Message NOT NULL AND Message IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Cloud Services / Applications" AND Requestcontext NOT NULL AND Requestcontext IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Cloud Services / Applications" AND customstring3 NOT NULL AND customstring3 IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND requesturl NOT NULL AND requesturl IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND Message NOT NULL AND Message IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND Requestcontext NOT NULL AND Requestcontext IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Web Application Firewall" AND requesturl NOT NULL AND requesturl IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Web Application Firewall" AND Message NOT NULL AND Message IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Web Application Firewall" AND Requestcontext NOT NULL AND Requestcontext IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Web Application Firewall" AND customstring3 NOT NULL AND customstring3 IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND requesturl NOT NULL AND requesturl IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND Message NOT NULL AND Message IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND Requestcontext NOT NULL AND Requestcontext IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND customstring3 NOT NULL AND customstring3 IN ("www.dropbox.com/scl/fi/l37v94e1cmkpndra2k54h/winlogon.t?rlkey=ezayv7o216lebiyj4f15y20se&dl=1","www.dropbox.com/scl/fi/fl12d5db094koajsf0bm9/ultravnc.t?rlkey=mtboezl2ox6fu7i5t8ud7rnv3&dl=1")
