index=activity AND rg_functionality="Endpoint Management Systems" AND baseeventid = "11" AND (filename ENDS WITH "msmpeng.exe" OR filename ENDS WITH "mpsvc.dll") AND (filename NOT CONTAINS "C:\Program Files\windows defender\")
index=activity AND rg_functionality="Endpoint Management Systems" AND (deviceaction = "ProcessRollup2" or deviceaction = "Procstart" or deviceaction = "Childproc" or deviceaction = "Process" or deviceaction = "Process Create" or deviceaction = "Trace Executed Process" or baseeventid=1)  AND resourcecustomfield8 ENDS WITH "netsh" AND resourcecustomfield1 CONTAINS "advfirewall" AND resourcecustomfield1 CONTAINS "firewall" AND resourcecustomfield1 CONTAINS "Network Discovery" AND resourcecustomfield1 CONTAINS "enable=Yes"
index=activity AND rg_functionality="Endpoint Management Systems" AND baseeventid = "7" AND (resourcecustomfield8 ENDS WITH "msmpeng.exe" AND resourcecustomfield5 ENDS WITH "mpsvc.dll") AND (resourcecustomfield5 NOT CONTAINS "C:\Program Files\Windows Defender\")
