index=activity AND rg_functionality="Next Generation Firewall" AND ipaddress NOT NULL AND ipaddress IN ("104.21.49.220","80.85.155.80","193.38.54.110")
index=activity AND rg_functionality="Firewall" AND ipaddress NOT NULL AND ipaddress IN ("104.21.49.220","80.85.155.80","193.38.54.110")
index=activity AND rg_functionality="Web Proxy" AND ipaddress NOT NULL AND ipaddress IN ("104.21.49.220","80.85.155.80","193.38.54.110")
index=activity AND rg_functionality="Web Application Firewall" AND ipaddress NOT NULL AND ipaddress IN ("104.21.49.220","80.85.155.80","193.38.54.110")
index=activity AND rg_functionality="DNS / DHCP" AND ipaddress NOT NULL AND ipaddress IN ("104.21.49.220","80.85.155.80","193.38.54.110")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND ipaddress NOT NULL AND ipaddress IN ("104.21.49.220","80.85.155.80","193.38.54.110")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("104.21.49.220","80.85.155.80","193.38.54.110")
index=activity AND rg_functionality="Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("104.21.49.220","80.85.155.80","193.38.54.110")
index=activity AND rg_functionality="Web Proxy" AND destinationaddress NOT NULL AND destinationaddress IN ("104.21.49.220","80.85.155.80","193.38.54.110")
index=activity AND rg_functionality="Web Application Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("104.21.49.220","80.85.155.80","193.38.54.110")
index=activity AND rg_functionality="DNS / DHCP" AND destinationaddress NOT NULL AND destinationaddress IN ("104.21.49.220","80.85.155.80","193.38.54.110")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationaddress NOT NULL AND destinationaddress IN ("104.21.49.220","80.85.155.80","193.38.54.110")
index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("1077A3DC0D9CCFBB73BD9F2E6B72BC67ADDCF2AB","153B8E46458BD65A68A89D258997E314FEF72181","829AADBDE42DF14CE8ED06AC02AD697A6C9798FE","9762BC1C4CB04FE8EAEEF50A4378A8D188D85360","EA44E9FBDBE5906A7FC469A988D83587E8E4B20D","AA5B5F24BDFB049EF51BBB6246CB56CEC89752BF")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("1077A3DC0D9CCFBB73BD9F2E6B72BC67ADDCF2AB","153B8E46458BD65A68A89D258997E314FEF72181","829AADBDE42DF14CE8ED06AC02AD697A6C9798FE","9762BC1C4CB04FE8EAEEF50A4378A8D188D85360","EA44E9FBDBE5906A7FC469A988D83587E8E4B20D","AA5B5F24BDFB049EF51BBB6246CB56CEC89752BF")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("1077A3DC0D9CCFBB73BD9F2E6B72BC67ADDCF2AB","153B8E46458BD65A68A89D258997E314FEF72181","829AADBDE42DF14CE8ED06AC02AD697A6C9798FE","9762BC1C4CB04FE8EAEEF50A4378A8D188D85360","EA44E9FBDBE5906A7FC469A988D83587E8E4B20D","AA5B5F24BDFB049EF51BBB6246CB56CEC89752BF")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("1077A3DC0D9CCFBB73BD9F2E6B72BC67ADDCF2AB","153B8E46458BD65A68A89D258997E314FEF72181","829AADBDE42DF14CE8ED06AC02AD697A6C9798FE","9762BC1C4CB04FE8EAEEF50A4378A8D188D85360","EA44E9FBDBE5906A7FC469A988D83587E8E4B20D","AA5B5F24BDFB049EF51BBB6246CB56CEC89752BF")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("1077A3DC0D9CCFBB73BD9F2E6B72BC67ADDCF2AB","153B8E46458BD65A68A89D258997E314FEF72181","829AADBDE42DF14CE8ED06AC02AD697A6C9798FE","9762BC1C4CB04FE8EAEEF50A4378A8D188D85360","EA44E9FBDBE5906A7FC469A988D83587E8E4B20D","AA5B5F24BDFB049EF51BBB6246CB56CEC89752BF")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("1077A3DC0D9CCFBB73BD9F2E6B72BC67ADDCF2AB","153B8E46458BD65A68A89D258997E314FEF72181","829AADBDE42DF14CE8ED06AC02AD697A6C9798FE","9762BC1C4CB04FE8EAEEF50A4378A8D188D85360","EA44E9FBDBE5906A7FC469A988D83587E8E4B20D","AA5B5F24BDFB049EF51BBB6246CB56CEC89752BF")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "update.facebookint.workers.dev" OR destinationhostname CONTAINS "cdn.cloudfiare.workers.dev")
index=activity AND rg_functionality="Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "update.facebookint.workers.dev" OR destinationhostname CONTAINS "cdn.cloudfiare.workers.dev")
index=activity AND rg_functionality="Web Proxy" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "update.facebookint.workers.dev" OR destinationhostname CONTAINS "cdn.cloudfiare.workers.dev")
