index=activity AND rg_functionality="Next Generation Firewall" AND ipaddress NOT NULL AND ipaddress IN ("159.65.46.32","45.14.224.127","185.224.129.235","23.95.80.200")
index=activity AND rg_functionality="Firewall" AND ipaddress NOT NULL AND ipaddress IN ("159.65.46.32","45.14.224.127","185.224.129.235","23.95.80.200")
index=activity AND rg_functionality="Web Proxy" AND ipaddress NOT NULL AND ipaddress IN ("159.65.46.32","45.14.224.127","185.224.129.235","23.95.80.200")
index=activity AND rg_functionality="Web Application Firewall" AND ipaddress NOT NULL AND ipaddress IN ("159.65.46.32","45.14.224.127","185.224.129.235","23.95.80.200")
index=activity AND rg_functionality="DNS / DHCP" AND ipaddress NOT NULL AND ipaddress IN ("159.65.46.32","45.14.224.127","185.224.129.235","23.95.80.200")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND ipaddress NOT NULL AND ipaddress IN ("159.65.46.32","45.14.224.127","185.224.129.235","23.95.80.200")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("159.65.46.32","45.14.224.127","185.224.129.235","23.95.80.200")
index=activity AND rg_functionality="Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("159.65.46.32","45.14.224.127","185.224.129.235","23.95.80.200")
index=activity AND rg_functionality="Web Proxy" AND destinationaddress NOT NULL AND destinationaddress IN ("159.65.46.32","45.14.224.127","185.224.129.235","23.95.80.200")
index=activity AND rg_functionality="Web Application Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("159.65.46.32","45.14.224.127","185.224.129.235","23.95.80.200")
index=activity AND rg_functionality="DNS / DHCP" AND destinationaddress NOT NULL AND destinationaddress IN ("159.65.46.32","45.14.224.127","185.224.129.235","23.95.80.200")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationaddress NOT NULL AND destinationaddress IN ("159.65.46.32","45.14.224.127","185.224.129.235","23.95.80.200")
index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("c2d5e54544742b7a1b04cf45047859a10bb90c6945d340120872f575aa866e6d","45dda743b2c85f0bda113a271dad2e27c059bbacbbd083e420bf6777610c1f12","c1f4402201114a74cc213ac8c0f2ccac9a9ec6edfc3d672b6055763a960001c1","e847dfbd831df6015519d03d42ada8241ce1174e9bd96f405452627617229c63","6d18b433183fc68cd7b731fed198732d3460a21afba53163f059152bd410b55f")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("c2d5e54544742b7a1b04cf45047859a10bb90c6945d340120872f575aa866e6d","45dda743b2c85f0bda113a271dad2e27c059bbacbbd083e420bf6777610c1f12","c1f4402201114a74cc213ac8c0f2ccac9a9ec6edfc3d672b6055763a960001c1","e847dfbd831df6015519d03d42ada8241ce1174e9bd96f405452627617229c63","6d18b433183fc68cd7b731fed198732d3460a21afba53163f059152bd410b55f")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("c2d5e54544742b7a1b04cf45047859a10bb90c6945d340120872f575aa866e6d","45dda743b2c85f0bda113a271dad2e27c059bbacbbd083e420bf6777610c1f12","c1f4402201114a74cc213ac8c0f2ccac9a9ec6edfc3d672b6055763a960001c1","e847dfbd831df6015519d03d42ada8241ce1174e9bd96f405452627617229c63","6d18b433183fc68cd7b731fed198732d3460a21afba53163f059152bd410b55f")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("c2d5e54544742b7a1b04cf45047859a10bb90c6945d340120872f575aa866e6d","45dda743b2c85f0bda113a271dad2e27c059bbacbbd083e420bf6777610c1f12","c1f4402201114a74cc213ac8c0f2ccac9a9ec6edfc3d672b6055763a960001c1","e847dfbd831df6015519d03d42ada8241ce1174e9bd96f405452627617229c63","6d18b433183fc68cd7b731fed198732d3460a21afba53163f059152bd410b55f")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("c2d5e54544742b7a1b04cf45047859a10bb90c6945d340120872f575aa866e6d","45dda743b2c85f0bda113a271dad2e27c059bbacbbd083e420bf6777610c1f12","c1f4402201114a74cc213ac8c0f2ccac9a9ec6edfc3d672b6055763a960001c1","e847dfbd831df6015519d03d42ada8241ce1174e9bd96f405452627617229c63","6d18b433183fc68cd7b731fed198732d3460a21afba53163f059152bd410b55f")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("c2d5e54544742b7a1b04cf45047859a10bb90c6945d340120872f575aa866e6d","45dda743b2c85f0bda113a271dad2e27c059bbacbbd083e420bf6777610c1f12","c1f4402201114a74cc213ac8c0f2ccac9a9ec6edfc3d672b6055763a960001c1","e847dfbd831df6015519d03d42ada8241ce1174e9bd96f405452627617229c63","6d18b433183fc68cd7b731fed198732d3460a21afba53163f059152bd410b55f")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "b0tz.xyz")
index=activity AND rg_functionality="Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "b0tz.xyz")
index=activity AND rg_functionality="Web Proxy" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "b0tz.xyz")
