index=activity AND rg_functionality="Next Generation Firewall" AND ipaddress NOT NULL AND ipaddress IN ("194.33.40.72","5.149.253.45")
index=activity AND rg_functionality="Firewall" AND ipaddress NOT NULL AND ipaddress IN ("194.33.40.72","5.149.253.45")
index=activity AND rg_functionality="Web Proxy" AND ipaddress NOT NULL AND ipaddress IN ("194.33.40.72","5.149.253.45")
index=activity AND rg_functionality="Web Application Firewall" AND ipaddress NOT NULL AND ipaddress IN ("194.33.40.72","5.149.253.45")
index=activity AND rg_functionality="DNS / DHCP" AND ipaddress NOT NULL AND ipaddress IN ("194.33.40.72","5.149.253.45")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND ipaddress NOT NULL AND ipaddress IN ("194.33.40.72","5.149.253.45")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("194.33.40.72","5.149.253.45")
index=activity AND rg_functionality="Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("194.33.40.72","5.149.253.45")
index=activity AND rg_functionality="Web Proxy" AND destinationaddress NOT NULL AND destinationaddress IN ("194.33.40.72","5.149.253.45")
index=activity AND rg_functionality="Web Application Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("194.33.40.72","5.149.253.45")
index=activity AND rg_functionality="DNS / DHCP" AND destinationaddress NOT NULL AND destinationaddress IN ("194.33.40.72","5.149.253.45")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationaddress NOT NULL AND destinationaddress IN ("194.33.40.72","5.149.253.45")
index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("ae1e587d19250deb40e92587b8a2188c","efa4fa5ddee99853c32b321496f9369f2db119eb","12331809c3e03d84498f428a37a28cf6cbb1dafe98c36463593ad12898c588c9","4f3ac4c7b5932f11662d4d22fa5d88ec","45d607109d1a12a279664eec8f4bd604287b62c7","04e1772997b884540d5728a2069c3cc93b8f29478e306d341120f789ea8ec79e","3537ed6d4038ca7dbc054308c40fc3e3","a13cb50e2405440ec984dd3fc340bceea4a81cfc","2a652721243f29e82bdf57b565208c59937bbb6af4ab51e7b6ba7ed270ea6bce","fa4b1efd428bbf47f9c8395ca91eff25","e15c665f02fb288fc4bdef9d23b2dc802b3aca0d","ae0bc3358fef0ca2a103e694aa556f55a3fed4e98ba57d16f5ae7ad4ad583698")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("ae1e587d19250deb40e92587b8a2188c","efa4fa5ddee99853c32b321496f9369f2db119eb","12331809c3e03d84498f428a37a28cf6cbb1dafe98c36463593ad12898c588c9","4f3ac4c7b5932f11662d4d22fa5d88ec","45d607109d1a12a279664eec8f4bd604287b62c7","04e1772997b884540d5728a2069c3cc93b8f29478e306d341120f789ea8ec79e","3537ed6d4038ca7dbc054308c40fc3e3","a13cb50e2405440ec984dd3fc340bceea4a81cfc","2a652721243f29e82bdf57b565208c59937bbb6af4ab51e7b6ba7ed270ea6bce","fa4b1efd428bbf47f9c8395ca91eff25","e15c665f02fb288fc4bdef9d23b2dc802b3aca0d","ae0bc3358fef0ca2a103e694aa556f55a3fed4e98ba57d16f5ae7ad4ad583698")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("ae1e587d19250deb40e92587b8a2188c","efa4fa5ddee99853c32b321496f9369f2db119eb","12331809c3e03d84498f428a37a28cf6cbb1dafe98c36463593ad12898c588c9","4f3ac4c7b5932f11662d4d22fa5d88ec","45d607109d1a12a279664eec8f4bd604287b62c7","04e1772997b884540d5728a2069c3cc93b8f29478e306d341120f789ea8ec79e","3537ed6d4038ca7dbc054308c40fc3e3","a13cb50e2405440ec984dd3fc340bceea4a81cfc","2a652721243f29e82bdf57b565208c59937bbb6af4ab51e7b6ba7ed270ea6bce","fa4b1efd428bbf47f9c8395ca91eff25","e15c665f02fb288fc4bdef9d23b2dc802b3aca0d","ae0bc3358fef0ca2a103e694aa556f55a3fed4e98ba57d16f5ae7ad4ad583698")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("ae1e587d19250deb40e92587b8a2188c","efa4fa5ddee99853c32b321496f9369f2db119eb","12331809c3e03d84498f428a37a28cf6cbb1dafe98c36463593ad12898c588c9","4f3ac4c7b5932f11662d4d22fa5d88ec","45d607109d1a12a279664eec8f4bd604287b62c7","04e1772997b884540d5728a2069c3cc93b8f29478e306d341120f789ea8ec79e","3537ed6d4038ca7dbc054308c40fc3e3","a13cb50e2405440ec984dd3fc340bceea4a81cfc","2a652721243f29e82bdf57b565208c59937bbb6af4ab51e7b6ba7ed270ea6bce","fa4b1efd428bbf47f9c8395ca91eff25","e15c665f02fb288fc4bdef9d23b2dc802b3aca0d","ae0bc3358fef0ca2a103e694aa556f55a3fed4e98ba57d16f5ae7ad4ad583698")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("ae1e587d19250deb40e92587b8a2188c","efa4fa5ddee99853c32b321496f9369f2db119eb","12331809c3e03d84498f428a37a28cf6cbb1dafe98c36463593ad12898c588c9","4f3ac4c7b5932f11662d4d22fa5d88ec","45d607109d1a12a279664eec8f4bd604287b62c7","04e1772997b884540d5728a2069c3cc93b8f29478e306d341120f789ea8ec79e","3537ed6d4038ca7dbc054308c40fc3e3","a13cb50e2405440ec984dd3fc340bceea4a81cfc","2a652721243f29e82bdf57b565208c59937bbb6af4ab51e7b6ba7ed270ea6bce","fa4b1efd428bbf47f9c8395ca91eff25","e15c665f02fb288fc4bdef9d23b2dc802b3aca0d","ae0bc3358fef0ca2a103e694aa556f55a3fed4e98ba57d16f5ae7ad4ad583698")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("ae1e587d19250deb40e92587b8a2188c","efa4fa5ddee99853c32b321496f9369f2db119eb","12331809c3e03d84498f428a37a28cf6cbb1dafe98c36463593ad12898c588c9","4f3ac4c7b5932f11662d4d22fa5d88ec","45d607109d1a12a279664eec8f4bd604287b62c7","04e1772997b884540d5728a2069c3cc93b8f29478e306d341120f789ea8ec79e","3537ed6d4038ca7dbc054308c40fc3e3","a13cb50e2405440ec984dd3fc340bceea4a81cfc","2a652721243f29e82bdf57b565208c59937bbb6af4ab51e7b6ba7ed270ea6bce","fa4b1efd428bbf47f9c8395ca91eff25","e15c665f02fb288fc4bdef9d23b2dc802b3aca0d","ae0bc3358fef0ca2a103e694aa556f55a3fed4e98ba57d16f5ae7ad4ad583698")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "updaterweb.com" OR destinationhostname CONTAINS "getstatpro.com")
index=activity AND rg_functionality="Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "updaterweb.com" OR destinationhostname CONTAINS "getstatpro.com")
index=activity AND rg_functionality="Web Proxy" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "updaterweb.com" OR destinationhostname CONTAINS "getstatpro.com")
