rg_functionality = "Endpoint Management Systems" AND baseeventid = "1" AND destinationprocessname ENDS WITH "cmd.exe" AND sourceprocessname ENDS WITH "tomcat.exe"
rg_functionality ="Web Proxy" AND RequestURL NOT NULL AND RequestURL CONTAINS "/dload_apps?action"
rg_functionality ="Firewall" AND RequestURL NOT NULL AND RequestURL CONTAINS "/dload_apps?action"
rg_functionality ="Web Server" AND RequestURL NOT NULL AND RequestURL CONTAINS "/dload_apps?action"  
rg_functionality = "Endpoint Management Systems" AND baseeventid = "11" AND filepath ENDS WITH ".zip" AND filepath CONTAINS "SonicWallES\data\branding"
rg_functionality="Web Proxy" AND RequestURL NOT NULL AND RequestURL CONTAINS "/createou?data" 
rg_functionality="Firewall" AND RequestURL NOT NULL AND RequestURL CONTAINS "/createou?data"
rg_functionality="Web Server" AND RequestURL NOT NULL AND RequestURL CONTAINS "/createou?data"
