index=activity AND rg_functionality="Next Generation Firewall" AND ipaddress NOT NULL AND ipaddress IN ("82.146.53.237","179.43.160.195")
index=activity AND rg_functionality="Firewall" AND ipaddress NOT NULL AND ipaddress IN ("82.146.53.237","179.43.160.195")
index=activity AND rg_functionality="Web Proxy" AND ipaddress NOT NULL AND ipaddress IN ("82.146.53.237","179.43.160.195")
index=activity AND rg_functionality="Web Application Firewall" AND ipaddress NOT NULL AND ipaddress IN ("82.146.53.237","179.43.160.195")
index=activity AND rg_functionality="DNS / DHCP" AND ipaddress NOT NULL AND ipaddress IN ("82.146.53.237","179.43.160.195")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND ipaddress NOT NULL AND ipaddress IN ("82.146.53.237","179.43.160.195")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("82.146.53.237","179.43.160.195")
index=activity AND rg_functionality="Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("82.146.53.237","179.43.160.195")
index=activity AND rg_functionality="Web Proxy" AND destinationaddress NOT NULL AND destinationaddress IN ("82.146.53.237","179.43.160.195")
index=activity AND rg_functionality="Web Application Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("82.146.53.237","179.43.160.195")
index=activity AND rg_functionality="DNS / DHCP" AND destinationaddress NOT NULL AND destinationaddress IN ("82.146.53.237","179.43.160.195")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationaddress NOT NULL AND destinationaddress IN ("82.146.53.237","179.43.160.195")
index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("15a7fb45f703d5315320eef132f3151873055161","5816a77bf4f8485bfdab1803d948885f76e0c926fed9da5ac02d94e62af8b145","320eefd378256d6e495cbd2e59b7f205d5101e7f","18cb9b218bd23e936128a37a90f2661f72c820581e4f4303326705b2103714a9","e835de2930bf2708a3a57a99fe775c48f851fa8f","1318aeaea4f2f4299c21699279ca4ea5c8fa7fc38354dd2b80d539f21836df5a","98137dd04e4f350ee6d2f5da613f365b223a4f49","aa41e33d3f184cedaaaabb5e16c251e90a6c4ff721a599642dc5563a57550822","a4854ce87081095ab1f1b26ff16817e446d786af","4a97bc8111631795cb730dfe7836d0afac3131ed8a91db81dde5062bb8021058","c31a0e58ae70f571bf8140db8a1ab20a7f566ab5","315045e506eb5e9f5fd24e4a55cda48d223ac3450037586ce6dab70afc8ddfc9")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("15a7fb45f703d5315320eef132f3151873055161","5816a77bf4f8485bfdab1803d948885f76e0c926fed9da5ac02d94e62af8b145","320eefd378256d6e495cbd2e59b7f205d5101e7f","18cb9b218bd23e936128a37a90f2661f72c820581e4f4303326705b2103714a9","e835de2930bf2708a3a57a99fe775c48f851fa8f","1318aeaea4f2f4299c21699279ca4ea5c8fa7fc38354dd2b80d539f21836df5a","98137dd04e4f350ee6d2f5da613f365b223a4f49","aa41e33d3f184cedaaaabb5e16c251e90a6c4ff721a599642dc5563a57550822","a4854ce87081095ab1f1b26ff16817e446d786af","4a97bc8111631795cb730dfe7836d0afac3131ed8a91db81dde5062bb8021058","c31a0e58ae70f571bf8140db8a1ab20a7f566ab5","315045e506eb5e9f5fd24e4a55cda48d223ac3450037586ce6dab70afc8ddfc9")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("15a7fb45f703d5315320eef132f3151873055161","5816a77bf4f8485bfdab1803d948885f76e0c926fed9da5ac02d94e62af8b145","320eefd378256d6e495cbd2e59b7f205d5101e7f","18cb9b218bd23e936128a37a90f2661f72c820581e4f4303326705b2103714a9","e835de2930bf2708a3a57a99fe775c48f851fa8f","1318aeaea4f2f4299c21699279ca4ea5c8fa7fc38354dd2b80d539f21836df5a","98137dd04e4f350ee6d2f5da613f365b223a4f49","aa41e33d3f184cedaaaabb5e16c251e90a6c4ff721a599642dc5563a57550822","a4854ce87081095ab1f1b26ff16817e446d786af","4a97bc8111631795cb730dfe7836d0afac3131ed8a91db81dde5062bb8021058","c31a0e58ae70f571bf8140db8a1ab20a7f566ab5","315045e506eb5e9f5fd24e4a55cda48d223ac3450037586ce6dab70afc8ddfc9")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("15a7fb45f703d5315320eef132f3151873055161","5816a77bf4f8485bfdab1803d948885f76e0c926fed9da5ac02d94e62af8b145","320eefd378256d6e495cbd2e59b7f205d5101e7f","18cb9b218bd23e936128a37a90f2661f72c820581e4f4303326705b2103714a9","e835de2930bf2708a3a57a99fe775c48f851fa8f","1318aeaea4f2f4299c21699279ca4ea5c8fa7fc38354dd2b80d539f21836df5a","98137dd04e4f350ee6d2f5da613f365b223a4f49","aa41e33d3f184cedaaaabb5e16c251e90a6c4ff721a599642dc5563a57550822","a4854ce87081095ab1f1b26ff16817e446d786af","4a97bc8111631795cb730dfe7836d0afac3131ed8a91db81dde5062bb8021058","c31a0e58ae70f571bf8140db8a1ab20a7f566ab5","315045e506eb5e9f5fd24e4a55cda48d223ac3450037586ce6dab70afc8ddfc9")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("15a7fb45f703d5315320eef132f3151873055161","5816a77bf4f8485bfdab1803d948885f76e0c926fed9da5ac02d94e62af8b145","320eefd378256d6e495cbd2e59b7f205d5101e7f","18cb9b218bd23e936128a37a90f2661f72c820581e4f4303326705b2103714a9","e835de2930bf2708a3a57a99fe775c48f851fa8f","1318aeaea4f2f4299c21699279ca4ea5c8fa7fc38354dd2b80d539f21836df5a","98137dd04e4f350ee6d2f5da613f365b223a4f49","aa41e33d3f184cedaaaabb5e16c251e90a6c4ff721a599642dc5563a57550822","a4854ce87081095ab1f1b26ff16817e446d786af","4a97bc8111631795cb730dfe7836d0afac3131ed8a91db81dde5062bb8021058","c31a0e58ae70f571bf8140db8a1ab20a7f566ab5","315045e506eb5e9f5fd24e4a55cda48d223ac3450037586ce6dab70afc8ddfc9")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("15a7fb45f703d5315320eef132f3151873055161","5816a77bf4f8485bfdab1803d948885f76e0c926fed9da5ac02d94e62af8b145","320eefd378256d6e495cbd2e59b7f205d5101e7f","18cb9b218bd23e936128a37a90f2661f72c820581e4f4303326705b2103714a9","e835de2930bf2708a3a57a99fe775c48f851fa8f","1318aeaea4f2f4299c21699279ca4ea5c8fa7fc38354dd2b80d539f21836df5a","98137dd04e4f350ee6d2f5da613f365b223a4f49","aa41e33d3f184cedaaaabb5e16c251e90a6c4ff721a599642dc5563a57550822","a4854ce87081095ab1f1b26ff16817e446d786af","4a97bc8111631795cb730dfe7836d0afac3131ed8a91db81dde5062bb8021058","c31a0e58ae70f571bf8140db8a1ab20a7f566ab5","315045e506eb5e9f5fd24e4a55cda48d223ac3450037586ce6dab70afc8ddfc9")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "sugarpanel.space" OR destinationhostname CONTAINS "bottomcdnfiles.com" OR destinationhostname CONTAINS "cdnmegafiles.com" OR destinationhostname CONTAINS "chat5sqrnzqewampznybomgn4hf2m53tybkarxk4sfaktwt7oqpkcvyd.onion")
index=activity AND rg_functionality="Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "sugarpanel.space" OR destinationhostname CONTAINS "bottomcdnfiles.com" OR destinationhostname CONTAINS "cdnmegafiles.com" OR destinationhostname CONTAINS "chat5sqrnzqewampznybomgn4hf2m53tybkarxk4sfaktwt7oqpkcvyd.onion")
index=activity AND rg_functionality="Web Proxy" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "sugarpanel.space" OR destinationhostname CONTAINS "bottomcdnfiles.com" OR destinationhostname CONTAINS "cdnmegafiles.com" OR destinationhostname CONTAINS "chat5sqrnzqewampznybomgn4hf2m53tybkarxk4sfaktwt7oqpkcvyd.onion")
