index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("bd0141e88a0d56b508bc52db4dab68a49b6027a486e4d9514ec0db006fe71eed","d028e64bf4ec97dfd655ccd1157a5b96515d461a710231ac8a529d7bdb936ff3","1a9a5c797777f37463b44de2b49a7f95abca786db3977dcdac0f79da739c08ac","61df74731fbe1eafb2eb987f20e5226962eeceef010164e41ea6c4494a4010fc","1ffd6559d21470c40dcf9236da51e5823d7ad58c93502279871c3fe7718c901c")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("bd0141e88a0d56b508bc52db4dab68a49b6027a486e4d9514ec0db006fe71eed","d028e64bf4ec97dfd655ccd1157a5b96515d461a710231ac8a529d7bdb936ff3","1a9a5c797777f37463b44de2b49a7f95abca786db3977dcdac0f79da739c08ac","61df74731fbe1eafb2eb987f20e5226962eeceef010164e41ea6c4494a4010fc","1ffd6559d21470c40dcf9236da51e5823d7ad58c93502279871c3fe7718c901c")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("bd0141e88a0d56b508bc52db4dab68a49b6027a486e4d9514ec0db006fe71eed","d028e64bf4ec97dfd655ccd1157a5b96515d461a710231ac8a529d7bdb936ff3","1a9a5c797777f37463b44de2b49a7f95abca786db3977dcdac0f79da739c08ac","61df74731fbe1eafb2eb987f20e5226962eeceef010164e41ea6c4494a4010fc","1ffd6559d21470c40dcf9236da51e5823d7ad58c93502279871c3fe7718c901c")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("bd0141e88a0d56b508bc52db4dab68a49b6027a486e4d9514ec0db006fe71eed","d028e64bf4ec97dfd655ccd1157a5b96515d461a710231ac8a529d7bdb936ff3","1a9a5c797777f37463b44de2b49a7f95abca786db3977dcdac0f79da739c08ac","61df74731fbe1eafb2eb987f20e5226962eeceef010164e41ea6c4494a4010fc","1ffd6559d21470c40dcf9236da51e5823d7ad58c93502279871c3fe7718c901c")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("bd0141e88a0d56b508bc52db4dab68a49b6027a486e4d9514ec0db006fe71eed","d028e64bf4ec97dfd655ccd1157a5b96515d461a710231ac8a529d7bdb936ff3","1a9a5c797777f37463b44de2b49a7f95abca786db3977dcdac0f79da739c08ac","61df74731fbe1eafb2eb987f20e5226962eeceef010164e41ea6c4494a4010fc","1ffd6559d21470c40dcf9236da51e5823d7ad58c93502279871c3fe7718c901c")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("bd0141e88a0d56b508bc52db4dab68a49b6027a486e4d9514ec0db006fe71eed","d028e64bf4ec97dfd655ccd1157a5b96515d461a710231ac8a529d7bdb936ff3","1a9a5c797777f37463b44de2b49a7f95abca786db3977dcdac0f79da739c08ac","61df74731fbe1eafb2eb987f20e5226962eeceef010164e41ea6c4494a4010fc","1ffd6559d21470c40dcf9236da51e5823d7ad58c93502279871c3fe7718c901c")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "bookitlab.tech" OR destinationhostname CONTAINS "winaudio-tools.com" OR destinationhostname CONTAINS "graphic-updater.com" OR destinationhostname CONTAINS "github.url-mini.com" OR destinationhostname CONTAINS "office360-update.com")
index=activity AND rg_functionality="Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "bookitlab.tech" OR destinationhostname CONTAINS "winaudio-tools.com" OR destinationhostname CONTAINS "graphic-updater.com" OR destinationhostname CONTAINS "github.url-mini.com" OR destinationhostname CONTAINS "office360-update.com")
index=activity AND rg_functionality="Web Proxy" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "bookitlab.tech" OR destinationhostname CONTAINS "winaudio-tools.com" OR destinationhostname CONTAINS "graphic-updater.com" OR destinationhostname CONTAINS "github.url-mini.com" OR destinationhostname CONTAINS "office360-update.com")
index=activity AND rg_functionality="Web Proxy" AND requesturl NOT NULL AND requesturl IN ("bookitlab.tech","winaudio-tools.com","graphic-updater.com","github.url-mini.com","office360-update.com","https://drive.google.com/uc?export=download&id=1-NVty4YX0dPHdxkgMrbdCldQCpCaE-Hn","https://drive.google.com/uc?exp ort=download&id=1W64PQQxrwY3XjBnv_QAeBQu-ePr537eu")
