index=activity AND rg_functionality="Next Generation Firewall" AND ipaddress NOT NULL AND ipaddress IN ("119.205.235.58","136.243.90.99","153.127.216.132","94.176.237.229","94.176.237.229")
index=activity AND rg_functionality="Firewall" AND ipaddress NOT NULL AND ipaddress IN ("119.205.235.58","136.243.90.99","153.127.216.132","94.176.237.229","94.176.237.229")
index=activity AND rg_functionality="Web Proxy" AND ipaddress NOT NULL AND ipaddress IN ("119.205.235.58","136.243.90.99","153.127.216.132","94.176.237.229","94.176.237.229")
index=activity AND rg_functionality="Web Application Firewall" AND ipaddress NOT NULL AND ipaddress IN ("119.205.235.58","136.243.90.99","153.127.216.132","94.176.237.229","94.176.237.229")
index=activity AND rg_functionality="DNS / DHCP" AND ipaddress NOT NULL AND ipaddress IN ("119.205.235.58","136.243.90.99","153.127.216.132","94.176.237.229","94.176.237.229")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND ipaddress NOT NULL AND ipaddress IN ("119.205.235.58","136.243.90.99","153.127.216.132","94.176.237.229","94.176.237.229")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("119.205.235.58","136.243.90.99","153.127.216.132","94.176.237.229","94.176.237.229")
index=activity AND rg_functionality="Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("119.205.235.58","136.243.90.99","153.127.216.132","94.176.237.229","94.176.237.229")
index=activity AND rg_functionality="Web Proxy" AND destinationaddress NOT NULL AND destinationaddress IN ("119.205.235.58","136.243.90.99","153.127.216.132","94.176.237.229","94.176.237.229")
index=activity AND rg_functionality="Web Application Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("119.205.235.58","136.243.90.99","153.127.216.132","94.176.237.229","94.176.237.229")
index=activity AND rg_functionality="DNS / DHCP" AND destinationaddress NOT NULL AND destinationaddress IN ("119.205.235.58","136.243.90.99","153.127.216.132","94.176.237.229","94.176.237.229")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationaddress NOT NULL AND destinationaddress IN ("119.205.235.58","136.243.90.99","153.127.216.132","94.176.237.229","94.176.237.229")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "7jmrbtrvkgcqkldzyob4kotpyvsgz546yvik2xv4rpnfmrhe4imxthqd.onion" OR destinationhostname CONTAINS "bggts547gukhvmf4cgandlgxxphengxovoyo6ewhns5qmmb2b5oi43yd.onion" OR destinationhostname CONTAINS "Dreambusweduybcp.onion" OR destinationhostname CONTAINS "i62hmnztfpzwrhjg34m6ruxem5oe36nulzmxcgbdbkiaceubprkta7ad.onion" OR destinationhostname CONTAINS "ji55jjplpknk7eayxxtb5o3ulxuevntutsdanov5dp3wya7l7btjv4qd.onion" OR destinationhostname CONTAINS "mhevkk4odgzqpt2hbj3hhw2uz4vhunoo55evewrgmouyiehcaltmbrqd.onion" OR destinationhostname CONTAINS "ojk5zra7b3yq32timb27n4qj5udk4w2l5kqn5ulhnugdscelttfhtoyd.onion" OR destinationhostname CONTAINS "plgs6otqdiu7snxdfwjnidhw4ncmp5qvvxi5gepiszg75kxebwci2wad.onion" OR destinationhostname CONTAINS "Ryukdssuskovhnwb.onion" OR destinationhostname CONTAINS "sg722jwocbvedckhd4dptpqfek5fsbmx3v57qg6lzhuo56np73mb3zyd.onion" OR destinationhostname CONTAINS "trumpzbffbewy3gn.onion" OR destinationhostname CONTAINS "Trumpzwlvlyrvlss.onion" OR destinationhostname CONTAINS "Unixdbnuadxmwtob.onion" OR destinationhostname CONTAINS "va6xh4hqgb754klsffjamjgotlq7mne3lyyrhu5vhypakbumzeo4c4ad.onion" OR destinationhostname CONTAINS "y4mcrfeigcaa2robjk3azb2qwcd5hk45xpoaddupmdwv24qoggnmdbid.onion" OR destinationhostname CONTAINS "yrxxxqia45xxcdqfwyx4pk6ufyanazdwjbv3de7r4mrtyztt5mpw35yd.onion")
index=activity AND rg_functionality="Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "7jmrbtrvkgcqkldzyob4kotpyvsgz546yvik2xv4rpnfmrhe4imxthqd.onion" OR destinationhostname CONTAINS "bggts547gukhvmf4cgandlgxxphengxovoyo6ewhns5qmmb2b5oi43yd.onion" OR destinationhostname CONTAINS "Dreambusweduybcp.onion" OR destinationhostname CONTAINS "i62hmnztfpzwrhjg34m6ruxem5oe36nulzmxcgbdbkiaceubprkta7ad.onion" OR destinationhostname CONTAINS "ji55jjplpknk7eayxxtb5o3ulxuevntutsdanov5dp3wya7l7btjv4qd.onion" OR destinationhostname CONTAINS "mhevkk4odgzqpt2hbj3hhw2uz4vhunoo55evewrgmouyiehcaltmbrqd.onion" OR destinationhostname CONTAINS "ojk5zra7b3yq32timb27n4qj5udk4w2l5kqn5ulhnugdscelttfhtoyd.onion" OR destinationhostname CONTAINS "plgs6otqdiu7snxdfwjnidhw4ncmp5qvvxi5gepiszg75kxebwci2wad.onion" OR destinationhostname CONTAINS "Ryukdssuskovhnwb.onion" OR destinationhostname CONTAINS "sg722jwocbvedckhd4dptpqfek5fsbmx3v57qg6lzhuo56np73mb3zyd.onion" OR destinationhostname CONTAINS "trumpzbffbewy3gn.onion" OR destinationhostname CONTAINS "Trumpzwlvlyrvlss.onion" OR destinationhostname CONTAINS "Unixdbnuadxmwtob.onion" OR destinationhostname CONTAINS "va6xh4hqgb754klsffjamjgotlq7mne3lyyrhu5vhypakbumzeo4c4ad.onion" OR destinationhostname CONTAINS "y4mcrfeigcaa2robjk3azb2qwcd5hk45xpoaddupmdwv24qoggnmdbid.onion" OR destinationhostname CONTAINS "yrxxxqia45xxcdqfwyx4pk6ufyanazdwjbv3de7r4mrtyztt5mpw35yd.onion")
index=activity AND rg_functionality="Web Proxy" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "7jmrbtrvkgcqkldzyob4kotpyvsgz546yvik2xv4rpnfmrhe4imxthqd.onion" OR destinationhostname CONTAINS "bggts547gukhvmf4cgandlgxxphengxovoyo6ewhns5qmmb2b5oi43yd.onion" OR destinationhostname CONTAINS "Dreambusweduybcp.onion" OR destinationhostname CONTAINS "i62hmnztfpzwrhjg34m6ruxem5oe36nulzmxcgbdbkiaceubprkta7ad.onion" OR destinationhostname CONTAINS "ji55jjplpknk7eayxxtb5o3ulxuevntutsdanov5dp3wya7l7btjv4qd.onion" OR destinationhostname CONTAINS "mhevkk4odgzqpt2hbj3hhw2uz4vhunoo55evewrgmouyiehcaltmbrqd.onion" OR destinationhostname CONTAINS "ojk5zra7b3yq32timb27n4qj5udk4w2l5kqn5ulhnugdscelttfhtoyd.onion" OR destinationhostname CONTAINS "plgs6otqdiu7snxdfwjnidhw4ncmp5qvvxi5gepiszg75kxebwci2wad.onion" OR destinationhostname CONTAINS "Ryukdssuskovhnwb.onion" OR destinationhostname CONTAINS "sg722jwocbvedckhd4dptpqfek5fsbmx3v57qg6lzhuo56np73mb3zyd.onion" OR destinationhostname CONTAINS "trumpzbffbewy3gn.onion" OR destinationhostname CONTAINS "Trumpzwlvlyrvlss.onion" OR destinationhostname CONTAINS "Unixdbnuadxmwtob.onion" OR destinationhostname CONTAINS "va6xh4hqgb754klsffjamjgotlq7mne3lyyrhu5vhypakbumzeo4c4ad.onion" OR destinationhostname CONTAINS "y4mcrfeigcaa2robjk3azb2qwcd5hk45xpoaddupmdwv24qoggnmdbid.onion" OR destinationhostname CONTAINS "yrxxxqia45xxcdqfwyx4pk6ufyanazdwjbv3de7r4mrtyztt5mpw35yd.onion")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationaddress NOT NULL AND destinationport NOT NULL AND ((destinationaddress="144.76.110.70" AND destinationport=9050) OR (destinationaddress="172.104.56.209" AND destinationport=9050) OR (destinationaddress="178.128.84.253" AND destinationport=9050) OR (destinationaddress="185.188.183.254" AND destinationport=9050) OR (destinationaddress="185.35.223.76" AND destinationport=9050) OR (destinationaddress="201.159.100.58" AND destinationport=9050) OR (destinationaddress="209.97.174.97" AND destinationport=9050) OR (destinationaddress="45.32.171.166" AND destinationport=9050) OR (destinationaddress="46.101.61.9" AND destinationport=9050) OR (destinationaddress="46.229.55.38" AND destinationport=9050))
index=activity AND rg_functionality="Firewall" AND destinationaddress NOT NULL AND destinationport NOT NULL AND ((destinationaddress="144.76.110.70" AND destinationport=9050) OR (destinationaddress="172.104.56.209" AND destinationport=9050) OR (destinationaddress="178.128.84.253" AND destinationport=9050) OR (destinationaddress="185.188.183.254" AND destinationport=9050) OR (destinationaddress="185.35.223.76" AND destinationport=9050) OR (destinationaddress="201.159.100.58" AND destinationport=9050) OR (destinationaddress="209.97.174.97" AND destinationport=9050) OR (destinationaddress="45.32.171.166" AND destinationport=9050) OR (destinationaddress="46.101.61.9" AND destinationport=9050) OR (destinationaddress="46.229.55.38" AND destinationport=9050))
index=activity AND rg_functionality="Next Generation Firewall" AND destinationaddress NOT NULL AND destinationport NOT NULL AND ((destinationaddress="46.229.55.39" AND destinationport=9050) OR (destinationaddress="51.103.16.14" AND destinationport=9050) OR (destinationaddress="51.68.214.156" AND destinationport=9050) OR (destinationaddress="51.75.163.92" AND destinationport=9050) OR (destinationaddress="51.89.149.71" AND destinationport=9050) OR (destinationaddress="67.149.39.182" AND destinationport=9050) OR (destinationaddress="77.120.123.179" AND destinationport=9050) OR (destinationaddress="77.66.176.9" AND destinationport=9050) OR (destinationaddress="82.37.194.181" AND destinationport=9050) OR (destinationaddress="83.217.28.46" AND destinationport=9050))
index=activity AND rg_functionality="Firewall" AND destinationaddress NOT NULL AND destinationport NOT NULL AND ((destinationaddress="46.229.55.39" AND destinationport=9050) OR (destinationaddress="51.103.16.14" AND destinationport=9050) OR (destinationaddress="51.68.214.156" AND destinationport=9050) OR (destinationaddress="51.75.163.92" AND destinationport=9050) OR (destinationaddress="51.89.149.71" AND destinationport=9050) OR (destinationaddress="67.149.39.182" AND destinationport=9050) OR (destinationaddress="77.120.123.179" AND destinationport=9050) OR (destinationaddress="77.66.176.9" AND destinationport=9050) OR (destinationaddress="82.37.194.181" AND destinationport=9050) OR (destinationaddress="83.217.28.46" AND destinationport=9050))
index=activity AND rg_functionality="Next Generation Firewall" AND destinationaddress NOT NULL AND destinationport NOT NULL AND ((destinationaddress="85.159.44.163" AND destinationport=9050) OR (destinationaddress="85.234.143.106" AND destinationport=9050) OR (destinationaddress="91.194.250.134" AND destinationport=9050) OR (destinationaddress="92.63.192.7" AND destinationport=9050) OR (destinationaddress="119.205.235.58" AND destinationport=443) OR (destinationaddress="119.205.235.58" AND destinationport=8080) OR (destinationaddress="136.243.90.99" AND destinationport=443) OR (destinationaddress="136.243.90.99" AND destinationport=8080) OR (destinationaddress="153.127.216.132" AND destinationport=8080) OR (destinationaddress="94.176.237.229" AND destinationport=443))
index=activity AND rg_functionality="Firewall" AND destinationaddress NOT NULL AND destinationport NOT NULL AND ((destinationaddress="85.159.44.163" AND destinationport=9050) OR (destinationaddress="85.234.143.106" AND destinationport=9050) OR (destinationaddress="91.194.250.134" AND destinationport=9050) OR (destinationaddress="92.63.192.7" AND destinationport=9050) OR (destinationaddress="119.205.235.58" AND destinationport=443) OR (destinationaddress="119.205.235.58" AND destinationport=8080) OR (destinationaddress="136.243.90.99" AND destinationport=443) OR (destinationaddress="136.243.90.99" AND destinationport=8080) OR (destinationaddress="153.127.216.132" AND destinationport=8080) OR (destinationaddress="94.176.237.229" AND destinationport=443))
index=activity AND rg_functionality="Next Generation Firewall" AND destinationaddress NOT NULL AND destinationport NOT NULL AND ((destinationaddress="94.176.237.229" AND destinationport=80) OR (destinationaddress="94.176.237.229" AND destinationport=8080))
index=activity AND rg_functionality="Firewall" AND destinationaddress NOT NULL AND destinationport NOT NULL AND ((destinationaddress="94.176.237.229" AND destinationport=80) OR (destinationaddress="94.176.237.229" AND destinationport=8080))
