index=activity AND rg_functionality="Next Generation Firewall" AND ipaddress NOT NULL AND ipaddress IN ("185.215.113.31","178.32.130.170")
index=activity AND rg_functionality="Firewall" AND ipaddress NOT NULL AND ipaddress IN ("185.215.113.31","178.32.130.170")
index=activity AND rg_functionality="Web Proxy" AND ipaddress NOT NULL AND ipaddress IN ("185.215.113.31","178.32.130.170")
index=activity AND rg_functionality="Web Application Firewall" AND ipaddress NOT NULL AND ipaddress IN ("185.215.113.31","178.32.130.170")
index=activity AND rg_functionality="DNS / DHCP" AND ipaddress NOT NULL AND ipaddress IN ("185.215.113.31","178.32.130.170")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND ipaddress NOT NULL AND ipaddress IN ("185.215.113.31","178.32.130.170")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("185.215.113.31","178.32.130.170")
index=activity AND rg_functionality="Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("185.215.113.31","178.32.130.170")
index=activity AND rg_functionality="Web Proxy" AND destinationaddress NOT NULL AND destinationaddress IN ("185.215.113.31","178.32.130.170")
index=activity AND rg_functionality="Web Application Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("185.215.113.31","178.32.130.170")
index=activity AND rg_functionality="DNS / DHCP" AND destinationaddress NOT NULL AND destinationaddress IN ("185.215.113.31","178.32.130.170")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationaddress NOT NULL AND destinationaddress IN ("185.215.113.31","178.32.130.170")
index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("89e5746d0903777ef68582733c777b9ee53c42dc4d64187398e1131cccfc0599","7f5b870ed1f286d8a08a1860d38ef4966d4e9754b2d42bf41d7511e1856cc990")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("89e5746d0903777ef68582733c777b9ee53c42dc4d64187398e1131cccfc0599","7f5b870ed1f286d8a08a1860d38ef4966d4e9754b2d42bf41d7511e1856cc990")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("89e5746d0903777ef68582733c777b9ee53c42dc4d64187398e1131cccfc0599","7f5b870ed1f286d8a08a1860d38ef4966d4e9754b2d42bf41d7511e1856cc990")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("89e5746d0903777ef68582733c777b9ee53c42dc4d64187398e1131cccfc0599","7f5b870ed1f286d8a08a1860d38ef4966d4e9754b2d42bf41d7511e1856cc990")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("89e5746d0903777ef68582733c777b9ee53c42dc4d64187398e1131cccfc0599","7f5b870ed1f286d8a08a1860d38ef4966d4e9754b2d42bf41d7511e1856cc990")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("89e5746d0903777ef68582733c777b9ee53c42dc4d64187398e1131cccfc0599","7f5b870ed1f286d8a08a1860d38ef4966d4e9754b2d42bf41d7511e1856cc990")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "kopozkapalo.xyz" OR destinationhostname CONTAINS "sepoloskotop.xyz")
index=activity AND rg_functionality="Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "kopozkapalo.xyz" OR destinationhostname CONTAINS "sepoloskotop.xyz")
index=activity AND rg_functionality="Web Proxy" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "kopozkapalo.xyz" OR destinationhostname CONTAINS "sepoloskotop.xyz")
