index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("e4cbf31ac0aacb712219b080af8ccbc11899cc1e7a695077b61df5317ffc3a1d","3834d3be235ebc488832a35dbd98d301c33281f9062a2cb16a681b77b3480044","5731851703e6ca1dd31c4ba3455a4e961621aab904d53ff5d747f811d3dee1b0","b5eaf10fcee125295402478e086f6e3c441024daec47dde0170ba528525f1eb2","eccf6b8a45f044951712b08013fcb020bff95e7c784164464afcf5e6adba1fdb","0c26d498ccd4d7aea16e4b6e7e647fe4e16b89f67e18a8eacb4b0965fce2f381","65a060f8606f2213f1480ea132d519590f2736d8e1f53edb33fdfb27b3c9d869","c0cdd15f9913c6e88d7e124cbcba7ea981f12a856f473d0e96a94d8835d9ecf3","86c4e141ec49a5bb2646d39efec6207f01f9f9cfdff552715fcef860ec7d0b2d","4635a9149c53a2fbc072ceb338351d3b149e093cd43163e01d629bb016f8cd7c","54bc5a6ed4cca0770ced899f55b18a9e4d7ba7c6b0136f3291c43a5112ef0800","7b2f904ede2ef17c8b9cda1433ffab97b5f7098ee33664a8362beaa1479e1baa","0df41caa968a517a454a6f36528c572af685f1ab62f792760e3a4d8e9de40461","bfe368b6b3729f8dfee1531e43cd41a787c554e3090645dd66f9785be96ccff4","f06e0e417bca037bfa2150451bb6a4e38aa9db104c29167c1f642dc2ca60abfc","1bda055af670cb8e8f37d4860197b58cea1464c16dfaa31fadf42a9eedee8b25","c04f64f0b5cbd336ad8b5dcf40727f50dba7534d66df1998110f38af533b45b3","c0cdd15f9913c6e88d7e124cbcba7ea981f12a856f473d0e96a94d8835d9ecf3","ced59ab566ffe8b3274d7bba452a3b93341411c2c1cc23f2577a767ac846591a")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("e4cbf31ac0aacb712219b080af8ccbc11899cc1e7a695077b61df5317ffc3a1d","3834d3be235ebc488832a35dbd98d301c33281f9062a2cb16a681b77b3480044","5731851703e6ca1dd31c4ba3455a4e961621aab904d53ff5d747f811d3dee1b0","b5eaf10fcee125295402478e086f6e3c441024daec47dde0170ba528525f1eb2","eccf6b8a45f044951712b08013fcb020bff95e7c784164464afcf5e6adba1fdb","0c26d498ccd4d7aea16e4b6e7e647fe4e16b89f67e18a8eacb4b0965fce2f381","65a060f8606f2213f1480ea132d519590f2736d8e1f53edb33fdfb27b3c9d869","c0cdd15f9913c6e88d7e124cbcba7ea981f12a856f473d0e96a94d8835d9ecf3","86c4e141ec49a5bb2646d39efec6207f01f9f9cfdff552715fcef860ec7d0b2d","4635a9149c53a2fbc072ceb338351d3b149e093cd43163e01d629bb016f8cd7c","54bc5a6ed4cca0770ced899f55b18a9e4d7ba7c6b0136f3291c43a5112ef0800","7b2f904ede2ef17c8b9cda1433ffab97b5f7098ee33664a8362beaa1479e1baa","0df41caa968a517a454a6f36528c572af685f1ab62f792760e3a4d8e9de40461","bfe368b6b3729f8dfee1531e43cd41a787c554e3090645dd66f9785be96ccff4","f06e0e417bca037bfa2150451bb6a4e38aa9db104c29167c1f642dc2ca60abfc","1bda055af670cb8e8f37d4860197b58cea1464c16dfaa31fadf42a9eedee8b25","c04f64f0b5cbd336ad8b5dcf40727f50dba7534d66df1998110f38af533b45b3","c0cdd15f9913c6e88d7e124cbcba7ea981f12a856f473d0e96a94d8835d9ecf3","ced59ab566ffe8b3274d7bba452a3b93341411c2c1cc23f2577a767ac846591a")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("e4cbf31ac0aacb712219b080af8ccbc11899cc1e7a695077b61df5317ffc3a1d","3834d3be235ebc488832a35dbd98d301c33281f9062a2cb16a681b77b3480044","5731851703e6ca1dd31c4ba3455a4e961621aab904d53ff5d747f811d3dee1b0","b5eaf10fcee125295402478e086f6e3c441024daec47dde0170ba528525f1eb2","eccf6b8a45f044951712b08013fcb020bff95e7c784164464afcf5e6adba1fdb","0c26d498ccd4d7aea16e4b6e7e647fe4e16b89f67e18a8eacb4b0965fce2f381","65a060f8606f2213f1480ea132d519590f2736d8e1f53edb33fdfb27b3c9d869","c0cdd15f9913c6e88d7e124cbcba7ea981f12a856f473d0e96a94d8835d9ecf3","86c4e141ec49a5bb2646d39efec6207f01f9f9cfdff552715fcef860ec7d0b2d","4635a9149c53a2fbc072ceb338351d3b149e093cd43163e01d629bb016f8cd7c","54bc5a6ed4cca0770ced899f55b18a9e4d7ba7c6b0136f3291c43a5112ef0800","7b2f904ede2ef17c8b9cda1433ffab97b5f7098ee33664a8362beaa1479e1baa","0df41caa968a517a454a6f36528c572af685f1ab62f792760e3a4d8e9de40461","bfe368b6b3729f8dfee1531e43cd41a787c554e3090645dd66f9785be96ccff4","f06e0e417bca037bfa2150451bb6a4e38aa9db104c29167c1f642dc2ca60abfc","1bda055af670cb8e8f37d4860197b58cea1464c16dfaa31fadf42a9eedee8b25","c04f64f0b5cbd336ad8b5dcf40727f50dba7534d66df1998110f38af533b45b3","c0cdd15f9913c6e88d7e124cbcba7ea981f12a856f473d0e96a94d8835d9ecf3","ced59ab566ffe8b3274d7bba452a3b93341411c2c1cc23f2577a767ac846591a")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring64 NOT NULL AND customstring64 IN ("e4cbf31ac0aacb712219b080af8ccbc11899cc1e7a695077b61df5317ffc3a1d","3834d3be235ebc488832a35dbd98d301c33281f9062a2cb16a681b77b3480044","5731851703e6ca1dd31c4ba3455a4e961621aab904d53ff5d747f811d3dee1b0","b5eaf10fcee125295402478e086f6e3c441024daec47dde0170ba528525f1eb2","eccf6b8a45f044951712b08013fcb020bff95e7c784164464afcf5e6adba1fdb","0c26d498ccd4d7aea16e4b6e7e647fe4e16b89f67e18a8eacb4b0965fce2f381","65a060f8606f2213f1480ea132d519590f2736d8e1f53edb33fdfb27b3c9d869","c0cdd15f9913c6e88d7e124cbcba7ea981f12a856f473d0e96a94d8835d9ecf3","86c4e141ec49a5bb2646d39efec6207f01f9f9cfdff552715fcef860ec7d0b2d","4635a9149c53a2fbc072ceb338351d3b149e093cd43163e01d629bb016f8cd7c","54bc5a6ed4cca0770ced899f55b18a9e4d7ba7c6b0136f3291c43a5112ef0800","7b2f904ede2ef17c8b9cda1433ffab97b5f7098ee33664a8362beaa1479e1baa","0df41caa968a517a454a6f36528c572af685f1ab62f792760e3a4d8e9de40461","bfe368b6b3729f8dfee1531e43cd41a787c554e3090645dd66f9785be96ccff4","f06e0e417bca037bfa2150451bb6a4e38aa9db104c29167c1f642dc2ca60abfc","1bda055af670cb8e8f37d4860197b58cea1464c16dfaa31fadf42a9eedee8b25","c04f64f0b5cbd336ad8b5dcf40727f50dba7534d66df1998110f38af533b45b3","c0cdd15f9913c6e88d7e124cbcba7ea981f12a856f473d0e96a94d8835d9ecf3","ced59ab566ffe8b3274d7bba452a3b93341411c2c1cc23f2577a767ac846591a")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("e4cbf31ac0aacb712219b080af8ccbc11899cc1e7a695077b61df5317ffc3a1d","3834d3be235ebc488832a35dbd98d301c33281f9062a2cb16a681b77b3480044","5731851703e6ca1dd31c4ba3455a4e961621aab904d53ff5d747f811d3dee1b0","b5eaf10fcee125295402478e086f6e3c441024daec47dde0170ba528525f1eb2","eccf6b8a45f044951712b08013fcb020bff95e7c784164464afcf5e6adba1fdb","0c26d498ccd4d7aea16e4b6e7e647fe4e16b89f67e18a8eacb4b0965fce2f381","65a060f8606f2213f1480ea132d519590f2736d8e1f53edb33fdfb27b3c9d869","c0cdd15f9913c6e88d7e124cbcba7ea981f12a856f473d0e96a94d8835d9ecf3","86c4e141ec49a5bb2646d39efec6207f01f9f9cfdff552715fcef860ec7d0b2d","4635a9149c53a2fbc072ceb338351d3b149e093cd43163e01d629bb016f8cd7c","54bc5a6ed4cca0770ced899f55b18a9e4d7ba7c6b0136f3291c43a5112ef0800","7b2f904ede2ef17c8b9cda1433ffab97b5f7098ee33664a8362beaa1479e1baa","0df41caa968a517a454a6f36528c572af685f1ab62f792760e3a4d8e9de40461","bfe368b6b3729f8dfee1531e43cd41a787c554e3090645dd66f9785be96ccff4","f06e0e417bca037bfa2150451bb6a4e38aa9db104c29167c1f642dc2ca60abfc","1bda055af670cb8e8f37d4860197b58cea1464c16dfaa31fadf42a9eedee8b25","c04f64f0b5cbd336ad8b5dcf40727f50dba7534d66df1998110f38af533b45b3","c0cdd15f9913c6e88d7e124cbcba7ea981f12a856f473d0e96a94d8835d9ecf3","ced59ab566ffe8b3274d7bba452a3b93341411c2c1cc23f2577a767ac846591a")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("e4cbf31ac0aacb712219b080af8ccbc11899cc1e7a695077b61df5317ffc3a1d","3834d3be235ebc488832a35dbd98d301c33281f9062a2cb16a681b77b3480044","5731851703e6ca1dd31c4ba3455a4e961621aab904d53ff5d747f811d3dee1b0","b5eaf10fcee125295402478e086f6e3c441024daec47dde0170ba528525f1eb2","eccf6b8a45f044951712b08013fcb020bff95e7c784164464afcf5e6adba1fdb","0c26d498ccd4d7aea16e4b6e7e647fe4e16b89f67e18a8eacb4b0965fce2f381","65a060f8606f2213f1480ea132d519590f2736d8e1f53edb33fdfb27b3c9d869","c0cdd15f9913c6e88d7e124cbcba7ea981f12a856f473d0e96a94d8835d9ecf3","86c4e141ec49a5bb2646d39efec6207f01f9f9cfdff552715fcef860ec7d0b2d","4635a9149c53a2fbc072ceb338351d3b149e093cd43163e01d629bb016f8cd7c","54bc5a6ed4cca0770ced899f55b18a9e4d7ba7c6b0136f3291c43a5112ef0800","7b2f904ede2ef17c8b9cda1433ffab97b5f7098ee33664a8362beaa1479e1baa","0df41caa968a517a454a6f36528c572af685f1ab62f792760e3a4d8e9de40461","bfe368b6b3729f8dfee1531e43cd41a787c554e3090645dd66f9785be96ccff4","f06e0e417bca037bfa2150451bb6a4e38aa9db104c29167c1f642dc2ca60abfc","1bda055af670cb8e8f37d4860197b58cea1464c16dfaa31fadf42a9eedee8b25","c04f64f0b5cbd336ad8b5dcf40727f50dba7534d66df1998110f38af533b45b3","c0cdd15f9913c6e88d7e124cbcba7ea981f12a856f473d0e96a94d8835d9ecf3","ced59ab566ffe8b3274d7bba452a3b93341411c2c1cc23f2577a767ac846591a")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("e4cbf31ac0aacb712219b080af8ccbc11899cc1e7a695077b61df5317ffc3a1d","3834d3be235ebc488832a35dbd98d301c33281f9062a2cb16a681b77b3480044","5731851703e6ca1dd31c4ba3455a4e961621aab904d53ff5d747f811d3dee1b0","b5eaf10fcee125295402478e086f6e3c441024daec47dde0170ba528525f1eb2","eccf6b8a45f044951712b08013fcb020bff95e7c784164464afcf5e6adba1fdb","0c26d498ccd4d7aea16e4b6e7e647fe4e16b89f67e18a8eacb4b0965fce2f381","65a060f8606f2213f1480ea132d519590f2736d8e1f53edb33fdfb27b3c9d869","c0cdd15f9913c6e88d7e124cbcba7ea981f12a856f473d0e96a94d8835d9ecf3","86c4e141ec49a5bb2646d39efec6207f01f9f9cfdff552715fcef860ec7d0b2d","4635a9149c53a2fbc072ceb338351d3b149e093cd43163e01d629bb016f8cd7c","54bc5a6ed4cca0770ced899f55b18a9e4d7ba7c6b0136f3291c43a5112ef0800","7b2f904ede2ef17c8b9cda1433ffab97b5f7098ee33664a8362beaa1479e1baa","0df41caa968a517a454a6f36528c572af685f1ab62f792760e3a4d8e9de40461","bfe368b6b3729f8dfee1531e43cd41a787c554e3090645dd66f9785be96ccff4","f06e0e417bca037bfa2150451bb6a4e38aa9db104c29167c1f642dc2ca60abfc","1bda055af670cb8e8f37d4860197b58cea1464c16dfaa31fadf42a9eedee8b25","c04f64f0b5cbd336ad8b5dcf40727f50dba7534d66df1998110f38af533b45b3","c0cdd15f9913c6e88d7e124cbcba7ea981f12a856f473d0e96a94d8835d9ecf3","ced59ab566ffe8b3274d7bba452a3b93341411c2c1cc23f2577a767ac846591a")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("e4cbf31ac0aacb712219b080af8ccbc11899cc1e7a695077b61df5317ffc3a1d","3834d3be235ebc488832a35dbd98d301c33281f9062a2cb16a681b77b3480044","5731851703e6ca1dd31c4ba3455a4e961621aab904d53ff5d747f811d3dee1b0","b5eaf10fcee125295402478e086f6e3c441024daec47dde0170ba528525f1eb2","eccf6b8a45f044951712b08013fcb020bff95e7c784164464afcf5e6adba1fdb","0c26d498ccd4d7aea16e4b6e7e647fe4e16b89f67e18a8eacb4b0965fce2f381","65a060f8606f2213f1480ea132d519590f2736d8e1f53edb33fdfb27b3c9d869","c0cdd15f9913c6e88d7e124cbcba7ea981f12a856f473d0e96a94d8835d9ecf3","86c4e141ec49a5bb2646d39efec6207f01f9f9cfdff552715fcef860ec7d0b2d","4635a9149c53a2fbc072ceb338351d3b149e093cd43163e01d629bb016f8cd7c","54bc5a6ed4cca0770ced899f55b18a9e4d7ba7c6b0136f3291c43a5112ef0800","7b2f904ede2ef17c8b9cda1433ffab97b5f7098ee33664a8362beaa1479e1baa","0df41caa968a517a454a6f36528c572af685f1ab62f792760e3a4d8e9de40461","bfe368b6b3729f8dfee1531e43cd41a787c554e3090645dd66f9785be96ccff4","f06e0e417bca037bfa2150451bb6a4e38aa9db104c29167c1f642dc2ca60abfc","1bda055af670cb8e8f37d4860197b58cea1464c16dfaa31fadf42a9eedee8b25","c04f64f0b5cbd336ad8b5dcf40727f50dba7534d66df1998110f38af533b45b3","c0cdd15f9913c6e88d7e124cbcba7ea981f12a856f473d0e96a94d8835d9ecf3","ced59ab566ffe8b3274d7bba452a3b93341411c2c1cc23f2577a767ac846591a")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("e4cbf31ac0aacb712219b080af8ccbc11899cc1e7a695077b61df5317ffc3a1d","3834d3be235ebc488832a35dbd98d301c33281f9062a2cb16a681b77b3480044","5731851703e6ca1dd31c4ba3455a4e961621aab904d53ff5d747f811d3dee1b0","b5eaf10fcee125295402478e086f6e3c441024daec47dde0170ba528525f1eb2","eccf6b8a45f044951712b08013fcb020bff95e7c784164464afcf5e6adba1fdb","0c26d498ccd4d7aea16e4b6e7e647fe4e16b89f67e18a8eacb4b0965fce2f381","65a060f8606f2213f1480ea132d519590f2736d8e1f53edb33fdfb27b3c9d869","c0cdd15f9913c6e88d7e124cbcba7ea981f12a856f473d0e96a94d8835d9ecf3","86c4e141ec49a5bb2646d39efec6207f01f9f9cfdff552715fcef860ec7d0b2d","4635a9149c53a2fbc072ceb338351d3b149e093cd43163e01d629bb016f8cd7c","54bc5a6ed4cca0770ced899f55b18a9e4d7ba7c6b0136f3291c43a5112ef0800","7b2f904ede2ef17c8b9cda1433ffab97b5f7098ee33664a8362beaa1479e1baa","0df41caa968a517a454a6f36528c572af685f1ab62f792760e3a4d8e9de40461","bfe368b6b3729f8dfee1531e43cd41a787c554e3090645dd66f9785be96ccff4","f06e0e417bca037bfa2150451bb6a4e38aa9db104c29167c1f642dc2ca60abfc","1bda055af670cb8e8f37d4860197b58cea1464c16dfaa31fadf42a9eedee8b25","c04f64f0b5cbd336ad8b5dcf40727f50dba7534d66df1998110f38af533b45b3","c0cdd15f9913c6e88d7e124cbcba7ea981f12a856f473d0e96a94d8835d9ecf3","ced59ab566ffe8b3274d7bba452a3b93341411c2c1cc23f2577a767ac846591a")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("e4cbf31ac0aacb712219b080af8ccbc11899cc1e7a695077b61df5317ffc3a1d","3834d3be235ebc488832a35dbd98d301c33281f9062a2cb16a681b77b3480044","5731851703e6ca1dd31c4ba3455a4e961621aab904d53ff5d747f811d3dee1b0","b5eaf10fcee125295402478e086f6e3c441024daec47dde0170ba528525f1eb2","eccf6b8a45f044951712b08013fcb020bff95e7c784164464afcf5e6adba1fdb","0c26d498ccd4d7aea16e4b6e7e647fe4e16b89f67e18a8eacb4b0965fce2f381","65a060f8606f2213f1480ea132d519590f2736d8e1f53edb33fdfb27b3c9d869","c0cdd15f9913c6e88d7e124cbcba7ea981f12a856f473d0e96a94d8835d9ecf3","86c4e141ec49a5bb2646d39efec6207f01f9f9cfdff552715fcef860ec7d0b2d","4635a9149c53a2fbc072ceb338351d3b149e093cd43163e01d629bb016f8cd7c","54bc5a6ed4cca0770ced899f55b18a9e4d7ba7c6b0136f3291c43a5112ef0800","7b2f904ede2ef17c8b9cda1433ffab97b5f7098ee33664a8362beaa1479e1baa","0df41caa968a517a454a6f36528c572af685f1ab62f792760e3a4d8e9de40461","bfe368b6b3729f8dfee1531e43cd41a787c554e3090645dd66f9785be96ccff4","f06e0e417bca037bfa2150451bb6a4e38aa9db104c29167c1f642dc2ca60abfc","1bda055af670cb8e8f37d4860197b58cea1464c16dfaa31fadf42a9eedee8b25","c04f64f0b5cbd336ad8b5dcf40727f50dba7534d66df1998110f38af533b45b3","c0cdd15f9913c6e88d7e124cbcba7ea981f12a856f473d0e96a94d8835d9ecf3","ced59ab566ffe8b3274d7bba452a3b93341411c2c1cc23f2577a767ac846591a")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("e4cbf31ac0aacb712219b080af8ccbc11899cc1e7a695077b61df5317ffc3a1d","3834d3be235ebc488832a35dbd98d301c33281f9062a2cb16a681b77b3480044","5731851703e6ca1dd31c4ba3455a4e961621aab904d53ff5d747f811d3dee1b0","b5eaf10fcee125295402478e086f6e3c441024daec47dde0170ba528525f1eb2","eccf6b8a45f044951712b08013fcb020bff95e7c784164464afcf5e6adba1fdb","0c26d498ccd4d7aea16e4b6e7e647fe4e16b89f67e18a8eacb4b0965fce2f381","65a060f8606f2213f1480ea132d519590f2736d8e1f53edb33fdfb27b3c9d869","c0cdd15f9913c6e88d7e124cbcba7ea981f12a856f473d0e96a94d8835d9ecf3","86c4e141ec49a5bb2646d39efec6207f01f9f9cfdff552715fcef860ec7d0b2d","4635a9149c53a2fbc072ceb338351d3b149e093cd43163e01d629bb016f8cd7c","54bc5a6ed4cca0770ced899f55b18a9e4d7ba7c6b0136f3291c43a5112ef0800","7b2f904ede2ef17c8b9cda1433ffab97b5f7098ee33664a8362beaa1479e1baa","0df41caa968a517a454a6f36528c572af685f1ab62f792760e3a4d8e9de40461","bfe368b6b3729f8dfee1531e43cd41a787c554e3090645dd66f9785be96ccff4","f06e0e417bca037bfa2150451bb6a4e38aa9db104c29167c1f642dc2ca60abfc","1bda055af670cb8e8f37d4860197b58cea1464c16dfaa31fadf42a9eedee8b25","c04f64f0b5cbd336ad8b5dcf40727f50dba7534d66df1998110f38af533b45b3","c0cdd15f9913c6e88d7e124cbcba7ea981f12a856f473d0e96a94d8835d9ecf3","ced59ab566ffe8b3274d7bba452a3b93341411c2c1cc23f2577a767ac846591a")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("e4cbf31ac0aacb712219b080af8ccbc11899cc1e7a695077b61df5317ffc3a1d","3834d3be235ebc488832a35dbd98d301c33281f9062a2cb16a681b77b3480044","5731851703e6ca1dd31c4ba3455a4e961621aab904d53ff5d747f811d3dee1b0","b5eaf10fcee125295402478e086f6e3c441024daec47dde0170ba528525f1eb2","eccf6b8a45f044951712b08013fcb020bff95e7c784164464afcf5e6adba1fdb","0c26d498ccd4d7aea16e4b6e7e647fe4e16b89f67e18a8eacb4b0965fce2f381","65a060f8606f2213f1480ea132d519590f2736d8e1f53edb33fdfb27b3c9d869","c0cdd15f9913c6e88d7e124cbcba7ea981f12a856f473d0e96a94d8835d9ecf3","86c4e141ec49a5bb2646d39efec6207f01f9f9cfdff552715fcef860ec7d0b2d","4635a9149c53a2fbc072ceb338351d3b149e093cd43163e01d629bb016f8cd7c","54bc5a6ed4cca0770ced899f55b18a9e4d7ba7c6b0136f3291c43a5112ef0800","7b2f904ede2ef17c8b9cda1433ffab97b5f7098ee33664a8362beaa1479e1baa","0df41caa968a517a454a6f36528c572af685f1ab62f792760e3a4d8e9de40461","bfe368b6b3729f8dfee1531e43cd41a787c554e3090645dd66f9785be96ccff4","f06e0e417bca037bfa2150451bb6a4e38aa9db104c29167c1f642dc2ca60abfc","1bda055af670cb8e8f37d4860197b58cea1464c16dfaa31fadf42a9eedee8b25","c04f64f0b5cbd336ad8b5dcf40727f50dba7534d66df1998110f38af533b45b3","c0cdd15f9913c6e88d7e124cbcba7ea981f12a856f473d0e96a94d8835d9ecf3","ced59ab566ffe8b3274d7bba452a3b93341411c2c1cc23f2577a767ac846591a")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("e4cbf31ac0aacb712219b080af8ccbc11899cc1e7a695077b61df5317ffc3a1d","3834d3be235ebc488832a35dbd98d301c33281f9062a2cb16a681b77b3480044","5731851703e6ca1dd31c4ba3455a4e961621aab904d53ff5d747f811d3dee1b0","b5eaf10fcee125295402478e086f6e3c441024daec47dde0170ba528525f1eb2","eccf6b8a45f044951712b08013fcb020bff95e7c784164464afcf5e6adba1fdb","0c26d498ccd4d7aea16e4b6e7e647fe4e16b89f67e18a8eacb4b0965fce2f381","65a060f8606f2213f1480ea132d519590f2736d8e1f53edb33fdfb27b3c9d869","c0cdd15f9913c6e88d7e124cbcba7ea981f12a856f473d0e96a94d8835d9ecf3","86c4e141ec49a5bb2646d39efec6207f01f9f9cfdff552715fcef860ec7d0b2d","4635a9149c53a2fbc072ceb338351d3b149e093cd43163e01d629bb016f8cd7c","54bc5a6ed4cca0770ced899f55b18a9e4d7ba7c6b0136f3291c43a5112ef0800","7b2f904ede2ef17c8b9cda1433ffab97b5f7098ee33664a8362beaa1479e1baa","0df41caa968a517a454a6f36528c572af685f1ab62f792760e3a4d8e9de40461","bfe368b6b3729f8dfee1531e43cd41a787c554e3090645dd66f9785be96ccff4","f06e0e417bca037bfa2150451bb6a4e38aa9db104c29167c1f642dc2ca60abfc","1bda055af670cb8e8f37d4860197b58cea1464c16dfaa31fadf42a9eedee8b25","c04f64f0b5cbd336ad8b5dcf40727f50dba7534d66df1998110f38af533b45b3","c0cdd15f9913c6e88d7e124cbcba7ea981f12a856f473d0e96a94d8835d9ecf3","ced59ab566ffe8b3274d7bba452a3b93341411c2c1cc23f2577a767ac846591a")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("e4cbf31ac0aacb712219b080af8ccbc11899cc1e7a695077b61df5317ffc3a1d","3834d3be235ebc488832a35dbd98d301c33281f9062a2cb16a681b77b3480044","5731851703e6ca1dd31c4ba3455a4e961621aab904d53ff5d747f811d3dee1b0","b5eaf10fcee125295402478e086f6e3c441024daec47dde0170ba528525f1eb2","eccf6b8a45f044951712b08013fcb020bff95e7c784164464afcf5e6adba1fdb","0c26d498ccd4d7aea16e4b6e7e647fe4e16b89f67e18a8eacb4b0965fce2f381","65a060f8606f2213f1480ea132d519590f2736d8e1f53edb33fdfb27b3c9d869","c0cdd15f9913c6e88d7e124cbcba7ea981f12a856f473d0e96a94d8835d9ecf3","86c4e141ec49a5bb2646d39efec6207f01f9f9cfdff552715fcef860ec7d0b2d","4635a9149c53a2fbc072ceb338351d3b149e093cd43163e01d629bb016f8cd7c","54bc5a6ed4cca0770ced899f55b18a9e4d7ba7c6b0136f3291c43a5112ef0800","7b2f904ede2ef17c8b9cda1433ffab97b5f7098ee33664a8362beaa1479e1baa","0df41caa968a517a454a6f36528c572af685f1ab62f792760e3a4d8e9de40461","bfe368b6b3729f8dfee1531e43cd41a787c554e3090645dd66f9785be96ccff4","f06e0e417bca037bfa2150451bb6a4e38aa9db104c29167c1f642dc2ca60abfc","1bda055af670cb8e8f37d4860197b58cea1464c16dfaa31fadf42a9eedee8b25","c04f64f0b5cbd336ad8b5dcf40727f50dba7534d66df1998110f38af533b45b3","c0cdd15f9913c6e88d7e124cbcba7ea981f12a856f473d0e96a94d8835d9ecf3","ced59ab566ffe8b3274d7bba452a3b93341411c2c1cc23f2577a767ac846591a")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("e4cbf31ac0aacb712219b080af8ccbc11899cc1e7a695077b61df5317ffc3a1d","3834d3be235ebc488832a35dbd98d301c33281f9062a2cb16a681b77b3480044","5731851703e6ca1dd31c4ba3455a4e961621aab904d53ff5d747f811d3dee1b0","b5eaf10fcee125295402478e086f6e3c441024daec47dde0170ba528525f1eb2","eccf6b8a45f044951712b08013fcb020bff95e7c784164464afcf5e6adba1fdb","0c26d498ccd4d7aea16e4b6e7e647fe4e16b89f67e18a8eacb4b0965fce2f381","65a060f8606f2213f1480ea132d519590f2736d8e1f53edb33fdfb27b3c9d869","c0cdd15f9913c6e88d7e124cbcba7ea981f12a856f473d0e96a94d8835d9ecf3","86c4e141ec49a5bb2646d39efec6207f01f9f9cfdff552715fcef860ec7d0b2d","4635a9149c53a2fbc072ceb338351d3b149e093cd43163e01d629bb016f8cd7c","54bc5a6ed4cca0770ced899f55b18a9e4d7ba7c6b0136f3291c43a5112ef0800","7b2f904ede2ef17c8b9cda1433ffab97b5f7098ee33664a8362beaa1479e1baa","0df41caa968a517a454a6f36528c572af685f1ab62f792760e3a4d8e9de40461","bfe368b6b3729f8dfee1531e43cd41a787c554e3090645dd66f9785be96ccff4","f06e0e417bca037bfa2150451bb6a4e38aa9db104c29167c1f642dc2ca60abfc","1bda055af670cb8e8f37d4860197b58cea1464c16dfaa31fadf42a9eedee8b25","c04f64f0b5cbd336ad8b5dcf40727f50dba7534d66df1998110f38af533b45b3","c0cdd15f9913c6e88d7e124cbcba7ea981f12a856f473d0e96a94d8835d9ecf3","ced59ab566ffe8b3274d7bba452a3b93341411c2c1cc23f2577a767ac846591a")
index=activity AND rg_functionality="Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("e4cbf31ac0aacb712219b080af8ccbc11899cc1e7a695077b61df5317ffc3a1d","3834d3be235ebc488832a35dbd98d301c33281f9062a2cb16a681b77b3480044","5731851703e6ca1dd31c4ba3455a4e961621aab904d53ff5d747f811d3dee1b0","b5eaf10fcee125295402478e086f6e3c441024daec47dde0170ba528525f1eb2","eccf6b8a45f044951712b08013fcb020bff95e7c784164464afcf5e6adba1fdb","0c26d498ccd4d7aea16e4b6e7e647fe4e16b89f67e18a8eacb4b0965fce2f381","65a060f8606f2213f1480ea132d519590f2736d8e1f53edb33fdfb27b3c9d869","c0cdd15f9913c6e88d7e124cbcba7ea981f12a856f473d0e96a94d8835d9ecf3","86c4e141ec49a5bb2646d39efec6207f01f9f9cfdff552715fcef860ec7d0b2d","4635a9149c53a2fbc072ceb338351d3b149e093cd43163e01d629bb016f8cd7c","54bc5a6ed4cca0770ced899f55b18a9e4d7ba7c6b0136f3291c43a5112ef0800","7b2f904ede2ef17c8b9cda1433ffab97b5f7098ee33664a8362beaa1479e1baa","0df41caa968a517a454a6f36528c572af685f1ab62f792760e3a4d8e9de40461","bfe368b6b3729f8dfee1531e43cd41a787c554e3090645dd66f9785be96ccff4","f06e0e417bca037bfa2150451bb6a4e38aa9db104c29167c1f642dc2ca60abfc","1bda055af670cb8e8f37d4860197b58cea1464c16dfaa31fadf42a9eedee8b25","c04f64f0b5cbd336ad8b5dcf40727f50dba7534d66df1998110f38af533b45b3","c0cdd15f9913c6e88d7e124cbcba7ea981f12a856f473d0e96a94d8835d9ecf3","ced59ab566ffe8b3274d7bba452a3b93341411c2c1cc23f2577a767ac846591a")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("e4cbf31ac0aacb712219b080af8ccbc11899cc1e7a695077b61df5317ffc3a1d","3834d3be235ebc488832a35dbd98d301c33281f9062a2cb16a681b77b3480044","5731851703e6ca1dd31c4ba3455a4e961621aab904d53ff5d747f811d3dee1b0","b5eaf10fcee125295402478e086f6e3c441024daec47dde0170ba528525f1eb2","eccf6b8a45f044951712b08013fcb020bff95e7c784164464afcf5e6adba1fdb","0c26d498ccd4d7aea16e4b6e7e647fe4e16b89f67e18a8eacb4b0965fce2f381","65a060f8606f2213f1480ea132d519590f2736d8e1f53edb33fdfb27b3c9d869","c0cdd15f9913c6e88d7e124cbcba7ea981f12a856f473d0e96a94d8835d9ecf3","86c4e141ec49a5bb2646d39efec6207f01f9f9cfdff552715fcef860ec7d0b2d","4635a9149c53a2fbc072ceb338351d3b149e093cd43163e01d629bb016f8cd7c","54bc5a6ed4cca0770ced899f55b18a9e4d7ba7c6b0136f3291c43a5112ef0800","7b2f904ede2ef17c8b9cda1433ffab97b5f7098ee33664a8362beaa1479e1baa","0df41caa968a517a454a6f36528c572af685f1ab62f792760e3a4d8e9de40461","bfe368b6b3729f8dfee1531e43cd41a787c554e3090645dd66f9785be96ccff4","f06e0e417bca037bfa2150451bb6a4e38aa9db104c29167c1f642dc2ca60abfc","1bda055af670cb8e8f37d4860197b58cea1464c16dfaa31fadf42a9eedee8b25","c04f64f0b5cbd336ad8b5dcf40727f50dba7534d66df1998110f38af533b45b3","c0cdd15f9913c6e88d7e124cbcba7ea981f12a856f473d0e96a94d8835d9ecf3","ced59ab566ffe8b3274d7bba452a3b93341411c2c1cc23f2577a767ac846591a")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("e4cbf31ac0aacb712219b080af8ccbc11899cc1e7a695077b61df5317ffc3a1d","3834d3be235ebc488832a35dbd98d301c33281f9062a2cb16a681b77b3480044","5731851703e6ca1dd31c4ba3455a4e961621aab904d53ff5d747f811d3dee1b0","b5eaf10fcee125295402478e086f6e3c441024daec47dde0170ba528525f1eb2","eccf6b8a45f044951712b08013fcb020bff95e7c784164464afcf5e6adba1fdb","0c26d498ccd4d7aea16e4b6e7e647fe4e16b89f67e18a8eacb4b0965fce2f381","65a060f8606f2213f1480ea132d519590f2736d8e1f53edb33fdfb27b3c9d869","c0cdd15f9913c6e88d7e124cbcba7ea981f12a856f473d0e96a94d8835d9ecf3","86c4e141ec49a5bb2646d39efec6207f01f9f9cfdff552715fcef860ec7d0b2d","4635a9149c53a2fbc072ceb338351d3b149e093cd43163e01d629bb016f8cd7c","54bc5a6ed4cca0770ced899f55b18a9e4d7ba7c6b0136f3291c43a5112ef0800","7b2f904ede2ef17c8b9cda1433ffab97b5f7098ee33664a8362beaa1479e1baa","0df41caa968a517a454a6f36528c572af685f1ab62f792760e3a4d8e9de40461","bfe368b6b3729f8dfee1531e43cd41a787c554e3090645dd66f9785be96ccff4","f06e0e417bca037bfa2150451bb6a4e38aa9db104c29167c1f642dc2ca60abfc","1bda055af670cb8e8f37d4860197b58cea1464c16dfaa31fadf42a9eedee8b25","c04f64f0b5cbd336ad8b5dcf40727f50dba7534d66df1998110f38af533b45b3","c0cdd15f9913c6e88d7e124cbcba7ea981f12a856f473d0e96a94d8835d9ecf3","ced59ab566ffe8b3274d7bba452a3b93341411c2c1cc23f2577a767ac846591a")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("e4cbf31ac0aacb712219b080af8ccbc11899cc1e7a695077b61df5317ffc3a1d","3834d3be235ebc488832a35dbd98d301c33281f9062a2cb16a681b77b3480044","5731851703e6ca1dd31c4ba3455a4e961621aab904d53ff5d747f811d3dee1b0","b5eaf10fcee125295402478e086f6e3c441024daec47dde0170ba528525f1eb2","eccf6b8a45f044951712b08013fcb020bff95e7c784164464afcf5e6adba1fdb","0c26d498ccd4d7aea16e4b6e7e647fe4e16b89f67e18a8eacb4b0965fce2f381","65a060f8606f2213f1480ea132d519590f2736d8e1f53edb33fdfb27b3c9d869","c0cdd15f9913c6e88d7e124cbcba7ea981f12a856f473d0e96a94d8835d9ecf3","86c4e141ec49a5bb2646d39efec6207f01f9f9cfdff552715fcef860ec7d0b2d","4635a9149c53a2fbc072ceb338351d3b149e093cd43163e01d629bb016f8cd7c","54bc5a6ed4cca0770ced899f55b18a9e4d7ba7c6b0136f3291c43a5112ef0800","7b2f904ede2ef17c8b9cda1433ffab97b5f7098ee33664a8362beaa1479e1baa","0df41caa968a517a454a6f36528c572af685f1ab62f792760e3a4d8e9de40461","bfe368b6b3729f8dfee1531e43cd41a787c554e3090645dd66f9785be96ccff4","f06e0e417bca037bfa2150451bb6a4e38aa9db104c29167c1f642dc2ca60abfc","1bda055af670cb8e8f37d4860197b58cea1464c16dfaa31fadf42a9eedee8b25","c04f64f0b5cbd336ad8b5dcf40727f50dba7534d66df1998110f38af533b45b3","c0cdd15f9913c6e88d7e124cbcba7ea981f12a856f473d0e96a94d8835d9ecf3","ced59ab566ffe8b3274d7bba452a3b93341411c2c1cc23f2577a767ac846591a")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("e4cbf31ac0aacb712219b080af8ccbc11899cc1e7a695077b61df5317ffc3a1d","3834d3be235ebc488832a35dbd98d301c33281f9062a2cb16a681b77b3480044","5731851703e6ca1dd31c4ba3455a4e961621aab904d53ff5d747f811d3dee1b0","b5eaf10fcee125295402478e086f6e3c441024daec47dde0170ba528525f1eb2","eccf6b8a45f044951712b08013fcb020bff95e7c784164464afcf5e6adba1fdb","0c26d498ccd4d7aea16e4b6e7e647fe4e16b89f67e18a8eacb4b0965fce2f381","65a060f8606f2213f1480ea132d519590f2736d8e1f53edb33fdfb27b3c9d869","c0cdd15f9913c6e88d7e124cbcba7ea981f12a856f473d0e96a94d8835d9ecf3","86c4e141ec49a5bb2646d39efec6207f01f9f9cfdff552715fcef860ec7d0b2d","4635a9149c53a2fbc072ceb338351d3b149e093cd43163e01d629bb016f8cd7c","54bc5a6ed4cca0770ced899f55b18a9e4d7ba7c6b0136f3291c43a5112ef0800","7b2f904ede2ef17c8b9cda1433ffab97b5f7098ee33664a8362beaa1479e1baa","0df41caa968a517a454a6f36528c572af685f1ab62f792760e3a4d8e9de40461","bfe368b6b3729f8dfee1531e43cd41a787c554e3090645dd66f9785be96ccff4","f06e0e417bca037bfa2150451bb6a4e38aa9db104c29167c1f642dc2ca60abfc","1bda055af670cb8e8f37d4860197b58cea1464c16dfaa31fadf42a9eedee8b25","c04f64f0b5cbd336ad8b5dcf40727f50dba7534d66df1998110f38af533b45b3","c0cdd15f9913c6e88d7e124cbcba7ea981f12a856f473d0e96a94d8835d9ecf3","ced59ab566ffe8b3274d7bba452a3b93341411c2c1cc23f2577a767ac846591a")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("e4cbf31ac0aacb712219b080af8ccbc11899cc1e7a695077b61df5317ffc3a1d","3834d3be235ebc488832a35dbd98d301c33281f9062a2cb16a681b77b3480044","5731851703e6ca1dd31c4ba3455a4e961621aab904d53ff5d747f811d3dee1b0","b5eaf10fcee125295402478e086f6e3c441024daec47dde0170ba528525f1eb2","eccf6b8a45f044951712b08013fcb020bff95e7c784164464afcf5e6adba1fdb","0c26d498ccd4d7aea16e4b6e7e647fe4e16b89f67e18a8eacb4b0965fce2f381","65a060f8606f2213f1480ea132d519590f2736d8e1f53edb33fdfb27b3c9d869","c0cdd15f9913c6e88d7e124cbcba7ea981f12a856f473d0e96a94d8835d9ecf3","86c4e141ec49a5bb2646d39efec6207f01f9f9cfdff552715fcef860ec7d0b2d","4635a9149c53a2fbc072ceb338351d3b149e093cd43163e01d629bb016f8cd7c","54bc5a6ed4cca0770ced899f55b18a9e4d7ba7c6b0136f3291c43a5112ef0800","7b2f904ede2ef17c8b9cda1433ffab97b5f7098ee33664a8362beaa1479e1baa","0df41caa968a517a454a6f36528c572af685f1ab62f792760e3a4d8e9de40461","bfe368b6b3729f8dfee1531e43cd41a787c554e3090645dd66f9785be96ccff4","f06e0e417bca037bfa2150451bb6a4e38aa9db104c29167c1f642dc2ca60abfc","1bda055af670cb8e8f37d4860197b58cea1464c16dfaa31fadf42a9eedee8b25","c04f64f0b5cbd336ad8b5dcf40727f50dba7534d66df1998110f38af533b45b3","c0cdd15f9913c6e88d7e124cbcba7ea981f12a856f473d0e96a94d8835d9ecf3","ced59ab566ffe8b3274d7bba452a3b93341411c2c1cc23f2577a767ac846591a")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("e4cbf31ac0aacb712219b080af8ccbc11899cc1e7a695077b61df5317ffc3a1d","3834d3be235ebc488832a35dbd98d301c33281f9062a2cb16a681b77b3480044","5731851703e6ca1dd31c4ba3455a4e961621aab904d53ff5d747f811d3dee1b0","b5eaf10fcee125295402478e086f6e3c441024daec47dde0170ba528525f1eb2","eccf6b8a45f044951712b08013fcb020bff95e7c784164464afcf5e6adba1fdb","0c26d498ccd4d7aea16e4b6e7e647fe4e16b89f67e18a8eacb4b0965fce2f381","65a060f8606f2213f1480ea132d519590f2736d8e1f53edb33fdfb27b3c9d869","c0cdd15f9913c6e88d7e124cbcba7ea981f12a856f473d0e96a94d8835d9ecf3","86c4e141ec49a5bb2646d39efec6207f01f9f9cfdff552715fcef860ec7d0b2d","4635a9149c53a2fbc072ceb338351d3b149e093cd43163e01d629bb016f8cd7c","54bc5a6ed4cca0770ced899f55b18a9e4d7ba7c6b0136f3291c43a5112ef0800","7b2f904ede2ef17c8b9cda1433ffab97b5f7098ee33664a8362beaa1479e1baa","0df41caa968a517a454a6f36528c572af685f1ab62f792760e3a4d8e9de40461","bfe368b6b3729f8dfee1531e43cd41a787c554e3090645dd66f9785be96ccff4","f06e0e417bca037bfa2150451bb6a4e38aa9db104c29167c1f642dc2ca60abfc","1bda055af670cb8e8f37d4860197b58cea1464c16dfaa31fadf42a9eedee8b25","c04f64f0b5cbd336ad8b5dcf40727f50dba7534d66df1998110f38af533b45b3","c0cdd15f9913c6e88d7e124cbcba7ea981f12a856f473d0e96a94d8835d9ecf3","ced59ab566ffe8b3274d7bba452a3b93341411c2c1cc23f2577a767ac846591a")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("e4cbf31ac0aacb712219b080af8ccbc11899cc1e7a695077b61df5317ffc3a1d","3834d3be235ebc488832a35dbd98d301c33281f9062a2cb16a681b77b3480044","5731851703e6ca1dd31c4ba3455a4e961621aab904d53ff5d747f811d3dee1b0","b5eaf10fcee125295402478e086f6e3c441024daec47dde0170ba528525f1eb2","eccf6b8a45f044951712b08013fcb020bff95e7c784164464afcf5e6adba1fdb","0c26d498ccd4d7aea16e4b6e7e647fe4e16b89f67e18a8eacb4b0965fce2f381","65a060f8606f2213f1480ea132d519590f2736d8e1f53edb33fdfb27b3c9d869","c0cdd15f9913c6e88d7e124cbcba7ea981f12a856f473d0e96a94d8835d9ecf3","86c4e141ec49a5bb2646d39efec6207f01f9f9cfdff552715fcef860ec7d0b2d","4635a9149c53a2fbc072ceb338351d3b149e093cd43163e01d629bb016f8cd7c","54bc5a6ed4cca0770ced899f55b18a9e4d7ba7c6b0136f3291c43a5112ef0800","7b2f904ede2ef17c8b9cda1433ffab97b5f7098ee33664a8362beaa1479e1baa","0df41caa968a517a454a6f36528c572af685f1ab62f792760e3a4d8e9de40461","bfe368b6b3729f8dfee1531e43cd41a787c554e3090645dd66f9785be96ccff4","f06e0e417bca037bfa2150451bb6a4e38aa9db104c29167c1f642dc2ca60abfc","1bda055af670cb8e8f37d4860197b58cea1464c16dfaa31fadf42a9eedee8b25","c04f64f0b5cbd336ad8b5dcf40727f50dba7534d66df1998110f38af533b45b3","c0cdd15f9913c6e88d7e124cbcba7ea981f12a856f473d0e96a94d8835d9ecf3","ced59ab566ffe8b3274d7bba452a3b93341411c2c1cc23f2577a767ac846591a")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring64 NOT NULL AND customstring64 IN ("e4cbf31ac0aacb712219b080af8ccbc11899cc1e7a695077b61df5317ffc3a1d","3834d3be235ebc488832a35dbd98d301c33281f9062a2cb16a681b77b3480044","5731851703e6ca1dd31c4ba3455a4e961621aab904d53ff5d747f811d3dee1b0","b5eaf10fcee125295402478e086f6e3c441024daec47dde0170ba528525f1eb2","eccf6b8a45f044951712b08013fcb020bff95e7c784164464afcf5e6adba1fdb","0c26d498ccd4d7aea16e4b6e7e647fe4e16b89f67e18a8eacb4b0965fce2f381","65a060f8606f2213f1480ea132d519590f2736d8e1f53edb33fdfb27b3c9d869","c0cdd15f9913c6e88d7e124cbcba7ea981f12a856f473d0e96a94d8835d9ecf3","86c4e141ec49a5bb2646d39efec6207f01f9f9cfdff552715fcef860ec7d0b2d","4635a9149c53a2fbc072ceb338351d3b149e093cd43163e01d629bb016f8cd7c","54bc5a6ed4cca0770ced899f55b18a9e4d7ba7c6b0136f3291c43a5112ef0800","7b2f904ede2ef17c8b9cda1433ffab97b5f7098ee33664a8362beaa1479e1baa","0df41caa968a517a454a6f36528c572af685f1ab62f792760e3a4d8e9de40461","bfe368b6b3729f8dfee1531e43cd41a787c554e3090645dd66f9785be96ccff4","f06e0e417bca037bfa2150451bb6a4e38aa9db104c29167c1f642dc2ca60abfc","1bda055af670cb8e8f37d4860197b58cea1464c16dfaa31fadf42a9eedee8b25","c04f64f0b5cbd336ad8b5dcf40727f50dba7534d66df1998110f38af533b45b3","c0cdd15f9913c6e88d7e124cbcba7ea981f12a856f473d0e96a94d8835d9ecf3","ced59ab566ffe8b3274d7bba452a3b93341411c2c1cc23f2577a767ac846591a")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("e4cbf31ac0aacb712219b080af8ccbc11899cc1e7a695077b61df5317ffc3a1d","3834d3be235ebc488832a35dbd98d301c33281f9062a2cb16a681b77b3480044","5731851703e6ca1dd31c4ba3455a4e961621aab904d53ff5d747f811d3dee1b0","b5eaf10fcee125295402478e086f6e3c441024daec47dde0170ba528525f1eb2","eccf6b8a45f044951712b08013fcb020bff95e7c784164464afcf5e6adba1fdb","0c26d498ccd4d7aea16e4b6e7e647fe4e16b89f67e18a8eacb4b0965fce2f381","65a060f8606f2213f1480ea132d519590f2736d8e1f53edb33fdfb27b3c9d869","c0cdd15f9913c6e88d7e124cbcba7ea981f12a856f473d0e96a94d8835d9ecf3","86c4e141ec49a5bb2646d39efec6207f01f9f9cfdff552715fcef860ec7d0b2d","4635a9149c53a2fbc072ceb338351d3b149e093cd43163e01d629bb016f8cd7c","54bc5a6ed4cca0770ced899f55b18a9e4d7ba7c6b0136f3291c43a5112ef0800","7b2f904ede2ef17c8b9cda1433ffab97b5f7098ee33664a8362beaa1479e1baa","0df41caa968a517a454a6f36528c572af685f1ab62f792760e3a4d8e9de40461","bfe368b6b3729f8dfee1531e43cd41a787c554e3090645dd66f9785be96ccff4","f06e0e417bca037bfa2150451bb6a4e38aa9db104c29167c1f642dc2ca60abfc","1bda055af670cb8e8f37d4860197b58cea1464c16dfaa31fadf42a9eedee8b25","c04f64f0b5cbd336ad8b5dcf40727f50dba7534d66df1998110f38af533b45b3","c0cdd15f9913c6e88d7e124cbcba7ea981f12a856f473d0e96a94d8835d9ecf3","ced59ab566ffe8b3274d7bba452a3b93341411c2c1cc23f2577a767ac846591a")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("e4cbf31ac0aacb712219b080af8ccbc11899cc1e7a695077b61df5317ffc3a1d","3834d3be235ebc488832a35dbd98d301c33281f9062a2cb16a681b77b3480044","5731851703e6ca1dd31c4ba3455a4e961621aab904d53ff5d747f811d3dee1b0","b5eaf10fcee125295402478e086f6e3c441024daec47dde0170ba528525f1eb2","eccf6b8a45f044951712b08013fcb020bff95e7c784164464afcf5e6adba1fdb","0c26d498ccd4d7aea16e4b6e7e647fe4e16b89f67e18a8eacb4b0965fce2f381","65a060f8606f2213f1480ea132d519590f2736d8e1f53edb33fdfb27b3c9d869","c0cdd15f9913c6e88d7e124cbcba7ea981f12a856f473d0e96a94d8835d9ecf3","86c4e141ec49a5bb2646d39efec6207f01f9f9cfdff552715fcef860ec7d0b2d","4635a9149c53a2fbc072ceb338351d3b149e093cd43163e01d629bb016f8cd7c","54bc5a6ed4cca0770ced899f55b18a9e4d7ba7c6b0136f3291c43a5112ef0800","7b2f904ede2ef17c8b9cda1433ffab97b5f7098ee33664a8362beaa1479e1baa","0df41caa968a517a454a6f36528c572af685f1ab62f792760e3a4d8e9de40461","bfe368b6b3729f8dfee1531e43cd41a787c554e3090645dd66f9785be96ccff4","f06e0e417bca037bfa2150451bb6a4e38aa9db104c29167c1f642dc2ca60abfc","1bda055af670cb8e8f37d4860197b58cea1464c16dfaa31fadf42a9eedee8b25","c04f64f0b5cbd336ad8b5dcf40727f50dba7534d66df1998110f38af533b45b3","c0cdd15f9913c6e88d7e124cbcba7ea981f12a856f473d0e96a94d8835d9ecf3","ced59ab566ffe8b3274d7bba452a3b93341411c2c1cc23f2577a767ac846591a")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("e4cbf31ac0aacb712219b080af8ccbc11899cc1e7a695077b61df5317ffc3a1d","3834d3be235ebc488832a35dbd98d301c33281f9062a2cb16a681b77b3480044","5731851703e6ca1dd31c4ba3455a4e961621aab904d53ff5d747f811d3dee1b0","b5eaf10fcee125295402478e086f6e3c441024daec47dde0170ba528525f1eb2","eccf6b8a45f044951712b08013fcb020bff95e7c784164464afcf5e6adba1fdb","0c26d498ccd4d7aea16e4b6e7e647fe4e16b89f67e18a8eacb4b0965fce2f381","65a060f8606f2213f1480ea132d519590f2736d8e1f53edb33fdfb27b3c9d869","c0cdd15f9913c6e88d7e124cbcba7ea981f12a856f473d0e96a94d8835d9ecf3","86c4e141ec49a5bb2646d39efec6207f01f9f9cfdff552715fcef860ec7d0b2d","4635a9149c53a2fbc072ceb338351d3b149e093cd43163e01d629bb016f8cd7c","54bc5a6ed4cca0770ced899f55b18a9e4d7ba7c6b0136f3291c43a5112ef0800","7b2f904ede2ef17c8b9cda1433ffab97b5f7098ee33664a8362beaa1479e1baa","0df41caa968a517a454a6f36528c572af685f1ab62f792760e3a4d8e9de40461","bfe368b6b3729f8dfee1531e43cd41a787c554e3090645dd66f9785be96ccff4","f06e0e417bca037bfa2150451bb6a4e38aa9db104c29167c1f642dc2ca60abfc","1bda055af670cb8e8f37d4860197b58cea1464c16dfaa31fadf42a9eedee8b25","c04f64f0b5cbd336ad8b5dcf40727f50dba7534d66df1998110f38af533b45b3","c0cdd15f9913c6e88d7e124cbcba7ea981f12a856f473d0e96a94d8835d9ecf3","ced59ab566ffe8b3274d7bba452a3b93341411c2c1cc23f2577a767ac846591a")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring64 NOT NULL AND customstring64 IN ("e4cbf31ac0aacb712219b080af8ccbc11899cc1e7a695077b61df5317ffc3a1d","3834d3be235ebc488832a35dbd98d301c33281f9062a2cb16a681b77b3480044","5731851703e6ca1dd31c4ba3455a4e961621aab904d53ff5d747f811d3dee1b0","b5eaf10fcee125295402478e086f6e3c441024daec47dde0170ba528525f1eb2","eccf6b8a45f044951712b08013fcb020bff95e7c784164464afcf5e6adba1fdb","0c26d498ccd4d7aea16e4b6e7e647fe4e16b89f67e18a8eacb4b0965fce2f381","65a060f8606f2213f1480ea132d519590f2736d8e1f53edb33fdfb27b3c9d869","c0cdd15f9913c6e88d7e124cbcba7ea981f12a856f473d0e96a94d8835d9ecf3","86c4e141ec49a5bb2646d39efec6207f01f9f9cfdff552715fcef860ec7d0b2d","4635a9149c53a2fbc072ceb338351d3b149e093cd43163e01d629bb016f8cd7c","54bc5a6ed4cca0770ced899f55b18a9e4d7ba7c6b0136f3291c43a5112ef0800","7b2f904ede2ef17c8b9cda1433ffab97b5f7098ee33664a8362beaa1479e1baa","0df41caa968a517a454a6f36528c572af685f1ab62f792760e3a4d8e9de40461","bfe368b6b3729f8dfee1531e43cd41a787c554e3090645dd66f9785be96ccff4","f06e0e417bca037bfa2150451bb6a4e38aa9db104c29167c1f642dc2ca60abfc","1bda055af670cb8e8f37d4860197b58cea1464c16dfaa31fadf42a9eedee8b25","c04f64f0b5cbd336ad8b5dcf40727f50dba7534d66df1998110f38af533b45b3","c0cdd15f9913c6e88d7e124cbcba7ea981f12a856f473d0e96a94d8835d9ecf3","ced59ab566ffe8b3274d7bba452a3b93341411c2c1cc23f2577a767ac846591a")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("e4cbf31ac0aacb712219b080af8ccbc11899cc1e7a695077b61df5317ffc3a1d","3834d3be235ebc488832a35dbd98d301c33281f9062a2cb16a681b77b3480044","5731851703e6ca1dd31c4ba3455a4e961621aab904d53ff5d747f811d3dee1b0","b5eaf10fcee125295402478e086f6e3c441024daec47dde0170ba528525f1eb2","eccf6b8a45f044951712b08013fcb020bff95e7c784164464afcf5e6adba1fdb","0c26d498ccd4d7aea16e4b6e7e647fe4e16b89f67e18a8eacb4b0965fce2f381","65a060f8606f2213f1480ea132d519590f2736d8e1f53edb33fdfb27b3c9d869","c0cdd15f9913c6e88d7e124cbcba7ea981f12a856f473d0e96a94d8835d9ecf3","86c4e141ec49a5bb2646d39efec6207f01f9f9cfdff552715fcef860ec7d0b2d","4635a9149c53a2fbc072ceb338351d3b149e093cd43163e01d629bb016f8cd7c","54bc5a6ed4cca0770ced899f55b18a9e4d7ba7c6b0136f3291c43a5112ef0800","7b2f904ede2ef17c8b9cda1433ffab97b5f7098ee33664a8362beaa1479e1baa","0df41caa968a517a454a6f36528c572af685f1ab62f792760e3a4d8e9de40461","bfe368b6b3729f8dfee1531e43cd41a787c554e3090645dd66f9785be96ccff4","f06e0e417bca037bfa2150451bb6a4e38aa9db104c29167c1f642dc2ca60abfc","1bda055af670cb8e8f37d4860197b58cea1464c16dfaa31fadf42a9eedee8b25","c04f64f0b5cbd336ad8b5dcf40727f50dba7534d66df1998110f38af533b45b3","c0cdd15f9913c6e88d7e124cbcba7ea981f12a856f473d0e96a94d8835d9ecf3","ced59ab566ffe8b3274d7bba452a3b93341411c2c1cc23f2577a767ac846591a")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("e4cbf31ac0aacb712219b080af8ccbc11899cc1e7a695077b61df5317ffc3a1d","3834d3be235ebc488832a35dbd98d301c33281f9062a2cb16a681b77b3480044","5731851703e6ca1dd31c4ba3455a4e961621aab904d53ff5d747f811d3dee1b0","b5eaf10fcee125295402478e086f6e3c441024daec47dde0170ba528525f1eb2","eccf6b8a45f044951712b08013fcb020bff95e7c784164464afcf5e6adba1fdb","0c26d498ccd4d7aea16e4b6e7e647fe4e16b89f67e18a8eacb4b0965fce2f381","65a060f8606f2213f1480ea132d519590f2736d8e1f53edb33fdfb27b3c9d869","c0cdd15f9913c6e88d7e124cbcba7ea981f12a856f473d0e96a94d8835d9ecf3","86c4e141ec49a5bb2646d39efec6207f01f9f9cfdff552715fcef860ec7d0b2d","4635a9149c53a2fbc072ceb338351d3b149e093cd43163e01d629bb016f8cd7c","54bc5a6ed4cca0770ced899f55b18a9e4d7ba7c6b0136f3291c43a5112ef0800","7b2f904ede2ef17c8b9cda1433ffab97b5f7098ee33664a8362beaa1479e1baa","0df41caa968a517a454a6f36528c572af685f1ab62f792760e3a4d8e9de40461","bfe368b6b3729f8dfee1531e43cd41a787c554e3090645dd66f9785be96ccff4","f06e0e417bca037bfa2150451bb6a4e38aa9db104c29167c1f642dc2ca60abfc","1bda055af670cb8e8f37d4860197b58cea1464c16dfaa31fadf42a9eedee8b25","c04f64f0b5cbd336ad8b5dcf40727f50dba7534d66df1998110f38af533b45b3","c0cdd15f9913c6e88d7e124cbcba7ea981f12a856f473d0e96a94d8835d9ecf3","ced59ab566ffe8b3274d7bba452a3b93341411c2c1cc23f2577a767ac846591a")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("e4cbf31ac0aacb712219b080af8ccbc11899cc1e7a695077b61df5317ffc3a1d","3834d3be235ebc488832a35dbd98d301c33281f9062a2cb16a681b77b3480044","5731851703e6ca1dd31c4ba3455a4e961621aab904d53ff5d747f811d3dee1b0","b5eaf10fcee125295402478e086f6e3c441024daec47dde0170ba528525f1eb2","eccf6b8a45f044951712b08013fcb020bff95e7c784164464afcf5e6adba1fdb","0c26d498ccd4d7aea16e4b6e7e647fe4e16b89f67e18a8eacb4b0965fce2f381","65a060f8606f2213f1480ea132d519590f2736d8e1f53edb33fdfb27b3c9d869","c0cdd15f9913c6e88d7e124cbcba7ea981f12a856f473d0e96a94d8835d9ecf3","86c4e141ec49a5bb2646d39efec6207f01f9f9cfdff552715fcef860ec7d0b2d","4635a9149c53a2fbc072ceb338351d3b149e093cd43163e01d629bb016f8cd7c","54bc5a6ed4cca0770ced899f55b18a9e4d7ba7c6b0136f3291c43a5112ef0800","7b2f904ede2ef17c8b9cda1433ffab97b5f7098ee33664a8362beaa1479e1baa","0df41caa968a517a454a6f36528c572af685f1ab62f792760e3a4d8e9de40461","bfe368b6b3729f8dfee1531e43cd41a787c554e3090645dd66f9785be96ccff4","f06e0e417bca037bfa2150451bb6a4e38aa9db104c29167c1f642dc2ca60abfc","1bda055af670cb8e8f37d4860197b58cea1464c16dfaa31fadf42a9eedee8b25","c04f64f0b5cbd336ad8b5dcf40727f50dba7534d66df1998110f38af533b45b3","c0cdd15f9913c6e88d7e124cbcba7ea981f12a856f473d0e96a94d8835d9ecf3","ced59ab566ffe8b3274d7bba452a3b93341411c2c1cc23f2577a767ac846591a")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring64 NOT NULL AND customstring64 IN ("e4cbf31ac0aacb712219b080af8ccbc11899cc1e7a695077b61df5317ffc3a1d","3834d3be235ebc488832a35dbd98d301c33281f9062a2cb16a681b77b3480044","5731851703e6ca1dd31c4ba3455a4e961621aab904d53ff5d747f811d3dee1b0","b5eaf10fcee125295402478e086f6e3c441024daec47dde0170ba528525f1eb2","eccf6b8a45f044951712b08013fcb020bff95e7c784164464afcf5e6adba1fdb","0c26d498ccd4d7aea16e4b6e7e647fe4e16b89f67e18a8eacb4b0965fce2f381","65a060f8606f2213f1480ea132d519590f2736d8e1f53edb33fdfb27b3c9d869","c0cdd15f9913c6e88d7e124cbcba7ea981f12a856f473d0e96a94d8835d9ecf3","86c4e141ec49a5bb2646d39efec6207f01f9f9cfdff552715fcef860ec7d0b2d","4635a9149c53a2fbc072ceb338351d3b149e093cd43163e01d629bb016f8cd7c","54bc5a6ed4cca0770ced899f55b18a9e4d7ba7c6b0136f3291c43a5112ef0800","7b2f904ede2ef17c8b9cda1433ffab97b5f7098ee33664a8362beaa1479e1baa","0df41caa968a517a454a6f36528c572af685f1ab62f792760e3a4d8e9de40461","bfe368b6b3729f8dfee1531e43cd41a787c554e3090645dd66f9785be96ccff4","f06e0e417bca037bfa2150451bb6a4e38aa9db104c29167c1f642dc2ca60abfc","1bda055af670cb8e8f37d4860197b58cea1464c16dfaa31fadf42a9eedee8b25","c04f64f0b5cbd336ad8b5dcf40727f50dba7534d66df1998110f38af533b45b3","c0cdd15f9913c6e88d7e124cbcba7ea981f12a856f473d0e96a94d8835d9ecf3","ced59ab566ffe8b3274d7bba452a3b93341411c2c1cc23f2577a767ac846591a")
index=activity AND rg_functionality="Endpoint Management Systems" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="41.216.183.36" AND destinationport=3306 OR destinationaddress="185.209.21.88" AND destinationport=3306 OR destinationaddress="147.45.44.166" AND destinationport=3306)
index=activity AND rg_functionality="Endpoint Management Systems" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="41.216.183.36" AND sourceport=3306 OR sourceaddress="185.209.21.88" AND sourceport=3306 OR sourceaddress="147.45.44.166" AND sourceport=3306)
index=activity AND rg_functionality="Endpoint Management Systems" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="41.216.183.36" AND sourceport=3306 OR translatedipaddress="185.209.21.88" AND sourceport=3306 OR translatedipaddress="147.45.44.166" AND sourceport=3306)
index=activity AND rg_functionality="Endpoint Management Systems" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="41.216.183.36" AND destinationport=3306 OR destinationtranslatedaddress="185.209.21.88" AND destinationport=3306 OR destinationtranslatedaddress="147.45.44.166" AND destinationport=3306)
index=activity AND rg_functionality="Endpoint Management Systems" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="41.216.183.36" AND destinationtranslatedport=3306 OR destinationtranslatedaddress="185.209.21.88" AND destinationtranslatedport=3306 OR destinationtranslatedaddress="147.45.44.166" AND destinationtranslatedport=3306)
index=activity AND rg_functionality="Endpoint Management Systems" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="41.216.183.36" AND translatedport=3306 OR destinationtranslatedaddress="185.209.21.88" AND translatedport=3306 OR destinationtranslatedaddress="147.45.44.166" AND translatedport=3306)
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="41.216.183.36" AND destinationport=3306 OR destinationaddress="185.209.21.88" AND destinationport=3306 OR destinationaddress="147.45.44.166" AND destinationport=3306)
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="41.216.183.36" AND sourceport=3306 OR sourceaddress="185.209.21.88" AND sourceport=3306 OR sourceaddress="147.45.44.166" AND sourceport=3306)
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="41.216.183.36" AND sourceport=3306 OR translatedipaddress="185.209.21.88" AND sourceport=3306 OR translatedipaddress="147.45.44.166" AND sourceport=3306)
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="41.216.183.36" AND destinationport=3306 OR destinationtranslatedaddress="185.209.21.88" AND destinationport=3306 OR destinationtranslatedaddress="147.45.44.166" AND destinationport=3306)
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="41.216.183.36" AND destinationtranslatedport=3306 OR destinationtranslatedaddress="185.209.21.88" AND destinationtranslatedport=3306 OR destinationtranslatedaddress="147.45.44.166" AND destinationtranslatedport=3306)
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="41.216.183.36" AND translatedport=3306 OR destinationtranslatedaddress="185.209.21.88" AND translatedport=3306 OR destinationtranslatedaddress="147.45.44.166" AND translatedport=3306)
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="41.216.183.36" AND destinationport=3306 OR destinationaddress="185.209.21.88" AND destinationport=3306 OR destinationaddress="147.45.44.166" AND destinationport=3306)
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="41.216.183.36" AND sourceport=3306 OR sourceaddress="185.209.21.88" AND sourceport=3306 OR sourceaddress="147.45.44.166" AND sourceport=3306)
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="41.216.183.36" AND sourceport=3306 OR translatedipaddress="185.209.21.88" AND sourceport=3306 OR translatedipaddress="147.45.44.166" AND sourceport=3306)
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="41.216.183.36" AND destinationport=3306 OR destinationtranslatedaddress="185.209.21.88" AND destinationport=3306 OR destinationtranslatedaddress="147.45.44.166" AND destinationport=3306)
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="41.216.183.36" AND destinationtranslatedport=3306 OR destinationtranslatedaddress="185.209.21.88" AND destinationtranslatedport=3306 OR destinationtranslatedaddress="147.45.44.166" AND destinationtranslatedport=3306)
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="41.216.183.36" AND translatedport=3306 OR destinationtranslatedaddress="185.209.21.88" AND translatedport=3306 OR destinationtranslatedaddress="147.45.44.166" AND translatedport=3306)
index=activity AND rg_functionality="Email / Email Security" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="41.216.183.36" AND destinationport=3306 OR destinationaddress="185.209.21.88" AND destinationport=3306 OR destinationaddress="147.45.44.166" AND destinationport=3306)
index=activity AND rg_functionality="Email / Email Security" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="41.216.183.36" AND sourceport=3306 OR sourceaddress="185.209.21.88" AND sourceport=3306 OR sourceaddress="147.45.44.166" AND sourceport=3306)
index=activity AND rg_functionality="Email / Email Security" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="41.216.183.36" AND sourceport=3306 OR translatedipaddress="185.209.21.88" AND sourceport=3306 OR translatedipaddress="147.45.44.166" AND sourceport=3306)
index=activity AND rg_functionality="Email / Email Security" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="41.216.183.36" AND destinationport=3306 OR destinationtranslatedaddress="185.209.21.88" AND destinationport=3306 OR destinationtranslatedaddress="147.45.44.166" AND destinationport=3306)
index=activity AND rg_functionality="Email / Email Security" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="41.216.183.36" AND destinationtranslatedport=3306 OR destinationtranslatedaddress="185.209.21.88" AND destinationtranslatedport=3306 OR destinationtranslatedaddress="147.45.44.166" AND destinationtranslatedport=3306)
index=activity AND rg_functionality="Email / Email Security" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="41.216.183.36" AND translatedport=3306 OR destinationtranslatedaddress="185.209.21.88" AND translatedport=3306 OR destinationtranslatedaddress="147.45.44.166" AND translatedport=3306)
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="41.216.183.36" AND destinationport=3306 OR destinationaddress="185.209.21.88" AND destinationport=3306 OR destinationaddress="147.45.44.166" AND destinationport=3306)
index=activity AND rg_functionality="Cloud Email / Email Security" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="41.216.183.36" AND sourceport=3306 OR sourceaddress="185.209.21.88" AND sourceport=3306 OR sourceaddress="147.45.44.166" AND sourceport=3306)
index=activity AND rg_functionality="Cloud Email / Email Security" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="41.216.183.36" AND sourceport=3306 OR translatedipaddress="185.209.21.88" AND sourceport=3306 OR translatedipaddress="147.45.44.166" AND sourceport=3306)
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="41.216.183.36" AND destinationport=3306 OR destinationtranslatedaddress="185.209.21.88" AND destinationport=3306 OR destinationtranslatedaddress="147.45.44.166" AND destinationport=3306)
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="41.216.183.36" AND destinationtranslatedport=3306 OR destinationtranslatedaddress="185.209.21.88" AND destinationtranslatedport=3306 OR destinationtranslatedaddress="147.45.44.166" AND destinationtranslatedport=3306)
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="41.216.183.36" AND translatedport=3306 OR destinationtranslatedaddress="185.209.21.88" AND translatedport=3306 OR destinationtranslatedaddress="147.45.44.166" AND translatedport=3306)
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="41.216.183.36" AND destinationport=3306 OR destinationaddress="185.209.21.88" AND destinationport=3306 OR destinationaddress="147.45.44.166" AND destinationport=3306)
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="41.216.183.36" AND sourceport=3306 OR sourceaddress="185.209.21.88" AND sourceport=3306 OR sourceaddress="147.45.44.166" AND sourceport=3306)
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="41.216.183.36" AND sourceport=3306 OR translatedipaddress="185.209.21.88" AND sourceport=3306 OR translatedipaddress="147.45.44.166" AND sourceport=3306)
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="41.216.183.36" AND destinationport=3306 OR destinationtranslatedaddress="185.209.21.88" AND destinationport=3306 OR destinationtranslatedaddress="147.45.44.166" AND destinationport=3306)
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="41.216.183.36" AND destinationtranslatedport=3306 OR destinationtranslatedaddress="185.209.21.88" AND destinationtranslatedport=3306 OR destinationtranslatedaddress="147.45.44.166" AND destinationtranslatedport=3306)
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="41.216.183.36" AND translatedport=3306 OR destinationtranslatedaddress="185.209.21.88" AND translatedport=3306 OR destinationtranslatedaddress="147.45.44.166" AND translatedport=3306)
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="41.216.183.36" AND destinationport=3306 OR destinationaddress="185.209.21.88" AND destinationport=3306 OR destinationaddress="147.45.44.166" AND destinationport=3306)
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="41.216.183.36" AND sourceport=3306 OR sourceaddress="185.209.21.88" AND sourceport=3306 OR sourceaddress="147.45.44.166" AND sourceport=3306)
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="41.216.183.36" AND sourceport=3306 OR translatedipaddress="185.209.21.88" AND sourceport=3306 OR translatedipaddress="147.45.44.166" AND sourceport=3306)
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="41.216.183.36" AND destinationport=3306 OR destinationtranslatedaddress="185.209.21.88" AND destinationport=3306 OR destinationtranslatedaddress="147.45.44.166" AND destinationport=3306)
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="41.216.183.36" AND destinationtranslatedport=3306 OR destinationtranslatedaddress="185.209.21.88" AND destinationtranslatedport=3306 OR destinationtranslatedaddress="147.45.44.166" AND destinationtranslatedport=3306)
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="41.216.183.36" AND translatedport=3306 OR destinationtranslatedaddress="185.209.21.88" AND translatedport=3306 OR destinationtranslatedaddress="147.45.44.166" AND translatedport=3306)
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="41.216.183.36" AND destinationport=3306 OR destinationaddress="185.209.21.88" AND destinationport=3306 OR destinationaddress="147.45.44.166" AND destinationport=3306)
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="41.216.183.36" AND sourceport=3306 OR sourceaddress="185.209.21.88" AND sourceport=3306 OR sourceaddress="147.45.44.166" AND sourceport=3306)
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="41.216.183.36" AND sourceport=3306 OR translatedipaddress="185.209.21.88" AND sourceport=3306 OR translatedipaddress="147.45.44.166" AND sourceport=3306)
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="41.216.183.36" AND destinationport=3306 OR destinationtranslatedaddress="185.209.21.88" AND destinationport=3306 OR destinationtranslatedaddress="147.45.44.166" AND destinationport=3306)
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="41.216.183.36" AND destinationtranslatedport=3306 OR destinationtranslatedaddress="185.209.21.88" AND destinationtranslatedport=3306 OR destinationtranslatedaddress="147.45.44.166" AND destinationtranslatedport=3306)
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="41.216.183.36" AND translatedport=3306 OR destinationtranslatedaddress="185.209.21.88" AND translatedport=3306 OR destinationtranslatedaddress="147.45.44.166" AND translatedport=3306)
index=activity AND rg_functionality="Next Generation Firewall" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="41.216.183.36" AND destinationport=3306 OR destinationaddress="185.209.21.88" AND destinationport=3306 OR destinationaddress="147.45.44.166" AND destinationport=3306)
index=activity AND rg_functionality="Next Generation Firewall" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="41.216.183.36" AND sourceport=3306 OR sourceaddress="185.209.21.88" AND sourceport=3306 OR sourceaddress="147.45.44.166" AND sourceport=3306)
index=activity AND rg_functionality="Next Generation Firewall" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="41.216.183.36" AND sourceport=3306 OR translatedipaddress="185.209.21.88" AND sourceport=3306 OR translatedipaddress="147.45.44.166" AND sourceport=3306)
index=activity AND rg_functionality="Next Generation Firewall" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="41.216.183.36" AND destinationport=3306 OR destinationtranslatedaddress="185.209.21.88" AND destinationport=3306 OR destinationtranslatedaddress="147.45.44.166" AND destinationport=3306)
index=activity AND rg_functionality="Next Generation Firewall" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="41.216.183.36" AND destinationtranslatedport=3306 OR destinationtranslatedaddress="185.209.21.88" AND destinationtranslatedport=3306 OR destinationtranslatedaddress="147.45.44.166" AND destinationtranslatedport=3306)
index=activity AND rg_functionality="Next Generation Firewall" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="41.216.183.36" AND translatedport=3306 OR destinationtranslatedaddress="185.209.21.88" AND translatedport=3306 OR destinationtranslatedaddress="147.45.44.166" AND translatedport=3306)
index=activity AND rg_functionality="Firewall" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="41.216.183.36" AND destinationport=3306 OR destinationaddress="185.209.21.88" AND destinationport=3306 OR destinationaddress="147.45.44.166" AND destinationport=3306)
index=activity AND rg_functionality="Firewall" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="41.216.183.36" AND sourceport=3306 OR sourceaddress="185.209.21.88" AND sourceport=3306 OR sourceaddress="147.45.44.166" AND sourceport=3306)
index=activity AND rg_functionality="Firewall" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="41.216.183.36" AND sourceport=3306 OR translatedipaddress="185.209.21.88" AND sourceport=3306 OR translatedipaddress="147.45.44.166" AND sourceport=3306)
index=activity AND rg_functionality="Firewall" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="41.216.183.36" AND destinationport=3306 OR destinationtranslatedaddress="185.209.21.88" AND destinationport=3306 OR destinationtranslatedaddress="147.45.44.166" AND destinationport=3306)
index=activity AND rg_functionality="Firewall" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="41.216.183.36" AND destinationtranslatedport=3306 OR destinationtranslatedaddress="185.209.21.88" AND destinationtranslatedport=3306 OR destinationtranslatedaddress="147.45.44.166" AND destinationtranslatedport=3306)
index=activity AND rg_functionality="Firewall" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="41.216.183.36" AND translatedport=3306 OR destinationtranslatedaddress="185.209.21.88" AND translatedport=3306 OR destinationtranslatedaddress="147.45.44.166" AND translatedport=3306)
index=activity AND rg_functionality="Web Proxy" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="41.216.183.36" AND destinationport=3306 OR destinationaddress="185.209.21.88" AND destinationport=3306 OR destinationaddress="147.45.44.166" AND destinationport=3306)
index=activity AND rg_functionality="Web Proxy" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="41.216.183.36" AND sourceport=3306 OR sourceaddress="185.209.21.88" AND sourceport=3306 OR sourceaddress="147.45.44.166" AND sourceport=3306)
index=activity AND rg_functionality="Web Proxy" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="41.216.183.36" AND sourceport=3306 OR translatedipaddress="185.209.21.88" AND sourceport=3306 OR translatedipaddress="147.45.44.166" AND sourceport=3306)
index=activity AND rg_functionality="Web Proxy" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="41.216.183.36" AND destinationport=3306 OR destinationtranslatedaddress="185.209.21.88" AND destinationport=3306 OR destinationtranslatedaddress="147.45.44.166" AND destinationport=3306)
index=activity AND rg_functionality="Web Proxy" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="41.216.183.36" AND destinationtranslatedport=3306 OR destinationtranslatedaddress="185.209.21.88" AND destinationtranslatedport=3306 OR destinationtranslatedaddress="147.45.44.166" AND destinationtranslatedport=3306)
index=activity AND rg_functionality="Web Proxy" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="41.216.183.36" AND translatedport=3306 OR destinationtranslatedaddress="185.209.21.88" AND translatedport=3306 OR destinationtranslatedaddress="147.45.44.166" AND translatedport=3306)
index=activity AND rg_functionality="Flow" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="41.216.183.36" AND destinationport=3306 OR destinationaddress="185.209.21.88" AND destinationport=3306 OR destinationaddress="147.45.44.166" AND destinationport=3306)
index=activity AND rg_functionality="Flow" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="41.216.183.36" AND sourceport=3306 OR sourceaddress="185.209.21.88" AND sourceport=3306 OR sourceaddress="147.45.44.166" AND sourceport=3306)
index=activity AND rg_functionality="Flow" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="41.216.183.36" AND sourceport=3306 OR translatedipaddress="185.209.21.88" AND sourceport=3306 OR translatedipaddress="147.45.44.166" AND sourceport=3306)
index=activity AND rg_functionality="Flow" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="41.216.183.36" AND destinationport=3306 OR destinationtranslatedaddress="185.209.21.88" AND destinationport=3306 OR destinationtranslatedaddress="147.45.44.166" AND destinationport=3306)
index=activity AND rg_functionality="Flow" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="41.216.183.36" AND destinationtranslatedport=3306 OR destinationtranslatedaddress="185.209.21.88" AND destinationtranslatedport=3306 OR destinationtranslatedaddress="147.45.44.166" AND destinationtranslatedport=3306)
index=activity AND rg_functionality="Flow" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="41.216.183.36" AND translatedport=3306 OR destinationtranslatedaddress="185.209.21.88" AND translatedport=3306 OR destinationtranslatedaddress="147.45.44.166" AND translatedport=3306)
index=activity AND rg_functionality="Web Server" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="41.216.183.36" AND destinationport=3306 OR destinationaddress="185.209.21.88" AND destinationport=3306 OR destinationaddress="147.45.44.166" AND destinationport=3306)
index=activity AND rg_functionality="Web Server" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="41.216.183.36" AND sourceport=3306 OR sourceaddress="185.209.21.88" AND sourceport=3306 OR sourceaddress="147.45.44.166" AND sourceport=3306)
index=activity AND rg_functionality="Web Server" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="41.216.183.36" AND sourceport=3306 OR translatedipaddress="185.209.21.88" AND sourceport=3306 OR translatedipaddress="147.45.44.166" AND sourceport=3306)
index=activity AND rg_functionality="Web Server" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="41.216.183.36" AND destinationport=3306 OR destinationtranslatedaddress="185.209.21.88" AND destinationport=3306 OR destinationtranslatedaddress="147.45.44.166" AND destinationport=3306)
index=activity AND rg_functionality="Web Server" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="41.216.183.36" AND destinationtranslatedport=3306 OR destinationtranslatedaddress="185.209.21.88" AND destinationtranslatedport=3306 OR destinationtranslatedaddress="147.45.44.166" AND destinationtranslatedport=3306)
index=activity AND rg_functionality="Web Server" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="41.216.183.36" AND translatedport=3306 OR destinationtranslatedaddress="185.209.21.88" AND translatedport=3306 OR destinationtranslatedaddress="147.45.44.166" AND translatedport=3306)
index=activity AND rg_functionality="Web Application Firewall" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="41.216.183.36" AND destinationport=3306 OR destinationaddress="185.209.21.88" AND destinationport=3306 OR destinationaddress="147.45.44.166" AND destinationport=3306)
index=activity AND rg_functionality="Web Application Firewall" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="41.216.183.36" AND sourceport=3306 OR sourceaddress="185.209.21.88" AND sourceport=3306 OR sourceaddress="147.45.44.166" AND sourceport=3306)
index=activity AND rg_functionality="Web Application Firewall" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="41.216.183.36" AND sourceport=3306 OR translatedipaddress="185.209.21.88" AND sourceport=3306 OR translatedipaddress="147.45.44.166" AND sourceport=3306)
index=activity AND rg_functionality="Web Application Firewall" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="41.216.183.36" AND destinationport=3306 OR destinationtranslatedaddress="185.209.21.88" AND destinationport=3306 OR destinationtranslatedaddress="147.45.44.166" AND destinationport=3306)
index=activity AND rg_functionality="Web Application Firewall" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="41.216.183.36" AND destinationtranslatedport=3306 OR destinationtranslatedaddress="185.209.21.88" AND destinationtranslatedport=3306 OR destinationtranslatedaddress="147.45.44.166" AND destinationtranslatedport=3306)
index=activity AND rg_functionality="Web Application Firewall" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="41.216.183.36" AND translatedport=3306 OR destinationtranslatedaddress="185.209.21.88" AND translatedport=3306 OR destinationtranslatedaddress="147.45.44.166" AND translatedport=3306)
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="41.216.183.36" AND destinationport=3306 OR destinationaddress="185.209.21.88" AND destinationport=3306 OR destinationaddress="147.45.44.166" AND destinationport=3306)
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="41.216.183.36" AND sourceport=3306 OR sourceaddress="185.209.21.88" AND sourceport=3306 OR sourceaddress="147.45.44.166" AND sourceport=3306)
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="41.216.183.36" AND sourceport=3306 OR translatedipaddress="185.209.21.88" AND sourceport=3306 OR translatedipaddress="147.45.44.166" AND sourceport=3306)
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="41.216.183.36" AND destinationport=3306 OR destinationtranslatedaddress="185.209.21.88" AND destinationport=3306 OR destinationtranslatedaddress="147.45.44.166" AND destinationport=3306)
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="41.216.183.36" AND destinationtranslatedport=3306 OR destinationtranslatedaddress="185.209.21.88" AND destinationtranslatedport=3306 OR destinationtranslatedaddress="147.45.44.166" AND destinationtranslatedport=3306)
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="41.216.183.36" AND translatedport=3306 OR destinationtranslatedaddress="185.209.21.88" AND translatedport=3306 OR destinationtranslatedaddress="147.45.44.166" AND translatedport=3306)
index=activity AND rg_functionality="Cloud Services / Applications" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="41.216.183.36" AND destinationport=3306 OR destinationaddress="185.209.21.88" AND destinationport=3306 OR destinationaddress="147.45.44.166" AND destinationport=3306)
index=activity AND rg_functionality="Cloud Services / Applications" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="41.216.183.36" AND sourceport=3306 OR sourceaddress="185.209.21.88" AND sourceport=3306 OR sourceaddress="147.45.44.166" AND sourceport=3306)
index=activity AND rg_functionality="Cloud Services / Applications" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="41.216.183.36" AND sourceport=3306 OR translatedipaddress="185.209.21.88" AND sourceport=3306 OR translatedipaddress="147.45.44.166" AND sourceport=3306)
index=activity AND rg_functionality="Cloud Services / Applications" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="41.216.183.36" AND destinationport=3306 OR destinationtranslatedaddress="185.209.21.88" AND destinationport=3306 OR destinationtranslatedaddress="147.45.44.166" AND destinationport=3306)
index=activity AND rg_functionality="Cloud Services / Applications" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="41.216.183.36" AND destinationtranslatedport=3306 OR destinationtranslatedaddress="185.209.21.88" AND destinationtranslatedport=3306 OR destinationtranslatedaddress="147.45.44.166" AND destinationtranslatedport=3306)
index=activity AND rg_functionality="Cloud Services / Applications" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="41.216.183.36" AND translatedport=3306 OR destinationtranslatedaddress="185.209.21.88" AND translatedport=3306 OR destinationtranslatedaddress="147.45.44.166" AND translatedport=3306)
index=activity AND rg_functionality="Cloud Application Audit" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="41.216.183.36" AND destinationport=3306 OR destinationaddress="185.209.21.88" AND destinationport=3306 OR destinationaddress="147.45.44.166" AND destinationport=3306)
index=activity AND rg_functionality="Cloud Application Audit" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="41.216.183.36" AND sourceport=3306 OR sourceaddress="185.209.21.88" AND sourceport=3306 OR sourceaddress="147.45.44.166" AND sourceport=3306)
index=activity AND rg_functionality="Cloud Application Audit" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="41.216.183.36" AND sourceport=3306 OR translatedipaddress="185.209.21.88" AND sourceport=3306 OR translatedipaddress="147.45.44.166" AND sourceport=3306)
index=activity AND rg_functionality="Cloud Application Audit" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="41.216.183.36" AND destinationport=3306 OR destinationtranslatedaddress="185.209.21.88" AND destinationport=3306 OR destinationtranslatedaddress="147.45.44.166" AND destinationport=3306)
index=activity AND rg_functionality="Cloud Application Audit" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="41.216.183.36" AND destinationtranslatedport=3306 OR destinationtranslatedaddress="185.209.21.88" AND destinationtranslatedport=3306 OR destinationtranslatedaddress="147.45.44.166" AND destinationtranslatedport=3306)
index=activity AND rg_functionality="Cloud Application Audit" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="41.216.183.36" AND translatedport=3306 OR destinationtranslatedaddress="185.209.21.88" AND translatedport=3306 OR destinationtranslatedaddress="147.45.44.166" AND translatedport=3306)
index=activity AND rg_functionality="Authentication / VPN" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="41.216.183.36" AND destinationport=3306 OR destinationaddress="185.209.21.88" AND destinationport=3306 OR destinationaddress="147.45.44.166" AND destinationport=3306)
index=activity AND rg_functionality="Authentication / VPN" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="41.216.183.36" AND sourceport=3306 OR sourceaddress="185.209.21.88" AND sourceport=3306 OR sourceaddress="147.45.44.166" AND sourceport=3306)
index=activity AND rg_functionality="Authentication / VPN" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="41.216.183.36" AND sourceport=3306 OR translatedipaddress="185.209.21.88" AND sourceport=3306 OR translatedipaddress="147.45.44.166" AND sourceport=3306)
index=activity AND rg_functionality="Authentication / VPN" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="41.216.183.36" AND destinationport=3306 OR destinationtranslatedaddress="185.209.21.88" AND destinationport=3306 OR destinationtranslatedaddress="147.45.44.166" AND destinationport=3306)
index=activity AND rg_functionality="Authentication / VPN" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="41.216.183.36" AND destinationtranslatedport=3306 OR destinationtranslatedaddress="185.209.21.88" AND destinationtranslatedport=3306 OR destinationtranslatedaddress="147.45.44.166" AND destinationtranslatedport=3306)
index=activity AND rg_functionality="Authentication / VPN" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="41.216.183.36" AND translatedport=3306 OR destinationtranslatedaddress="185.209.21.88" AND translatedport=3306 OR destinationtranslatedaddress="147.45.44.166" AND translatedport=3306)
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="41.216.183.36" AND destinationport=3306 OR destinationaddress="185.209.21.88" AND destinationport=3306 OR destinationaddress="147.45.44.166" AND destinationport=3306)
index=activity AND rg_functionality="Unix / Linux / AIX" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="41.216.183.36" AND sourceport=3306 OR sourceaddress="185.209.21.88" AND sourceport=3306 OR sourceaddress="147.45.44.166" AND sourceport=3306)
index=activity AND rg_functionality="Unix / Linux / AIX" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="41.216.183.36" AND sourceport=3306 OR translatedipaddress="185.209.21.88" AND sourceport=3306 OR translatedipaddress="147.45.44.166" AND sourceport=3306)
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="41.216.183.36" AND destinationport=3306 OR destinationtranslatedaddress="185.209.21.88" AND destinationport=3306 OR destinationtranslatedaddress="147.45.44.166" AND destinationport=3306)
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="41.216.183.36" AND destinationtranslatedport=3306 OR destinationtranslatedaddress="185.209.21.88" AND destinationtranslatedport=3306 OR destinationtranslatedaddress="147.45.44.166" AND destinationtranslatedport=3306)
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="41.216.183.36" AND translatedport=3306 OR destinationtranslatedaddress="185.209.21.88" AND translatedport=3306 OR destinationtranslatedaddress="147.45.44.166" AND translatedport=3306)
index=activity AND rg_functionality="Authentication / WiFi" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="41.216.183.36" AND destinationport=3306 OR destinationaddress="185.209.21.88" AND destinationport=3306 OR destinationaddress="147.45.44.166" AND destinationport=3306)
index=activity AND rg_functionality="Authentication / WiFi" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="41.216.183.36" AND sourceport=3306 OR sourceaddress="185.209.21.88" AND sourceport=3306 OR sourceaddress="147.45.44.166" AND sourceport=3306)
index=activity AND rg_functionality="Authentication / WiFi" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="41.216.183.36" AND sourceport=3306 OR translatedipaddress="185.209.21.88" AND sourceport=3306 OR translatedipaddress="147.45.44.166" AND sourceport=3306)
index=activity AND rg_functionality="Authentication / WiFi" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="41.216.183.36" AND destinationport=3306 OR destinationtranslatedaddress="185.209.21.88" AND destinationport=3306 OR destinationtranslatedaddress="147.45.44.166" AND destinationport=3306)
index=activity AND rg_functionality="Authentication / WiFi" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="41.216.183.36" AND destinationtranslatedport=3306 OR destinationtranslatedaddress="185.209.21.88" AND destinationtranslatedport=3306 OR destinationtranslatedaddress="147.45.44.166" AND destinationtranslatedport=3306)
index=activity AND rg_functionality="Authentication / WiFi" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="41.216.183.36" AND translatedport=3306 OR destinationtranslatedaddress="185.209.21.88" AND translatedport=3306 OR destinationtranslatedaddress="147.45.44.166" AND translatedport=3306)
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="41.216.183.36" AND destinationport=3306 OR destinationaddress="185.209.21.88" AND destinationport=3306 OR destinationaddress="147.45.44.166" AND destinationport=3306)
index=activity AND rg_functionality="Cloud Application Security Broker" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="41.216.183.36" AND sourceport=3306 OR sourceaddress="185.209.21.88" AND sourceport=3306 OR sourceaddress="147.45.44.166" AND sourceport=3306)
index=activity AND rg_functionality="Cloud Application Security Broker" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="41.216.183.36" AND sourceport=3306 OR translatedipaddress="185.209.21.88" AND sourceport=3306 OR translatedipaddress="147.45.44.166" AND sourceport=3306)
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="41.216.183.36" AND destinationport=3306 OR destinationtranslatedaddress="185.209.21.88" AND destinationport=3306 OR destinationtranslatedaddress="147.45.44.166" AND destinationport=3306)
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="41.216.183.36" AND destinationtranslatedport=3306 OR destinationtranslatedaddress="185.209.21.88" AND destinationtranslatedport=3306 OR destinationtranslatedaddress="147.45.44.166" AND destinationtranslatedport=3306)
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="41.216.183.36" AND translatedport=3306 OR destinationtranslatedaddress="185.209.21.88" AND translatedport=3306 OR destinationtranslatedaddress="147.45.44.166" AND translatedport=3306)
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="41.216.183.36" AND destinationport=3306 OR destinationaddress="185.209.21.88" AND destinationport=3306 OR destinationaddress="147.45.44.166" AND destinationport=3306)
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="41.216.183.36" AND sourceport=3306 OR sourceaddress="185.209.21.88" AND sourceport=3306 OR sourceaddress="147.45.44.166" AND sourceport=3306)
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="41.216.183.36" AND sourceport=3306 OR translatedipaddress="185.209.21.88" AND sourceport=3306 OR translatedipaddress="147.45.44.166" AND sourceport=3306)
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="41.216.183.36" AND destinationport=3306 OR destinationtranslatedaddress="185.209.21.88" AND destinationport=3306 OR destinationtranslatedaddress="147.45.44.166" AND destinationport=3306)
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="41.216.183.36" AND destinationtranslatedport=3306 OR destinationtranslatedaddress="185.209.21.88" AND destinationtranslatedport=3306 OR destinationtranslatedaddress="147.45.44.166" AND destinationtranslatedport=3306)
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="41.216.183.36" AND translatedport=3306 OR destinationtranslatedaddress="185.209.21.88" AND translatedport=3306 OR destinationtranslatedaddress="147.45.44.166" AND translatedport=3306)
