index=activity AND rg_functionality="Next Generation Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "a-ad-tml.ntp-update.com" OR destinationhostname CONTAINS "rps-a.ntp-update.com" OR destinationhostname CONTAINS "a-rps.ntp-update.com" OR destinationhostname CONTAINS "dns-a.ntp-update.com" OR destinationhostname CONTAINS "a-tb.ntp-update.com" OR destinationhostname CONTAINS "alast.sun-java.com" OR destinationhostname CONTAINS "alast.ntp-update.com" OR destinationhostname CONTAINS "dell-a.ntp-update.com" OR destinationhostname CONTAINS "a-sp-rps.0g6666.com" OR destinationhostname CONTAINS "windows.javaupdate-cdn.com" OR destinationhostname CONTAINS "javaupdatecdn.com" OR destinationhostname CONTAINS "flash.javaupdate-cdn.com" OR destinationhostname CONTAINS "linux.ntp-update.com" OR destinationhostname CONTAINS "esxi-lty.ntp-update.com" OR destinationhostname CONTAINS "windows.0g6666.com" OR destinationhostname CONTAINS "ubuntu-ndi.ntp-update.com" OR destinationhostname CONTAINS "h1.xpjpz400.com" OR destinationhostname CONTAINS "cg.xpjpz400.com" OR destinationhostname CONTAINS "letsencrypt.msupdatesync.com" OR destinationhostname CONTAINS "cloud.ntp-update.com" OR destinationhostname CONTAINS "fe.ntp-update.com" OR destinationhostname CONTAINS "wtech.ntp-update.com" OR destinationhostname CONTAINS "imp.ntp-update.com" OR destinationhostname CONTAINS "ogplus.ntp-update.com" OR destinationhostname CONTAINS "organization.0g6666.com" OR destinationhostname CONTAINS "global.ntp-update.com" OR destinationhostname CONTAINS "kaiy.0g6666.com" OR destinationhostname CONTAINS "kaiy.ntp-update.com" OR destinationhostname CONTAINS "ky.0g6666.com" OR destinationhostname CONTAINS "oriental.ntp-update.com" OR destinationhostname CONTAINS "guard.ntp-update.com" OR destinationhostname CONTAINS "oglive.ntp-update.com" OR destinationhostname CONTAINS "guard.0g6666.com" OR destinationhostname CONTAINS "plus.ntp-update.com" OR destinationhostname CONTAINS "oglty.0g6666.com" OR destinationhostname CONTAINS "oglty.ntp-update.com" OR destinationhostname CONTAINS "oglty-ml.ntp-update.com" OR destinationhostname CONTAINS "ml-lty.ntp-update.com" OR destinationhostname CONTAINS "telegram.ntp-update.com" OR destinationhostname CONTAINS "easyh.ntp-update.com" OR destinationhostname CONTAINS "weblog.ntp-update.com" OR destinationhostname CONTAINS "weblog-ml.ntp-update.com" OR destinationhostname CONTAINS "o-fsh.ntp-update.com" OR destinationhostname CONTAINS "idn-tb.ntp-update.com" OR destinationhostname CONTAINS "tb-ndi2.ntp-update.com" OR destinationhostname CONTAINS "ml-ndi.ntp-update.com" OR destinationhostname CONTAINS "vct.0g6666.com" OR destinationhostname CONTAINS "windows-i-tb.ntp-update.com" OR destinationhostname CONTAINS "windows-qc-tb-i.ntp-update.com" OR destinationhostname CONTAINS "windows-tb-i.ntp-update.com")
index=activity AND rg_functionality="Next Generation Firewall" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "a-ad-tml.ntp-update.com" OR sourcentdomain CONTAINS "rps-a.ntp-update.com" OR sourcentdomain CONTAINS "a-rps.ntp-update.com" OR sourcentdomain CONTAINS "dns-a.ntp-update.com" OR sourcentdomain CONTAINS "a-tb.ntp-update.com" OR sourcentdomain CONTAINS "alast.sun-java.com" OR sourcentdomain CONTAINS "alast.ntp-update.com" OR sourcentdomain CONTAINS "dell-a.ntp-update.com" OR sourcentdomain CONTAINS "a-sp-rps.0g6666.com" OR sourcentdomain CONTAINS "windows.javaupdate-cdn.com" OR sourcentdomain CONTAINS "javaupdatecdn.com" OR sourcentdomain CONTAINS "flash.javaupdate-cdn.com" OR sourcentdomain CONTAINS "linux.ntp-update.com" OR sourcentdomain CONTAINS "esxi-lty.ntp-update.com" OR sourcentdomain CONTAINS "windows.0g6666.com" OR sourcentdomain CONTAINS "ubuntu-ndi.ntp-update.com" OR sourcentdomain CONTAINS "h1.xpjpz400.com" OR sourcentdomain CONTAINS "cg.xpjpz400.com" OR sourcentdomain CONTAINS "letsencrypt.msupdatesync.com" OR sourcentdomain CONTAINS "cloud.ntp-update.com" OR sourcentdomain CONTAINS "fe.ntp-update.com" OR sourcentdomain CONTAINS "wtech.ntp-update.com" OR sourcentdomain CONTAINS "imp.ntp-update.com" OR sourcentdomain CONTAINS "ogplus.ntp-update.com" OR sourcentdomain CONTAINS "organization.0g6666.com" OR sourcentdomain CONTAINS "global.ntp-update.com" OR sourcentdomain CONTAINS "kaiy.0g6666.com" OR sourcentdomain CONTAINS "kaiy.ntp-update.com" OR sourcentdomain CONTAINS "ky.0g6666.com" OR sourcentdomain CONTAINS "oriental.ntp-update.com" OR sourcentdomain CONTAINS "guard.ntp-update.com" OR sourcentdomain CONTAINS "oglive.ntp-update.com" OR sourcentdomain CONTAINS "guard.0g6666.com" OR sourcentdomain CONTAINS "plus.ntp-update.com" OR sourcentdomain CONTAINS "oglty.0g6666.com" OR sourcentdomain CONTAINS "oglty.ntp-update.com" OR sourcentdomain CONTAINS "oglty-ml.ntp-update.com" OR sourcentdomain CONTAINS "ml-lty.ntp-update.com" OR sourcentdomain CONTAINS "telegram.ntp-update.com" OR sourcentdomain CONTAINS "easyh.ntp-update.com" OR sourcentdomain CONTAINS "weblog.ntp-update.com" OR sourcentdomain CONTAINS "weblog-ml.ntp-update.com" OR sourcentdomain CONTAINS "o-fsh.ntp-update.com" OR sourcentdomain CONTAINS "idn-tb.ntp-update.com" OR sourcentdomain CONTAINS "tb-ndi2.ntp-update.com" OR sourcentdomain CONTAINS "ml-ndi.ntp-update.com" OR sourcentdomain CONTAINS "vct.0g6666.com" OR sourcentdomain CONTAINS "windows-i-tb.ntp-update.com" OR sourcentdomain CONTAINS "windows-qc-tb-i.ntp-update.com" OR sourcentdomain CONTAINS "windows-tb-i.ntp-update.com")
index=activity AND rg_functionality="Next Generation Firewall" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "a-ad-tml.ntp-update.com" OR sourcehostname CONTAINS "rps-a.ntp-update.com" OR sourcehostname CONTAINS "a-rps.ntp-update.com" OR sourcehostname CONTAINS "dns-a.ntp-update.com" OR sourcehostname CONTAINS "a-tb.ntp-update.com" OR sourcehostname CONTAINS "alast.sun-java.com" OR sourcehostname CONTAINS "alast.ntp-update.com" OR sourcehostname CONTAINS "dell-a.ntp-update.com" OR sourcehostname CONTAINS "a-sp-rps.0g6666.com" OR sourcehostname CONTAINS "windows.javaupdate-cdn.com" OR sourcehostname CONTAINS "javaupdatecdn.com" OR sourcehostname CONTAINS "flash.javaupdate-cdn.com" OR sourcehostname CONTAINS "linux.ntp-update.com" OR sourcehostname CONTAINS "esxi-lty.ntp-update.com" OR sourcehostname CONTAINS "windows.0g6666.com" OR sourcehostname CONTAINS "ubuntu-ndi.ntp-update.com" OR sourcehostname CONTAINS "h1.xpjpz400.com" OR sourcehostname CONTAINS "cg.xpjpz400.com" OR sourcehostname CONTAINS "letsencrypt.msupdatesync.com" OR sourcehostname CONTAINS "cloud.ntp-update.com" OR sourcehostname CONTAINS "fe.ntp-update.com" OR sourcehostname CONTAINS "wtech.ntp-update.com" OR sourcehostname CONTAINS "imp.ntp-update.com" OR sourcehostname CONTAINS "ogplus.ntp-update.com" OR sourcehostname CONTAINS "organization.0g6666.com" OR sourcehostname CONTAINS "global.ntp-update.com" OR sourcehostname CONTAINS "kaiy.0g6666.com" OR sourcehostname CONTAINS "kaiy.ntp-update.com" OR sourcehostname CONTAINS "ky.0g6666.com" OR sourcehostname CONTAINS "oriental.ntp-update.com" OR sourcehostname CONTAINS "guard.ntp-update.com" OR sourcehostname CONTAINS "oglive.ntp-update.com" OR sourcehostname CONTAINS "guard.0g6666.com" OR sourcehostname CONTAINS "plus.ntp-update.com" OR sourcehostname CONTAINS "oglty.0g6666.com" OR sourcehostname CONTAINS "oglty.ntp-update.com" OR sourcehostname CONTAINS "oglty-ml.ntp-update.com" OR sourcehostname CONTAINS "ml-lty.ntp-update.com" OR sourcehostname CONTAINS "telegram.ntp-update.com" OR sourcehostname CONTAINS "easyh.ntp-update.com" OR sourcehostname CONTAINS "weblog.ntp-update.com" OR sourcehostname CONTAINS "weblog-ml.ntp-update.com" OR sourcehostname CONTAINS "o-fsh.ntp-update.com" OR sourcehostname CONTAINS "idn-tb.ntp-update.com" OR sourcehostname CONTAINS "tb-ndi2.ntp-update.com" OR sourcehostname CONTAINS "ml-ndi.ntp-update.com" OR sourcehostname CONTAINS "vct.0g6666.com" OR sourcehostname CONTAINS "windows-i-tb.ntp-update.com" OR sourcehostname CONTAINS "windows-qc-tb-i.ntp-update.com" OR sourcehostname CONTAINS "windows-tb-i.ntp-update.com")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "a-ad-tml.ntp-update.com" OR destinationntdomain CONTAINS "rps-a.ntp-update.com" OR destinationntdomain CONTAINS "a-rps.ntp-update.com" OR destinationntdomain CONTAINS "dns-a.ntp-update.com" OR destinationntdomain CONTAINS "a-tb.ntp-update.com" OR destinationntdomain CONTAINS "alast.sun-java.com" OR destinationntdomain CONTAINS "alast.ntp-update.com" OR destinationntdomain CONTAINS "dell-a.ntp-update.com" OR destinationntdomain CONTAINS "a-sp-rps.0g6666.com" OR destinationntdomain CONTAINS "windows.javaupdate-cdn.com" OR destinationntdomain CONTAINS "javaupdatecdn.com" OR destinationntdomain CONTAINS "flash.javaupdate-cdn.com" OR destinationntdomain CONTAINS "linux.ntp-update.com" OR destinationntdomain CONTAINS "esxi-lty.ntp-update.com" OR destinationntdomain CONTAINS "windows.0g6666.com" OR destinationntdomain CONTAINS "ubuntu-ndi.ntp-update.com" OR destinationntdomain CONTAINS "h1.xpjpz400.com" OR destinationntdomain CONTAINS "cg.xpjpz400.com" OR destinationntdomain CONTAINS "letsencrypt.msupdatesync.com" OR destinationntdomain CONTAINS "cloud.ntp-update.com" OR destinationntdomain CONTAINS "fe.ntp-update.com" OR destinationntdomain CONTAINS "wtech.ntp-update.com" OR destinationntdomain CONTAINS "imp.ntp-update.com" OR destinationntdomain CONTAINS "ogplus.ntp-update.com" OR destinationntdomain CONTAINS "organization.0g6666.com" OR destinationntdomain CONTAINS "global.ntp-update.com" OR destinationntdomain CONTAINS "kaiy.0g6666.com" OR destinationntdomain CONTAINS "kaiy.ntp-update.com" OR destinationntdomain CONTAINS "ky.0g6666.com" OR destinationntdomain CONTAINS "oriental.ntp-update.com" OR destinationntdomain CONTAINS "guard.ntp-update.com" OR destinationntdomain CONTAINS "oglive.ntp-update.com" OR destinationntdomain CONTAINS "guard.0g6666.com" OR destinationntdomain CONTAINS "plus.ntp-update.com" OR destinationntdomain CONTAINS "oglty.0g6666.com" OR destinationntdomain CONTAINS "oglty.ntp-update.com" OR destinationntdomain CONTAINS "oglty-ml.ntp-update.com" OR destinationntdomain CONTAINS "ml-lty.ntp-update.com" OR destinationntdomain CONTAINS "telegram.ntp-update.com" OR destinationntdomain CONTAINS "easyh.ntp-update.com" OR destinationntdomain CONTAINS "weblog.ntp-update.com" OR destinationntdomain CONTAINS "weblog-ml.ntp-update.com" OR destinationntdomain CONTAINS "o-fsh.ntp-update.com" OR destinationntdomain CONTAINS "idn-tb.ntp-update.com" OR destinationntdomain CONTAINS "tb-ndi2.ntp-update.com" OR destinationntdomain CONTAINS "ml-ndi.ntp-update.com" OR destinationntdomain CONTAINS "vct.0g6666.com" OR destinationntdomain CONTAINS "windows-i-tb.ntp-update.com" OR destinationntdomain CONTAINS "windows-qc-tb-i.ntp-update.com" OR destinationntdomain CONTAINS "windows-tb-i.ntp-update.com")
index=activity AND rg_functionality="Next Generation Firewall" AND requesturl NOT NULL AND (requesturl CONTAINS "a-ad-tml.ntp-update.com" OR requesturl CONTAINS "rps-a.ntp-update.com" OR requesturl CONTAINS "a-rps.ntp-update.com" OR requesturl CONTAINS "dns-a.ntp-update.com" OR requesturl CONTAINS "a-tb.ntp-update.com" OR requesturl CONTAINS "alast.sun-java.com" OR requesturl CONTAINS "alast.ntp-update.com" OR requesturl CONTAINS "dell-a.ntp-update.com" OR requesturl CONTAINS "a-sp-rps.0g6666.com" OR requesturl CONTAINS "windows.javaupdate-cdn.com" OR requesturl CONTAINS "javaupdatecdn.com" OR requesturl CONTAINS "flash.javaupdate-cdn.com" OR requesturl CONTAINS "linux.ntp-update.com" OR requesturl CONTAINS "esxi-lty.ntp-update.com" OR requesturl CONTAINS "windows.0g6666.com" OR requesturl CONTAINS "ubuntu-ndi.ntp-update.com" OR requesturl CONTAINS "h1.xpjpz400.com" OR requesturl CONTAINS "cg.xpjpz400.com" OR requesturl CONTAINS "letsencrypt.msupdatesync.com" OR requesturl CONTAINS "cloud.ntp-update.com" OR requesturl CONTAINS "fe.ntp-update.com" OR requesturl CONTAINS "wtech.ntp-update.com" OR requesturl CONTAINS "imp.ntp-update.com" OR requesturl CONTAINS "ogplus.ntp-update.com" OR requesturl CONTAINS "organization.0g6666.com" OR requesturl CONTAINS "global.ntp-update.com" OR requesturl CONTAINS "kaiy.0g6666.com" OR requesturl CONTAINS "kaiy.ntp-update.com" OR requesturl CONTAINS "ky.0g6666.com" OR requesturl CONTAINS "oriental.ntp-update.com" OR requesturl CONTAINS "guard.ntp-update.com" OR requesturl CONTAINS "oglive.ntp-update.com" OR requesturl CONTAINS "guard.0g6666.com" OR requesturl CONTAINS "plus.ntp-update.com" OR requesturl CONTAINS "oglty.0g6666.com" OR requesturl CONTAINS "oglty.ntp-update.com" OR requesturl CONTAINS "oglty-ml.ntp-update.com" OR requesturl CONTAINS "ml-lty.ntp-update.com" OR requesturl CONTAINS "telegram.ntp-update.com" OR requesturl CONTAINS "easyh.ntp-update.com" OR requesturl CONTAINS "weblog.ntp-update.com" OR requesturl CONTAINS "weblog-ml.ntp-update.com" OR requesturl CONTAINS "o-fsh.ntp-update.com" OR requesturl CONTAINS "idn-tb.ntp-update.com" OR requesturl CONTAINS "tb-ndi2.ntp-update.com" OR requesturl CONTAINS "ml-ndi.ntp-update.com" OR requesturl CONTAINS "vct.0g6666.com" OR requesturl CONTAINS "windows-i-tb.ntp-update.com" OR requesturl CONTAINS "windows-qc-tb-i.ntp-update.com" OR requesturl CONTAINS "windows-tb-i.ntp-update.com")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "a-fms.ntp-update.com" OR destinationhostname CONTAINS "plus.0g6666.com" OR destinationhostname CONTAINS "aprotect.sun-java.com" OR destinationhostname CONTAINS "og8888.0g6666.com" OR destinationhostname CONTAINS "adobe.javaupdate-cdn.com" OR destinationhostname CONTAINS "linux.0g6666.com" OR destinationhostname CONTAINS "ad.ntp-update.com" OR destinationhostname CONTAINS "www.0g6666.com" OR destinationhostname CONTAINS "wt.ntp-update.com" OR destinationhostname CONTAINS "aliyun.ntp-update.com")
index=activity AND rg_functionality="Next Generation Firewall" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "a-fms.ntp-update.com" OR sourcentdomain CONTAINS "plus.0g6666.com" OR sourcentdomain CONTAINS "aprotect.sun-java.com" OR sourcentdomain CONTAINS "og8888.0g6666.com" OR sourcentdomain CONTAINS "adobe.javaupdate-cdn.com" OR sourcentdomain CONTAINS "linux.0g6666.com" OR sourcentdomain CONTAINS "ad.ntp-update.com" OR sourcentdomain CONTAINS "www.0g6666.com" OR sourcentdomain CONTAINS "wt.ntp-update.com" OR sourcentdomain CONTAINS "aliyun.ntp-update.com")
index=activity AND rg_functionality="Next Generation Firewall" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "a-fms.ntp-update.com" OR sourcehostname CONTAINS "plus.0g6666.com" OR sourcehostname CONTAINS "aprotect.sun-java.com" OR sourcehostname CONTAINS "og8888.0g6666.com" OR sourcehostname CONTAINS "adobe.javaupdate-cdn.com" OR sourcehostname CONTAINS "linux.0g6666.com" OR sourcehostname CONTAINS "ad.ntp-update.com" OR sourcehostname CONTAINS "www.0g6666.com" OR sourcehostname CONTAINS "wt.ntp-update.com" OR sourcehostname CONTAINS "aliyun.ntp-update.com")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "a-fms.ntp-update.com" OR destinationntdomain CONTAINS "plus.0g6666.com" OR destinationntdomain CONTAINS "aprotect.sun-java.com" OR destinationntdomain CONTAINS "og8888.0g6666.com" OR destinationntdomain CONTAINS "adobe.javaupdate-cdn.com" OR destinationntdomain CONTAINS "linux.0g6666.com" OR destinationntdomain CONTAINS "ad.ntp-update.com" OR destinationntdomain CONTAINS "www.0g6666.com" OR destinationntdomain CONTAINS "wt.ntp-update.com" OR destinationntdomain CONTAINS "aliyun.ntp-update.com")
index=activity AND rg_functionality="Next Generation Firewall" AND requesturl NOT NULL AND (requesturl CONTAINS "a-fms.ntp-update.com" OR requesturl CONTAINS "plus.0g6666.com" OR requesturl CONTAINS "aprotect.sun-java.com" OR requesturl CONTAINS "og8888.0g6666.com" OR requesturl CONTAINS "adobe.javaupdate-cdn.com" OR requesturl CONTAINS "linux.0g6666.com" OR requesturl CONTAINS "ad.ntp-update.com" OR requesturl CONTAINS "www.0g6666.com" OR requesturl CONTAINS "wt.ntp-update.com" OR requesturl CONTAINS "aliyun.ntp-update.com")
index=activity AND rg_functionality="Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "a-ad-tml.ntp-update.com" OR destinationhostname CONTAINS "rps-a.ntp-update.com" OR destinationhostname CONTAINS "a-rps.ntp-update.com" OR destinationhostname CONTAINS "dns-a.ntp-update.com" OR destinationhostname CONTAINS "a-tb.ntp-update.com" OR destinationhostname CONTAINS "alast.sun-java.com" OR destinationhostname CONTAINS "alast.ntp-update.com" OR destinationhostname CONTAINS "dell-a.ntp-update.com" OR destinationhostname CONTAINS "a-sp-rps.0g6666.com" OR destinationhostname CONTAINS "windows.javaupdate-cdn.com" OR destinationhostname CONTAINS "javaupdatecdn.com" OR destinationhostname CONTAINS "flash.javaupdate-cdn.com" OR destinationhostname CONTAINS "linux.ntp-update.com" OR destinationhostname CONTAINS "esxi-lty.ntp-update.com" OR destinationhostname CONTAINS "windows.0g6666.com" OR destinationhostname CONTAINS "ubuntu-ndi.ntp-update.com" OR destinationhostname CONTAINS "h1.xpjpz400.com" OR destinationhostname CONTAINS "cg.xpjpz400.com" OR destinationhostname CONTAINS "letsencrypt.msupdatesync.com" OR destinationhostname CONTAINS "cloud.ntp-update.com" OR destinationhostname CONTAINS "fe.ntp-update.com" OR destinationhostname CONTAINS "wtech.ntp-update.com" OR destinationhostname CONTAINS "imp.ntp-update.com" OR destinationhostname CONTAINS "ogplus.ntp-update.com" OR destinationhostname CONTAINS "organization.0g6666.com" OR destinationhostname CONTAINS "global.ntp-update.com" OR destinationhostname CONTAINS "kaiy.0g6666.com" OR destinationhostname CONTAINS "kaiy.ntp-update.com" OR destinationhostname CONTAINS "ky.0g6666.com" OR destinationhostname CONTAINS "oriental.ntp-update.com" OR destinationhostname CONTAINS "guard.ntp-update.com" OR destinationhostname CONTAINS "oglive.ntp-update.com" OR destinationhostname CONTAINS "guard.0g6666.com" OR destinationhostname CONTAINS "plus.ntp-update.com" OR destinationhostname CONTAINS "oglty.0g6666.com" OR destinationhostname CONTAINS "oglty.ntp-update.com" OR destinationhostname CONTAINS "oglty-ml.ntp-update.com" OR destinationhostname CONTAINS "ml-lty.ntp-update.com" OR destinationhostname CONTAINS "telegram.ntp-update.com" OR destinationhostname CONTAINS "easyh.ntp-update.com" OR destinationhostname CONTAINS "weblog.ntp-update.com" OR destinationhostname CONTAINS "weblog-ml.ntp-update.com" OR destinationhostname CONTAINS "o-fsh.ntp-update.com" OR destinationhostname CONTAINS "idn-tb.ntp-update.com" OR destinationhostname CONTAINS "tb-ndi2.ntp-update.com" OR destinationhostname CONTAINS "ml-ndi.ntp-update.com" OR destinationhostname CONTAINS "vct.0g6666.com" OR destinationhostname CONTAINS "windows-i-tb.ntp-update.com" OR destinationhostname CONTAINS "windows-qc-tb-i.ntp-update.com" OR destinationhostname CONTAINS "windows-tb-i.ntp-update.com")
index=activity AND rg_functionality="Firewall" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "a-ad-tml.ntp-update.com" OR sourcentdomain CONTAINS "rps-a.ntp-update.com" OR sourcentdomain CONTAINS "a-rps.ntp-update.com" OR sourcentdomain CONTAINS "dns-a.ntp-update.com" OR sourcentdomain CONTAINS "a-tb.ntp-update.com" OR sourcentdomain CONTAINS "alast.sun-java.com" OR sourcentdomain CONTAINS "alast.ntp-update.com" OR sourcentdomain CONTAINS "dell-a.ntp-update.com" OR sourcentdomain CONTAINS "a-sp-rps.0g6666.com" OR sourcentdomain CONTAINS "windows.javaupdate-cdn.com" OR sourcentdomain CONTAINS "javaupdatecdn.com" OR sourcentdomain CONTAINS "flash.javaupdate-cdn.com" OR sourcentdomain CONTAINS "linux.ntp-update.com" OR sourcentdomain CONTAINS "esxi-lty.ntp-update.com" OR sourcentdomain CONTAINS "windows.0g6666.com" OR sourcentdomain CONTAINS "ubuntu-ndi.ntp-update.com" OR sourcentdomain CONTAINS "h1.xpjpz400.com" OR sourcentdomain CONTAINS "cg.xpjpz400.com" OR sourcentdomain CONTAINS "letsencrypt.msupdatesync.com" OR sourcentdomain CONTAINS "cloud.ntp-update.com" OR sourcentdomain CONTAINS "fe.ntp-update.com" OR sourcentdomain CONTAINS "wtech.ntp-update.com" OR sourcentdomain CONTAINS "imp.ntp-update.com" OR sourcentdomain CONTAINS "ogplus.ntp-update.com" OR sourcentdomain CONTAINS "organization.0g6666.com" OR sourcentdomain CONTAINS "global.ntp-update.com" OR sourcentdomain CONTAINS "kaiy.0g6666.com" OR sourcentdomain CONTAINS "kaiy.ntp-update.com" OR sourcentdomain CONTAINS "ky.0g6666.com" OR sourcentdomain CONTAINS "oriental.ntp-update.com" OR sourcentdomain CONTAINS "guard.ntp-update.com" OR sourcentdomain CONTAINS "oglive.ntp-update.com" OR sourcentdomain CONTAINS "guard.0g6666.com" OR sourcentdomain CONTAINS "plus.ntp-update.com" OR sourcentdomain CONTAINS "oglty.0g6666.com" OR sourcentdomain CONTAINS "oglty.ntp-update.com" OR sourcentdomain CONTAINS "oglty-ml.ntp-update.com" OR sourcentdomain CONTAINS "ml-lty.ntp-update.com" OR sourcentdomain CONTAINS "telegram.ntp-update.com" OR sourcentdomain CONTAINS "easyh.ntp-update.com" OR sourcentdomain CONTAINS "weblog.ntp-update.com" OR sourcentdomain CONTAINS "weblog-ml.ntp-update.com" OR sourcentdomain CONTAINS "o-fsh.ntp-update.com" OR sourcentdomain CONTAINS "idn-tb.ntp-update.com" OR sourcentdomain CONTAINS "tb-ndi2.ntp-update.com" OR sourcentdomain CONTAINS "ml-ndi.ntp-update.com" OR sourcentdomain CONTAINS "vct.0g6666.com" OR sourcentdomain CONTAINS "windows-i-tb.ntp-update.com" OR sourcentdomain CONTAINS "windows-qc-tb-i.ntp-update.com" OR sourcentdomain CONTAINS "windows-tb-i.ntp-update.com")
index=activity AND rg_functionality="Firewall" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "a-ad-tml.ntp-update.com" OR sourcehostname CONTAINS "rps-a.ntp-update.com" OR sourcehostname CONTAINS "a-rps.ntp-update.com" OR sourcehostname CONTAINS "dns-a.ntp-update.com" OR sourcehostname CONTAINS "a-tb.ntp-update.com" OR sourcehostname CONTAINS "alast.sun-java.com" OR sourcehostname CONTAINS "alast.ntp-update.com" OR sourcehostname CONTAINS "dell-a.ntp-update.com" OR sourcehostname CONTAINS "a-sp-rps.0g6666.com" OR sourcehostname CONTAINS "windows.javaupdate-cdn.com" OR sourcehostname CONTAINS "javaupdatecdn.com" OR sourcehostname CONTAINS "flash.javaupdate-cdn.com" OR sourcehostname CONTAINS "linux.ntp-update.com" OR sourcehostname CONTAINS "esxi-lty.ntp-update.com" OR sourcehostname CONTAINS "windows.0g6666.com" OR sourcehostname CONTAINS "ubuntu-ndi.ntp-update.com" OR sourcehostname CONTAINS "h1.xpjpz400.com" OR sourcehostname CONTAINS "cg.xpjpz400.com" OR sourcehostname CONTAINS "letsencrypt.msupdatesync.com" OR sourcehostname CONTAINS "cloud.ntp-update.com" OR sourcehostname CONTAINS "fe.ntp-update.com" OR sourcehostname CONTAINS "wtech.ntp-update.com" OR sourcehostname CONTAINS "imp.ntp-update.com" OR sourcehostname CONTAINS "ogplus.ntp-update.com" OR sourcehostname CONTAINS "organization.0g6666.com" OR sourcehostname CONTAINS "global.ntp-update.com" OR sourcehostname CONTAINS "kaiy.0g6666.com" OR sourcehostname CONTAINS "kaiy.ntp-update.com" OR sourcehostname CONTAINS "ky.0g6666.com" OR sourcehostname CONTAINS "oriental.ntp-update.com" OR sourcehostname CONTAINS "guard.ntp-update.com" OR sourcehostname CONTAINS "oglive.ntp-update.com" OR sourcehostname CONTAINS "guard.0g6666.com" OR sourcehostname CONTAINS "plus.ntp-update.com" OR sourcehostname CONTAINS "oglty.0g6666.com" OR sourcehostname CONTAINS "oglty.ntp-update.com" OR sourcehostname CONTAINS "oglty-ml.ntp-update.com" OR sourcehostname CONTAINS "ml-lty.ntp-update.com" OR sourcehostname CONTAINS "telegram.ntp-update.com" OR sourcehostname CONTAINS "easyh.ntp-update.com" OR sourcehostname CONTAINS "weblog.ntp-update.com" OR sourcehostname CONTAINS "weblog-ml.ntp-update.com" OR sourcehostname CONTAINS "o-fsh.ntp-update.com" OR sourcehostname CONTAINS "idn-tb.ntp-update.com" OR sourcehostname CONTAINS "tb-ndi2.ntp-update.com" OR sourcehostname CONTAINS "ml-ndi.ntp-update.com" OR sourcehostname CONTAINS "vct.0g6666.com" OR sourcehostname CONTAINS "windows-i-tb.ntp-update.com" OR sourcehostname CONTAINS "windows-qc-tb-i.ntp-update.com" OR sourcehostname CONTAINS "windows-tb-i.ntp-update.com")
index=activity AND rg_functionality="Firewall" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "a-ad-tml.ntp-update.com" OR destinationntdomain CONTAINS "rps-a.ntp-update.com" OR destinationntdomain CONTAINS "a-rps.ntp-update.com" OR destinationntdomain CONTAINS "dns-a.ntp-update.com" OR destinationntdomain CONTAINS "a-tb.ntp-update.com" OR destinationntdomain CONTAINS "alast.sun-java.com" OR destinationntdomain CONTAINS "alast.ntp-update.com" OR destinationntdomain CONTAINS "dell-a.ntp-update.com" OR destinationntdomain CONTAINS "a-sp-rps.0g6666.com" OR destinationntdomain CONTAINS "windows.javaupdate-cdn.com" OR destinationntdomain CONTAINS "javaupdatecdn.com" OR destinationntdomain CONTAINS "flash.javaupdate-cdn.com" OR destinationntdomain CONTAINS "linux.ntp-update.com" OR destinationntdomain CONTAINS "esxi-lty.ntp-update.com" OR destinationntdomain CONTAINS "windows.0g6666.com" OR destinationntdomain CONTAINS "ubuntu-ndi.ntp-update.com" OR destinationntdomain CONTAINS "h1.xpjpz400.com" OR destinationntdomain CONTAINS "cg.xpjpz400.com" OR destinationntdomain CONTAINS "letsencrypt.msupdatesync.com" OR destinationntdomain CONTAINS "cloud.ntp-update.com" OR destinationntdomain CONTAINS "fe.ntp-update.com" OR destinationntdomain CONTAINS "wtech.ntp-update.com" OR destinationntdomain CONTAINS "imp.ntp-update.com" OR destinationntdomain CONTAINS "ogplus.ntp-update.com" OR destinationntdomain CONTAINS "organization.0g6666.com" OR destinationntdomain CONTAINS "global.ntp-update.com" OR destinationntdomain CONTAINS "kaiy.0g6666.com" OR destinationntdomain CONTAINS "kaiy.ntp-update.com" OR destinationntdomain CONTAINS "ky.0g6666.com" OR destinationntdomain CONTAINS "oriental.ntp-update.com" OR destinationntdomain CONTAINS "guard.ntp-update.com" OR destinationntdomain CONTAINS "oglive.ntp-update.com" OR destinationntdomain CONTAINS "guard.0g6666.com" OR destinationntdomain CONTAINS "plus.ntp-update.com" OR destinationntdomain CONTAINS "oglty.0g6666.com" OR destinationntdomain CONTAINS "oglty.ntp-update.com" OR destinationntdomain CONTAINS "oglty-ml.ntp-update.com" OR destinationntdomain CONTAINS "ml-lty.ntp-update.com" OR destinationntdomain CONTAINS "telegram.ntp-update.com" OR destinationntdomain CONTAINS "easyh.ntp-update.com" OR destinationntdomain CONTAINS "weblog.ntp-update.com" OR destinationntdomain CONTAINS "weblog-ml.ntp-update.com" OR destinationntdomain CONTAINS "o-fsh.ntp-update.com" OR destinationntdomain CONTAINS "idn-tb.ntp-update.com" OR destinationntdomain CONTAINS "tb-ndi2.ntp-update.com" OR destinationntdomain CONTAINS "ml-ndi.ntp-update.com" OR destinationntdomain CONTAINS "vct.0g6666.com" OR destinationntdomain CONTAINS "windows-i-tb.ntp-update.com" OR destinationntdomain CONTAINS "windows-qc-tb-i.ntp-update.com" OR destinationntdomain CONTAINS "windows-tb-i.ntp-update.com")
index=activity AND rg_functionality="Firewall" AND requesturl NOT NULL AND (requesturl CONTAINS "a-ad-tml.ntp-update.com" OR requesturl CONTAINS "rps-a.ntp-update.com" OR requesturl CONTAINS "a-rps.ntp-update.com" OR requesturl CONTAINS "dns-a.ntp-update.com" OR requesturl CONTAINS "a-tb.ntp-update.com" OR requesturl CONTAINS "alast.sun-java.com" OR requesturl CONTAINS "alast.ntp-update.com" OR requesturl CONTAINS "dell-a.ntp-update.com" OR requesturl CONTAINS "a-sp-rps.0g6666.com" OR requesturl CONTAINS "windows.javaupdate-cdn.com" OR requesturl CONTAINS "javaupdatecdn.com" OR requesturl CONTAINS "flash.javaupdate-cdn.com" OR requesturl CONTAINS "linux.ntp-update.com" OR requesturl CONTAINS "esxi-lty.ntp-update.com" OR requesturl CONTAINS "windows.0g6666.com" OR requesturl CONTAINS "ubuntu-ndi.ntp-update.com" OR requesturl CONTAINS "h1.xpjpz400.com" OR requesturl CONTAINS "cg.xpjpz400.com" OR requesturl CONTAINS "letsencrypt.msupdatesync.com" OR requesturl CONTAINS "cloud.ntp-update.com" OR requesturl CONTAINS "fe.ntp-update.com" OR requesturl CONTAINS "wtech.ntp-update.com" OR requesturl CONTAINS "imp.ntp-update.com" OR requesturl CONTAINS "ogplus.ntp-update.com" OR requesturl CONTAINS "organization.0g6666.com" OR requesturl CONTAINS "global.ntp-update.com" OR requesturl CONTAINS "kaiy.0g6666.com" OR requesturl CONTAINS "kaiy.ntp-update.com" OR requesturl CONTAINS "ky.0g6666.com" OR requesturl CONTAINS "oriental.ntp-update.com" OR requesturl CONTAINS "guard.ntp-update.com" OR requesturl CONTAINS "oglive.ntp-update.com" OR requesturl CONTAINS "guard.0g6666.com" OR requesturl CONTAINS "plus.ntp-update.com" OR requesturl CONTAINS "oglty.0g6666.com" OR requesturl CONTAINS "oglty.ntp-update.com" OR requesturl CONTAINS "oglty-ml.ntp-update.com" OR requesturl CONTAINS "ml-lty.ntp-update.com" OR requesturl CONTAINS "telegram.ntp-update.com" OR requesturl CONTAINS "easyh.ntp-update.com" OR requesturl CONTAINS "weblog.ntp-update.com" OR requesturl CONTAINS "weblog-ml.ntp-update.com" OR requesturl CONTAINS "o-fsh.ntp-update.com" OR requesturl CONTAINS "idn-tb.ntp-update.com" OR requesturl CONTAINS "tb-ndi2.ntp-update.com" OR requesturl CONTAINS "ml-ndi.ntp-update.com" OR requesturl CONTAINS "vct.0g6666.com" OR requesturl CONTAINS "windows-i-tb.ntp-update.com" OR requesturl CONTAINS "windows-qc-tb-i.ntp-update.com" OR requesturl CONTAINS "windows-tb-i.ntp-update.com")
index=activity AND rg_functionality="Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "a-fms.ntp-update.com" OR destinationhostname CONTAINS "plus.0g6666.com" OR destinationhostname CONTAINS "aprotect.sun-java.com" OR destinationhostname CONTAINS "og8888.0g6666.com" OR destinationhostname CONTAINS "adobe.javaupdate-cdn.com" OR destinationhostname CONTAINS "linux.0g6666.com" OR destinationhostname CONTAINS "ad.ntp-update.com" OR destinationhostname CONTAINS "www.0g6666.com" OR destinationhostname CONTAINS "wt.ntp-update.com" OR destinationhostname CONTAINS "aliyun.ntp-update.com")
index=activity AND rg_functionality="Firewall" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "a-fms.ntp-update.com" OR sourcentdomain CONTAINS "plus.0g6666.com" OR sourcentdomain CONTAINS "aprotect.sun-java.com" OR sourcentdomain CONTAINS "og8888.0g6666.com" OR sourcentdomain CONTAINS "adobe.javaupdate-cdn.com" OR sourcentdomain CONTAINS "linux.0g6666.com" OR sourcentdomain CONTAINS "ad.ntp-update.com" OR sourcentdomain CONTAINS "www.0g6666.com" OR sourcentdomain CONTAINS "wt.ntp-update.com" OR sourcentdomain CONTAINS "aliyun.ntp-update.com")
index=activity AND rg_functionality="Firewall" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "a-fms.ntp-update.com" OR sourcehostname CONTAINS "plus.0g6666.com" OR sourcehostname CONTAINS "aprotect.sun-java.com" OR sourcehostname CONTAINS "og8888.0g6666.com" OR sourcehostname CONTAINS "adobe.javaupdate-cdn.com" OR sourcehostname CONTAINS "linux.0g6666.com" OR sourcehostname CONTAINS "ad.ntp-update.com" OR sourcehostname CONTAINS "www.0g6666.com" OR sourcehostname CONTAINS "wt.ntp-update.com" OR sourcehostname CONTAINS "aliyun.ntp-update.com")
index=activity AND rg_functionality="Firewall" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "a-fms.ntp-update.com" OR destinationntdomain CONTAINS "plus.0g6666.com" OR destinationntdomain CONTAINS "aprotect.sun-java.com" OR destinationntdomain CONTAINS "og8888.0g6666.com" OR destinationntdomain CONTAINS "adobe.javaupdate-cdn.com" OR destinationntdomain CONTAINS "linux.0g6666.com" OR destinationntdomain CONTAINS "ad.ntp-update.com" OR destinationntdomain CONTAINS "www.0g6666.com" OR destinationntdomain CONTAINS "wt.ntp-update.com" OR destinationntdomain CONTAINS "aliyun.ntp-update.com")
index=activity AND rg_functionality="Firewall" AND requesturl NOT NULL AND (requesturl CONTAINS "a-fms.ntp-update.com" OR requesturl CONTAINS "plus.0g6666.com" OR requesturl CONTAINS "aprotect.sun-java.com" OR requesturl CONTAINS "og8888.0g6666.com" OR requesturl CONTAINS "adobe.javaupdate-cdn.com" OR requesturl CONTAINS "linux.0g6666.com" OR requesturl CONTAINS "ad.ntp-update.com" OR requesturl CONTAINS "www.0g6666.com" OR requesturl CONTAINS "wt.ntp-update.com" OR requesturl CONTAINS "aliyun.ntp-update.com")
index=activity AND rg_functionality="Web Proxy" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "a-ad-tml.ntp-update.com" OR destinationhostname CONTAINS "rps-a.ntp-update.com" OR destinationhostname CONTAINS "a-rps.ntp-update.com" OR destinationhostname CONTAINS "dns-a.ntp-update.com" OR destinationhostname CONTAINS "a-tb.ntp-update.com" OR destinationhostname CONTAINS "alast.sun-java.com" OR destinationhostname CONTAINS "alast.ntp-update.com" OR destinationhostname CONTAINS "dell-a.ntp-update.com" OR destinationhostname CONTAINS "a-sp-rps.0g6666.com" OR destinationhostname CONTAINS "windows.javaupdate-cdn.com" OR destinationhostname CONTAINS "javaupdatecdn.com" OR destinationhostname CONTAINS "flash.javaupdate-cdn.com" OR destinationhostname CONTAINS "linux.ntp-update.com" OR destinationhostname CONTAINS "esxi-lty.ntp-update.com" OR destinationhostname CONTAINS "windows.0g6666.com" OR destinationhostname CONTAINS "ubuntu-ndi.ntp-update.com" OR destinationhostname CONTAINS "h1.xpjpz400.com" OR destinationhostname CONTAINS "cg.xpjpz400.com" OR destinationhostname CONTAINS "letsencrypt.msupdatesync.com" OR destinationhostname CONTAINS "cloud.ntp-update.com" OR destinationhostname CONTAINS "fe.ntp-update.com" OR destinationhostname CONTAINS "wtech.ntp-update.com" OR destinationhostname CONTAINS "imp.ntp-update.com" OR destinationhostname CONTAINS "ogplus.ntp-update.com" OR destinationhostname CONTAINS "organization.0g6666.com" OR destinationhostname CONTAINS "global.ntp-update.com" OR destinationhostname CONTAINS "kaiy.0g6666.com" OR destinationhostname CONTAINS "kaiy.ntp-update.com" OR destinationhostname CONTAINS "ky.0g6666.com" OR destinationhostname CONTAINS "oriental.ntp-update.com" OR destinationhostname CONTAINS "guard.ntp-update.com" OR destinationhostname CONTAINS "oglive.ntp-update.com" OR destinationhostname CONTAINS "guard.0g6666.com" OR destinationhostname CONTAINS "plus.ntp-update.com" OR destinationhostname CONTAINS "oglty.0g6666.com" OR destinationhostname CONTAINS "oglty.ntp-update.com" OR destinationhostname CONTAINS "oglty-ml.ntp-update.com" OR destinationhostname CONTAINS "ml-lty.ntp-update.com" OR destinationhostname CONTAINS "telegram.ntp-update.com" OR destinationhostname CONTAINS "easyh.ntp-update.com" OR destinationhostname CONTAINS "weblog.ntp-update.com" OR destinationhostname CONTAINS "weblog-ml.ntp-update.com" OR destinationhostname CONTAINS "o-fsh.ntp-update.com" OR destinationhostname CONTAINS "idn-tb.ntp-update.com" OR destinationhostname CONTAINS "tb-ndi2.ntp-update.com" OR destinationhostname CONTAINS "ml-ndi.ntp-update.com" OR destinationhostname CONTAINS "vct.0g6666.com" OR destinationhostname CONTAINS "windows-i-tb.ntp-update.com" OR destinationhostname CONTAINS "windows-qc-tb-i.ntp-update.com" OR destinationhostname CONTAINS "windows-tb-i.ntp-update.com")
index=activity AND rg_functionality="Web Proxy" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "a-ad-tml.ntp-update.com" OR sourcentdomain CONTAINS "rps-a.ntp-update.com" OR sourcentdomain CONTAINS "a-rps.ntp-update.com" OR sourcentdomain CONTAINS "dns-a.ntp-update.com" OR sourcentdomain CONTAINS "a-tb.ntp-update.com" OR sourcentdomain CONTAINS "alast.sun-java.com" OR sourcentdomain CONTAINS "alast.ntp-update.com" OR sourcentdomain CONTAINS "dell-a.ntp-update.com" OR sourcentdomain CONTAINS "a-sp-rps.0g6666.com" OR sourcentdomain CONTAINS "windows.javaupdate-cdn.com" OR sourcentdomain CONTAINS "javaupdatecdn.com" OR sourcentdomain CONTAINS "flash.javaupdate-cdn.com" OR sourcentdomain CONTAINS "linux.ntp-update.com" OR sourcentdomain CONTAINS "esxi-lty.ntp-update.com" OR sourcentdomain CONTAINS "windows.0g6666.com" OR sourcentdomain CONTAINS "ubuntu-ndi.ntp-update.com" OR sourcentdomain CONTAINS "h1.xpjpz400.com" OR sourcentdomain CONTAINS "cg.xpjpz400.com" OR sourcentdomain CONTAINS "letsencrypt.msupdatesync.com" OR sourcentdomain CONTAINS "cloud.ntp-update.com" OR sourcentdomain CONTAINS "fe.ntp-update.com" OR sourcentdomain CONTAINS "wtech.ntp-update.com" OR sourcentdomain CONTAINS "imp.ntp-update.com" OR sourcentdomain CONTAINS "ogplus.ntp-update.com" OR sourcentdomain CONTAINS "organization.0g6666.com" OR sourcentdomain CONTAINS "global.ntp-update.com" OR sourcentdomain CONTAINS "kaiy.0g6666.com" OR sourcentdomain CONTAINS "kaiy.ntp-update.com" OR sourcentdomain CONTAINS "ky.0g6666.com" OR sourcentdomain CONTAINS "oriental.ntp-update.com" OR sourcentdomain CONTAINS "guard.ntp-update.com" OR sourcentdomain CONTAINS "oglive.ntp-update.com" OR sourcentdomain CONTAINS "guard.0g6666.com" OR sourcentdomain CONTAINS "plus.ntp-update.com" OR sourcentdomain CONTAINS "oglty.0g6666.com" OR sourcentdomain CONTAINS "oglty.ntp-update.com" OR sourcentdomain CONTAINS "oglty-ml.ntp-update.com" OR sourcentdomain CONTAINS "ml-lty.ntp-update.com" OR sourcentdomain CONTAINS "telegram.ntp-update.com" OR sourcentdomain CONTAINS "easyh.ntp-update.com" OR sourcentdomain CONTAINS "weblog.ntp-update.com" OR sourcentdomain CONTAINS "weblog-ml.ntp-update.com" OR sourcentdomain CONTAINS "o-fsh.ntp-update.com" OR sourcentdomain CONTAINS "idn-tb.ntp-update.com" OR sourcentdomain CONTAINS "tb-ndi2.ntp-update.com" OR sourcentdomain CONTAINS "ml-ndi.ntp-update.com" OR sourcentdomain CONTAINS "vct.0g6666.com" OR sourcentdomain CONTAINS "windows-i-tb.ntp-update.com" OR sourcentdomain CONTAINS "windows-qc-tb-i.ntp-update.com" OR sourcentdomain CONTAINS "windows-tb-i.ntp-update.com")
index=activity AND rg_functionality="Web Proxy" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "a-ad-tml.ntp-update.com" OR sourcehostname CONTAINS "rps-a.ntp-update.com" OR sourcehostname CONTAINS "a-rps.ntp-update.com" OR sourcehostname CONTAINS "dns-a.ntp-update.com" OR sourcehostname CONTAINS "a-tb.ntp-update.com" OR sourcehostname CONTAINS "alast.sun-java.com" OR sourcehostname CONTAINS "alast.ntp-update.com" OR sourcehostname CONTAINS "dell-a.ntp-update.com" OR sourcehostname CONTAINS "a-sp-rps.0g6666.com" OR sourcehostname CONTAINS "windows.javaupdate-cdn.com" OR sourcehostname CONTAINS "javaupdatecdn.com" OR sourcehostname CONTAINS "flash.javaupdate-cdn.com" OR sourcehostname CONTAINS "linux.ntp-update.com" OR sourcehostname CONTAINS "esxi-lty.ntp-update.com" OR sourcehostname CONTAINS "windows.0g6666.com" OR sourcehostname CONTAINS "ubuntu-ndi.ntp-update.com" OR sourcehostname CONTAINS "h1.xpjpz400.com" OR sourcehostname CONTAINS "cg.xpjpz400.com" OR sourcehostname CONTAINS "letsencrypt.msupdatesync.com" OR sourcehostname CONTAINS "cloud.ntp-update.com" OR sourcehostname CONTAINS "fe.ntp-update.com" OR sourcehostname CONTAINS "wtech.ntp-update.com" OR sourcehostname CONTAINS "imp.ntp-update.com" OR sourcehostname CONTAINS "ogplus.ntp-update.com" OR sourcehostname CONTAINS "organization.0g6666.com" OR sourcehostname CONTAINS "global.ntp-update.com" OR sourcehostname CONTAINS "kaiy.0g6666.com" OR sourcehostname CONTAINS "kaiy.ntp-update.com" OR sourcehostname CONTAINS "ky.0g6666.com" OR sourcehostname CONTAINS "oriental.ntp-update.com" OR sourcehostname CONTAINS "guard.ntp-update.com" OR sourcehostname CONTAINS "oglive.ntp-update.com" OR sourcehostname CONTAINS "guard.0g6666.com" OR sourcehostname CONTAINS "plus.ntp-update.com" OR sourcehostname CONTAINS "oglty.0g6666.com" OR sourcehostname CONTAINS "oglty.ntp-update.com" OR sourcehostname CONTAINS "oglty-ml.ntp-update.com" OR sourcehostname CONTAINS "ml-lty.ntp-update.com" OR sourcehostname CONTAINS "telegram.ntp-update.com" OR sourcehostname CONTAINS "easyh.ntp-update.com" OR sourcehostname CONTAINS "weblog.ntp-update.com" OR sourcehostname CONTAINS "weblog-ml.ntp-update.com" OR sourcehostname CONTAINS "o-fsh.ntp-update.com" OR sourcehostname CONTAINS "idn-tb.ntp-update.com" OR sourcehostname CONTAINS "tb-ndi2.ntp-update.com" OR sourcehostname CONTAINS "ml-ndi.ntp-update.com" OR sourcehostname CONTAINS "vct.0g6666.com" OR sourcehostname CONTAINS "windows-i-tb.ntp-update.com" OR sourcehostname CONTAINS "windows-qc-tb-i.ntp-update.com" OR sourcehostname CONTAINS "windows-tb-i.ntp-update.com")
index=activity AND rg_functionality="Web Proxy" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "a-ad-tml.ntp-update.com" OR destinationntdomain CONTAINS "rps-a.ntp-update.com" OR destinationntdomain CONTAINS "a-rps.ntp-update.com" OR destinationntdomain CONTAINS "dns-a.ntp-update.com" OR destinationntdomain CONTAINS "a-tb.ntp-update.com" OR destinationntdomain CONTAINS "alast.sun-java.com" OR destinationntdomain CONTAINS "alast.ntp-update.com" OR destinationntdomain CONTAINS "dell-a.ntp-update.com" OR destinationntdomain CONTAINS "a-sp-rps.0g6666.com" OR destinationntdomain CONTAINS "windows.javaupdate-cdn.com" OR destinationntdomain CONTAINS "javaupdatecdn.com" OR destinationntdomain CONTAINS "flash.javaupdate-cdn.com" OR destinationntdomain CONTAINS "linux.ntp-update.com" OR destinationntdomain CONTAINS "esxi-lty.ntp-update.com" OR destinationntdomain CONTAINS "windows.0g6666.com" OR destinationntdomain CONTAINS "ubuntu-ndi.ntp-update.com" OR destinationntdomain CONTAINS "h1.xpjpz400.com" OR destinationntdomain CONTAINS "cg.xpjpz400.com" OR destinationntdomain CONTAINS "letsencrypt.msupdatesync.com" OR destinationntdomain CONTAINS "cloud.ntp-update.com" OR destinationntdomain CONTAINS "fe.ntp-update.com" OR destinationntdomain CONTAINS "wtech.ntp-update.com" OR destinationntdomain CONTAINS "imp.ntp-update.com" OR destinationntdomain CONTAINS "ogplus.ntp-update.com" OR destinationntdomain CONTAINS "organization.0g6666.com" OR destinationntdomain CONTAINS "global.ntp-update.com" OR destinationntdomain CONTAINS "kaiy.0g6666.com" OR destinationntdomain CONTAINS "kaiy.ntp-update.com" OR destinationntdomain CONTAINS "ky.0g6666.com" OR destinationntdomain CONTAINS "oriental.ntp-update.com" OR destinationntdomain CONTAINS "guard.ntp-update.com" OR destinationntdomain CONTAINS "oglive.ntp-update.com" OR destinationntdomain CONTAINS "guard.0g6666.com" OR destinationntdomain CONTAINS "plus.ntp-update.com" OR destinationntdomain CONTAINS "oglty.0g6666.com" OR destinationntdomain CONTAINS "oglty.ntp-update.com" OR destinationntdomain CONTAINS "oglty-ml.ntp-update.com" OR destinationntdomain CONTAINS "ml-lty.ntp-update.com" OR destinationntdomain CONTAINS "telegram.ntp-update.com" OR destinationntdomain CONTAINS "easyh.ntp-update.com" OR destinationntdomain CONTAINS "weblog.ntp-update.com" OR destinationntdomain CONTAINS "weblog-ml.ntp-update.com" OR destinationntdomain CONTAINS "o-fsh.ntp-update.com" OR destinationntdomain CONTAINS "idn-tb.ntp-update.com" OR destinationntdomain CONTAINS "tb-ndi2.ntp-update.com" OR destinationntdomain CONTAINS "ml-ndi.ntp-update.com" OR destinationntdomain CONTAINS "vct.0g6666.com" OR destinationntdomain CONTAINS "windows-i-tb.ntp-update.com" OR destinationntdomain CONTAINS "windows-qc-tb-i.ntp-update.com" OR destinationntdomain CONTAINS "windows-tb-i.ntp-update.com")
index=activity AND rg_functionality="Web Proxy" AND requesturl NOT NULL AND (requesturl CONTAINS "a-ad-tml.ntp-update.com" OR requesturl CONTAINS "rps-a.ntp-update.com" OR requesturl CONTAINS "a-rps.ntp-update.com" OR requesturl CONTAINS "dns-a.ntp-update.com" OR requesturl CONTAINS "a-tb.ntp-update.com" OR requesturl CONTAINS "alast.sun-java.com" OR requesturl CONTAINS "alast.ntp-update.com" OR requesturl CONTAINS "dell-a.ntp-update.com" OR requesturl CONTAINS "a-sp-rps.0g6666.com" OR requesturl CONTAINS "windows.javaupdate-cdn.com" OR requesturl CONTAINS "javaupdatecdn.com" OR requesturl CONTAINS "flash.javaupdate-cdn.com" OR requesturl CONTAINS "linux.ntp-update.com" OR requesturl CONTAINS "esxi-lty.ntp-update.com" OR requesturl CONTAINS "windows.0g6666.com" OR requesturl CONTAINS "ubuntu-ndi.ntp-update.com" OR requesturl CONTAINS "h1.xpjpz400.com" OR requesturl CONTAINS "cg.xpjpz400.com" OR requesturl CONTAINS "letsencrypt.msupdatesync.com" OR requesturl CONTAINS "cloud.ntp-update.com" OR requesturl CONTAINS "fe.ntp-update.com" OR requesturl CONTAINS "wtech.ntp-update.com" OR requesturl CONTAINS "imp.ntp-update.com" OR requesturl CONTAINS "ogplus.ntp-update.com" OR requesturl CONTAINS "organization.0g6666.com" OR requesturl CONTAINS "global.ntp-update.com" OR requesturl CONTAINS "kaiy.0g6666.com" OR requesturl CONTAINS "kaiy.ntp-update.com" OR requesturl CONTAINS "ky.0g6666.com" OR requesturl CONTAINS "oriental.ntp-update.com" OR requesturl CONTAINS "guard.ntp-update.com" OR requesturl CONTAINS "oglive.ntp-update.com" OR requesturl CONTAINS "guard.0g6666.com" OR requesturl CONTAINS "plus.ntp-update.com" OR requesturl CONTAINS "oglty.0g6666.com" OR requesturl CONTAINS "oglty.ntp-update.com" OR requesturl CONTAINS "oglty-ml.ntp-update.com" OR requesturl CONTAINS "ml-lty.ntp-update.com" OR requesturl CONTAINS "telegram.ntp-update.com" OR requesturl CONTAINS "easyh.ntp-update.com" OR requesturl CONTAINS "weblog.ntp-update.com" OR requesturl CONTAINS "weblog-ml.ntp-update.com" OR requesturl CONTAINS "o-fsh.ntp-update.com" OR requesturl CONTAINS "idn-tb.ntp-update.com" OR requesturl CONTAINS "tb-ndi2.ntp-update.com" OR requesturl CONTAINS "ml-ndi.ntp-update.com" OR requesturl CONTAINS "vct.0g6666.com" OR requesturl CONTAINS "windows-i-tb.ntp-update.com" OR requesturl CONTAINS "windows-qc-tb-i.ntp-update.com" OR requesturl CONTAINS "windows-tb-i.ntp-update.com")
index=activity AND rg_functionality="Web Proxy" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "a-fms.ntp-update.com" OR destinationhostname CONTAINS "plus.0g6666.com" OR destinationhostname CONTAINS "aprotect.sun-java.com" OR destinationhostname CONTAINS "og8888.0g6666.com" OR destinationhostname CONTAINS "adobe.javaupdate-cdn.com" OR destinationhostname CONTAINS "linux.0g6666.com" OR destinationhostname CONTAINS "ad.ntp-update.com" OR destinationhostname CONTAINS "www.0g6666.com" OR destinationhostname CONTAINS "wt.ntp-update.com" OR destinationhostname CONTAINS "aliyun.ntp-update.com")
index=activity AND rg_functionality="Web Proxy" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "a-fms.ntp-update.com" OR sourcentdomain CONTAINS "plus.0g6666.com" OR sourcentdomain CONTAINS "aprotect.sun-java.com" OR sourcentdomain CONTAINS "og8888.0g6666.com" OR sourcentdomain CONTAINS "adobe.javaupdate-cdn.com" OR sourcentdomain CONTAINS "linux.0g6666.com" OR sourcentdomain CONTAINS "ad.ntp-update.com" OR sourcentdomain CONTAINS "www.0g6666.com" OR sourcentdomain CONTAINS "wt.ntp-update.com" OR sourcentdomain CONTAINS "aliyun.ntp-update.com")
index=activity AND rg_functionality="Web Proxy" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "a-fms.ntp-update.com" OR sourcehostname CONTAINS "plus.0g6666.com" OR sourcehostname CONTAINS "aprotect.sun-java.com" OR sourcehostname CONTAINS "og8888.0g6666.com" OR sourcehostname CONTAINS "adobe.javaupdate-cdn.com" OR sourcehostname CONTAINS "linux.0g6666.com" OR sourcehostname CONTAINS "ad.ntp-update.com" OR sourcehostname CONTAINS "www.0g6666.com" OR sourcehostname CONTAINS "wt.ntp-update.com" OR sourcehostname CONTAINS "aliyun.ntp-update.com")
index=activity AND rg_functionality="Web Proxy" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "a-fms.ntp-update.com" OR destinationntdomain CONTAINS "plus.0g6666.com" OR destinationntdomain CONTAINS "aprotect.sun-java.com" OR destinationntdomain CONTAINS "og8888.0g6666.com" OR destinationntdomain CONTAINS "adobe.javaupdate-cdn.com" OR destinationntdomain CONTAINS "linux.0g6666.com" OR destinationntdomain CONTAINS "ad.ntp-update.com" OR destinationntdomain CONTAINS "www.0g6666.com" OR destinationntdomain CONTAINS "wt.ntp-update.com" OR destinationntdomain CONTAINS "aliyun.ntp-update.com")
index=activity AND rg_functionality="Web Proxy" AND requesturl NOT NULL AND (requesturl CONTAINS "a-fms.ntp-update.com" OR requesturl CONTAINS "plus.0g6666.com" OR requesturl CONTAINS "aprotect.sun-java.com" OR requesturl CONTAINS "og8888.0g6666.com" OR requesturl CONTAINS "adobe.javaupdate-cdn.com" OR requesturl CONTAINS "linux.0g6666.com" OR requesturl CONTAINS "ad.ntp-update.com" OR requesturl CONTAINS "www.0g6666.com" OR requesturl CONTAINS "wt.ntp-update.com" OR requesturl CONTAINS "aliyun.ntp-update.com")
index=activity AND rg_functionality="Flow" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "a-ad-tml.ntp-update.com" OR destinationhostname CONTAINS "rps-a.ntp-update.com" OR destinationhostname CONTAINS "a-rps.ntp-update.com" OR destinationhostname CONTAINS "dns-a.ntp-update.com" OR destinationhostname CONTAINS "a-tb.ntp-update.com" OR destinationhostname CONTAINS "alast.sun-java.com" OR destinationhostname CONTAINS "alast.ntp-update.com" OR destinationhostname CONTAINS "dell-a.ntp-update.com" OR destinationhostname CONTAINS "a-sp-rps.0g6666.com" OR destinationhostname CONTAINS "windows.javaupdate-cdn.com" OR destinationhostname CONTAINS "javaupdatecdn.com" OR destinationhostname CONTAINS "flash.javaupdate-cdn.com" OR destinationhostname CONTAINS "linux.ntp-update.com" OR destinationhostname CONTAINS "esxi-lty.ntp-update.com" OR destinationhostname CONTAINS "windows.0g6666.com" OR destinationhostname CONTAINS "ubuntu-ndi.ntp-update.com" OR destinationhostname CONTAINS "h1.xpjpz400.com" OR destinationhostname CONTAINS "cg.xpjpz400.com" OR destinationhostname CONTAINS "letsencrypt.msupdatesync.com" OR destinationhostname CONTAINS "cloud.ntp-update.com" OR destinationhostname CONTAINS "fe.ntp-update.com" OR destinationhostname CONTAINS "wtech.ntp-update.com" OR destinationhostname CONTAINS "imp.ntp-update.com" OR destinationhostname CONTAINS "ogplus.ntp-update.com" OR destinationhostname CONTAINS "organization.0g6666.com" OR destinationhostname CONTAINS "global.ntp-update.com" OR destinationhostname CONTAINS "kaiy.0g6666.com" OR destinationhostname CONTAINS "kaiy.ntp-update.com" OR destinationhostname CONTAINS "ky.0g6666.com" OR destinationhostname CONTAINS "oriental.ntp-update.com" OR destinationhostname CONTAINS "guard.ntp-update.com" OR destinationhostname CONTAINS "oglive.ntp-update.com" OR destinationhostname CONTAINS "guard.0g6666.com" OR destinationhostname CONTAINS "plus.ntp-update.com" OR destinationhostname CONTAINS "oglty.0g6666.com" OR destinationhostname CONTAINS "oglty.ntp-update.com" OR destinationhostname CONTAINS "oglty-ml.ntp-update.com" OR destinationhostname CONTAINS "ml-lty.ntp-update.com" OR destinationhostname CONTAINS "telegram.ntp-update.com" OR destinationhostname CONTAINS "easyh.ntp-update.com" OR destinationhostname CONTAINS "weblog.ntp-update.com" OR destinationhostname CONTAINS "weblog-ml.ntp-update.com" OR destinationhostname CONTAINS "o-fsh.ntp-update.com" OR destinationhostname CONTAINS "idn-tb.ntp-update.com" OR destinationhostname CONTAINS "tb-ndi2.ntp-update.com" OR destinationhostname CONTAINS "ml-ndi.ntp-update.com" OR destinationhostname CONTAINS "vct.0g6666.com" OR destinationhostname CONTAINS "windows-i-tb.ntp-update.com" OR destinationhostname CONTAINS "windows-qc-tb-i.ntp-update.com" OR destinationhostname CONTAINS "windows-tb-i.ntp-update.com")
index=activity AND rg_functionality="Flow" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "a-ad-tml.ntp-update.com" OR sourcentdomain CONTAINS "rps-a.ntp-update.com" OR sourcentdomain CONTAINS "a-rps.ntp-update.com" OR sourcentdomain CONTAINS "dns-a.ntp-update.com" OR sourcentdomain CONTAINS "a-tb.ntp-update.com" OR sourcentdomain CONTAINS "alast.sun-java.com" OR sourcentdomain CONTAINS "alast.ntp-update.com" OR sourcentdomain CONTAINS "dell-a.ntp-update.com" OR sourcentdomain CONTAINS "a-sp-rps.0g6666.com" OR sourcentdomain CONTAINS "windows.javaupdate-cdn.com" OR sourcentdomain CONTAINS "javaupdatecdn.com" OR sourcentdomain CONTAINS "flash.javaupdate-cdn.com" OR sourcentdomain CONTAINS "linux.ntp-update.com" OR sourcentdomain CONTAINS "esxi-lty.ntp-update.com" OR sourcentdomain CONTAINS "windows.0g6666.com" OR sourcentdomain CONTAINS "ubuntu-ndi.ntp-update.com" OR sourcentdomain CONTAINS "h1.xpjpz400.com" OR sourcentdomain CONTAINS "cg.xpjpz400.com" OR sourcentdomain CONTAINS "letsencrypt.msupdatesync.com" OR sourcentdomain CONTAINS "cloud.ntp-update.com" OR sourcentdomain CONTAINS "fe.ntp-update.com" OR sourcentdomain CONTAINS "wtech.ntp-update.com" OR sourcentdomain CONTAINS "imp.ntp-update.com" OR sourcentdomain CONTAINS "ogplus.ntp-update.com" OR sourcentdomain CONTAINS "organization.0g6666.com" OR sourcentdomain CONTAINS "global.ntp-update.com" OR sourcentdomain CONTAINS "kaiy.0g6666.com" OR sourcentdomain CONTAINS "kaiy.ntp-update.com" OR sourcentdomain CONTAINS "ky.0g6666.com" OR sourcentdomain CONTAINS "oriental.ntp-update.com" OR sourcentdomain CONTAINS "guard.ntp-update.com" OR sourcentdomain CONTAINS "oglive.ntp-update.com" OR sourcentdomain CONTAINS "guard.0g6666.com" OR sourcentdomain CONTAINS "plus.ntp-update.com" OR sourcentdomain CONTAINS "oglty.0g6666.com" OR sourcentdomain CONTAINS "oglty.ntp-update.com" OR sourcentdomain CONTAINS "oglty-ml.ntp-update.com" OR sourcentdomain CONTAINS "ml-lty.ntp-update.com" OR sourcentdomain CONTAINS "telegram.ntp-update.com" OR sourcentdomain CONTAINS "easyh.ntp-update.com" OR sourcentdomain CONTAINS "weblog.ntp-update.com" OR sourcentdomain CONTAINS "weblog-ml.ntp-update.com" OR sourcentdomain CONTAINS "o-fsh.ntp-update.com" OR sourcentdomain CONTAINS "idn-tb.ntp-update.com" OR sourcentdomain CONTAINS "tb-ndi2.ntp-update.com" OR sourcentdomain CONTAINS "ml-ndi.ntp-update.com" OR sourcentdomain CONTAINS "vct.0g6666.com" OR sourcentdomain CONTAINS "windows-i-tb.ntp-update.com" OR sourcentdomain CONTAINS "windows-qc-tb-i.ntp-update.com" OR sourcentdomain CONTAINS "windows-tb-i.ntp-update.com")
index=activity AND rg_functionality="Flow" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "a-ad-tml.ntp-update.com" OR sourcehostname CONTAINS "rps-a.ntp-update.com" OR sourcehostname CONTAINS "a-rps.ntp-update.com" OR sourcehostname CONTAINS "dns-a.ntp-update.com" OR sourcehostname CONTAINS "a-tb.ntp-update.com" OR sourcehostname CONTAINS "alast.sun-java.com" OR sourcehostname CONTAINS "alast.ntp-update.com" OR sourcehostname CONTAINS "dell-a.ntp-update.com" OR sourcehostname CONTAINS "a-sp-rps.0g6666.com" OR sourcehostname CONTAINS "windows.javaupdate-cdn.com" OR sourcehostname CONTAINS "javaupdatecdn.com" OR sourcehostname CONTAINS "flash.javaupdate-cdn.com" OR sourcehostname CONTAINS "linux.ntp-update.com" OR sourcehostname CONTAINS "esxi-lty.ntp-update.com" OR sourcehostname CONTAINS "windows.0g6666.com" OR sourcehostname CONTAINS "ubuntu-ndi.ntp-update.com" OR sourcehostname CONTAINS "h1.xpjpz400.com" OR sourcehostname CONTAINS "cg.xpjpz400.com" OR sourcehostname CONTAINS "letsencrypt.msupdatesync.com" OR sourcehostname CONTAINS "cloud.ntp-update.com" OR sourcehostname CONTAINS "fe.ntp-update.com" OR sourcehostname CONTAINS "wtech.ntp-update.com" OR sourcehostname CONTAINS "imp.ntp-update.com" OR sourcehostname CONTAINS "ogplus.ntp-update.com" OR sourcehostname CONTAINS "organization.0g6666.com" OR sourcehostname CONTAINS "global.ntp-update.com" OR sourcehostname CONTAINS "kaiy.0g6666.com" OR sourcehostname CONTAINS "kaiy.ntp-update.com" OR sourcehostname CONTAINS "ky.0g6666.com" OR sourcehostname CONTAINS "oriental.ntp-update.com" OR sourcehostname CONTAINS "guard.ntp-update.com" OR sourcehostname CONTAINS "oglive.ntp-update.com" OR sourcehostname CONTAINS "guard.0g6666.com" OR sourcehostname CONTAINS "plus.ntp-update.com" OR sourcehostname CONTAINS "oglty.0g6666.com" OR sourcehostname CONTAINS "oglty.ntp-update.com" OR sourcehostname CONTAINS "oglty-ml.ntp-update.com" OR sourcehostname CONTAINS "ml-lty.ntp-update.com" OR sourcehostname CONTAINS "telegram.ntp-update.com" OR sourcehostname CONTAINS "easyh.ntp-update.com" OR sourcehostname CONTAINS "weblog.ntp-update.com" OR sourcehostname CONTAINS "weblog-ml.ntp-update.com" OR sourcehostname CONTAINS "o-fsh.ntp-update.com" OR sourcehostname CONTAINS "idn-tb.ntp-update.com" OR sourcehostname CONTAINS "tb-ndi2.ntp-update.com" OR sourcehostname CONTAINS "ml-ndi.ntp-update.com" OR sourcehostname CONTAINS "vct.0g6666.com" OR sourcehostname CONTAINS "windows-i-tb.ntp-update.com" OR sourcehostname CONTAINS "windows-qc-tb-i.ntp-update.com" OR sourcehostname CONTAINS "windows-tb-i.ntp-update.com")
index=activity AND rg_functionality="Flow" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "a-ad-tml.ntp-update.com" OR destinationntdomain CONTAINS "rps-a.ntp-update.com" OR destinationntdomain CONTAINS "a-rps.ntp-update.com" OR destinationntdomain CONTAINS "dns-a.ntp-update.com" OR destinationntdomain CONTAINS "a-tb.ntp-update.com" OR destinationntdomain CONTAINS "alast.sun-java.com" OR destinationntdomain CONTAINS "alast.ntp-update.com" OR destinationntdomain CONTAINS "dell-a.ntp-update.com" OR destinationntdomain CONTAINS "a-sp-rps.0g6666.com" OR destinationntdomain CONTAINS "windows.javaupdate-cdn.com" OR destinationntdomain CONTAINS "javaupdatecdn.com" OR destinationntdomain CONTAINS "flash.javaupdate-cdn.com" OR destinationntdomain CONTAINS "linux.ntp-update.com" OR destinationntdomain CONTAINS "esxi-lty.ntp-update.com" OR destinationntdomain CONTAINS "windows.0g6666.com" OR destinationntdomain CONTAINS "ubuntu-ndi.ntp-update.com" OR destinationntdomain CONTAINS "h1.xpjpz400.com" OR destinationntdomain CONTAINS "cg.xpjpz400.com" OR destinationntdomain CONTAINS "letsencrypt.msupdatesync.com" OR destinationntdomain CONTAINS "cloud.ntp-update.com" OR destinationntdomain CONTAINS "fe.ntp-update.com" OR destinationntdomain CONTAINS "wtech.ntp-update.com" OR destinationntdomain CONTAINS "imp.ntp-update.com" OR destinationntdomain CONTAINS "ogplus.ntp-update.com" OR destinationntdomain CONTAINS "organization.0g6666.com" OR destinationntdomain CONTAINS "global.ntp-update.com" OR destinationntdomain CONTAINS "kaiy.0g6666.com" OR destinationntdomain CONTAINS "kaiy.ntp-update.com" OR destinationntdomain CONTAINS "ky.0g6666.com" OR destinationntdomain CONTAINS "oriental.ntp-update.com" OR destinationntdomain CONTAINS "guard.ntp-update.com" OR destinationntdomain CONTAINS "oglive.ntp-update.com" OR destinationntdomain CONTAINS "guard.0g6666.com" OR destinationntdomain CONTAINS "plus.ntp-update.com" OR destinationntdomain CONTAINS "oglty.0g6666.com" OR destinationntdomain CONTAINS "oglty.ntp-update.com" OR destinationntdomain CONTAINS "oglty-ml.ntp-update.com" OR destinationntdomain CONTAINS "ml-lty.ntp-update.com" OR destinationntdomain CONTAINS "telegram.ntp-update.com" OR destinationntdomain CONTAINS "easyh.ntp-update.com" OR destinationntdomain CONTAINS "weblog.ntp-update.com" OR destinationntdomain CONTAINS "weblog-ml.ntp-update.com" OR destinationntdomain CONTAINS "o-fsh.ntp-update.com" OR destinationntdomain CONTAINS "idn-tb.ntp-update.com" OR destinationntdomain CONTAINS "tb-ndi2.ntp-update.com" OR destinationntdomain CONTAINS "ml-ndi.ntp-update.com" OR destinationntdomain CONTAINS "vct.0g6666.com" OR destinationntdomain CONTAINS "windows-i-tb.ntp-update.com" OR destinationntdomain CONTAINS "windows-qc-tb-i.ntp-update.com" OR destinationntdomain CONTAINS "windows-tb-i.ntp-update.com")
index=activity AND rg_functionality="Flow" AND requesturl NOT NULL AND (requesturl CONTAINS "a-ad-tml.ntp-update.com" OR requesturl CONTAINS "rps-a.ntp-update.com" OR requesturl CONTAINS "a-rps.ntp-update.com" OR requesturl CONTAINS "dns-a.ntp-update.com" OR requesturl CONTAINS "a-tb.ntp-update.com" OR requesturl CONTAINS "alast.sun-java.com" OR requesturl CONTAINS "alast.ntp-update.com" OR requesturl CONTAINS "dell-a.ntp-update.com" OR requesturl CONTAINS "a-sp-rps.0g6666.com" OR requesturl CONTAINS "windows.javaupdate-cdn.com" OR requesturl CONTAINS "javaupdatecdn.com" OR requesturl CONTAINS "flash.javaupdate-cdn.com" OR requesturl CONTAINS "linux.ntp-update.com" OR requesturl CONTAINS "esxi-lty.ntp-update.com" OR requesturl CONTAINS "windows.0g6666.com" OR requesturl CONTAINS "ubuntu-ndi.ntp-update.com" OR requesturl CONTAINS "h1.xpjpz400.com" OR requesturl CONTAINS "cg.xpjpz400.com" OR requesturl CONTAINS "letsencrypt.msupdatesync.com" OR requesturl CONTAINS "cloud.ntp-update.com" OR requesturl CONTAINS "fe.ntp-update.com" OR requesturl CONTAINS "wtech.ntp-update.com" OR requesturl CONTAINS "imp.ntp-update.com" OR requesturl CONTAINS "ogplus.ntp-update.com" OR requesturl CONTAINS "organization.0g6666.com" OR requesturl CONTAINS "global.ntp-update.com" OR requesturl CONTAINS "kaiy.0g6666.com" OR requesturl CONTAINS "kaiy.ntp-update.com" OR requesturl CONTAINS "ky.0g6666.com" OR requesturl CONTAINS "oriental.ntp-update.com" OR requesturl CONTAINS "guard.ntp-update.com" OR requesturl CONTAINS "oglive.ntp-update.com" OR requesturl CONTAINS "guard.0g6666.com" OR requesturl CONTAINS "plus.ntp-update.com" OR requesturl CONTAINS "oglty.0g6666.com" OR requesturl CONTAINS "oglty.ntp-update.com" OR requesturl CONTAINS "oglty-ml.ntp-update.com" OR requesturl CONTAINS "ml-lty.ntp-update.com" OR requesturl CONTAINS "telegram.ntp-update.com" OR requesturl CONTAINS "easyh.ntp-update.com" OR requesturl CONTAINS "weblog.ntp-update.com" OR requesturl CONTAINS "weblog-ml.ntp-update.com" OR requesturl CONTAINS "o-fsh.ntp-update.com" OR requesturl CONTAINS "idn-tb.ntp-update.com" OR requesturl CONTAINS "tb-ndi2.ntp-update.com" OR requesturl CONTAINS "ml-ndi.ntp-update.com" OR requesturl CONTAINS "vct.0g6666.com" OR requesturl CONTAINS "windows-i-tb.ntp-update.com" OR requesturl CONTAINS "windows-qc-tb-i.ntp-update.com" OR requesturl CONTAINS "windows-tb-i.ntp-update.com")
index=activity AND rg_functionality="Flow" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "a-fms.ntp-update.com" OR destinationhostname CONTAINS "plus.0g6666.com" OR destinationhostname CONTAINS "aprotect.sun-java.com" OR destinationhostname CONTAINS "og8888.0g6666.com" OR destinationhostname CONTAINS "adobe.javaupdate-cdn.com" OR destinationhostname CONTAINS "linux.0g6666.com" OR destinationhostname CONTAINS "ad.ntp-update.com" OR destinationhostname CONTAINS "www.0g6666.com" OR destinationhostname CONTAINS "wt.ntp-update.com" OR destinationhostname CONTAINS "aliyun.ntp-update.com")
index=activity AND rg_functionality="Flow" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "a-fms.ntp-update.com" OR sourcentdomain CONTAINS "plus.0g6666.com" OR sourcentdomain CONTAINS "aprotect.sun-java.com" OR sourcentdomain CONTAINS "og8888.0g6666.com" OR sourcentdomain CONTAINS "adobe.javaupdate-cdn.com" OR sourcentdomain CONTAINS "linux.0g6666.com" OR sourcentdomain CONTAINS "ad.ntp-update.com" OR sourcentdomain CONTAINS "www.0g6666.com" OR sourcentdomain CONTAINS "wt.ntp-update.com" OR sourcentdomain CONTAINS "aliyun.ntp-update.com")
index=activity AND rg_functionality="Flow" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "a-fms.ntp-update.com" OR sourcehostname CONTAINS "plus.0g6666.com" OR sourcehostname CONTAINS "aprotect.sun-java.com" OR sourcehostname CONTAINS "og8888.0g6666.com" OR sourcehostname CONTAINS "adobe.javaupdate-cdn.com" OR sourcehostname CONTAINS "linux.0g6666.com" OR sourcehostname CONTAINS "ad.ntp-update.com" OR sourcehostname CONTAINS "www.0g6666.com" OR sourcehostname CONTAINS "wt.ntp-update.com" OR sourcehostname CONTAINS "aliyun.ntp-update.com")
index=activity AND rg_functionality="Flow" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "a-fms.ntp-update.com" OR destinationntdomain CONTAINS "plus.0g6666.com" OR destinationntdomain CONTAINS "aprotect.sun-java.com" OR destinationntdomain CONTAINS "og8888.0g6666.com" OR destinationntdomain CONTAINS "adobe.javaupdate-cdn.com" OR destinationntdomain CONTAINS "linux.0g6666.com" OR destinationntdomain CONTAINS "ad.ntp-update.com" OR destinationntdomain CONTAINS "www.0g6666.com" OR destinationntdomain CONTAINS "wt.ntp-update.com" OR destinationntdomain CONTAINS "aliyun.ntp-update.com")
index=activity AND rg_functionality="Flow" AND requesturl NOT NULL AND (requesturl CONTAINS "a-fms.ntp-update.com" OR requesturl CONTAINS "plus.0g6666.com" OR requesturl CONTAINS "aprotect.sun-java.com" OR requesturl CONTAINS "og8888.0g6666.com" OR requesturl CONTAINS "adobe.javaupdate-cdn.com" OR requesturl CONTAINS "linux.0g6666.com" OR requesturl CONTAINS "ad.ntp-update.com" OR requesturl CONTAINS "www.0g6666.com" OR requesturl CONTAINS "wt.ntp-update.com" OR requesturl CONTAINS "aliyun.ntp-update.com")
index=activity AND rg_functionality="Web Server" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "a-ad-tml.ntp-update.com" OR destinationhostname CONTAINS "rps-a.ntp-update.com" OR destinationhostname CONTAINS "a-rps.ntp-update.com" OR destinationhostname CONTAINS "dns-a.ntp-update.com" OR destinationhostname CONTAINS "a-tb.ntp-update.com" OR destinationhostname CONTAINS "alast.sun-java.com" OR destinationhostname CONTAINS "alast.ntp-update.com" OR destinationhostname CONTAINS "dell-a.ntp-update.com" OR destinationhostname CONTAINS "a-sp-rps.0g6666.com" OR destinationhostname CONTAINS "windows.javaupdate-cdn.com" OR destinationhostname CONTAINS "javaupdatecdn.com" OR destinationhostname CONTAINS "flash.javaupdate-cdn.com" OR destinationhostname CONTAINS "linux.ntp-update.com" OR destinationhostname CONTAINS "esxi-lty.ntp-update.com" OR destinationhostname CONTAINS "windows.0g6666.com" OR destinationhostname CONTAINS "ubuntu-ndi.ntp-update.com" OR destinationhostname CONTAINS "h1.xpjpz400.com" OR destinationhostname CONTAINS "cg.xpjpz400.com" OR destinationhostname CONTAINS "letsencrypt.msupdatesync.com" OR destinationhostname CONTAINS "cloud.ntp-update.com" OR destinationhostname CONTAINS "fe.ntp-update.com" OR destinationhostname CONTAINS "wtech.ntp-update.com" OR destinationhostname CONTAINS "imp.ntp-update.com" OR destinationhostname CONTAINS "ogplus.ntp-update.com" OR destinationhostname CONTAINS "organization.0g6666.com" OR destinationhostname CONTAINS "global.ntp-update.com" OR destinationhostname CONTAINS "kaiy.0g6666.com" OR destinationhostname CONTAINS "kaiy.ntp-update.com" OR destinationhostname CONTAINS "ky.0g6666.com" OR destinationhostname CONTAINS "oriental.ntp-update.com" OR destinationhostname CONTAINS "guard.ntp-update.com" OR destinationhostname CONTAINS "oglive.ntp-update.com" OR destinationhostname CONTAINS "guard.0g6666.com" OR destinationhostname CONTAINS "plus.ntp-update.com" OR destinationhostname CONTAINS "oglty.0g6666.com" OR destinationhostname CONTAINS "oglty.ntp-update.com" OR destinationhostname CONTAINS "oglty-ml.ntp-update.com" OR destinationhostname CONTAINS "ml-lty.ntp-update.com" OR destinationhostname CONTAINS "telegram.ntp-update.com" OR destinationhostname CONTAINS "easyh.ntp-update.com" OR destinationhostname CONTAINS "weblog.ntp-update.com" OR destinationhostname CONTAINS "weblog-ml.ntp-update.com" OR destinationhostname CONTAINS "o-fsh.ntp-update.com" OR destinationhostname CONTAINS "idn-tb.ntp-update.com" OR destinationhostname CONTAINS "tb-ndi2.ntp-update.com" OR destinationhostname CONTAINS "ml-ndi.ntp-update.com" OR destinationhostname CONTAINS "vct.0g6666.com" OR destinationhostname CONTAINS "windows-i-tb.ntp-update.com" OR destinationhostname CONTAINS "windows-qc-tb-i.ntp-update.com" OR destinationhostname CONTAINS "windows-tb-i.ntp-update.com")
index=activity AND rg_functionality="Web Server" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "a-ad-tml.ntp-update.com" OR sourcentdomain CONTAINS "rps-a.ntp-update.com" OR sourcentdomain CONTAINS "a-rps.ntp-update.com" OR sourcentdomain CONTAINS "dns-a.ntp-update.com" OR sourcentdomain CONTAINS "a-tb.ntp-update.com" OR sourcentdomain CONTAINS "alast.sun-java.com" OR sourcentdomain CONTAINS "alast.ntp-update.com" OR sourcentdomain CONTAINS "dell-a.ntp-update.com" OR sourcentdomain CONTAINS "a-sp-rps.0g6666.com" OR sourcentdomain CONTAINS "windows.javaupdate-cdn.com" OR sourcentdomain CONTAINS "javaupdatecdn.com" OR sourcentdomain CONTAINS "flash.javaupdate-cdn.com" OR sourcentdomain CONTAINS "linux.ntp-update.com" OR sourcentdomain CONTAINS "esxi-lty.ntp-update.com" OR sourcentdomain CONTAINS "windows.0g6666.com" OR sourcentdomain CONTAINS "ubuntu-ndi.ntp-update.com" OR sourcentdomain CONTAINS "h1.xpjpz400.com" OR sourcentdomain CONTAINS "cg.xpjpz400.com" OR sourcentdomain CONTAINS "letsencrypt.msupdatesync.com" OR sourcentdomain CONTAINS "cloud.ntp-update.com" OR sourcentdomain CONTAINS "fe.ntp-update.com" OR sourcentdomain CONTAINS "wtech.ntp-update.com" OR sourcentdomain CONTAINS "imp.ntp-update.com" OR sourcentdomain CONTAINS "ogplus.ntp-update.com" OR sourcentdomain CONTAINS "organization.0g6666.com" OR sourcentdomain CONTAINS "global.ntp-update.com" OR sourcentdomain CONTAINS "kaiy.0g6666.com" OR sourcentdomain CONTAINS "kaiy.ntp-update.com" OR sourcentdomain CONTAINS "ky.0g6666.com" OR sourcentdomain CONTAINS "oriental.ntp-update.com" OR sourcentdomain CONTAINS "guard.ntp-update.com" OR sourcentdomain CONTAINS "oglive.ntp-update.com" OR sourcentdomain CONTAINS "guard.0g6666.com" OR sourcentdomain CONTAINS "plus.ntp-update.com" OR sourcentdomain CONTAINS "oglty.0g6666.com" OR sourcentdomain CONTAINS "oglty.ntp-update.com" OR sourcentdomain CONTAINS "oglty-ml.ntp-update.com" OR sourcentdomain CONTAINS "ml-lty.ntp-update.com" OR sourcentdomain CONTAINS "telegram.ntp-update.com" OR sourcentdomain CONTAINS "easyh.ntp-update.com" OR sourcentdomain CONTAINS "weblog.ntp-update.com" OR sourcentdomain CONTAINS "weblog-ml.ntp-update.com" OR sourcentdomain CONTAINS "o-fsh.ntp-update.com" OR sourcentdomain CONTAINS "idn-tb.ntp-update.com" OR sourcentdomain CONTAINS "tb-ndi2.ntp-update.com" OR sourcentdomain CONTAINS "ml-ndi.ntp-update.com" OR sourcentdomain CONTAINS "vct.0g6666.com" OR sourcentdomain CONTAINS "windows-i-tb.ntp-update.com" OR sourcentdomain CONTAINS "windows-qc-tb-i.ntp-update.com" OR sourcentdomain CONTAINS "windows-tb-i.ntp-update.com")
index=activity AND rg_functionality="Web Server" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "a-ad-tml.ntp-update.com" OR sourcehostname CONTAINS "rps-a.ntp-update.com" OR sourcehostname CONTAINS "a-rps.ntp-update.com" OR sourcehostname CONTAINS "dns-a.ntp-update.com" OR sourcehostname CONTAINS "a-tb.ntp-update.com" OR sourcehostname CONTAINS "alast.sun-java.com" OR sourcehostname CONTAINS "alast.ntp-update.com" OR sourcehostname CONTAINS "dell-a.ntp-update.com" OR sourcehostname CONTAINS "a-sp-rps.0g6666.com" OR sourcehostname CONTAINS "windows.javaupdate-cdn.com" OR sourcehostname CONTAINS "javaupdatecdn.com" OR sourcehostname CONTAINS "flash.javaupdate-cdn.com" OR sourcehostname CONTAINS "linux.ntp-update.com" OR sourcehostname CONTAINS "esxi-lty.ntp-update.com" OR sourcehostname CONTAINS "windows.0g6666.com" OR sourcehostname CONTAINS "ubuntu-ndi.ntp-update.com" OR sourcehostname CONTAINS "h1.xpjpz400.com" OR sourcehostname CONTAINS "cg.xpjpz400.com" OR sourcehostname CONTAINS "letsencrypt.msupdatesync.com" OR sourcehostname CONTAINS "cloud.ntp-update.com" OR sourcehostname CONTAINS "fe.ntp-update.com" OR sourcehostname CONTAINS "wtech.ntp-update.com" OR sourcehostname CONTAINS "imp.ntp-update.com" OR sourcehostname CONTAINS "ogplus.ntp-update.com" OR sourcehostname CONTAINS "organization.0g6666.com" OR sourcehostname CONTAINS "global.ntp-update.com" OR sourcehostname CONTAINS "kaiy.0g6666.com" OR sourcehostname CONTAINS "kaiy.ntp-update.com" OR sourcehostname CONTAINS "ky.0g6666.com" OR sourcehostname CONTAINS "oriental.ntp-update.com" OR sourcehostname CONTAINS "guard.ntp-update.com" OR sourcehostname CONTAINS "oglive.ntp-update.com" OR sourcehostname CONTAINS "guard.0g6666.com" OR sourcehostname CONTAINS "plus.ntp-update.com" OR sourcehostname CONTAINS "oglty.0g6666.com" OR sourcehostname CONTAINS "oglty.ntp-update.com" OR sourcehostname CONTAINS "oglty-ml.ntp-update.com" OR sourcehostname CONTAINS "ml-lty.ntp-update.com" OR sourcehostname CONTAINS "telegram.ntp-update.com" OR sourcehostname CONTAINS "easyh.ntp-update.com" OR sourcehostname CONTAINS "weblog.ntp-update.com" OR sourcehostname CONTAINS "weblog-ml.ntp-update.com" OR sourcehostname CONTAINS "o-fsh.ntp-update.com" OR sourcehostname CONTAINS "idn-tb.ntp-update.com" OR sourcehostname CONTAINS "tb-ndi2.ntp-update.com" OR sourcehostname CONTAINS "ml-ndi.ntp-update.com" OR sourcehostname CONTAINS "vct.0g6666.com" OR sourcehostname CONTAINS "windows-i-tb.ntp-update.com" OR sourcehostname CONTAINS "windows-qc-tb-i.ntp-update.com" OR sourcehostname CONTAINS "windows-tb-i.ntp-update.com")
index=activity AND rg_functionality="Web Server" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "a-ad-tml.ntp-update.com" OR destinationntdomain CONTAINS "rps-a.ntp-update.com" OR destinationntdomain CONTAINS "a-rps.ntp-update.com" OR destinationntdomain CONTAINS "dns-a.ntp-update.com" OR destinationntdomain CONTAINS "a-tb.ntp-update.com" OR destinationntdomain CONTAINS "alast.sun-java.com" OR destinationntdomain CONTAINS "alast.ntp-update.com" OR destinationntdomain CONTAINS "dell-a.ntp-update.com" OR destinationntdomain CONTAINS "a-sp-rps.0g6666.com" OR destinationntdomain CONTAINS "windows.javaupdate-cdn.com" OR destinationntdomain CONTAINS "javaupdatecdn.com" OR destinationntdomain CONTAINS "flash.javaupdate-cdn.com" OR destinationntdomain CONTAINS "linux.ntp-update.com" OR destinationntdomain CONTAINS "esxi-lty.ntp-update.com" OR destinationntdomain CONTAINS "windows.0g6666.com" OR destinationntdomain CONTAINS "ubuntu-ndi.ntp-update.com" OR destinationntdomain CONTAINS "h1.xpjpz400.com" OR destinationntdomain CONTAINS "cg.xpjpz400.com" OR destinationntdomain CONTAINS "letsencrypt.msupdatesync.com" OR destinationntdomain CONTAINS "cloud.ntp-update.com" OR destinationntdomain CONTAINS "fe.ntp-update.com" OR destinationntdomain CONTAINS "wtech.ntp-update.com" OR destinationntdomain CONTAINS "imp.ntp-update.com" OR destinationntdomain CONTAINS "ogplus.ntp-update.com" OR destinationntdomain CONTAINS "organization.0g6666.com" OR destinationntdomain CONTAINS "global.ntp-update.com" OR destinationntdomain CONTAINS "kaiy.0g6666.com" OR destinationntdomain CONTAINS "kaiy.ntp-update.com" OR destinationntdomain CONTAINS "ky.0g6666.com" OR destinationntdomain CONTAINS "oriental.ntp-update.com" OR destinationntdomain CONTAINS "guard.ntp-update.com" OR destinationntdomain CONTAINS "oglive.ntp-update.com" OR destinationntdomain CONTAINS "guard.0g6666.com" OR destinationntdomain CONTAINS "plus.ntp-update.com" OR destinationntdomain CONTAINS "oglty.0g6666.com" OR destinationntdomain CONTAINS "oglty.ntp-update.com" OR destinationntdomain CONTAINS "oglty-ml.ntp-update.com" OR destinationntdomain CONTAINS "ml-lty.ntp-update.com" OR destinationntdomain CONTAINS "telegram.ntp-update.com" OR destinationntdomain CONTAINS "easyh.ntp-update.com" OR destinationntdomain CONTAINS "weblog.ntp-update.com" OR destinationntdomain CONTAINS "weblog-ml.ntp-update.com" OR destinationntdomain CONTAINS "o-fsh.ntp-update.com" OR destinationntdomain CONTAINS "idn-tb.ntp-update.com" OR destinationntdomain CONTAINS "tb-ndi2.ntp-update.com" OR destinationntdomain CONTAINS "ml-ndi.ntp-update.com" OR destinationntdomain CONTAINS "vct.0g6666.com" OR destinationntdomain CONTAINS "windows-i-tb.ntp-update.com" OR destinationntdomain CONTAINS "windows-qc-tb-i.ntp-update.com" OR destinationntdomain CONTAINS "windows-tb-i.ntp-update.com")
index=activity AND rg_functionality="Web Server" AND requesturl NOT NULL AND (requesturl CONTAINS "a-ad-tml.ntp-update.com" OR requesturl CONTAINS "rps-a.ntp-update.com" OR requesturl CONTAINS "a-rps.ntp-update.com" OR requesturl CONTAINS "dns-a.ntp-update.com" OR requesturl CONTAINS "a-tb.ntp-update.com" OR requesturl CONTAINS "alast.sun-java.com" OR requesturl CONTAINS "alast.ntp-update.com" OR requesturl CONTAINS "dell-a.ntp-update.com" OR requesturl CONTAINS "a-sp-rps.0g6666.com" OR requesturl CONTAINS "windows.javaupdate-cdn.com" OR requesturl CONTAINS "javaupdatecdn.com" OR requesturl CONTAINS "flash.javaupdate-cdn.com" OR requesturl CONTAINS "linux.ntp-update.com" OR requesturl CONTAINS "esxi-lty.ntp-update.com" OR requesturl CONTAINS "windows.0g6666.com" OR requesturl CONTAINS "ubuntu-ndi.ntp-update.com" OR requesturl CONTAINS "h1.xpjpz400.com" OR requesturl CONTAINS "cg.xpjpz400.com" OR requesturl CONTAINS "letsencrypt.msupdatesync.com" OR requesturl CONTAINS "cloud.ntp-update.com" OR requesturl CONTAINS "fe.ntp-update.com" OR requesturl CONTAINS "wtech.ntp-update.com" OR requesturl CONTAINS "imp.ntp-update.com" OR requesturl CONTAINS "ogplus.ntp-update.com" OR requesturl CONTAINS "organization.0g6666.com" OR requesturl CONTAINS "global.ntp-update.com" OR requesturl CONTAINS "kaiy.0g6666.com" OR requesturl CONTAINS "kaiy.ntp-update.com" OR requesturl CONTAINS "ky.0g6666.com" OR requesturl CONTAINS "oriental.ntp-update.com" OR requesturl CONTAINS "guard.ntp-update.com" OR requesturl CONTAINS "oglive.ntp-update.com" OR requesturl CONTAINS "guard.0g6666.com" OR requesturl CONTAINS "plus.ntp-update.com" OR requesturl CONTAINS "oglty.0g6666.com" OR requesturl CONTAINS "oglty.ntp-update.com" OR requesturl CONTAINS "oglty-ml.ntp-update.com" OR requesturl CONTAINS "ml-lty.ntp-update.com" OR requesturl CONTAINS "telegram.ntp-update.com" OR requesturl CONTAINS "easyh.ntp-update.com" OR requesturl CONTAINS "weblog.ntp-update.com" OR requesturl CONTAINS "weblog-ml.ntp-update.com" OR requesturl CONTAINS "o-fsh.ntp-update.com" OR requesturl CONTAINS "idn-tb.ntp-update.com" OR requesturl CONTAINS "tb-ndi2.ntp-update.com" OR requesturl CONTAINS "ml-ndi.ntp-update.com" OR requesturl CONTAINS "vct.0g6666.com" OR requesturl CONTAINS "windows-i-tb.ntp-update.com" OR requesturl CONTAINS "windows-qc-tb-i.ntp-update.com" OR requesturl CONTAINS "windows-tb-i.ntp-update.com")
index=activity AND rg_functionality="Web Server" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "a-fms.ntp-update.com" OR destinationhostname CONTAINS "plus.0g6666.com" OR destinationhostname CONTAINS "aprotect.sun-java.com" OR destinationhostname CONTAINS "og8888.0g6666.com" OR destinationhostname CONTAINS "adobe.javaupdate-cdn.com" OR destinationhostname CONTAINS "linux.0g6666.com" OR destinationhostname CONTAINS "ad.ntp-update.com" OR destinationhostname CONTAINS "www.0g6666.com" OR destinationhostname CONTAINS "wt.ntp-update.com" OR destinationhostname CONTAINS "aliyun.ntp-update.com")
index=activity AND rg_functionality="Web Server" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "a-fms.ntp-update.com" OR sourcentdomain CONTAINS "plus.0g6666.com" OR sourcentdomain CONTAINS "aprotect.sun-java.com" OR sourcentdomain CONTAINS "og8888.0g6666.com" OR sourcentdomain CONTAINS "adobe.javaupdate-cdn.com" OR sourcentdomain CONTAINS "linux.0g6666.com" OR sourcentdomain CONTAINS "ad.ntp-update.com" OR sourcentdomain CONTAINS "www.0g6666.com" OR sourcentdomain CONTAINS "wt.ntp-update.com" OR sourcentdomain CONTAINS "aliyun.ntp-update.com")
index=activity AND rg_functionality="Web Server" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "a-fms.ntp-update.com" OR sourcehostname CONTAINS "plus.0g6666.com" OR sourcehostname CONTAINS "aprotect.sun-java.com" OR sourcehostname CONTAINS "og8888.0g6666.com" OR sourcehostname CONTAINS "adobe.javaupdate-cdn.com" OR sourcehostname CONTAINS "linux.0g6666.com" OR sourcehostname CONTAINS "ad.ntp-update.com" OR sourcehostname CONTAINS "www.0g6666.com" OR sourcehostname CONTAINS "wt.ntp-update.com" OR sourcehostname CONTAINS "aliyun.ntp-update.com")
index=activity AND rg_functionality="Web Server" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "a-fms.ntp-update.com" OR destinationntdomain CONTAINS "plus.0g6666.com" OR destinationntdomain CONTAINS "aprotect.sun-java.com" OR destinationntdomain CONTAINS "og8888.0g6666.com" OR destinationntdomain CONTAINS "adobe.javaupdate-cdn.com" OR destinationntdomain CONTAINS "linux.0g6666.com" OR destinationntdomain CONTAINS "ad.ntp-update.com" OR destinationntdomain CONTAINS "www.0g6666.com" OR destinationntdomain CONTAINS "wt.ntp-update.com" OR destinationntdomain CONTAINS "aliyun.ntp-update.com")
index=activity AND rg_functionality="Web Server" AND requesturl NOT NULL AND (requesturl CONTAINS "a-fms.ntp-update.com" OR requesturl CONTAINS "plus.0g6666.com" OR requesturl CONTAINS "aprotect.sun-java.com" OR requesturl CONTAINS "og8888.0g6666.com" OR requesturl CONTAINS "adobe.javaupdate-cdn.com" OR requesturl CONTAINS "linux.0g6666.com" OR requesturl CONTAINS "ad.ntp-update.com" OR requesturl CONTAINS "www.0g6666.com" OR requesturl CONTAINS "wt.ntp-update.com" OR requesturl CONTAINS "aliyun.ntp-update.com")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "a-ad-tml.ntp-update.com" OR destinationhostname CONTAINS "rps-a.ntp-update.com" OR destinationhostname CONTAINS "a-rps.ntp-update.com" OR destinationhostname CONTAINS "dns-a.ntp-update.com" OR destinationhostname CONTAINS "a-tb.ntp-update.com" OR destinationhostname CONTAINS "alast.sun-java.com" OR destinationhostname CONTAINS "alast.ntp-update.com" OR destinationhostname CONTAINS "dell-a.ntp-update.com" OR destinationhostname CONTAINS "a-sp-rps.0g6666.com" OR destinationhostname CONTAINS "windows.javaupdate-cdn.com" OR destinationhostname CONTAINS "javaupdatecdn.com" OR destinationhostname CONTAINS "flash.javaupdate-cdn.com" OR destinationhostname CONTAINS "linux.ntp-update.com" OR destinationhostname CONTAINS "esxi-lty.ntp-update.com" OR destinationhostname CONTAINS "windows.0g6666.com" OR destinationhostname CONTAINS "ubuntu-ndi.ntp-update.com" OR destinationhostname CONTAINS "h1.xpjpz400.com" OR destinationhostname CONTAINS "cg.xpjpz400.com" OR destinationhostname CONTAINS "letsencrypt.msupdatesync.com" OR destinationhostname CONTAINS "cloud.ntp-update.com" OR destinationhostname CONTAINS "fe.ntp-update.com" OR destinationhostname CONTAINS "wtech.ntp-update.com" OR destinationhostname CONTAINS "imp.ntp-update.com" OR destinationhostname CONTAINS "ogplus.ntp-update.com" OR destinationhostname CONTAINS "organization.0g6666.com" OR destinationhostname CONTAINS "global.ntp-update.com" OR destinationhostname CONTAINS "kaiy.0g6666.com" OR destinationhostname CONTAINS "kaiy.ntp-update.com" OR destinationhostname CONTAINS "ky.0g6666.com" OR destinationhostname CONTAINS "oriental.ntp-update.com" OR destinationhostname CONTAINS "guard.ntp-update.com" OR destinationhostname CONTAINS "oglive.ntp-update.com" OR destinationhostname CONTAINS "guard.0g6666.com" OR destinationhostname CONTAINS "plus.ntp-update.com" OR destinationhostname CONTAINS "oglty.0g6666.com" OR destinationhostname CONTAINS "oglty.ntp-update.com" OR destinationhostname CONTAINS "oglty-ml.ntp-update.com" OR destinationhostname CONTAINS "ml-lty.ntp-update.com" OR destinationhostname CONTAINS "telegram.ntp-update.com" OR destinationhostname CONTAINS "easyh.ntp-update.com" OR destinationhostname CONTAINS "weblog.ntp-update.com" OR destinationhostname CONTAINS "weblog-ml.ntp-update.com" OR destinationhostname CONTAINS "o-fsh.ntp-update.com" OR destinationhostname CONTAINS "idn-tb.ntp-update.com" OR destinationhostname CONTAINS "tb-ndi2.ntp-update.com" OR destinationhostname CONTAINS "ml-ndi.ntp-update.com" OR destinationhostname CONTAINS "vct.0g6666.com" OR destinationhostname CONTAINS "windows-i-tb.ntp-update.com" OR destinationhostname CONTAINS "windows-qc-tb-i.ntp-update.com" OR destinationhostname CONTAINS "windows-tb-i.ntp-update.com")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "a-ad-tml.ntp-update.com" OR sourcentdomain CONTAINS "rps-a.ntp-update.com" OR sourcentdomain CONTAINS "a-rps.ntp-update.com" OR sourcentdomain CONTAINS "dns-a.ntp-update.com" OR sourcentdomain CONTAINS "a-tb.ntp-update.com" OR sourcentdomain CONTAINS "alast.sun-java.com" OR sourcentdomain CONTAINS "alast.ntp-update.com" OR sourcentdomain CONTAINS "dell-a.ntp-update.com" OR sourcentdomain CONTAINS "a-sp-rps.0g6666.com" OR sourcentdomain CONTAINS "windows.javaupdate-cdn.com" OR sourcentdomain CONTAINS "javaupdatecdn.com" OR sourcentdomain CONTAINS "flash.javaupdate-cdn.com" OR sourcentdomain CONTAINS "linux.ntp-update.com" OR sourcentdomain CONTAINS "esxi-lty.ntp-update.com" OR sourcentdomain CONTAINS "windows.0g6666.com" OR sourcentdomain CONTAINS "ubuntu-ndi.ntp-update.com" OR sourcentdomain CONTAINS "h1.xpjpz400.com" OR sourcentdomain CONTAINS "cg.xpjpz400.com" OR sourcentdomain CONTAINS "letsencrypt.msupdatesync.com" OR sourcentdomain CONTAINS "cloud.ntp-update.com" OR sourcentdomain CONTAINS "fe.ntp-update.com" OR sourcentdomain CONTAINS "wtech.ntp-update.com" OR sourcentdomain CONTAINS "imp.ntp-update.com" OR sourcentdomain CONTAINS "ogplus.ntp-update.com" OR sourcentdomain CONTAINS "organization.0g6666.com" OR sourcentdomain CONTAINS "global.ntp-update.com" OR sourcentdomain CONTAINS "kaiy.0g6666.com" OR sourcentdomain CONTAINS "kaiy.ntp-update.com" OR sourcentdomain CONTAINS "ky.0g6666.com" OR sourcentdomain CONTAINS "oriental.ntp-update.com" OR sourcentdomain CONTAINS "guard.ntp-update.com" OR sourcentdomain CONTAINS "oglive.ntp-update.com" OR sourcentdomain CONTAINS "guard.0g6666.com" OR sourcentdomain CONTAINS "plus.ntp-update.com" OR sourcentdomain CONTAINS "oglty.0g6666.com" OR sourcentdomain CONTAINS "oglty.ntp-update.com" OR sourcentdomain CONTAINS "oglty-ml.ntp-update.com" OR sourcentdomain CONTAINS "ml-lty.ntp-update.com" OR sourcentdomain CONTAINS "telegram.ntp-update.com" OR sourcentdomain CONTAINS "easyh.ntp-update.com" OR sourcentdomain CONTAINS "weblog.ntp-update.com" OR sourcentdomain CONTAINS "weblog-ml.ntp-update.com" OR sourcentdomain CONTAINS "o-fsh.ntp-update.com" OR sourcentdomain CONTAINS "idn-tb.ntp-update.com" OR sourcentdomain CONTAINS "tb-ndi2.ntp-update.com" OR sourcentdomain CONTAINS "ml-ndi.ntp-update.com" OR sourcentdomain CONTAINS "vct.0g6666.com" OR sourcentdomain CONTAINS "windows-i-tb.ntp-update.com" OR sourcentdomain CONTAINS "windows-qc-tb-i.ntp-update.com" OR sourcentdomain CONTAINS "windows-tb-i.ntp-update.com")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "a-ad-tml.ntp-update.com" OR sourcehostname CONTAINS "rps-a.ntp-update.com" OR sourcehostname CONTAINS "a-rps.ntp-update.com" OR sourcehostname CONTAINS "dns-a.ntp-update.com" OR sourcehostname CONTAINS "a-tb.ntp-update.com" OR sourcehostname CONTAINS "alast.sun-java.com" OR sourcehostname CONTAINS "alast.ntp-update.com" OR sourcehostname CONTAINS "dell-a.ntp-update.com" OR sourcehostname CONTAINS "a-sp-rps.0g6666.com" OR sourcehostname CONTAINS "windows.javaupdate-cdn.com" OR sourcehostname CONTAINS "javaupdatecdn.com" OR sourcehostname CONTAINS "flash.javaupdate-cdn.com" OR sourcehostname CONTAINS "linux.ntp-update.com" OR sourcehostname CONTAINS "esxi-lty.ntp-update.com" OR sourcehostname CONTAINS "windows.0g6666.com" OR sourcehostname CONTAINS "ubuntu-ndi.ntp-update.com" OR sourcehostname CONTAINS "h1.xpjpz400.com" OR sourcehostname CONTAINS "cg.xpjpz400.com" OR sourcehostname CONTAINS "letsencrypt.msupdatesync.com" OR sourcehostname CONTAINS "cloud.ntp-update.com" OR sourcehostname CONTAINS "fe.ntp-update.com" OR sourcehostname CONTAINS "wtech.ntp-update.com" OR sourcehostname CONTAINS "imp.ntp-update.com" OR sourcehostname CONTAINS "ogplus.ntp-update.com" OR sourcehostname CONTAINS "organization.0g6666.com" OR sourcehostname CONTAINS "global.ntp-update.com" OR sourcehostname CONTAINS "kaiy.0g6666.com" OR sourcehostname CONTAINS "kaiy.ntp-update.com" OR sourcehostname CONTAINS "ky.0g6666.com" OR sourcehostname CONTAINS "oriental.ntp-update.com" OR sourcehostname CONTAINS "guard.ntp-update.com" OR sourcehostname CONTAINS "oglive.ntp-update.com" OR sourcehostname CONTAINS "guard.0g6666.com" OR sourcehostname CONTAINS "plus.ntp-update.com" OR sourcehostname CONTAINS "oglty.0g6666.com" OR sourcehostname CONTAINS "oglty.ntp-update.com" OR sourcehostname CONTAINS "oglty-ml.ntp-update.com" OR sourcehostname CONTAINS "ml-lty.ntp-update.com" OR sourcehostname CONTAINS "telegram.ntp-update.com" OR sourcehostname CONTAINS "easyh.ntp-update.com" OR sourcehostname CONTAINS "weblog.ntp-update.com" OR sourcehostname CONTAINS "weblog-ml.ntp-update.com" OR sourcehostname CONTAINS "o-fsh.ntp-update.com" OR sourcehostname CONTAINS "idn-tb.ntp-update.com" OR sourcehostname CONTAINS "tb-ndi2.ntp-update.com" OR sourcehostname CONTAINS "ml-ndi.ntp-update.com" OR sourcehostname CONTAINS "vct.0g6666.com" OR sourcehostname CONTAINS "windows-i-tb.ntp-update.com" OR sourcehostname CONTAINS "windows-qc-tb-i.ntp-update.com" OR sourcehostname CONTAINS "windows-tb-i.ntp-update.com")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "a-ad-tml.ntp-update.com" OR destinationntdomain CONTAINS "rps-a.ntp-update.com" OR destinationntdomain CONTAINS "a-rps.ntp-update.com" OR destinationntdomain CONTAINS "dns-a.ntp-update.com" OR destinationntdomain CONTAINS "a-tb.ntp-update.com" OR destinationntdomain CONTAINS "alast.sun-java.com" OR destinationntdomain CONTAINS "alast.ntp-update.com" OR destinationntdomain CONTAINS "dell-a.ntp-update.com" OR destinationntdomain CONTAINS "a-sp-rps.0g6666.com" OR destinationntdomain CONTAINS "windows.javaupdate-cdn.com" OR destinationntdomain CONTAINS "javaupdatecdn.com" OR destinationntdomain CONTAINS "flash.javaupdate-cdn.com" OR destinationntdomain CONTAINS "linux.ntp-update.com" OR destinationntdomain CONTAINS "esxi-lty.ntp-update.com" OR destinationntdomain CONTAINS "windows.0g6666.com" OR destinationntdomain CONTAINS "ubuntu-ndi.ntp-update.com" OR destinationntdomain CONTAINS "h1.xpjpz400.com" OR destinationntdomain CONTAINS "cg.xpjpz400.com" OR destinationntdomain CONTAINS "letsencrypt.msupdatesync.com" OR destinationntdomain CONTAINS "cloud.ntp-update.com" OR destinationntdomain CONTAINS "fe.ntp-update.com" OR destinationntdomain CONTAINS "wtech.ntp-update.com" OR destinationntdomain CONTAINS "imp.ntp-update.com" OR destinationntdomain CONTAINS "ogplus.ntp-update.com" OR destinationntdomain CONTAINS "organization.0g6666.com" OR destinationntdomain CONTAINS "global.ntp-update.com" OR destinationntdomain CONTAINS "kaiy.0g6666.com" OR destinationntdomain CONTAINS "kaiy.ntp-update.com" OR destinationntdomain CONTAINS "ky.0g6666.com" OR destinationntdomain CONTAINS "oriental.ntp-update.com" OR destinationntdomain CONTAINS "guard.ntp-update.com" OR destinationntdomain CONTAINS "oglive.ntp-update.com" OR destinationntdomain CONTAINS "guard.0g6666.com" OR destinationntdomain CONTAINS "plus.ntp-update.com" OR destinationntdomain CONTAINS "oglty.0g6666.com" OR destinationntdomain CONTAINS "oglty.ntp-update.com" OR destinationntdomain CONTAINS "oglty-ml.ntp-update.com" OR destinationntdomain CONTAINS "ml-lty.ntp-update.com" OR destinationntdomain CONTAINS "telegram.ntp-update.com" OR destinationntdomain CONTAINS "easyh.ntp-update.com" OR destinationntdomain CONTAINS "weblog.ntp-update.com" OR destinationntdomain CONTAINS "weblog-ml.ntp-update.com" OR destinationntdomain CONTAINS "o-fsh.ntp-update.com" OR destinationntdomain CONTAINS "idn-tb.ntp-update.com" OR destinationntdomain CONTAINS "tb-ndi2.ntp-update.com" OR destinationntdomain CONTAINS "ml-ndi.ntp-update.com" OR destinationntdomain CONTAINS "vct.0g6666.com" OR destinationntdomain CONTAINS "windows-i-tb.ntp-update.com" OR destinationntdomain CONTAINS "windows-qc-tb-i.ntp-update.com" OR destinationntdomain CONTAINS "windows-tb-i.ntp-update.com")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND requesturl NOT NULL AND (requesturl CONTAINS "a-ad-tml.ntp-update.com" OR requesturl CONTAINS "rps-a.ntp-update.com" OR requesturl CONTAINS "a-rps.ntp-update.com" OR requesturl CONTAINS "dns-a.ntp-update.com" OR requesturl CONTAINS "a-tb.ntp-update.com" OR requesturl CONTAINS "alast.sun-java.com" OR requesturl CONTAINS "alast.ntp-update.com" OR requesturl CONTAINS "dell-a.ntp-update.com" OR requesturl CONTAINS "a-sp-rps.0g6666.com" OR requesturl CONTAINS "windows.javaupdate-cdn.com" OR requesturl CONTAINS "javaupdatecdn.com" OR requesturl CONTAINS "flash.javaupdate-cdn.com" OR requesturl CONTAINS "linux.ntp-update.com" OR requesturl CONTAINS "esxi-lty.ntp-update.com" OR requesturl CONTAINS "windows.0g6666.com" OR requesturl CONTAINS "ubuntu-ndi.ntp-update.com" OR requesturl CONTAINS "h1.xpjpz400.com" OR requesturl CONTAINS "cg.xpjpz400.com" OR requesturl CONTAINS "letsencrypt.msupdatesync.com" OR requesturl CONTAINS "cloud.ntp-update.com" OR requesturl CONTAINS "fe.ntp-update.com" OR requesturl CONTAINS "wtech.ntp-update.com" OR requesturl CONTAINS "imp.ntp-update.com" OR requesturl CONTAINS "ogplus.ntp-update.com" OR requesturl CONTAINS "organization.0g6666.com" OR requesturl CONTAINS "global.ntp-update.com" OR requesturl CONTAINS "kaiy.0g6666.com" OR requesturl CONTAINS "kaiy.ntp-update.com" OR requesturl CONTAINS "ky.0g6666.com" OR requesturl CONTAINS "oriental.ntp-update.com" OR requesturl CONTAINS "guard.ntp-update.com" OR requesturl CONTAINS "oglive.ntp-update.com" OR requesturl CONTAINS "guard.0g6666.com" OR requesturl CONTAINS "plus.ntp-update.com" OR requesturl CONTAINS "oglty.0g6666.com" OR requesturl CONTAINS "oglty.ntp-update.com" OR requesturl CONTAINS "oglty-ml.ntp-update.com" OR requesturl CONTAINS "ml-lty.ntp-update.com" OR requesturl CONTAINS "telegram.ntp-update.com" OR requesturl CONTAINS "easyh.ntp-update.com" OR requesturl CONTAINS "weblog.ntp-update.com" OR requesturl CONTAINS "weblog-ml.ntp-update.com" OR requesturl CONTAINS "o-fsh.ntp-update.com" OR requesturl CONTAINS "idn-tb.ntp-update.com" OR requesturl CONTAINS "tb-ndi2.ntp-update.com" OR requesturl CONTAINS "ml-ndi.ntp-update.com" OR requesturl CONTAINS "vct.0g6666.com" OR requesturl CONTAINS "windows-i-tb.ntp-update.com" OR requesturl CONTAINS "windows-qc-tb-i.ntp-update.com" OR requesturl CONTAINS "windows-tb-i.ntp-update.com")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "a-fms.ntp-update.com" OR destinationhostname CONTAINS "plus.0g6666.com" OR destinationhostname CONTAINS "aprotect.sun-java.com" OR destinationhostname CONTAINS "og8888.0g6666.com" OR destinationhostname CONTAINS "adobe.javaupdate-cdn.com" OR destinationhostname CONTAINS "linux.0g6666.com" OR destinationhostname CONTAINS "ad.ntp-update.com" OR destinationhostname CONTAINS "www.0g6666.com" OR destinationhostname CONTAINS "wt.ntp-update.com" OR destinationhostname CONTAINS "aliyun.ntp-update.com")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "a-fms.ntp-update.com" OR sourcentdomain CONTAINS "plus.0g6666.com" OR sourcentdomain CONTAINS "aprotect.sun-java.com" OR sourcentdomain CONTAINS "og8888.0g6666.com" OR sourcentdomain CONTAINS "adobe.javaupdate-cdn.com" OR sourcentdomain CONTAINS "linux.0g6666.com" OR sourcentdomain CONTAINS "ad.ntp-update.com" OR sourcentdomain CONTAINS "www.0g6666.com" OR sourcentdomain CONTAINS "wt.ntp-update.com" OR sourcentdomain CONTAINS "aliyun.ntp-update.com")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "a-fms.ntp-update.com" OR sourcehostname CONTAINS "plus.0g6666.com" OR sourcehostname CONTAINS "aprotect.sun-java.com" OR sourcehostname CONTAINS "og8888.0g6666.com" OR sourcehostname CONTAINS "adobe.javaupdate-cdn.com" OR sourcehostname CONTAINS "linux.0g6666.com" OR sourcehostname CONTAINS "ad.ntp-update.com" OR sourcehostname CONTAINS "www.0g6666.com" OR sourcehostname CONTAINS "wt.ntp-update.com" OR sourcehostname CONTAINS "aliyun.ntp-update.com")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "a-fms.ntp-update.com" OR destinationntdomain CONTAINS "plus.0g6666.com" OR destinationntdomain CONTAINS "aprotect.sun-java.com" OR destinationntdomain CONTAINS "og8888.0g6666.com" OR destinationntdomain CONTAINS "adobe.javaupdate-cdn.com" OR destinationntdomain CONTAINS "linux.0g6666.com" OR destinationntdomain CONTAINS "ad.ntp-update.com" OR destinationntdomain CONTAINS "www.0g6666.com" OR destinationntdomain CONTAINS "wt.ntp-update.com" OR destinationntdomain CONTAINS "aliyun.ntp-update.com")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND requesturl NOT NULL AND (requesturl CONTAINS "a-fms.ntp-update.com" OR requesturl CONTAINS "plus.0g6666.com" OR requesturl CONTAINS "aprotect.sun-java.com" OR requesturl CONTAINS "og8888.0g6666.com" OR requesturl CONTAINS "adobe.javaupdate-cdn.com" OR requesturl CONTAINS "linux.0g6666.com" OR requesturl CONTAINS "ad.ntp-update.com" OR requesturl CONTAINS "www.0g6666.com" OR requesturl CONTAINS "wt.ntp-update.com" OR requesturl CONTAINS "aliyun.ntp-update.com")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "a-ad-tml.ntp-update.com" OR destinationhostname CONTAINS "rps-a.ntp-update.com" OR destinationhostname CONTAINS "a-rps.ntp-update.com" OR destinationhostname CONTAINS "dns-a.ntp-update.com" OR destinationhostname CONTAINS "a-tb.ntp-update.com" OR destinationhostname CONTAINS "alast.sun-java.com" OR destinationhostname CONTAINS "alast.ntp-update.com" OR destinationhostname CONTAINS "dell-a.ntp-update.com" OR destinationhostname CONTAINS "a-sp-rps.0g6666.com" OR destinationhostname CONTAINS "windows.javaupdate-cdn.com" OR destinationhostname CONTAINS "javaupdatecdn.com" OR destinationhostname CONTAINS "flash.javaupdate-cdn.com" OR destinationhostname CONTAINS "linux.ntp-update.com" OR destinationhostname CONTAINS "esxi-lty.ntp-update.com" OR destinationhostname CONTAINS "windows.0g6666.com" OR destinationhostname CONTAINS "ubuntu-ndi.ntp-update.com" OR destinationhostname CONTAINS "h1.xpjpz400.com" OR destinationhostname CONTAINS "cg.xpjpz400.com" OR destinationhostname CONTAINS "letsencrypt.msupdatesync.com" OR destinationhostname CONTAINS "cloud.ntp-update.com" OR destinationhostname CONTAINS "fe.ntp-update.com" OR destinationhostname CONTAINS "wtech.ntp-update.com" OR destinationhostname CONTAINS "imp.ntp-update.com" OR destinationhostname CONTAINS "ogplus.ntp-update.com" OR destinationhostname CONTAINS "organization.0g6666.com" OR destinationhostname CONTAINS "global.ntp-update.com" OR destinationhostname CONTAINS "kaiy.0g6666.com" OR destinationhostname CONTAINS "kaiy.ntp-update.com" OR destinationhostname CONTAINS "ky.0g6666.com" OR destinationhostname CONTAINS "oriental.ntp-update.com" OR destinationhostname CONTAINS "guard.ntp-update.com" OR destinationhostname CONTAINS "oglive.ntp-update.com" OR destinationhostname CONTAINS "guard.0g6666.com" OR destinationhostname CONTAINS "plus.ntp-update.com" OR destinationhostname CONTAINS "oglty.0g6666.com" OR destinationhostname CONTAINS "oglty.ntp-update.com" OR destinationhostname CONTAINS "oglty-ml.ntp-update.com" OR destinationhostname CONTAINS "ml-lty.ntp-update.com" OR destinationhostname CONTAINS "telegram.ntp-update.com" OR destinationhostname CONTAINS "easyh.ntp-update.com" OR destinationhostname CONTAINS "weblog.ntp-update.com" OR destinationhostname CONTAINS "weblog-ml.ntp-update.com" OR destinationhostname CONTAINS "o-fsh.ntp-update.com" OR destinationhostname CONTAINS "idn-tb.ntp-update.com" OR destinationhostname CONTAINS "tb-ndi2.ntp-update.com" OR destinationhostname CONTAINS "ml-ndi.ntp-update.com" OR destinationhostname CONTAINS "vct.0g6666.com" OR destinationhostname CONTAINS "windows-i-tb.ntp-update.com" OR destinationhostname CONTAINS "windows-qc-tb-i.ntp-update.com" OR destinationhostname CONTAINS "windows-tb-i.ntp-update.com")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "a-ad-tml.ntp-update.com" OR sourcentdomain CONTAINS "rps-a.ntp-update.com" OR sourcentdomain CONTAINS "a-rps.ntp-update.com" OR sourcentdomain CONTAINS "dns-a.ntp-update.com" OR sourcentdomain CONTAINS "a-tb.ntp-update.com" OR sourcentdomain CONTAINS "alast.sun-java.com" OR sourcentdomain CONTAINS "alast.ntp-update.com" OR sourcentdomain CONTAINS "dell-a.ntp-update.com" OR sourcentdomain CONTAINS "a-sp-rps.0g6666.com" OR sourcentdomain CONTAINS "windows.javaupdate-cdn.com" OR sourcentdomain CONTAINS "javaupdatecdn.com" OR sourcentdomain CONTAINS "flash.javaupdate-cdn.com" OR sourcentdomain CONTAINS "linux.ntp-update.com" OR sourcentdomain CONTAINS "esxi-lty.ntp-update.com" OR sourcentdomain CONTAINS "windows.0g6666.com" OR sourcentdomain CONTAINS "ubuntu-ndi.ntp-update.com" OR sourcentdomain CONTAINS "h1.xpjpz400.com" OR sourcentdomain CONTAINS "cg.xpjpz400.com" OR sourcentdomain CONTAINS "letsencrypt.msupdatesync.com" OR sourcentdomain CONTAINS "cloud.ntp-update.com" OR sourcentdomain CONTAINS "fe.ntp-update.com" OR sourcentdomain CONTAINS "wtech.ntp-update.com" OR sourcentdomain CONTAINS "imp.ntp-update.com" OR sourcentdomain CONTAINS "ogplus.ntp-update.com" OR sourcentdomain CONTAINS "organization.0g6666.com" OR sourcentdomain CONTAINS "global.ntp-update.com" OR sourcentdomain CONTAINS "kaiy.0g6666.com" OR sourcentdomain CONTAINS "kaiy.ntp-update.com" OR sourcentdomain CONTAINS "ky.0g6666.com" OR sourcentdomain CONTAINS "oriental.ntp-update.com" OR sourcentdomain CONTAINS "guard.ntp-update.com" OR sourcentdomain CONTAINS "oglive.ntp-update.com" OR sourcentdomain CONTAINS "guard.0g6666.com" OR sourcentdomain CONTAINS "plus.ntp-update.com" OR sourcentdomain CONTAINS "oglty.0g6666.com" OR sourcentdomain CONTAINS "oglty.ntp-update.com" OR sourcentdomain CONTAINS "oglty-ml.ntp-update.com" OR sourcentdomain CONTAINS "ml-lty.ntp-update.com" OR sourcentdomain CONTAINS "telegram.ntp-update.com" OR sourcentdomain CONTAINS "easyh.ntp-update.com" OR sourcentdomain CONTAINS "weblog.ntp-update.com" OR sourcentdomain CONTAINS "weblog-ml.ntp-update.com" OR sourcentdomain CONTAINS "o-fsh.ntp-update.com" OR sourcentdomain CONTAINS "idn-tb.ntp-update.com" OR sourcentdomain CONTAINS "tb-ndi2.ntp-update.com" OR sourcentdomain CONTAINS "ml-ndi.ntp-update.com" OR sourcentdomain CONTAINS "vct.0g6666.com" OR sourcentdomain CONTAINS "windows-i-tb.ntp-update.com" OR sourcentdomain CONTAINS "windows-qc-tb-i.ntp-update.com" OR sourcentdomain CONTAINS "windows-tb-i.ntp-update.com")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "a-ad-tml.ntp-update.com" OR sourcehostname CONTAINS "rps-a.ntp-update.com" OR sourcehostname CONTAINS "a-rps.ntp-update.com" OR sourcehostname CONTAINS "dns-a.ntp-update.com" OR sourcehostname CONTAINS "a-tb.ntp-update.com" OR sourcehostname CONTAINS "alast.sun-java.com" OR sourcehostname CONTAINS "alast.ntp-update.com" OR sourcehostname CONTAINS "dell-a.ntp-update.com" OR sourcehostname CONTAINS "a-sp-rps.0g6666.com" OR sourcehostname CONTAINS "windows.javaupdate-cdn.com" OR sourcehostname CONTAINS "javaupdatecdn.com" OR sourcehostname CONTAINS "flash.javaupdate-cdn.com" OR sourcehostname CONTAINS "linux.ntp-update.com" OR sourcehostname CONTAINS "esxi-lty.ntp-update.com" OR sourcehostname CONTAINS "windows.0g6666.com" OR sourcehostname CONTAINS "ubuntu-ndi.ntp-update.com" OR sourcehostname CONTAINS "h1.xpjpz400.com" OR sourcehostname CONTAINS "cg.xpjpz400.com" OR sourcehostname CONTAINS "letsencrypt.msupdatesync.com" OR sourcehostname CONTAINS "cloud.ntp-update.com" OR sourcehostname CONTAINS "fe.ntp-update.com" OR sourcehostname CONTAINS "wtech.ntp-update.com" OR sourcehostname CONTAINS "imp.ntp-update.com" OR sourcehostname CONTAINS "ogplus.ntp-update.com" OR sourcehostname CONTAINS "organization.0g6666.com" OR sourcehostname CONTAINS "global.ntp-update.com" OR sourcehostname CONTAINS "kaiy.0g6666.com" OR sourcehostname CONTAINS "kaiy.ntp-update.com" OR sourcehostname CONTAINS "ky.0g6666.com" OR sourcehostname CONTAINS "oriental.ntp-update.com" OR sourcehostname CONTAINS "guard.ntp-update.com" OR sourcehostname CONTAINS "oglive.ntp-update.com" OR sourcehostname CONTAINS "guard.0g6666.com" OR sourcehostname CONTAINS "plus.ntp-update.com" OR sourcehostname CONTAINS "oglty.0g6666.com" OR sourcehostname CONTAINS "oglty.ntp-update.com" OR sourcehostname CONTAINS "oglty-ml.ntp-update.com" OR sourcehostname CONTAINS "ml-lty.ntp-update.com" OR sourcehostname CONTAINS "telegram.ntp-update.com" OR sourcehostname CONTAINS "easyh.ntp-update.com" OR sourcehostname CONTAINS "weblog.ntp-update.com" OR sourcehostname CONTAINS "weblog-ml.ntp-update.com" OR sourcehostname CONTAINS "o-fsh.ntp-update.com" OR sourcehostname CONTAINS "idn-tb.ntp-update.com" OR sourcehostname CONTAINS "tb-ndi2.ntp-update.com" OR sourcehostname CONTAINS "ml-ndi.ntp-update.com" OR sourcehostname CONTAINS "vct.0g6666.com" OR sourcehostname CONTAINS "windows-i-tb.ntp-update.com" OR sourcehostname CONTAINS "windows-qc-tb-i.ntp-update.com" OR sourcehostname CONTAINS "windows-tb-i.ntp-update.com")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "a-ad-tml.ntp-update.com" OR destinationntdomain CONTAINS "rps-a.ntp-update.com" OR destinationntdomain CONTAINS "a-rps.ntp-update.com" OR destinationntdomain CONTAINS "dns-a.ntp-update.com" OR destinationntdomain CONTAINS "a-tb.ntp-update.com" OR destinationntdomain CONTAINS "alast.sun-java.com" OR destinationntdomain CONTAINS "alast.ntp-update.com" OR destinationntdomain CONTAINS "dell-a.ntp-update.com" OR destinationntdomain CONTAINS "a-sp-rps.0g6666.com" OR destinationntdomain CONTAINS "windows.javaupdate-cdn.com" OR destinationntdomain CONTAINS "javaupdatecdn.com" OR destinationntdomain CONTAINS "flash.javaupdate-cdn.com" OR destinationntdomain CONTAINS "linux.ntp-update.com" OR destinationntdomain CONTAINS "esxi-lty.ntp-update.com" OR destinationntdomain CONTAINS "windows.0g6666.com" OR destinationntdomain CONTAINS "ubuntu-ndi.ntp-update.com" OR destinationntdomain CONTAINS "h1.xpjpz400.com" OR destinationntdomain CONTAINS "cg.xpjpz400.com" OR destinationntdomain CONTAINS "letsencrypt.msupdatesync.com" OR destinationntdomain CONTAINS "cloud.ntp-update.com" OR destinationntdomain CONTAINS "fe.ntp-update.com" OR destinationntdomain CONTAINS "wtech.ntp-update.com" OR destinationntdomain CONTAINS "imp.ntp-update.com" OR destinationntdomain CONTAINS "ogplus.ntp-update.com" OR destinationntdomain CONTAINS "organization.0g6666.com" OR destinationntdomain CONTAINS "global.ntp-update.com" OR destinationntdomain CONTAINS "kaiy.0g6666.com" OR destinationntdomain CONTAINS "kaiy.ntp-update.com" OR destinationntdomain CONTAINS "ky.0g6666.com" OR destinationntdomain CONTAINS "oriental.ntp-update.com" OR destinationntdomain CONTAINS "guard.ntp-update.com" OR destinationntdomain CONTAINS "oglive.ntp-update.com" OR destinationntdomain CONTAINS "guard.0g6666.com" OR destinationntdomain CONTAINS "plus.ntp-update.com" OR destinationntdomain CONTAINS "oglty.0g6666.com" OR destinationntdomain CONTAINS "oglty.ntp-update.com" OR destinationntdomain CONTAINS "oglty-ml.ntp-update.com" OR destinationntdomain CONTAINS "ml-lty.ntp-update.com" OR destinationntdomain CONTAINS "telegram.ntp-update.com" OR destinationntdomain CONTAINS "easyh.ntp-update.com" OR destinationntdomain CONTAINS "weblog.ntp-update.com" OR destinationntdomain CONTAINS "weblog-ml.ntp-update.com" OR destinationntdomain CONTAINS "o-fsh.ntp-update.com" OR destinationntdomain CONTAINS "idn-tb.ntp-update.com" OR destinationntdomain CONTAINS "tb-ndi2.ntp-update.com" OR destinationntdomain CONTAINS "ml-ndi.ntp-update.com" OR destinationntdomain CONTAINS "vct.0g6666.com" OR destinationntdomain CONTAINS "windows-i-tb.ntp-update.com" OR destinationntdomain CONTAINS "windows-qc-tb-i.ntp-update.com" OR destinationntdomain CONTAINS "windows-tb-i.ntp-update.com")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND requesturl NOT NULL AND (requesturl CONTAINS "a-ad-tml.ntp-update.com" OR requesturl CONTAINS "rps-a.ntp-update.com" OR requesturl CONTAINS "a-rps.ntp-update.com" OR requesturl CONTAINS "dns-a.ntp-update.com" OR requesturl CONTAINS "a-tb.ntp-update.com" OR requesturl CONTAINS "alast.sun-java.com" OR requesturl CONTAINS "alast.ntp-update.com" OR requesturl CONTAINS "dell-a.ntp-update.com" OR requesturl CONTAINS "a-sp-rps.0g6666.com" OR requesturl CONTAINS "windows.javaupdate-cdn.com" OR requesturl CONTAINS "javaupdatecdn.com" OR requesturl CONTAINS "flash.javaupdate-cdn.com" OR requesturl CONTAINS "linux.ntp-update.com" OR requesturl CONTAINS "esxi-lty.ntp-update.com" OR requesturl CONTAINS "windows.0g6666.com" OR requesturl CONTAINS "ubuntu-ndi.ntp-update.com" OR requesturl CONTAINS "h1.xpjpz400.com" OR requesturl CONTAINS "cg.xpjpz400.com" OR requesturl CONTAINS "letsencrypt.msupdatesync.com" OR requesturl CONTAINS "cloud.ntp-update.com" OR requesturl CONTAINS "fe.ntp-update.com" OR requesturl CONTAINS "wtech.ntp-update.com" OR requesturl CONTAINS "imp.ntp-update.com" OR requesturl CONTAINS "ogplus.ntp-update.com" OR requesturl CONTAINS "organization.0g6666.com" OR requesturl CONTAINS "global.ntp-update.com" OR requesturl CONTAINS "kaiy.0g6666.com" OR requesturl CONTAINS "kaiy.ntp-update.com" OR requesturl CONTAINS "ky.0g6666.com" OR requesturl CONTAINS "oriental.ntp-update.com" OR requesturl CONTAINS "guard.ntp-update.com" OR requesturl CONTAINS "oglive.ntp-update.com" OR requesturl CONTAINS "guard.0g6666.com" OR requesturl CONTAINS "plus.ntp-update.com" OR requesturl CONTAINS "oglty.0g6666.com" OR requesturl CONTAINS "oglty.ntp-update.com" OR requesturl CONTAINS "oglty-ml.ntp-update.com" OR requesturl CONTAINS "ml-lty.ntp-update.com" OR requesturl CONTAINS "telegram.ntp-update.com" OR requesturl CONTAINS "easyh.ntp-update.com" OR requesturl CONTAINS "weblog.ntp-update.com" OR requesturl CONTAINS "weblog-ml.ntp-update.com" OR requesturl CONTAINS "o-fsh.ntp-update.com" OR requesturl CONTAINS "idn-tb.ntp-update.com" OR requesturl CONTAINS "tb-ndi2.ntp-update.com" OR requesturl CONTAINS "ml-ndi.ntp-update.com" OR requesturl CONTAINS "vct.0g6666.com" OR requesturl CONTAINS "windows-i-tb.ntp-update.com" OR requesturl CONTAINS "windows-qc-tb-i.ntp-update.com" OR requesturl CONTAINS "windows-tb-i.ntp-update.com")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "a-fms.ntp-update.com" OR destinationhostname CONTAINS "plus.0g6666.com" OR destinationhostname CONTAINS "aprotect.sun-java.com" OR destinationhostname CONTAINS "og8888.0g6666.com" OR destinationhostname CONTAINS "adobe.javaupdate-cdn.com" OR destinationhostname CONTAINS "linux.0g6666.com" OR destinationhostname CONTAINS "ad.ntp-update.com" OR destinationhostname CONTAINS "www.0g6666.com" OR destinationhostname CONTAINS "wt.ntp-update.com" OR destinationhostname CONTAINS "aliyun.ntp-update.com")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "a-fms.ntp-update.com" OR sourcentdomain CONTAINS "plus.0g6666.com" OR sourcentdomain CONTAINS "aprotect.sun-java.com" OR sourcentdomain CONTAINS "og8888.0g6666.com" OR sourcentdomain CONTAINS "adobe.javaupdate-cdn.com" OR sourcentdomain CONTAINS "linux.0g6666.com" OR sourcentdomain CONTAINS "ad.ntp-update.com" OR sourcentdomain CONTAINS "www.0g6666.com" OR sourcentdomain CONTAINS "wt.ntp-update.com" OR sourcentdomain CONTAINS "aliyun.ntp-update.com")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "a-fms.ntp-update.com" OR sourcehostname CONTAINS "plus.0g6666.com" OR sourcehostname CONTAINS "aprotect.sun-java.com" OR sourcehostname CONTAINS "og8888.0g6666.com" OR sourcehostname CONTAINS "adobe.javaupdate-cdn.com" OR sourcehostname CONTAINS "linux.0g6666.com" OR sourcehostname CONTAINS "ad.ntp-update.com" OR sourcehostname CONTAINS "www.0g6666.com" OR sourcehostname CONTAINS "wt.ntp-update.com" OR sourcehostname CONTAINS "aliyun.ntp-update.com")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "a-fms.ntp-update.com" OR destinationntdomain CONTAINS "plus.0g6666.com" OR destinationntdomain CONTAINS "aprotect.sun-java.com" OR destinationntdomain CONTAINS "og8888.0g6666.com" OR destinationntdomain CONTAINS "adobe.javaupdate-cdn.com" OR destinationntdomain CONTAINS "linux.0g6666.com" OR destinationntdomain CONTAINS "ad.ntp-update.com" OR destinationntdomain CONTAINS "www.0g6666.com" OR destinationntdomain CONTAINS "wt.ntp-update.com" OR destinationntdomain CONTAINS "aliyun.ntp-update.com")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND requesturl NOT NULL AND (requesturl CONTAINS "a-fms.ntp-update.com" OR requesturl CONTAINS "plus.0g6666.com" OR requesturl CONTAINS "aprotect.sun-java.com" OR requesturl CONTAINS "og8888.0g6666.com" OR requesturl CONTAINS "adobe.javaupdate-cdn.com" OR requesturl CONTAINS "linux.0g6666.com" OR requesturl CONTAINS "ad.ntp-update.com" OR requesturl CONTAINS "www.0g6666.com" OR requesturl CONTAINS "wt.ntp-update.com" OR requesturl CONTAINS "aliyun.ntp-update.com")
index=activity AND rg_functionality="Web Application Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "a-ad-tml.ntp-update.com" OR destinationhostname CONTAINS "rps-a.ntp-update.com" OR destinationhostname CONTAINS "a-rps.ntp-update.com" OR destinationhostname CONTAINS "dns-a.ntp-update.com" OR destinationhostname CONTAINS "a-tb.ntp-update.com" OR destinationhostname CONTAINS "alast.sun-java.com" OR destinationhostname CONTAINS "alast.ntp-update.com" OR destinationhostname CONTAINS "dell-a.ntp-update.com" OR destinationhostname CONTAINS "a-sp-rps.0g6666.com" OR destinationhostname CONTAINS "windows.javaupdate-cdn.com" OR destinationhostname CONTAINS "javaupdatecdn.com" OR destinationhostname CONTAINS "flash.javaupdate-cdn.com" OR destinationhostname CONTAINS "linux.ntp-update.com" OR destinationhostname CONTAINS "esxi-lty.ntp-update.com" OR destinationhostname CONTAINS "windows.0g6666.com" OR destinationhostname CONTAINS "ubuntu-ndi.ntp-update.com" OR destinationhostname CONTAINS "h1.xpjpz400.com" OR destinationhostname CONTAINS "cg.xpjpz400.com" OR destinationhostname CONTAINS "letsencrypt.msupdatesync.com" OR destinationhostname CONTAINS "cloud.ntp-update.com" OR destinationhostname CONTAINS "fe.ntp-update.com" OR destinationhostname CONTAINS "wtech.ntp-update.com" OR destinationhostname CONTAINS "imp.ntp-update.com" OR destinationhostname CONTAINS "ogplus.ntp-update.com" OR destinationhostname CONTAINS "organization.0g6666.com" OR destinationhostname CONTAINS "global.ntp-update.com" OR destinationhostname CONTAINS "kaiy.0g6666.com" OR destinationhostname CONTAINS "kaiy.ntp-update.com" OR destinationhostname CONTAINS "ky.0g6666.com" OR destinationhostname CONTAINS "oriental.ntp-update.com" OR destinationhostname CONTAINS "guard.ntp-update.com" OR destinationhostname CONTAINS "oglive.ntp-update.com" OR destinationhostname CONTAINS "guard.0g6666.com" OR destinationhostname CONTAINS "plus.ntp-update.com" OR destinationhostname CONTAINS "oglty.0g6666.com" OR destinationhostname CONTAINS "oglty.ntp-update.com" OR destinationhostname CONTAINS "oglty-ml.ntp-update.com" OR destinationhostname CONTAINS "ml-lty.ntp-update.com" OR destinationhostname CONTAINS "telegram.ntp-update.com" OR destinationhostname CONTAINS "easyh.ntp-update.com" OR destinationhostname CONTAINS "weblog.ntp-update.com" OR destinationhostname CONTAINS "weblog-ml.ntp-update.com" OR destinationhostname CONTAINS "o-fsh.ntp-update.com" OR destinationhostname CONTAINS "idn-tb.ntp-update.com" OR destinationhostname CONTAINS "tb-ndi2.ntp-update.com" OR destinationhostname CONTAINS "ml-ndi.ntp-update.com" OR destinationhostname CONTAINS "vct.0g6666.com" OR destinationhostname CONTAINS "windows-i-tb.ntp-update.com" OR destinationhostname CONTAINS "windows-qc-tb-i.ntp-update.com" OR destinationhostname CONTAINS "windows-tb-i.ntp-update.com")
index=activity AND rg_functionality="Web Application Firewall" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "a-ad-tml.ntp-update.com" OR sourcentdomain CONTAINS "rps-a.ntp-update.com" OR sourcentdomain CONTAINS "a-rps.ntp-update.com" OR sourcentdomain CONTAINS "dns-a.ntp-update.com" OR sourcentdomain CONTAINS "a-tb.ntp-update.com" OR sourcentdomain CONTAINS "alast.sun-java.com" OR sourcentdomain CONTAINS "alast.ntp-update.com" OR sourcentdomain CONTAINS "dell-a.ntp-update.com" OR sourcentdomain CONTAINS "a-sp-rps.0g6666.com" OR sourcentdomain CONTAINS "windows.javaupdate-cdn.com" OR sourcentdomain CONTAINS "javaupdatecdn.com" OR sourcentdomain CONTAINS "flash.javaupdate-cdn.com" OR sourcentdomain CONTAINS "linux.ntp-update.com" OR sourcentdomain CONTAINS "esxi-lty.ntp-update.com" OR sourcentdomain CONTAINS "windows.0g6666.com" OR sourcentdomain CONTAINS "ubuntu-ndi.ntp-update.com" OR sourcentdomain CONTAINS "h1.xpjpz400.com" OR sourcentdomain CONTAINS "cg.xpjpz400.com" OR sourcentdomain CONTAINS "letsencrypt.msupdatesync.com" OR sourcentdomain CONTAINS "cloud.ntp-update.com" OR sourcentdomain CONTAINS "fe.ntp-update.com" OR sourcentdomain CONTAINS "wtech.ntp-update.com" OR sourcentdomain CONTAINS "imp.ntp-update.com" OR sourcentdomain CONTAINS "ogplus.ntp-update.com" OR sourcentdomain CONTAINS "organization.0g6666.com" OR sourcentdomain CONTAINS "global.ntp-update.com" OR sourcentdomain CONTAINS "kaiy.0g6666.com" OR sourcentdomain CONTAINS "kaiy.ntp-update.com" OR sourcentdomain CONTAINS "ky.0g6666.com" OR sourcentdomain CONTAINS "oriental.ntp-update.com" OR sourcentdomain CONTAINS "guard.ntp-update.com" OR sourcentdomain CONTAINS "oglive.ntp-update.com" OR sourcentdomain CONTAINS "guard.0g6666.com" OR sourcentdomain CONTAINS "plus.ntp-update.com" OR sourcentdomain CONTAINS "oglty.0g6666.com" OR sourcentdomain CONTAINS "oglty.ntp-update.com" OR sourcentdomain CONTAINS "oglty-ml.ntp-update.com" OR sourcentdomain CONTAINS "ml-lty.ntp-update.com" OR sourcentdomain CONTAINS "telegram.ntp-update.com" OR sourcentdomain CONTAINS "easyh.ntp-update.com" OR sourcentdomain CONTAINS "weblog.ntp-update.com" OR sourcentdomain CONTAINS "weblog-ml.ntp-update.com" OR sourcentdomain CONTAINS "o-fsh.ntp-update.com" OR sourcentdomain CONTAINS "idn-tb.ntp-update.com" OR sourcentdomain CONTAINS "tb-ndi2.ntp-update.com" OR sourcentdomain CONTAINS "ml-ndi.ntp-update.com" OR sourcentdomain CONTAINS "vct.0g6666.com" OR sourcentdomain CONTAINS "windows-i-tb.ntp-update.com" OR sourcentdomain CONTAINS "windows-qc-tb-i.ntp-update.com" OR sourcentdomain CONTAINS "windows-tb-i.ntp-update.com")
index=activity AND rg_functionality="Web Application Firewall" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "a-ad-tml.ntp-update.com" OR sourcehostname CONTAINS "rps-a.ntp-update.com" OR sourcehostname CONTAINS "a-rps.ntp-update.com" OR sourcehostname CONTAINS "dns-a.ntp-update.com" OR sourcehostname CONTAINS "a-tb.ntp-update.com" OR sourcehostname CONTAINS "alast.sun-java.com" OR sourcehostname CONTAINS "alast.ntp-update.com" OR sourcehostname CONTAINS "dell-a.ntp-update.com" OR sourcehostname CONTAINS "a-sp-rps.0g6666.com" OR sourcehostname CONTAINS "windows.javaupdate-cdn.com" OR sourcehostname CONTAINS "javaupdatecdn.com" OR sourcehostname CONTAINS "flash.javaupdate-cdn.com" OR sourcehostname CONTAINS "linux.ntp-update.com" OR sourcehostname CONTAINS "esxi-lty.ntp-update.com" OR sourcehostname CONTAINS "windows.0g6666.com" OR sourcehostname CONTAINS "ubuntu-ndi.ntp-update.com" OR sourcehostname CONTAINS "h1.xpjpz400.com" OR sourcehostname CONTAINS "cg.xpjpz400.com" OR sourcehostname CONTAINS "letsencrypt.msupdatesync.com" OR sourcehostname CONTAINS "cloud.ntp-update.com" OR sourcehostname CONTAINS "fe.ntp-update.com" OR sourcehostname CONTAINS "wtech.ntp-update.com" OR sourcehostname CONTAINS "imp.ntp-update.com" OR sourcehostname CONTAINS "ogplus.ntp-update.com" OR sourcehostname CONTAINS "organization.0g6666.com" OR sourcehostname CONTAINS "global.ntp-update.com" OR sourcehostname CONTAINS "kaiy.0g6666.com" OR sourcehostname CONTAINS "kaiy.ntp-update.com" OR sourcehostname CONTAINS "ky.0g6666.com" OR sourcehostname CONTAINS "oriental.ntp-update.com" OR sourcehostname CONTAINS "guard.ntp-update.com" OR sourcehostname CONTAINS "oglive.ntp-update.com" OR sourcehostname CONTAINS "guard.0g6666.com" OR sourcehostname CONTAINS "plus.ntp-update.com" OR sourcehostname CONTAINS "oglty.0g6666.com" OR sourcehostname CONTAINS "oglty.ntp-update.com" OR sourcehostname CONTAINS "oglty-ml.ntp-update.com" OR sourcehostname CONTAINS "ml-lty.ntp-update.com" OR sourcehostname CONTAINS "telegram.ntp-update.com" OR sourcehostname CONTAINS "easyh.ntp-update.com" OR sourcehostname CONTAINS "weblog.ntp-update.com" OR sourcehostname CONTAINS "weblog-ml.ntp-update.com" OR sourcehostname CONTAINS "o-fsh.ntp-update.com" OR sourcehostname CONTAINS "idn-tb.ntp-update.com" OR sourcehostname CONTAINS "tb-ndi2.ntp-update.com" OR sourcehostname CONTAINS "ml-ndi.ntp-update.com" OR sourcehostname CONTAINS "vct.0g6666.com" OR sourcehostname CONTAINS "windows-i-tb.ntp-update.com" OR sourcehostname CONTAINS "windows-qc-tb-i.ntp-update.com" OR sourcehostname CONTAINS "windows-tb-i.ntp-update.com")
index=activity AND rg_functionality="Web Application Firewall" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "a-ad-tml.ntp-update.com" OR destinationntdomain CONTAINS "rps-a.ntp-update.com" OR destinationntdomain CONTAINS "a-rps.ntp-update.com" OR destinationntdomain CONTAINS "dns-a.ntp-update.com" OR destinationntdomain CONTAINS "a-tb.ntp-update.com" OR destinationntdomain CONTAINS "alast.sun-java.com" OR destinationntdomain CONTAINS "alast.ntp-update.com" OR destinationntdomain CONTAINS "dell-a.ntp-update.com" OR destinationntdomain CONTAINS "a-sp-rps.0g6666.com" OR destinationntdomain CONTAINS "windows.javaupdate-cdn.com" OR destinationntdomain CONTAINS "javaupdatecdn.com" OR destinationntdomain CONTAINS "flash.javaupdate-cdn.com" OR destinationntdomain CONTAINS "linux.ntp-update.com" OR destinationntdomain CONTAINS "esxi-lty.ntp-update.com" OR destinationntdomain CONTAINS "windows.0g6666.com" OR destinationntdomain CONTAINS "ubuntu-ndi.ntp-update.com" OR destinationntdomain CONTAINS "h1.xpjpz400.com" OR destinationntdomain CONTAINS "cg.xpjpz400.com" OR destinationntdomain CONTAINS "letsencrypt.msupdatesync.com" OR destinationntdomain CONTAINS "cloud.ntp-update.com" OR destinationntdomain CONTAINS "fe.ntp-update.com" OR destinationntdomain CONTAINS "wtech.ntp-update.com" OR destinationntdomain CONTAINS "imp.ntp-update.com" OR destinationntdomain CONTAINS "ogplus.ntp-update.com" OR destinationntdomain CONTAINS "organization.0g6666.com" OR destinationntdomain CONTAINS "global.ntp-update.com" OR destinationntdomain CONTAINS "kaiy.0g6666.com" OR destinationntdomain CONTAINS "kaiy.ntp-update.com" OR destinationntdomain CONTAINS "ky.0g6666.com" OR destinationntdomain CONTAINS "oriental.ntp-update.com" OR destinationntdomain CONTAINS "guard.ntp-update.com" OR destinationntdomain CONTAINS "oglive.ntp-update.com" OR destinationntdomain CONTAINS "guard.0g6666.com" OR destinationntdomain CONTAINS "plus.ntp-update.com" OR destinationntdomain CONTAINS "oglty.0g6666.com" OR destinationntdomain CONTAINS "oglty.ntp-update.com" OR destinationntdomain CONTAINS "oglty-ml.ntp-update.com" OR destinationntdomain CONTAINS "ml-lty.ntp-update.com" OR destinationntdomain CONTAINS "telegram.ntp-update.com" OR destinationntdomain CONTAINS "easyh.ntp-update.com" OR destinationntdomain CONTAINS "weblog.ntp-update.com" OR destinationntdomain CONTAINS "weblog-ml.ntp-update.com" OR destinationntdomain CONTAINS "o-fsh.ntp-update.com" OR destinationntdomain CONTAINS "idn-tb.ntp-update.com" OR destinationntdomain CONTAINS "tb-ndi2.ntp-update.com" OR destinationntdomain CONTAINS "ml-ndi.ntp-update.com" OR destinationntdomain CONTAINS "vct.0g6666.com" OR destinationntdomain CONTAINS "windows-i-tb.ntp-update.com" OR destinationntdomain CONTAINS "windows-qc-tb-i.ntp-update.com" OR destinationntdomain CONTAINS "windows-tb-i.ntp-update.com")
index=activity AND rg_functionality="Web Application Firewall" AND requesturl NOT NULL AND (requesturl CONTAINS "a-ad-tml.ntp-update.com" OR requesturl CONTAINS "rps-a.ntp-update.com" OR requesturl CONTAINS "a-rps.ntp-update.com" OR requesturl CONTAINS "dns-a.ntp-update.com" OR requesturl CONTAINS "a-tb.ntp-update.com" OR requesturl CONTAINS "alast.sun-java.com" OR requesturl CONTAINS "alast.ntp-update.com" OR requesturl CONTAINS "dell-a.ntp-update.com" OR requesturl CONTAINS "a-sp-rps.0g6666.com" OR requesturl CONTAINS "windows.javaupdate-cdn.com" OR requesturl CONTAINS "javaupdatecdn.com" OR requesturl CONTAINS "flash.javaupdate-cdn.com" OR requesturl CONTAINS "linux.ntp-update.com" OR requesturl CONTAINS "esxi-lty.ntp-update.com" OR requesturl CONTAINS "windows.0g6666.com" OR requesturl CONTAINS "ubuntu-ndi.ntp-update.com" OR requesturl CONTAINS "h1.xpjpz400.com" OR requesturl CONTAINS "cg.xpjpz400.com" OR requesturl CONTAINS "letsencrypt.msupdatesync.com" OR requesturl CONTAINS "cloud.ntp-update.com" OR requesturl CONTAINS "fe.ntp-update.com" OR requesturl CONTAINS "wtech.ntp-update.com" OR requesturl CONTAINS "imp.ntp-update.com" OR requesturl CONTAINS "ogplus.ntp-update.com" OR requesturl CONTAINS "organization.0g6666.com" OR requesturl CONTAINS "global.ntp-update.com" OR requesturl CONTAINS "kaiy.0g6666.com" OR requesturl CONTAINS "kaiy.ntp-update.com" OR requesturl CONTAINS "ky.0g6666.com" OR requesturl CONTAINS "oriental.ntp-update.com" OR requesturl CONTAINS "guard.ntp-update.com" OR requesturl CONTAINS "oglive.ntp-update.com" OR requesturl CONTAINS "guard.0g6666.com" OR requesturl CONTAINS "plus.ntp-update.com" OR requesturl CONTAINS "oglty.0g6666.com" OR requesturl CONTAINS "oglty.ntp-update.com" OR requesturl CONTAINS "oglty-ml.ntp-update.com" OR requesturl CONTAINS "ml-lty.ntp-update.com" OR requesturl CONTAINS "telegram.ntp-update.com" OR requesturl CONTAINS "easyh.ntp-update.com" OR requesturl CONTAINS "weblog.ntp-update.com" OR requesturl CONTAINS "weblog-ml.ntp-update.com" OR requesturl CONTAINS "o-fsh.ntp-update.com" OR requesturl CONTAINS "idn-tb.ntp-update.com" OR requesturl CONTAINS "tb-ndi2.ntp-update.com" OR requesturl CONTAINS "ml-ndi.ntp-update.com" OR requesturl CONTAINS "vct.0g6666.com" OR requesturl CONTAINS "windows-i-tb.ntp-update.com" OR requesturl CONTAINS "windows-qc-tb-i.ntp-update.com" OR requesturl CONTAINS "windows-tb-i.ntp-update.com")
index=activity AND rg_functionality="Web Application Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "a-fms.ntp-update.com" OR destinationhostname CONTAINS "plus.0g6666.com" OR destinationhostname CONTAINS "aprotect.sun-java.com" OR destinationhostname CONTAINS "og8888.0g6666.com" OR destinationhostname CONTAINS "adobe.javaupdate-cdn.com" OR destinationhostname CONTAINS "linux.0g6666.com" OR destinationhostname CONTAINS "ad.ntp-update.com" OR destinationhostname CONTAINS "www.0g6666.com" OR destinationhostname CONTAINS "wt.ntp-update.com" OR destinationhostname CONTAINS "aliyun.ntp-update.com")
index=activity AND rg_functionality="Web Application Firewall" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "a-fms.ntp-update.com" OR sourcentdomain CONTAINS "plus.0g6666.com" OR sourcentdomain CONTAINS "aprotect.sun-java.com" OR sourcentdomain CONTAINS "og8888.0g6666.com" OR sourcentdomain CONTAINS "adobe.javaupdate-cdn.com" OR sourcentdomain CONTAINS "linux.0g6666.com" OR sourcentdomain CONTAINS "ad.ntp-update.com" OR sourcentdomain CONTAINS "www.0g6666.com" OR sourcentdomain CONTAINS "wt.ntp-update.com" OR sourcentdomain CONTAINS "aliyun.ntp-update.com")
index=activity AND rg_functionality="Web Application Firewall" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "a-fms.ntp-update.com" OR sourcehostname CONTAINS "plus.0g6666.com" OR sourcehostname CONTAINS "aprotect.sun-java.com" OR sourcehostname CONTAINS "og8888.0g6666.com" OR sourcehostname CONTAINS "adobe.javaupdate-cdn.com" OR sourcehostname CONTAINS "linux.0g6666.com" OR sourcehostname CONTAINS "ad.ntp-update.com" OR sourcehostname CONTAINS "www.0g6666.com" OR sourcehostname CONTAINS "wt.ntp-update.com" OR sourcehostname CONTAINS "aliyun.ntp-update.com")
index=activity AND rg_functionality="Web Application Firewall" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "a-fms.ntp-update.com" OR destinationntdomain CONTAINS "plus.0g6666.com" OR destinationntdomain CONTAINS "aprotect.sun-java.com" OR destinationntdomain CONTAINS "og8888.0g6666.com" OR destinationntdomain CONTAINS "adobe.javaupdate-cdn.com" OR destinationntdomain CONTAINS "linux.0g6666.com" OR destinationntdomain CONTAINS "ad.ntp-update.com" OR destinationntdomain CONTAINS "www.0g6666.com" OR destinationntdomain CONTAINS "wt.ntp-update.com" OR destinationntdomain CONTAINS "aliyun.ntp-update.com")
index=activity AND rg_functionality="Web Application Firewall" AND requesturl NOT NULL AND (requesturl CONTAINS "a-fms.ntp-update.com" OR requesturl CONTAINS "plus.0g6666.com" OR requesturl CONTAINS "aprotect.sun-java.com" OR requesturl CONTAINS "og8888.0g6666.com" OR requesturl CONTAINS "adobe.javaupdate-cdn.com" OR requesturl CONTAINS "linux.0g6666.com" OR requesturl CONTAINS "ad.ntp-update.com" OR requesturl CONTAINS "www.0g6666.com" OR requesturl CONTAINS "wt.ntp-update.com" OR requesturl CONTAINS "aliyun.ntp-update.com")
index=activity AND rg_functionality="Endpoint management systems" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "a-ad-tml.ntp-update.com" OR destinationhostname CONTAINS "rps-a.ntp-update.com" OR destinationhostname CONTAINS "a-rps.ntp-update.com" OR destinationhostname CONTAINS "dns-a.ntp-update.com" OR destinationhostname CONTAINS "a-tb.ntp-update.com" OR destinationhostname CONTAINS "alast.sun-java.com" OR destinationhostname CONTAINS "alast.ntp-update.com" OR destinationhostname CONTAINS "dell-a.ntp-update.com" OR destinationhostname CONTAINS "a-sp-rps.0g6666.com" OR destinationhostname CONTAINS "windows.javaupdate-cdn.com" OR destinationhostname CONTAINS "javaupdatecdn.com" OR destinationhostname CONTAINS "flash.javaupdate-cdn.com" OR destinationhostname CONTAINS "linux.ntp-update.com" OR destinationhostname CONTAINS "esxi-lty.ntp-update.com" OR destinationhostname CONTAINS "windows.0g6666.com" OR destinationhostname CONTAINS "ubuntu-ndi.ntp-update.com" OR destinationhostname CONTAINS "h1.xpjpz400.com" OR destinationhostname CONTAINS "cg.xpjpz400.com" OR destinationhostname CONTAINS "letsencrypt.msupdatesync.com" OR destinationhostname CONTAINS "cloud.ntp-update.com" OR destinationhostname CONTAINS "fe.ntp-update.com" OR destinationhostname CONTAINS "wtech.ntp-update.com" OR destinationhostname CONTAINS "imp.ntp-update.com" OR destinationhostname CONTAINS "ogplus.ntp-update.com" OR destinationhostname CONTAINS "organization.0g6666.com" OR destinationhostname CONTAINS "global.ntp-update.com" OR destinationhostname CONTAINS "kaiy.0g6666.com" OR destinationhostname CONTAINS "kaiy.ntp-update.com" OR destinationhostname CONTAINS "ky.0g6666.com" OR destinationhostname CONTAINS "oriental.ntp-update.com" OR destinationhostname CONTAINS "guard.ntp-update.com" OR destinationhostname CONTAINS "oglive.ntp-update.com" OR destinationhostname CONTAINS "guard.0g6666.com" OR destinationhostname CONTAINS "plus.ntp-update.com" OR destinationhostname CONTAINS "oglty.0g6666.com" OR destinationhostname CONTAINS "oglty.ntp-update.com" OR destinationhostname CONTAINS "oglty-ml.ntp-update.com" OR destinationhostname CONTAINS "ml-lty.ntp-update.com" OR destinationhostname CONTAINS "telegram.ntp-update.com" OR destinationhostname CONTAINS "easyh.ntp-update.com" OR destinationhostname CONTAINS "weblog.ntp-update.com" OR destinationhostname CONTAINS "weblog-ml.ntp-update.com" OR destinationhostname CONTAINS "o-fsh.ntp-update.com" OR destinationhostname CONTAINS "idn-tb.ntp-update.com" OR destinationhostname CONTAINS "tb-ndi2.ntp-update.com" OR destinationhostname CONTAINS "ml-ndi.ntp-update.com" OR destinationhostname CONTAINS "vct.0g6666.com" OR destinationhostname CONTAINS "windows-i-tb.ntp-update.com" OR destinationhostname CONTAINS "windows-qc-tb-i.ntp-update.com" OR destinationhostname CONTAINS "windows-tb-i.ntp-update.com")
index=activity AND rg_functionality="Endpoint management systems" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "a-ad-tml.ntp-update.com" OR sourcentdomain CONTAINS "rps-a.ntp-update.com" OR sourcentdomain CONTAINS "a-rps.ntp-update.com" OR sourcentdomain CONTAINS "dns-a.ntp-update.com" OR sourcentdomain CONTAINS "a-tb.ntp-update.com" OR sourcentdomain CONTAINS "alast.sun-java.com" OR sourcentdomain CONTAINS "alast.ntp-update.com" OR sourcentdomain CONTAINS "dell-a.ntp-update.com" OR sourcentdomain CONTAINS "a-sp-rps.0g6666.com" OR sourcentdomain CONTAINS "windows.javaupdate-cdn.com" OR sourcentdomain CONTAINS "javaupdatecdn.com" OR sourcentdomain CONTAINS "flash.javaupdate-cdn.com" OR sourcentdomain CONTAINS "linux.ntp-update.com" OR sourcentdomain CONTAINS "esxi-lty.ntp-update.com" OR sourcentdomain CONTAINS "windows.0g6666.com" OR sourcentdomain CONTAINS "ubuntu-ndi.ntp-update.com" OR sourcentdomain CONTAINS "h1.xpjpz400.com" OR sourcentdomain CONTAINS "cg.xpjpz400.com" OR sourcentdomain CONTAINS "letsencrypt.msupdatesync.com" OR sourcentdomain CONTAINS "cloud.ntp-update.com" OR sourcentdomain CONTAINS "fe.ntp-update.com" OR sourcentdomain CONTAINS "wtech.ntp-update.com" OR sourcentdomain CONTAINS "imp.ntp-update.com" OR sourcentdomain CONTAINS "ogplus.ntp-update.com" OR sourcentdomain CONTAINS "organization.0g6666.com" OR sourcentdomain CONTAINS "global.ntp-update.com" OR sourcentdomain CONTAINS "kaiy.0g6666.com" OR sourcentdomain CONTAINS "kaiy.ntp-update.com" OR sourcentdomain CONTAINS "ky.0g6666.com" OR sourcentdomain CONTAINS "oriental.ntp-update.com" OR sourcentdomain CONTAINS "guard.ntp-update.com" OR sourcentdomain CONTAINS "oglive.ntp-update.com" OR sourcentdomain CONTAINS "guard.0g6666.com" OR sourcentdomain CONTAINS "plus.ntp-update.com" OR sourcentdomain CONTAINS "oglty.0g6666.com" OR sourcentdomain CONTAINS "oglty.ntp-update.com" OR sourcentdomain CONTAINS "oglty-ml.ntp-update.com" OR sourcentdomain CONTAINS "ml-lty.ntp-update.com" OR sourcentdomain CONTAINS "telegram.ntp-update.com" OR sourcentdomain CONTAINS "easyh.ntp-update.com" OR sourcentdomain CONTAINS "weblog.ntp-update.com" OR sourcentdomain CONTAINS "weblog-ml.ntp-update.com" OR sourcentdomain CONTAINS "o-fsh.ntp-update.com" OR sourcentdomain CONTAINS "idn-tb.ntp-update.com" OR sourcentdomain CONTAINS "tb-ndi2.ntp-update.com" OR sourcentdomain CONTAINS "ml-ndi.ntp-update.com" OR sourcentdomain CONTAINS "vct.0g6666.com" OR sourcentdomain CONTAINS "windows-i-tb.ntp-update.com" OR sourcentdomain CONTAINS "windows-qc-tb-i.ntp-update.com" OR sourcentdomain CONTAINS "windows-tb-i.ntp-update.com")
index=activity AND rg_functionality="Endpoint management systems" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "a-ad-tml.ntp-update.com" OR sourcehostname CONTAINS "rps-a.ntp-update.com" OR sourcehostname CONTAINS "a-rps.ntp-update.com" OR sourcehostname CONTAINS "dns-a.ntp-update.com" OR sourcehostname CONTAINS "a-tb.ntp-update.com" OR sourcehostname CONTAINS "alast.sun-java.com" OR sourcehostname CONTAINS "alast.ntp-update.com" OR sourcehostname CONTAINS "dell-a.ntp-update.com" OR sourcehostname CONTAINS "a-sp-rps.0g6666.com" OR sourcehostname CONTAINS "windows.javaupdate-cdn.com" OR sourcehostname CONTAINS "javaupdatecdn.com" OR sourcehostname CONTAINS "flash.javaupdate-cdn.com" OR sourcehostname CONTAINS "linux.ntp-update.com" OR sourcehostname CONTAINS "esxi-lty.ntp-update.com" OR sourcehostname CONTAINS "windows.0g6666.com" OR sourcehostname CONTAINS "ubuntu-ndi.ntp-update.com" OR sourcehostname CONTAINS "h1.xpjpz400.com" OR sourcehostname CONTAINS "cg.xpjpz400.com" OR sourcehostname CONTAINS "letsencrypt.msupdatesync.com" OR sourcehostname CONTAINS "cloud.ntp-update.com" OR sourcehostname CONTAINS "fe.ntp-update.com" OR sourcehostname CONTAINS "wtech.ntp-update.com" OR sourcehostname CONTAINS "imp.ntp-update.com" OR sourcehostname CONTAINS "ogplus.ntp-update.com" OR sourcehostname CONTAINS "organization.0g6666.com" OR sourcehostname CONTAINS "global.ntp-update.com" OR sourcehostname CONTAINS "kaiy.0g6666.com" OR sourcehostname CONTAINS "kaiy.ntp-update.com" OR sourcehostname CONTAINS "ky.0g6666.com" OR sourcehostname CONTAINS "oriental.ntp-update.com" OR sourcehostname CONTAINS "guard.ntp-update.com" OR sourcehostname CONTAINS "oglive.ntp-update.com" OR sourcehostname CONTAINS "guard.0g6666.com" OR sourcehostname CONTAINS "plus.ntp-update.com" OR sourcehostname CONTAINS "oglty.0g6666.com" OR sourcehostname CONTAINS "oglty.ntp-update.com" OR sourcehostname CONTAINS "oglty-ml.ntp-update.com" OR sourcehostname CONTAINS "ml-lty.ntp-update.com" OR sourcehostname CONTAINS "telegram.ntp-update.com" OR sourcehostname CONTAINS "easyh.ntp-update.com" OR sourcehostname CONTAINS "weblog.ntp-update.com" OR sourcehostname CONTAINS "weblog-ml.ntp-update.com" OR sourcehostname CONTAINS "o-fsh.ntp-update.com" OR sourcehostname CONTAINS "idn-tb.ntp-update.com" OR sourcehostname CONTAINS "tb-ndi2.ntp-update.com" OR sourcehostname CONTAINS "ml-ndi.ntp-update.com" OR sourcehostname CONTAINS "vct.0g6666.com" OR sourcehostname CONTAINS "windows-i-tb.ntp-update.com" OR sourcehostname CONTAINS "windows-qc-tb-i.ntp-update.com" OR sourcehostname CONTAINS "windows-tb-i.ntp-update.com")
index=activity AND rg_functionality="Endpoint management systems" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "a-ad-tml.ntp-update.com" OR destinationntdomain CONTAINS "rps-a.ntp-update.com" OR destinationntdomain CONTAINS "a-rps.ntp-update.com" OR destinationntdomain CONTAINS "dns-a.ntp-update.com" OR destinationntdomain CONTAINS "a-tb.ntp-update.com" OR destinationntdomain CONTAINS "alast.sun-java.com" OR destinationntdomain CONTAINS "alast.ntp-update.com" OR destinationntdomain CONTAINS "dell-a.ntp-update.com" OR destinationntdomain CONTAINS "a-sp-rps.0g6666.com" OR destinationntdomain CONTAINS "windows.javaupdate-cdn.com" OR destinationntdomain CONTAINS "javaupdatecdn.com" OR destinationntdomain CONTAINS "flash.javaupdate-cdn.com" OR destinationntdomain CONTAINS "linux.ntp-update.com" OR destinationntdomain CONTAINS "esxi-lty.ntp-update.com" OR destinationntdomain CONTAINS "windows.0g6666.com" OR destinationntdomain CONTAINS "ubuntu-ndi.ntp-update.com" OR destinationntdomain CONTAINS "h1.xpjpz400.com" OR destinationntdomain CONTAINS "cg.xpjpz400.com" OR destinationntdomain CONTAINS "letsencrypt.msupdatesync.com" OR destinationntdomain CONTAINS "cloud.ntp-update.com" OR destinationntdomain CONTAINS "fe.ntp-update.com" OR destinationntdomain CONTAINS "wtech.ntp-update.com" OR destinationntdomain CONTAINS "imp.ntp-update.com" OR destinationntdomain CONTAINS "ogplus.ntp-update.com" OR destinationntdomain CONTAINS "organization.0g6666.com" OR destinationntdomain CONTAINS "global.ntp-update.com" OR destinationntdomain CONTAINS "kaiy.0g6666.com" OR destinationntdomain CONTAINS "kaiy.ntp-update.com" OR destinationntdomain CONTAINS "ky.0g6666.com" OR destinationntdomain CONTAINS "oriental.ntp-update.com" OR destinationntdomain CONTAINS "guard.ntp-update.com" OR destinationntdomain CONTAINS "oglive.ntp-update.com" OR destinationntdomain CONTAINS "guard.0g6666.com" OR destinationntdomain CONTAINS "plus.ntp-update.com" OR destinationntdomain CONTAINS "oglty.0g6666.com" OR destinationntdomain CONTAINS "oglty.ntp-update.com" OR destinationntdomain CONTAINS "oglty-ml.ntp-update.com" OR destinationntdomain CONTAINS "ml-lty.ntp-update.com" OR destinationntdomain CONTAINS "telegram.ntp-update.com" OR destinationntdomain CONTAINS "easyh.ntp-update.com" OR destinationntdomain CONTAINS "weblog.ntp-update.com" OR destinationntdomain CONTAINS "weblog-ml.ntp-update.com" OR destinationntdomain CONTAINS "o-fsh.ntp-update.com" OR destinationntdomain CONTAINS "idn-tb.ntp-update.com" OR destinationntdomain CONTAINS "tb-ndi2.ntp-update.com" OR destinationntdomain CONTAINS "ml-ndi.ntp-update.com" OR destinationntdomain CONTAINS "vct.0g6666.com" OR destinationntdomain CONTAINS "windows-i-tb.ntp-update.com" OR destinationntdomain CONTAINS "windows-qc-tb-i.ntp-update.com" OR destinationntdomain CONTAINS "windows-tb-i.ntp-update.com")
index=activity AND rg_functionality="Endpoint management systems" AND requesturl NOT NULL AND (requesturl CONTAINS "a-ad-tml.ntp-update.com" OR requesturl CONTAINS "rps-a.ntp-update.com" OR requesturl CONTAINS "a-rps.ntp-update.com" OR requesturl CONTAINS "dns-a.ntp-update.com" OR requesturl CONTAINS "a-tb.ntp-update.com" OR requesturl CONTAINS "alast.sun-java.com" OR requesturl CONTAINS "alast.ntp-update.com" OR requesturl CONTAINS "dell-a.ntp-update.com" OR requesturl CONTAINS "a-sp-rps.0g6666.com" OR requesturl CONTAINS "windows.javaupdate-cdn.com" OR requesturl CONTAINS "javaupdatecdn.com" OR requesturl CONTAINS "flash.javaupdate-cdn.com" OR requesturl CONTAINS "linux.ntp-update.com" OR requesturl CONTAINS "esxi-lty.ntp-update.com" OR requesturl CONTAINS "windows.0g6666.com" OR requesturl CONTAINS "ubuntu-ndi.ntp-update.com" OR requesturl CONTAINS "h1.xpjpz400.com" OR requesturl CONTAINS "cg.xpjpz400.com" OR requesturl CONTAINS "letsencrypt.msupdatesync.com" OR requesturl CONTAINS "cloud.ntp-update.com" OR requesturl CONTAINS "fe.ntp-update.com" OR requesturl CONTAINS "wtech.ntp-update.com" OR requesturl CONTAINS "imp.ntp-update.com" OR requesturl CONTAINS "ogplus.ntp-update.com" OR requesturl CONTAINS "organization.0g6666.com" OR requesturl CONTAINS "global.ntp-update.com" OR requesturl CONTAINS "kaiy.0g6666.com" OR requesturl CONTAINS "kaiy.ntp-update.com" OR requesturl CONTAINS "ky.0g6666.com" OR requesturl CONTAINS "oriental.ntp-update.com" OR requesturl CONTAINS "guard.ntp-update.com" OR requesturl CONTAINS "oglive.ntp-update.com" OR requesturl CONTAINS "guard.0g6666.com" OR requesturl CONTAINS "plus.ntp-update.com" OR requesturl CONTAINS "oglty.0g6666.com" OR requesturl CONTAINS "oglty.ntp-update.com" OR requesturl CONTAINS "oglty-ml.ntp-update.com" OR requesturl CONTAINS "ml-lty.ntp-update.com" OR requesturl CONTAINS "telegram.ntp-update.com" OR requesturl CONTAINS "easyh.ntp-update.com" OR requesturl CONTAINS "weblog.ntp-update.com" OR requesturl CONTAINS "weblog-ml.ntp-update.com" OR requesturl CONTAINS "o-fsh.ntp-update.com" OR requesturl CONTAINS "idn-tb.ntp-update.com" OR requesturl CONTAINS "tb-ndi2.ntp-update.com" OR requesturl CONTAINS "ml-ndi.ntp-update.com" OR requesturl CONTAINS "vct.0g6666.com" OR requesturl CONTAINS "windows-i-tb.ntp-update.com" OR requesturl CONTAINS "windows-qc-tb-i.ntp-update.com" OR requesturl CONTAINS "windows-tb-i.ntp-update.com")
index=activity AND rg_functionality="Endpoint management systems" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "a-fms.ntp-update.com" OR destinationhostname CONTAINS "plus.0g6666.com" OR destinationhostname CONTAINS "aprotect.sun-java.com" OR destinationhostname CONTAINS "og8888.0g6666.com" OR destinationhostname CONTAINS "adobe.javaupdate-cdn.com" OR destinationhostname CONTAINS "linux.0g6666.com" OR destinationhostname CONTAINS "ad.ntp-update.com" OR destinationhostname CONTAINS "www.0g6666.com" OR destinationhostname CONTAINS "wt.ntp-update.com" OR destinationhostname CONTAINS "aliyun.ntp-update.com")
index=activity AND rg_functionality="Endpoint management systems" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "a-fms.ntp-update.com" OR sourcentdomain CONTAINS "plus.0g6666.com" OR sourcentdomain CONTAINS "aprotect.sun-java.com" OR sourcentdomain CONTAINS "og8888.0g6666.com" OR sourcentdomain CONTAINS "adobe.javaupdate-cdn.com" OR sourcentdomain CONTAINS "linux.0g6666.com" OR sourcentdomain CONTAINS "ad.ntp-update.com" OR sourcentdomain CONTAINS "www.0g6666.com" OR sourcentdomain CONTAINS "wt.ntp-update.com" OR sourcentdomain CONTAINS "aliyun.ntp-update.com")
index=activity AND rg_functionality="Endpoint management systems" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "a-fms.ntp-update.com" OR sourcehostname CONTAINS "plus.0g6666.com" OR sourcehostname CONTAINS "aprotect.sun-java.com" OR sourcehostname CONTAINS "og8888.0g6666.com" OR sourcehostname CONTAINS "adobe.javaupdate-cdn.com" OR sourcehostname CONTAINS "linux.0g6666.com" OR sourcehostname CONTAINS "ad.ntp-update.com" OR sourcehostname CONTAINS "www.0g6666.com" OR sourcehostname CONTAINS "wt.ntp-update.com" OR sourcehostname CONTAINS "aliyun.ntp-update.com")
index=activity AND rg_functionality="Endpoint management systems" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "a-fms.ntp-update.com" OR destinationntdomain CONTAINS "plus.0g6666.com" OR destinationntdomain CONTAINS "aprotect.sun-java.com" OR destinationntdomain CONTAINS "og8888.0g6666.com" OR destinationntdomain CONTAINS "adobe.javaupdate-cdn.com" OR destinationntdomain CONTAINS "linux.0g6666.com" OR destinationntdomain CONTAINS "ad.ntp-update.com" OR destinationntdomain CONTAINS "www.0g6666.com" OR destinationntdomain CONTAINS "wt.ntp-update.com" OR destinationntdomain CONTAINS "aliyun.ntp-update.com")
index=activity AND rg_functionality="Endpoint management systems" AND requesturl NOT NULL AND (requesturl CONTAINS "a-fms.ntp-update.com" OR requesturl CONTAINS "plus.0g6666.com" OR requesturl CONTAINS "aprotect.sun-java.com" OR requesturl CONTAINS "og8888.0g6666.com" OR requesturl CONTAINS "adobe.javaupdate-cdn.com" OR requesturl CONTAINS "linux.0g6666.com" OR requesturl CONTAINS "ad.ntp-update.com" OR requesturl CONTAINS "www.0g6666.com" OR requesturl CONTAINS "wt.ntp-update.com" OR requesturl CONTAINS "aliyun.ntp-update.com")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "a-ad-tml.ntp-update.com" OR destinationhostname CONTAINS "rps-a.ntp-update.com" OR destinationhostname CONTAINS "a-rps.ntp-update.com" OR destinationhostname CONTAINS "dns-a.ntp-update.com" OR destinationhostname CONTAINS "a-tb.ntp-update.com" OR destinationhostname CONTAINS "alast.sun-java.com" OR destinationhostname CONTAINS "alast.ntp-update.com" OR destinationhostname CONTAINS "dell-a.ntp-update.com" OR destinationhostname CONTAINS "a-sp-rps.0g6666.com" OR destinationhostname CONTAINS "windows.javaupdate-cdn.com" OR destinationhostname CONTAINS "javaupdatecdn.com" OR destinationhostname CONTAINS "flash.javaupdate-cdn.com" OR destinationhostname CONTAINS "linux.ntp-update.com" OR destinationhostname CONTAINS "esxi-lty.ntp-update.com" OR destinationhostname CONTAINS "windows.0g6666.com" OR destinationhostname CONTAINS "ubuntu-ndi.ntp-update.com" OR destinationhostname CONTAINS "h1.xpjpz400.com" OR destinationhostname CONTAINS "cg.xpjpz400.com" OR destinationhostname CONTAINS "letsencrypt.msupdatesync.com" OR destinationhostname CONTAINS "cloud.ntp-update.com" OR destinationhostname CONTAINS "fe.ntp-update.com" OR destinationhostname CONTAINS "wtech.ntp-update.com" OR destinationhostname CONTAINS "imp.ntp-update.com" OR destinationhostname CONTAINS "ogplus.ntp-update.com" OR destinationhostname CONTAINS "organization.0g6666.com" OR destinationhostname CONTAINS "global.ntp-update.com" OR destinationhostname CONTAINS "kaiy.0g6666.com" OR destinationhostname CONTAINS "kaiy.ntp-update.com" OR destinationhostname CONTAINS "ky.0g6666.com" OR destinationhostname CONTAINS "oriental.ntp-update.com" OR destinationhostname CONTAINS "guard.ntp-update.com" OR destinationhostname CONTAINS "oglive.ntp-update.com" OR destinationhostname CONTAINS "guard.0g6666.com" OR destinationhostname CONTAINS "plus.ntp-update.com" OR destinationhostname CONTAINS "oglty.0g6666.com" OR destinationhostname CONTAINS "oglty.ntp-update.com" OR destinationhostname CONTAINS "oglty-ml.ntp-update.com" OR destinationhostname CONTAINS "ml-lty.ntp-update.com" OR destinationhostname CONTAINS "telegram.ntp-update.com" OR destinationhostname CONTAINS "easyh.ntp-update.com" OR destinationhostname CONTAINS "weblog.ntp-update.com" OR destinationhostname CONTAINS "weblog-ml.ntp-update.com" OR destinationhostname CONTAINS "o-fsh.ntp-update.com" OR destinationhostname CONTAINS "idn-tb.ntp-update.com" OR destinationhostname CONTAINS "tb-ndi2.ntp-update.com" OR destinationhostname CONTAINS "ml-ndi.ntp-update.com" OR destinationhostname CONTAINS "vct.0g6666.com" OR destinationhostname CONTAINS "windows-i-tb.ntp-update.com" OR destinationhostname CONTAINS "windows-qc-tb-i.ntp-update.com" OR destinationhostname CONTAINS "windows-tb-i.ntp-update.com")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "a-ad-tml.ntp-update.com" OR sourcentdomain CONTAINS "rps-a.ntp-update.com" OR sourcentdomain CONTAINS "a-rps.ntp-update.com" OR sourcentdomain CONTAINS "dns-a.ntp-update.com" OR sourcentdomain CONTAINS "a-tb.ntp-update.com" OR sourcentdomain CONTAINS "alast.sun-java.com" OR sourcentdomain CONTAINS "alast.ntp-update.com" OR sourcentdomain CONTAINS "dell-a.ntp-update.com" OR sourcentdomain CONTAINS "a-sp-rps.0g6666.com" OR sourcentdomain CONTAINS "windows.javaupdate-cdn.com" OR sourcentdomain CONTAINS "javaupdatecdn.com" OR sourcentdomain CONTAINS "flash.javaupdate-cdn.com" OR sourcentdomain CONTAINS "linux.ntp-update.com" OR sourcentdomain CONTAINS "esxi-lty.ntp-update.com" OR sourcentdomain CONTAINS "windows.0g6666.com" OR sourcentdomain CONTAINS "ubuntu-ndi.ntp-update.com" OR sourcentdomain CONTAINS "h1.xpjpz400.com" OR sourcentdomain CONTAINS "cg.xpjpz400.com" OR sourcentdomain CONTAINS "letsencrypt.msupdatesync.com" OR sourcentdomain CONTAINS "cloud.ntp-update.com" OR sourcentdomain CONTAINS "fe.ntp-update.com" OR sourcentdomain CONTAINS "wtech.ntp-update.com" OR sourcentdomain CONTAINS "imp.ntp-update.com" OR sourcentdomain CONTAINS "ogplus.ntp-update.com" OR sourcentdomain CONTAINS "organization.0g6666.com" OR sourcentdomain CONTAINS "global.ntp-update.com" OR sourcentdomain CONTAINS "kaiy.0g6666.com" OR sourcentdomain CONTAINS "kaiy.ntp-update.com" OR sourcentdomain CONTAINS "ky.0g6666.com" OR sourcentdomain CONTAINS "oriental.ntp-update.com" OR sourcentdomain CONTAINS "guard.ntp-update.com" OR sourcentdomain CONTAINS "oglive.ntp-update.com" OR sourcentdomain CONTAINS "guard.0g6666.com" OR sourcentdomain CONTAINS "plus.ntp-update.com" OR sourcentdomain CONTAINS "oglty.0g6666.com" OR sourcentdomain CONTAINS "oglty.ntp-update.com" OR sourcentdomain CONTAINS "oglty-ml.ntp-update.com" OR sourcentdomain CONTAINS "ml-lty.ntp-update.com" OR sourcentdomain CONTAINS "telegram.ntp-update.com" OR sourcentdomain CONTAINS "easyh.ntp-update.com" OR sourcentdomain CONTAINS "weblog.ntp-update.com" OR sourcentdomain CONTAINS "weblog-ml.ntp-update.com" OR sourcentdomain CONTAINS "o-fsh.ntp-update.com" OR sourcentdomain CONTAINS "idn-tb.ntp-update.com" OR sourcentdomain CONTAINS "tb-ndi2.ntp-update.com" OR sourcentdomain CONTAINS "ml-ndi.ntp-update.com" OR sourcentdomain CONTAINS "vct.0g6666.com" OR sourcentdomain CONTAINS "windows-i-tb.ntp-update.com" OR sourcentdomain CONTAINS "windows-qc-tb-i.ntp-update.com" OR sourcentdomain CONTAINS "windows-tb-i.ntp-update.com")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "a-ad-tml.ntp-update.com" OR sourcehostname CONTAINS "rps-a.ntp-update.com" OR sourcehostname CONTAINS "a-rps.ntp-update.com" OR sourcehostname CONTAINS "dns-a.ntp-update.com" OR sourcehostname CONTAINS "a-tb.ntp-update.com" OR sourcehostname CONTAINS "alast.sun-java.com" OR sourcehostname CONTAINS "alast.ntp-update.com" OR sourcehostname CONTAINS "dell-a.ntp-update.com" OR sourcehostname CONTAINS "a-sp-rps.0g6666.com" OR sourcehostname CONTAINS "windows.javaupdate-cdn.com" OR sourcehostname CONTAINS "javaupdatecdn.com" OR sourcehostname CONTAINS "flash.javaupdate-cdn.com" OR sourcehostname CONTAINS "linux.ntp-update.com" OR sourcehostname CONTAINS "esxi-lty.ntp-update.com" OR sourcehostname CONTAINS "windows.0g6666.com" OR sourcehostname CONTAINS "ubuntu-ndi.ntp-update.com" OR sourcehostname CONTAINS "h1.xpjpz400.com" OR sourcehostname CONTAINS "cg.xpjpz400.com" OR sourcehostname CONTAINS "letsencrypt.msupdatesync.com" OR sourcehostname CONTAINS "cloud.ntp-update.com" OR sourcehostname CONTAINS "fe.ntp-update.com" OR sourcehostname CONTAINS "wtech.ntp-update.com" OR sourcehostname CONTAINS "imp.ntp-update.com" OR sourcehostname CONTAINS "ogplus.ntp-update.com" OR sourcehostname CONTAINS "organization.0g6666.com" OR sourcehostname CONTAINS "global.ntp-update.com" OR sourcehostname CONTAINS "kaiy.0g6666.com" OR sourcehostname CONTAINS "kaiy.ntp-update.com" OR sourcehostname CONTAINS "ky.0g6666.com" OR sourcehostname CONTAINS "oriental.ntp-update.com" OR sourcehostname CONTAINS "guard.ntp-update.com" OR sourcehostname CONTAINS "oglive.ntp-update.com" OR sourcehostname CONTAINS "guard.0g6666.com" OR sourcehostname CONTAINS "plus.ntp-update.com" OR sourcehostname CONTAINS "oglty.0g6666.com" OR sourcehostname CONTAINS "oglty.ntp-update.com" OR sourcehostname CONTAINS "oglty-ml.ntp-update.com" OR sourcehostname CONTAINS "ml-lty.ntp-update.com" OR sourcehostname CONTAINS "telegram.ntp-update.com" OR sourcehostname CONTAINS "easyh.ntp-update.com" OR sourcehostname CONTAINS "weblog.ntp-update.com" OR sourcehostname CONTAINS "weblog-ml.ntp-update.com" OR sourcehostname CONTAINS "o-fsh.ntp-update.com" OR sourcehostname CONTAINS "idn-tb.ntp-update.com" OR sourcehostname CONTAINS "tb-ndi2.ntp-update.com" OR sourcehostname CONTAINS "ml-ndi.ntp-update.com" OR sourcehostname CONTAINS "vct.0g6666.com" OR sourcehostname CONTAINS "windows-i-tb.ntp-update.com" OR sourcehostname CONTAINS "windows-qc-tb-i.ntp-update.com" OR sourcehostname CONTAINS "windows-tb-i.ntp-update.com")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "a-ad-tml.ntp-update.com" OR destinationntdomain CONTAINS "rps-a.ntp-update.com" OR destinationntdomain CONTAINS "a-rps.ntp-update.com" OR destinationntdomain CONTAINS "dns-a.ntp-update.com" OR destinationntdomain CONTAINS "a-tb.ntp-update.com" OR destinationntdomain CONTAINS "alast.sun-java.com" OR destinationntdomain CONTAINS "alast.ntp-update.com" OR destinationntdomain CONTAINS "dell-a.ntp-update.com" OR destinationntdomain CONTAINS "a-sp-rps.0g6666.com" OR destinationntdomain CONTAINS "windows.javaupdate-cdn.com" OR destinationntdomain CONTAINS "javaupdatecdn.com" OR destinationntdomain CONTAINS "flash.javaupdate-cdn.com" OR destinationntdomain CONTAINS "linux.ntp-update.com" OR destinationntdomain CONTAINS "esxi-lty.ntp-update.com" OR destinationntdomain CONTAINS "windows.0g6666.com" OR destinationntdomain CONTAINS "ubuntu-ndi.ntp-update.com" OR destinationntdomain CONTAINS "h1.xpjpz400.com" OR destinationntdomain CONTAINS "cg.xpjpz400.com" OR destinationntdomain CONTAINS "letsencrypt.msupdatesync.com" OR destinationntdomain CONTAINS "cloud.ntp-update.com" OR destinationntdomain CONTAINS "fe.ntp-update.com" OR destinationntdomain CONTAINS "wtech.ntp-update.com" OR destinationntdomain CONTAINS "imp.ntp-update.com" OR destinationntdomain CONTAINS "ogplus.ntp-update.com" OR destinationntdomain CONTAINS "organization.0g6666.com" OR destinationntdomain CONTAINS "global.ntp-update.com" OR destinationntdomain CONTAINS "kaiy.0g6666.com" OR destinationntdomain CONTAINS "kaiy.ntp-update.com" OR destinationntdomain CONTAINS "ky.0g6666.com" OR destinationntdomain CONTAINS "oriental.ntp-update.com" OR destinationntdomain CONTAINS "guard.ntp-update.com" OR destinationntdomain CONTAINS "oglive.ntp-update.com" OR destinationntdomain CONTAINS "guard.0g6666.com" OR destinationntdomain CONTAINS "plus.ntp-update.com" OR destinationntdomain CONTAINS "oglty.0g6666.com" OR destinationntdomain CONTAINS "oglty.ntp-update.com" OR destinationntdomain CONTAINS "oglty-ml.ntp-update.com" OR destinationntdomain CONTAINS "ml-lty.ntp-update.com" OR destinationntdomain CONTAINS "telegram.ntp-update.com" OR destinationntdomain CONTAINS "easyh.ntp-update.com" OR destinationntdomain CONTAINS "weblog.ntp-update.com" OR destinationntdomain CONTAINS "weblog-ml.ntp-update.com" OR destinationntdomain CONTAINS "o-fsh.ntp-update.com" OR destinationntdomain CONTAINS "idn-tb.ntp-update.com" OR destinationntdomain CONTAINS "tb-ndi2.ntp-update.com" OR destinationntdomain CONTAINS "ml-ndi.ntp-update.com" OR destinationntdomain CONTAINS "vct.0g6666.com" OR destinationntdomain CONTAINS "windows-i-tb.ntp-update.com" OR destinationntdomain CONTAINS "windows-qc-tb-i.ntp-update.com" OR destinationntdomain CONTAINS "windows-tb-i.ntp-update.com")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND requesturl NOT NULL AND (requesturl CONTAINS "a-ad-tml.ntp-update.com" OR requesturl CONTAINS "rps-a.ntp-update.com" OR requesturl CONTAINS "a-rps.ntp-update.com" OR requesturl CONTAINS "dns-a.ntp-update.com" OR requesturl CONTAINS "a-tb.ntp-update.com" OR requesturl CONTAINS "alast.sun-java.com" OR requesturl CONTAINS "alast.ntp-update.com" OR requesturl CONTAINS "dell-a.ntp-update.com" OR requesturl CONTAINS "a-sp-rps.0g6666.com" OR requesturl CONTAINS "windows.javaupdate-cdn.com" OR requesturl CONTAINS "javaupdatecdn.com" OR requesturl CONTAINS "flash.javaupdate-cdn.com" OR requesturl CONTAINS "linux.ntp-update.com" OR requesturl CONTAINS "esxi-lty.ntp-update.com" OR requesturl CONTAINS "windows.0g6666.com" OR requesturl CONTAINS "ubuntu-ndi.ntp-update.com" OR requesturl CONTAINS "h1.xpjpz400.com" OR requesturl CONTAINS "cg.xpjpz400.com" OR requesturl CONTAINS "letsencrypt.msupdatesync.com" OR requesturl CONTAINS "cloud.ntp-update.com" OR requesturl CONTAINS "fe.ntp-update.com" OR requesturl CONTAINS "wtech.ntp-update.com" OR requesturl CONTAINS "imp.ntp-update.com" OR requesturl CONTAINS "ogplus.ntp-update.com" OR requesturl CONTAINS "organization.0g6666.com" OR requesturl CONTAINS "global.ntp-update.com" OR requesturl CONTAINS "kaiy.0g6666.com" OR requesturl CONTAINS "kaiy.ntp-update.com" OR requesturl CONTAINS "ky.0g6666.com" OR requesturl CONTAINS "oriental.ntp-update.com" OR requesturl CONTAINS "guard.ntp-update.com" OR requesturl CONTAINS "oglive.ntp-update.com" OR requesturl CONTAINS "guard.0g6666.com" OR requesturl CONTAINS "plus.ntp-update.com" OR requesturl CONTAINS "oglty.0g6666.com" OR requesturl CONTAINS "oglty.ntp-update.com" OR requesturl CONTAINS "oglty-ml.ntp-update.com" OR requesturl CONTAINS "ml-lty.ntp-update.com" OR requesturl CONTAINS "telegram.ntp-update.com" OR requesturl CONTAINS "easyh.ntp-update.com" OR requesturl CONTAINS "weblog.ntp-update.com" OR requesturl CONTAINS "weblog-ml.ntp-update.com" OR requesturl CONTAINS "o-fsh.ntp-update.com" OR requesturl CONTAINS "idn-tb.ntp-update.com" OR requesturl CONTAINS "tb-ndi2.ntp-update.com" OR requesturl CONTAINS "ml-ndi.ntp-update.com" OR requesturl CONTAINS "vct.0g6666.com" OR requesturl CONTAINS "windows-i-tb.ntp-update.com" OR requesturl CONTAINS "windows-qc-tb-i.ntp-update.com" OR requesturl CONTAINS "windows-tb-i.ntp-update.com")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "a-fms.ntp-update.com" OR destinationhostname CONTAINS "plus.0g6666.com" OR destinationhostname CONTAINS "aprotect.sun-java.com" OR destinationhostname CONTAINS "og8888.0g6666.com" OR destinationhostname CONTAINS "adobe.javaupdate-cdn.com" OR destinationhostname CONTAINS "linux.0g6666.com" OR destinationhostname CONTAINS "ad.ntp-update.com" OR destinationhostname CONTAINS "www.0g6666.com" OR destinationhostname CONTAINS "wt.ntp-update.com" OR destinationhostname CONTAINS "aliyun.ntp-update.com")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "a-fms.ntp-update.com" OR sourcentdomain CONTAINS "plus.0g6666.com" OR sourcentdomain CONTAINS "aprotect.sun-java.com" OR sourcentdomain CONTAINS "og8888.0g6666.com" OR sourcentdomain CONTAINS "adobe.javaupdate-cdn.com" OR sourcentdomain CONTAINS "linux.0g6666.com" OR sourcentdomain CONTAINS "ad.ntp-update.com" OR sourcentdomain CONTAINS "www.0g6666.com" OR sourcentdomain CONTAINS "wt.ntp-update.com" OR sourcentdomain CONTAINS "aliyun.ntp-update.com")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "a-fms.ntp-update.com" OR sourcehostname CONTAINS "plus.0g6666.com" OR sourcehostname CONTAINS "aprotect.sun-java.com" OR sourcehostname CONTAINS "og8888.0g6666.com" OR sourcehostname CONTAINS "adobe.javaupdate-cdn.com" OR sourcehostname CONTAINS "linux.0g6666.com" OR sourcehostname CONTAINS "ad.ntp-update.com" OR sourcehostname CONTAINS "www.0g6666.com" OR sourcehostname CONTAINS "wt.ntp-update.com" OR sourcehostname CONTAINS "aliyun.ntp-update.com")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "a-fms.ntp-update.com" OR destinationntdomain CONTAINS "plus.0g6666.com" OR destinationntdomain CONTAINS "aprotect.sun-java.com" OR destinationntdomain CONTAINS "og8888.0g6666.com" OR destinationntdomain CONTAINS "adobe.javaupdate-cdn.com" OR destinationntdomain CONTAINS "linux.0g6666.com" OR destinationntdomain CONTAINS "ad.ntp-update.com" OR destinationntdomain CONTAINS "www.0g6666.com" OR destinationntdomain CONTAINS "wt.ntp-update.com" OR destinationntdomain CONTAINS "aliyun.ntp-update.com")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND requesturl NOT NULL AND (requesturl CONTAINS "a-fms.ntp-update.com" OR requesturl CONTAINS "plus.0g6666.com" OR requesturl CONTAINS "aprotect.sun-java.com" OR requesturl CONTAINS "og8888.0g6666.com" OR requesturl CONTAINS "adobe.javaupdate-cdn.com" OR requesturl CONTAINS "linux.0g6666.com" OR requesturl CONTAINS "ad.ntp-update.com" OR requesturl CONTAINS "www.0g6666.com" OR requesturl CONTAINS "wt.ntp-update.com" OR requesturl CONTAINS "aliyun.ntp-update.com")
index=activity AND rg_functionality="Cloud Application Audit" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "a-ad-tml.ntp-update.com" OR destinationhostname CONTAINS "rps-a.ntp-update.com" OR destinationhostname CONTAINS "a-rps.ntp-update.com" OR destinationhostname CONTAINS "dns-a.ntp-update.com" OR destinationhostname CONTAINS "a-tb.ntp-update.com" OR destinationhostname CONTAINS "alast.sun-java.com" OR destinationhostname CONTAINS "alast.ntp-update.com" OR destinationhostname CONTAINS "dell-a.ntp-update.com" OR destinationhostname CONTAINS "a-sp-rps.0g6666.com" OR destinationhostname CONTAINS "windows.javaupdate-cdn.com" OR destinationhostname CONTAINS "javaupdatecdn.com" OR destinationhostname CONTAINS "flash.javaupdate-cdn.com" OR destinationhostname CONTAINS "linux.ntp-update.com" OR destinationhostname CONTAINS "esxi-lty.ntp-update.com" OR destinationhostname CONTAINS "windows.0g6666.com" OR destinationhostname CONTAINS "ubuntu-ndi.ntp-update.com" OR destinationhostname CONTAINS "h1.xpjpz400.com" OR destinationhostname CONTAINS "cg.xpjpz400.com" OR destinationhostname CONTAINS "letsencrypt.msupdatesync.com" OR destinationhostname CONTAINS "cloud.ntp-update.com" OR destinationhostname CONTAINS "fe.ntp-update.com" OR destinationhostname CONTAINS "wtech.ntp-update.com" OR destinationhostname CONTAINS "imp.ntp-update.com" OR destinationhostname CONTAINS "ogplus.ntp-update.com" OR destinationhostname CONTAINS "organization.0g6666.com" OR destinationhostname CONTAINS "global.ntp-update.com" OR destinationhostname CONTAINS "kaiy.0g6666.com" OR destinationhostname CONTAINS "kaiy.ntp-update.com" OR destinationhostname CONTAINS "ky.0g6666.com" OR destinationhostname CONTAINS "oriental.ntp-update.com" OR destinationhostname CONTAINS "guard.ntp-update.com" OR destinationhostname CONTAINS "oglive.ntp-update.com" OR destinationhostname CONTAINS "guard.0g6666.com" OR destinationhostname CONTAINS "plus.ntp-update.com" OR destinationhostname CONTAINS "oglty.0g6666.com" OR destinationhostname CONTAINS "oglty.ntp-update.com" OR destinationhostname CONTAINS "oglty-ml.ntp-update.com" OR destinationhostname CONTAINS "ml-lty.ntp-update.com" OR destinationhostname CONTAINS "telegram.ntp-update.com" OR destinationhostname CONTAINS "easyh.ntp-update.com" OR destinationhostname CONTAINS "weblog.ntp-update.com" OR destinationhostname CONTAINS "weblog-ml.ntp-update.com" OR destinationhostname CONTAINS "o-fsh.ntp-update.com" OR destinationhostname CONTAINS "idn-tb.ntp-update.com" OR destinationhostname CONTAINS "tb-ndi2.ntp-update.com" OR destinationhostname CONTAINS "ml-ndi.ntp-update.com" OR destinationhostname CONTAINS "vct.0g6666.com" OR destinationhostname CONTAINS "windows-i-tb.ntp-update.com" OR destinationhostname CONTAINS "windows-qc-tb-i.ntp-update.com" OR destinationhostname CONTAINS "windows-tb-i.ntp-update.com")
index=activity AND rg_functionality="Cloud Application Audit" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "a-ad-tml.ntp-update.com" OR sourcentdomain CONTAINS "rps-a.ntp-update.com" OR sourcentdomain CONTAINS "a-rps.ntp-update.com" OR sourcentdomain CONTAINS "dns-a.ntp-update.com" OR sourcentdomain CONTAINS "a-tb.ntp-update.com" OR sourcentdomain CONTAINS "alast.sun-java.com" OR sourcentdomain CONTAINS "alast.ntp-update.com" OR sourcentdomain CONTAINS "dell-a.ntp-update.com" OR sourcentdomain CONTAINS "a-sp-rps.0g6666.com" OR sourcentdomain CONTAINS "windows.javaupdate-cdn.com" OR sourcentdomain CONTAINS "javaupdatecdn.com" OR sourcentdomain CONTAINS "flash.javaupdate-cdn.com" OR sourcentdomain CONTAINS "linux.ntp-update.com" OR sourcentdomain CONTAINS "esxi-lty.ntp-update.com" OR sourcentdomain CONTAINS "windows.0g6666.com" OR sourcentdomain CONTAINS "ubuntu-ndi.ntp-update.com" OR sourcentdomain CONTAINS "h1.xpjpz400.com" OR sourcentdomain CONTAINS "cg.xpjpz400.com" OR sourcentdomain CONTAINS "letsencrypt.msupdatesync.com" OR sourcentdomain CONTAINS "cloud.ntp-update.com" OR sourcentdomain CONTAINS "fe.ntp-update.com" OR sourcentdomain CONTAINS "wtech.ntp-update.com" OR sourcentdomain CONTAINS "imp.ntp-update.com" OR sourcentdomain CONTAINS "ogplus.ntp-update.com" OR sourcentdomain CONTAINS "organization.0g6666.com" OR sourcentdomain CONTAINS "global.ntp-update.com" OR sourcentdomain CONTAINS "kaiy.0g6666.com" OR sourcentdomain CONTAINS "kaiy.ntp-update.com" OR sourcentdomain CONTAINS "ky.0g6666.com" OR sourcentdomain CONTAINS "oriental.ntp-update.com" OR sourcentdomain CONTAINS "guard.ntp-update.com" OR sourcentdomain CONTAINS "oglive.ntp-update.com" OR sourcentdomain CONTAINS "guard.0g6666.com" OR sourcentdomain CONTAINS "plus.ntp-update.com" OR sourcentdomain CONTAINS "oglty.0g6666.com" OR sourcentdomain CONTAINS "oglty.ntp-update.com" OR sourcentdomain CONTAINS "oglty-ml.ntp-update.com" OR sourcentdomain CONTAINS "ml-lty.ntp-update.com" OR sourcentdomain CONTAINS "telegram.ntp-update.com" OR sourcentdomain CONTAINS "easyh.ntp-update.com" OR sourcentdomain CONTAINS "weblog.ntp-update.com" OR sourcentdomain CONTAINS "weblog-ml.ntp-update.com" OR sourcentdomain CONTAINS "o-fsh.ntp-update.com" OR sourcentdomain CONTAINS "idn-tb.ntp-update.com" OR sourcentdomain CONTAINS "tb-ndi2.ntp-update.com" OR sourcentdomain CONTAINS "ml-ndi.ntp-update.com" OR sourcentdomain CONTAINS "vct.0g6666.com" OR sourcentdomain CONTAINS "windows-i-tb.ntp-update.com" OR sourcentdomain CONTAINS "windows-qc-tb-i.ntp-update.com" OR sourcentdomain CONTAINS "windows-tb-i.ntp-update.com")
index=activity AND rg_functionality="Cloud Application Audit" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "a-ad-tml.ntp-update.com" OR sourcehostname CONTAINS "rps-a.ntp-update.com" OR sourcehostname CONTAINS "a-rps.ntp-update.com" OR sourcehostname CONTAINS "dns-a.ntp-update.com" OR sourcehostname CONTAINS "a-tb.ntp-update.com" OR sourcehostname CONTAINS "alast.sun-java.com" OR sourcehostname CONTAINS "alast.ntp-update.com" OR sourcehostname CONTAINS "dell-a.ntp-update.com" OR sourcehostname CONTAINS "a-sp-rps.0g6666.com" OR sourcehostname CONTAINS "windows.javaupdate-cdn.com" OR sourcehostname CONTAINS "javaupdatecdn.com" OR sourcehostname CONTAINS "flash.javaupdate-cdn.com" OR sourcehostname CONTAINS "linux.ntp-update.com" OR sourcehostname CONTAINS "esxi-lty.ntp-update.com" OR sourcehostname CONTAINS "windows.0g6666.com" OR sourcehostname CONTAINS "ubuntu-ndi.ntp-update.com" OR sourcehostname CONTAINS "h1.xpjpz400.com" OR sourcehostname CONTAINS "cg.xpjpz400.com" OR sourcehostname CONTAINS "letsencrypt.msupdatesync.com" OR sourcehostname CONTAINS "cloud.ntp-update.com" OR sourcehostname CONTAINS "fe.ntp-update.com" OR sourcehostname CONTAINS "wtech.ntp-update.com" OR sourcehostname CONTAINS "imp.ntp-update.com" OR sourcehostname CONTAINS "ogplus.ntp-update.com" OR sourcehostname CONTAINS "organization.0g6666.com" OR sourcehostname CONTAINS "global.ntp-update.com" OR sourcehostname CONTAINS "kaiy.0g6666.com" OR sourcehostname CONTAINS "kaiy.ntp-update.com" OR sourcehostname CONTAINS "ky.0g6666.com" OR sourcehostname CONTAINS "oriental.ntp-update.com" OR sourcehostname CONTAINS "guard.ntp-update.com" OR sourcehostname CONTAINS "oglive.ntp-update.com" OR sourcehostname CONTAINS "guard.0g6666.com" OR sourcehostname CONTAINS "plus.ntp-update.com" OR sourcehostname CONTAINS "oglty.0g6666.com" OR sourcehostname CONTAINS "oglty.ntp-update.com" OR sourcehostname CONTAINS "oglty-ml.ntp-update.com" OR sourcehostname CONTAINS "ml-lty.ntp-update.com" OR sourcehostname CONTAINS "telegram.ntp-update.com" OR sourcehostname CONTAINS "easyh.ntp-update.com" OR sourcehostname CONTAINS "weblog.ntp-update.com" OR sourcehostname CONTAINS "weblog-ml.ntp-update.com" OR sourcehostname CONTAINS "o-fsh.ntp-update.com" OR sourcehostname CONTAINS "idn-tb.ntp-update.com" OR sourcehostname CONTAINS "tb-ndi2.ntp-update.com" OR sourcehostname CONTAINS "ml-ndi.ntp-update.com" OR sourcehostname CONTAINS "vct.0g6666.com" OR sourcehostname CONTAINS "windows-i-tb.ntp-update.com" OR sourcehostname CONTAINS "windows-qc-tb-i.ntp-update.com" OR sourcehostname CONTAINS "windows-tb-i.ntp-update.com")
index=activity AND rg_functionality="Cloud Application Audit" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "a-ad-tml.ntp-update.com" OR destinationntdomain CONTAINS "rps-a.ntp-update.com" OR destinationntdomain CONTAINS "a-rps.ntp-update.com" OR destinationntdomain CONTAINS "dns-a.ntp-update.com" OR destinationntdomain CONTAINS "a-tb.ntp-update.com" OR destinationntdomain CONTAINS "alast.sun-java.com" OR destinationntdomain CONTAINS "alast.ntp-update.com" OR destinationntdomain CONTAINS "dell-a.ntp-update.com" OR destinationntdomain CONTAINS "a-sp-rps.0g6666.com" OR destinationntdomain CONTAINS "windows.javaupdate-cdn.com" OR destinationntdomain CONTAINS "javaupdatecdn.com" OR destinationntdomain CONTAINS "flash.javaupdate-cdn.com" OR destinationntdomain CONTAINS "linux.ntp-update.com" OR destinationntdomain CONTAINS "esxi-lty.ntp-update.com" OR destinationntdomain CONTAINS "windows.0g6666.com" OR destinationntdomain CONTAINS "ubuntu-ndi.ntp-update.com" OR destinationntdomain CONTAINS "h1.xpjpz400.com" OR destinationntdomain CONTAINS "cg.xpjpz400.com" OR destinationntdomain CONTAINS "letsencrypt.msupdatesync.com" OR destinationntdomain CONTAINS "cloud.ntp-update.com" OR destinationntdomain CONTAINS "fe.ntp-update.com" OR destinationntdomain CONTAINS "wtech.ntp-update.com" OR destinationntdomain CONTAINS "imp.ntp-update.com" OR destinationntdomain CONTAINS "ogplus.ntp-update.com" OR destinationntdomain CONTAINS "organization.0g6666.com" OR destinationntdomain CONTAINS "global.ntp-update.com" OR destinationntdomain CONTAINS "kaiy.0g6666.com" OR destinationntdomain CONTAINS "kaiy.ntp-update.com" OR destinationntdomain CONTAINS "ky.0g6666.com" OR destinationntdomain CONTAINS "oriental.ntp-update.com" OR destinationntdomain CONTAINS "guard.ntp-update.com" OR destinationntdomain CONTAINS "oglive.ntp-update.com" OR destinationntdomain CONTAINS "guard.0g6666.com" OR destinationntdomain CONTAINS "plus.ntp-update.com" OR destinationntdomain CONTAINS "oglty.0g6666.com" OR destinationntdomain CONTAINS "oglty.ntp-update.com" OR destinationntdomain CONTAINS "oglty-ml.ntp-update.com" OR destinationntdomain CONTAINS "ml-lty.ntp-update.com" OR destinationntdomain CONTAINS "telegram.ntp-update.com" OR destinationntdomain CONTAINS "easyh.ntp-update.com" OR destinationntdomain CONTAINS "weblog.ntp-update.com" OR destinationntdomain CONTAINS "weblog-ml.ntp-update.com" OR destinationntdomain CONTAINS "o-fsh.ntp-update.com" OR destinationntdomain CONTAINS "idn-tb.ntp-update.com" OR destinationntdomain CONTAINS "tb-ndi2.ntp-update.com" OR destinationntdomain CONTAINS "ml-ndi.ntp-update.com" OR destinationntdomain CONTAINS "vct.0g6666.com" OR destinationntdomain CONTAINS "windows-i-tb.ntp-update.com" OR destinationntdomain CONTAINS "windows-qc-tb-i.ntp-update.com" OR destinationntdomain CONTAINS "windows-tb-i.ntp-update.com")
index=activity AND rg_functionality="Cloud Application Audit" AND requesturl NOT NULL AND (requesturl CONTAINS "a-ad-tml.ntp-update.com" OR requesturl CONTAINS "rps-a.ntp-update.com" OR requesturl CONTAINS "a-rps.ntp-update.com" OR requesturl CONTAINS "dns-a.ntp-update.com" OR requesturl CONTAINS "a-tb.ntp-update.com" OR requesturl CONTAINS "alast.sun-java.com" OR requesturl CONTAINS "alast.ntp-update.com" OR requesturl CONTAINS "dell-a.ntp-update.com" OR requesturl CONTAINS "a-sp-rps.0g6666.com" OR requesturl CONTAINS "windows.javaupdate-cdn.com" OR requesturl CONTAINS "javaupdatecdn.com" OR requesturl CONTAINS "flash.javaupdate-cdn.com" OR requesturl CONTAINS "linux.ntp-update.com" OR requesturl CONTAINS "esxi-lty.ntp-update.com" OR requesturl CONTAINS "windows.0g6666.com" OR requesturl CONTAINS "ubuntu-ndi.ntp-update.com" OR requesturl CONTAINS "h1.xpjpz400.com" OR requesturl CONTAINS "cg.xpjpz400.com" OR requesturl CONTAINS "letsencrypt.msupdatesync.com" OR requesturl CONTAINS "cloud.ntp-update.com" OR requesturl CONTAINS "fe.ntp-update.com" OR requesturl CONTAINS "wtech.ntp-update.com" OR requesturl CONTAINS "imp.ntp-update.com" OR requesturl CONTAINS "ogplus.ntp-update.com" OR requesturl CONTAINS "organization.0g6666.com" OR requesturl CONTAINS "global.ntp-update.com" OR requesturl CONTAINS "kaiy.0g6666.com" OR requesturl CONTAINS "kaiy.ntp-update.com" OR requesturl CONTAINS "ky.0g6666.com" OR requesturl CONTAINS "oriental.ntp-update.com" OR requesturl CONTAINS "guard.ntp-update.com" OR requesturl CONTAINS "oglive.ntp-update.com" OR requesturl CONTAINS "guard.0g6666.com" OR requesturl CONTAINS "plus.ntp-update.com" OR requesturl CONTAINS "oglty.0g6666.com" OR requesturl CONTAINS "oglty.ntp-update.com" OR requesturl CONTAINS "oglty-ml.ntp-update.com" OR requesturl CONTAINS "ml-lty.ntp-update.com" OR requesturl CONTAINS "telegram.ntp-update.com" OR requesturl CONTAINS "easyh.ntp-update.com" OR requesturl CONTAINS "weblog.ntp-update.com" OR requesturl CONTAINS "weblog-ml.ntp-update.com" OR requesturl CONTAINS "o-fsh.ntp-update.com" OR requesturl CONTAINS "idn-tb.ntp-update.com" OR requesturl CONTAINS "tb-ndi2.ntp-update.com" OR requesturl CONTAINS "ml-ndi.ntp-update.com" OR requesturl CONTAINS "vct.0g6666.com" OR requesturl CONTAINS "windows-i-tb.ntp-update.com" OR requesturl CONTAINS "windows-qc-tb-i.ntp-update.com" OR requesturl CONTAINS "windows-tb-i.ntp-update.com")
index=activity AND rg_functionality="Cloud Application Audit" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "a-fms.ntp-update.com" OR destinationhostname CONTAINS "plus.0g6666.com" OR destinationhostname CONTAINS "aprotect.sun-java.com" OR destinationhostname CONTAINS "og8888.0g6666.com" OR destinationhostname CONTAINS "adobe.javaupdate-cdn.com" OR destinationhostname CONTAINS "linux.0g6666.com" OR destinationhostname CONTAINS "ad.ntp-update.com" OR destinationhostname CONTAINS "www.0g6666.com" OR destinationhostname CONTAINS "wt.ntp-update.com" OR destinationhostname CONTAINS "aliyun.ntp-update.com")
index=activity AND rg_functionality="Cloud Application Audit" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "a-fms.ntp-update.com" OR sourcentdomain CONTAINS "plus.0g6666.com" OR sourcentdomain CONTAINS "aprotect.sun-java.com" OR sourcentdomain CONTAINS "og8888.0g6666.com" OR sourcentdomain CONTAINS "adobe.javaupdate-cdn.com" OR sourcentdomain CONTAINS "linux.0g6666.com" OR sourcentdomain CONTAINS "ad.ntp-update.com" OR sourcentdomain CONTAINS "www.0g6666.com" OR sourcentdomain CONTAINS "wt.ntp-update.com" OR sourcentdomain CONTAINS "aliyun.ntp-update.com")
index=activity AND rg_functionality="Cloud Application Audit" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "a-fms.ntp-update.com" OR sourcehostname CONTAINS "plus.0g6666.com" OR sourcehostname CONTAINS "aprotect.sun-java.com" OR sourcehostname CONTAINS "og8888.0g6666.com" OR sourcehostname CONTAINS "adobe.javaupdate-cdn.com" OR sourcehostname CONTAINS "linux.0g6666.com" OR sourcehostname CONTAINS "ad.ntp-update.com" OR sourcehostname CONTAINS "www.0g6666.com" OR sourcehostname CONTAINS "wt.ntp-update.com" OR sourcehostname CONTAINS "aliyun.ntp-update.com")
index=activity AND rg_functionality="Cloud Application Audit" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "a-fms.ntp-update.com" OR destinationntdomain CONTAINS "plus.0g6666.com" OR destinationntdomain CONTAINS "aprotect.sun-java.com" OR destinationntdomain CONTAINS "og8888.0g6666.com" OR destinationntdomain CONTAINS "adobe.javaupdate-cdn.com" OR destinationntdomain CONTAINS "linux.0g6666.com" OR destinationntdomain CONTAINS "ad.ntp-update.com" OR destinationntdomain CONTAINS "www.0g6666.com" OR destinationntdomain CONTAINS "wt.ntp-update.com" OR destinationntdomain CONTAINS "aliyun.ntp-update.com")
index=activity AND rg_functionality="Cloud Application Audit" AND requesturl NOT NULL AND (requesturl CONTAINS "a-fms.ntp-update.com" OR requesturl CONTAINS "plus.0g6666.com" OR requesturl CONTAINS "aprotect.sun-java.com" OR requesturl CONTAINS "og8888.0g6666.com" OR requesturl CONTAINS "adobe.javaupdate-cdn.com" OR requesturl CONTAINS "linux.0g6666.com" OR requesturl CONTAINS "ad.ntp-update.com" OR requesturl CONTAINS "www.0g6666.com" OR requesturl CONTAINS "wt.ntp-update.com" OR requesturl CONTAINS "aliyun.ntp-update.com")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "a-ad-tml.ntp-update.com" OR destinationhostname CONTAINS "rps-a.ntp-update.com" OR destinationhostname CONTAINS "a-rps.ntp-update.com" OR destinationhostname CONTAINS "dns-a.ntp-update.com" OR destinationhostname CONTAINS "a-tb.ntp-update.com" OR destinationhostname CONTAINS "alast.sun-java.com" OR destinationhostname CONTAINS "alast.ntp-update.com" OR destinationhostname CONTAINS "dell-a.ntp-update.com" OR destinationhostname CONTAINS "a-sp-rps.0g6666.com" OR destinationhostname CONTAINS "windows.javaupdate-cdn.com" OR destinationhostname CONTAINS "javaupdatecdn.com" OR destinationhostname CONTAINS "flash.javaupdate-cdn.com" OR destinationhostname CONTAINS "linux.ntp-update.com" OR destinationhostname CONTAINS "esxi-lty.ntp-update.com" OR destinationhostname CONTAINS "windows.0g6666.com" OR destinationhostname CONTAINS "ubuntu-ndi.ntp-update.com" OR destinationhostname CONTAINS "h1.xpjpz400.com" OR destinationhostname CONTAINS "cg.xpjpz400.com" OR destinationhostname CONTAINS "letsencrypt.msupdatesync.com" OR destinationhostname CONTAINS "cloud.ntp-update.com" OR destinationhostname CONTAINS "fe.ntp-update.com" OR destinationhostname CONTAINS "wtech.ntp-update.com" OR destinationhostname CONTAINS "imp.ntp-update.com" OR destinationhostname CONTAINS "ogplus.ntp-update.com" OR destinationhostname CONTAINS "organization.0g6666.com" OR destinationhostname CONTAINS "global.ntp-update.com" OR destinationhostname CONTAINS "kaiy.0g6666.com" OR destinationhostname CONTAINS "kaiy.ntp-update.com" OR destinationhostname CONTAINS "ky.0g6666.com" OR destinationhostname CONTAINS "oriental.ntp-update.com" OR destinationhostname CONTAINS "guard.ntp-update.com" OR destinationhostname CONTAINS "oglive.ntp-update.com" OR destinationhostname CONTAINS "guard.0g6666.com" OR destinationhostname CONTAINS "plus.ntp-update.com" OR destinationhostname CONTAINS "oglty.0g6666.com" OR destinationhostname CONTAINS "oglty.ntp-update.com" OR destinationhostname CONTAINS "oglty-ml.ntp-update.com" OR destinationhostname CONTAINS "ml-lty.ntp-update.com" OR destinationhostname CONTAINS "telegram.ntp-update.com" OR destinationhostname CONTAINS "easyh.ntp-update.com" OR destinationhostname CONTAINS "weblog.ntp-update.com" OR destinationhostname CONTAINS "weblog-ml.ntp-update.com" OR destinationhostname CONTAINS "o-fsh.ntp-update.com" OR destinationhostname CONTAINS "idn-tb.ntp-update.com" OR destinationhostname CONTAINS "tb-ndi2.ntp-update.com" OR destinationhostname CONTAINS "ml-ndi.ntp-update.com" OR destinationhostname CONTAINS "vct.0g6666.com" OR destinationhostname CONTAINS "windows-i-tb.ntp-update.com" OR destinationhostname CONTAINS "windows-qc-tb-i.ntp-update.com" OR destinationhostname CONTAINS "windows-tb-i.ntp-update.com")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "a-ad-tml.ntp-update.com" OR sourcentdomain CONTAINS "rps-a.ntp-update.com" OR sourcentdomain CONTAINS "a-rps.ntp-update.com" OR sourcentdomain CONTAINS "dns-a.ntp-update.com" OR sourcentdomain CONTAINS "a-tb.ntp-update.com" OR sourcentdomain CONTAINS "alast.sun-java.com" OR sourcentdomain CONTAINS "alast.ntp-update.com" OR sourcentdomain CONTAINS "dell-a.ntp-update.com" OR sourcentdomain CONTAINS "a-sp-rps.0g6666.com" OR sourcentdomain CONTAINS "windows.javaupdate-cdn.com" OR sourcentdomain CONTAINS "javaupdatecdn.com" OR sourcentdomain CONTAINS "flash.javaupdate-cdn.com" OR sourcentdomain CONTAINS "linux.ntp-update.com" OR sourcentdomain CONTAINS "esxi-lty.ntp-update.com" OR sourcentdomain CONTAINS "windows.0g6666.com" OR sourcentdomain CONTAINS "ubuntu-ndi.ntp-update.com" OR sourcentdomain CONTAINS "h1.xpjpz400.com" OR sourcentdomain CONTAINS "cg.xpjpz400.com" OR sourcentdomain CONTAINS "letsencrypt.msupdatesync.com" OR sourcentdomain CONTAINS "cloud.ntp-update.com" OR sourcentdomain CONTAINS "fe.ntp-update.com" OR sourcentdomain CONTAINS "wtech.ntp-update.com" OR sourcentdomain CONTAINS "imp.ntp-update.com" OR sourcentdomain CONTAINS "ogplus.ntp-update.com" OR sourcentdomain CONTAINS "organization.0g6666.com" OR sourcentdomain CONTAINS "global.ntp-update.com" OR sourcentdomain CONTAINS "kaiy.0g6666.com" OR sourcentdomain CONTAINS "kaiy.ntp-update.com" OR sourcentdomain CONTAINS "ky.0g6666.com" OR sourcentdomain CONTAINS "oriental.ntp-update.com" OR sourcentdomain CONTAINS "guard.ntp-update.com" OR sourcentdomain CONTAINS "oglive.ntp-update.com" OR sourcentdomain CONTAINS "guard.0g6666.com" OR sourcentdomain CONTAINS "plus.ntp-update.com" OR sourcentdomain CONTAINS "oglty.0g6666.com" OR sourcentdomain CONTAINS "oglty.ntp-update.com" OR sourcentdomain CONTAINS "oglty-ml.ntp-update.com" OR sourcentdomain CONTAINS "ml-lty.ntp-update.com" OR sourcentdomain CONTAINS "telegram.ntp-update.com" OR sourcentdomain CONTAINS "easyh.ntp-update.com" OR sourcentdomain CONTAINS "weblog.ntp-update.com" OR sourcentdomain CONTAINS "weblog-ml.ntp-update.com" OR sourcentdomain CONTAINS "o-fsh.ntp-update.com" OR sourcentdomain CONTAINS "idn-tb.ntp-update.com" OR sourcentdomain CONTAINS "tb-ndi2.ntp-update.com" OR sourcentdomain CONTAINS "ml-ndi.ntp-update.com" OR sourcentdomain CONTAINS "vct.0g6666.com" OR sourcentdomain CONTAINS "windows-i-tb.ntp-update.com" OR sourcentdomain CONTAINS "windows-qc-tb-i.ntp-update.com" OR sourcentdomain CONTAINS "windows-tb-i.ntp-update.com")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "a-ad-tml.ntp-update.com" OR sourcehostname CONTAINS "rps-a.ntp-update.com" OR sourcehostname CONTAINS "a-rps.ntp-update.com" OR sourcehostname CONTAINS "dns-a.ntp-update.com" OR sourcehostname CONTAINS "a-tb.ntp-update.com" OR sourcehostname CONTAINS "alast.sun-java.com" OR sourcehostname CONTAINS "alast.ntp-update.com" OR sourcehostname CONTAINS "dell-a.ntp-update.com" OR sourcehostname CONTAINS "a-sp-rps.0g6666.com" OR sourcehostname CONTAINS "windows.javaupdate-cdn.com" OR sourcehostname CONTAINS "javaupdatecdn.com" OR sourcehostname CONTAINS "flash.javaupdate-cdn.com" OR sourcehostname CONTAINS "linux.ntp-update.com" OR sourcehostname CONTAINS "esxi-lty.ntp-update.com" OR sourcehostname CONTAINS "windows.0g6666.com" OR sourcehostname CONTAINS "ubuntu-ndi.ntp-update.com" OR sourcehostname CONTAINS "h1.xpjpz400.com" OR sourcehostname CONTAINS "cg.xpjpz400.com" OR sourcehostname CONTAINS "letsencrypt.msupdatesync.com" OR sourcehostname CONTAINS "cloud.ntp-update.com" OR sourcehostname CONTAINS "fe.ntp-update.com" OR sourcehostname CONTAINS "wtech.ntp-update.com" OR sourcehostname CONTAINS "imp.ntp-update.com" OR sourcehostname CONTAINS "ogplus.ntp-update.com" OR sourcehostname CONTAINS "organization.0g6666.com" OR sourcehostname CONTAINS "global.ntp-update.com" OR sourcehostname CONTAINS "kaiy.0g6666.com" OR sourcehostname CONTAINS "kaiy.ntp-update.com" OR sourcehostname CONTAINS "ky.0g6666.com" OR sourcehostname CONTAINS "oriental.ntp-update.com" OR sourcehostname CONTAINS "guard.ntp-update.com" OR sourcehostname CONTAINS "oglive.ntp-update.com" OR sourcehostname CONTAINS "guard.0g6666.com" OR sourcehostname CONTAINS "plus.ntp-update.com" OR sourcehostname CONTAINS "oglty.0g6666.com" OR sourcehostname CONTAINS "oglty.ntp-update.com" OR sourcehostname CONTAINS "oglty-ml.ntp-update.com" OR sourcehostname CONTAINS "ml-lty.ntp-update.com" OR sourcehostname CONTAINS "telegram.ntp-update.com" OR sourcehostname CONTAINS "easyh.ntp-update.com" OR sourcehostname CONTAINS "weblog.ntp-update.com" OR sourcehostname CONTAINS "weblog-ml.ntp-update.com" OR sourcehostname CONTAINS "o-fsh.ntp-update.com" OR sourcehostname CONTAINS "idn-tb.ntp-update.com" OR sourcehostname CONTAINS "tb-ndi2.ntp-update.com" OR sourcehostname CONTAINS "ml-ndi.ntp-update.com" OR sourcehostname CONTAINS "vct.0g6666.com" OR sourcehostname CONTAINS "windows-i-tb.ntp-update.com" OR sourcehostname CONTAINS "windows-qc-tb-i.ntp-update.com" OR sourcehostname CONTAINS "windows-tb-i.ntp-update.com")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "a-ad-tml.ntp-update.com" OR destinationntdomain CONTAINS "rps-a.ntp-update.com" OR destinationntdomain CONTAINS "a-rps.ntp-update.com" OR destinationntdomain CONTAINS "dns-a.ntp-update.com" OR destinationntdomain CONTAINS "a-tb.ntp-update.com" OR destinationntdomain CONTAINS "alast.sun-java.com" OR destinationntdomain CONTAINS "alast.ntp-update.com" OR destinationntdomain CONTAINS "dell-a.ntp-update.com" OR destinationntdomain CONTAINS "a-sp-rps.0g6666.com" OR destinationntdomain CONTAINS "windows.javaupdate-cdn.com" OR destinationntdomain CONTAINS "javaupdatecdn.com" OR destinationntdomain CONTAINS "flash.javaupdate-cdn.com" OR destinationntdomain CONTAINS "linux.ntp-update.com" OR destinationntdomain CONTAINS "esxi-lty.ntp-update.com" OR destinationntdomain CONTAINS "windows.0g6666.com" OR destinationntdomain CONTAINS "ubuntu-ndi.ntp-update.com" OR destinationntdomain CONTAINS "h1.xpjpz400.com" OR destinationntdomain CONTAINS "cg.xpjpz400.com" OR destinationntdomain CONTAINS "letsencrypt.msupdatesync.com" OR destinationntdomain CONTAINS "cloud.ntp-update.com" OR destinationntdomain CONTAINS "fe.ntp-update.com" OR destinationntdomain CONTAINS "wtech.ntp-update.com" OR destinationntdomain CONTAINS "imp.ntp-update.com" OR destinationntdomain CONTAINS "ogplus.ntp-update.com" OR destinationntdomain CONTAINS "organization.0g6666.com" OR destinationntdomain CONTAINS "global.ntp-update.com" OR destinationntdomain CONTAINS "kaiy.0g6666.com" OR destinationntdomain CONTAINS "kaiy.ntp-update.com" OR destinationntdomain CONTAINS "ky.0g6666.com" OR destinationntdomain CONTAINS "oriental.ntp-update.com" OR destinationntdomain CONTAINS "guard.ntp-update.com" OR destinationntdomain CONTAINS "oglive.ntp-update.com" OR destinationntdomain CONTAINS "guard.0g6666.com" OR destinationntdomain CONTAINS "plus.ntp-update.com" OR destinationntdomain CONTAINS "oglty.0g6666.com" OR destinationntdomain CONTAINS "oglty.ntp-update.com" OR destinationntdomain CONTAINS "oglty-ml.ntp-update.com" OR destinationntdomain CONTAINS "ml-lty.ntp-update.com" OR destinationntdomain CONTAINS "telegram.ntp-update.com" OR destinationntdomain CONTAINS "easyh.ntp-update.com" OR destinationntdomain CONTAINS "weblog.ntp-update.com" OR destinationntdomain CONTAINS "weblog-ml.ntp-update.com" OR destinationntdomain CONTAINS "o-fsh.ntp-update.com" OR destinationntdomain CONTAINS "idn-tb.ntp-update.com" OR destinationntdomain CONTAINS "tb-ndi2.ntp-update.com" OR destinationntdomain CONTAINS "ml-ndi.ntp-update.com" OR destinationntdomain CONTAINS "vct.0g6666.com" OR destinationntdomain CONTAINS "windows-i-tb.ntp-update.com" OR destinationntdomain CONTAINS "windows-qc-tb-i.ntp-update.com" OR destinationntdomain CONTAINS "windows-tb-i.ntp-update.com")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND requesturl NOT NULL AND (requesturl CONTAINS "a-ad-tml.ntp-update.com" OR requesturl CONTAINS "rps-a.ntp-update.com" OR requesturl CONTAINS "a-rps.ntp-update.com" OR requesturl CONTAINS "dns-a.ntp-update.com" OR requesturl CONTAINS "a-tb.ntp-update.com" OR requesturl CONTAINS "alast.sun-java.com" OR requesturl CONTAINS "alast.ntp-update.com" OR requesturl CONTAINS "dell-a.ntp-update.com" OR requesturl CONTAINS "a-sp-rps.0g6666.com" OR requesturl CONTAINS "windows.javaupdate-cdn.com" OR requesturl CONTAINS "javaupdatecdn.com" OR requesturl CONTAINS "flash.javaupdate-cdn.com" OR requesturl CONTAINS "linux.ntp-update.com" OR requesturl CONTAINS "esxi-lty.ntp-update.com" OR requesturl CONTAINS "windows.0g6666.com" OR requesturl CONTAINS "ubuntu-ndi.ntp-update.com" OR requesturl CONTAINS "h1.xpjpz400.com" OR requesturl CONTAINS "cg.xpjpz400.com" OR requesturl CONTAINS "letsencrypt.msupdatesync.com" OR requesturl CONTAINS "cloud.ntp-update.com" OR requesturl CONTAINS "fe.ntp-update.com" OR requesturl CONTAINS "wtech.ntp-update.com" OR requesturl CONTAINS "imp.ntp-update.com" OR requesturl CONTAINS "ogplus.ntp-update.com" OR requesturl CONTAINS "organization.0g6666.com" OR requesturl CONTAINS "global.ntp-update.com" OR requesturl CONTAINS "kaiy.0g6666.com" OR requesturl CONTAINS "kaiy.ntp-update.com" OR requesturl CONTAINS "ky.0g6666.com" OR requesturl CONTAINS "oriental.ntp-update.com" OR requesturl CONTAINS "guard.ntp-update.com" OR requesturl CONTAINS "oglive.ntp-update.com" OR requesturl CONTAINS "guard.0g6666.com" OR requesturl CONTAINS "plus.ntp-update.com" OR requesturl CONTAINS "oglty.0g6666.com" OR requesturl CONTAINS "oglty.ntp-update.com" OR requesturl CONTAINS "oglty-ml.ntp-update.com" OR requesturl CONTAINS "ml-lty.ntp-update.com" OR requesturl CONTAINS "telegram.ntp-update.com" OR requesturl CONTAINS "easyh.ntp-update.com" OR requesturl CONTAINS "weblog.ntp-update.com" OR requesturl CONTAINS "weblog-ml.ntp-update.com" OR requesturl CONTAINS "o-fsh.ntp-update.com" OR requesturl CONTAINS "idn-tb.ntp-update.com" OR requesturl CONTAINS "tb-ndi2.ntp-update.com" OR requesturl CONTAINS "ml-ndi.ntp-update.com" OR requesturl CONTAINS "vct.0g6666.com" OR requesturl CONTAINS "windows-i-tb.ntp-update.com" OR requesturl CONTAINS "windows-qc-tb-i.ntp-update.com" OR requesturl CONTAINS "windows-tb-i.ntp-update.com")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "a-fms.ntp-update.com" OR destinationhostname CONTAINS "plus.0g6666.com" OR destinationhostname CONTAINS "aprotect.sun-java.com" OR destinationhostname CONTAINS "og8888.0g6666.com" OR destinationhostname CONTAINS "adobe.javaupdate-cdn.com" OR destinationhostname CONTAINS "linux.0g6666.com" OR destinationhostname CONTAINS "ad.ntp-update.com" OR destinationhostname CONTAINS "www.0g6666.com" OR destinationhostname CONTAINS "wt.ntp-update.com" OR destinationhostname CONTAINS "aliyun.ntp-update.com")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "a-fms.ntp-update.com" OR sourcentdomain CONTAINS "plus.0g6666.com" OR sourcentdomain CONTAINS "aprotect.sun-java.com" OR sourcentdomain CONTAINS "og8888.0g6666.com" OR sourcentdomain CONTAINS "adobe.javaupdate-cdn.com" OR sourcentdomain CONTAINS "linux.0g6666.com" OR sourcentdomain CONTAINS "ad.ntp-update.com" OR sourcentdomain CONTAINS "www.0g6666.com" OR sourcentdomain CONTAINS "wt.ntp-update.com" OR sourcentdomain CONTAINS "aliyun.ntp-update.com")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "a-fms.ntp-update.com" OR sourcehostname CONTAINS "plus.0g6666.com" OR sourcehostname CONTAINS "aprotect.sun-java.com" OR sourcehostname CONTAINS "og8888.0g6666.com" OR sourcehostname CONTAINS "adobe.javaupdate-cdn.com" OR sourcehostname CONTAINS "linux.0g6666.com" OR sourcehostname CONTAINS "ad.ntp-update.com" OR sourcehostname CONTAINS "www.0g6666.com" OR sourcehostname CONTAINS "wt.ntp-update.com" OR sourcehostname CONTAINS "aliyun.ntp-update.com")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "a-fms.ntp-update.com" OR destinationntdomain CONTAINS "plus.0g6666.com" OR destinationntdomain CONTAINS "aprotect.sun-java.com" OR destinationntdomain CONTAINS "og8888.0g6666.com" OR destinationntdomain CONTAINS "adobe.javaupdate-cdn.com" OR destinationntdomain CONTAINS "linux.0g6666.com" OR destinationntdomain CONTAINS "ad.ntp-update.com" OR destinationntdomain CONTAINS "www.0g6666.com" OR destinationntdomain CONTAINS "wt.ntp-update.com" OR destinationntdomain CONTAINS "aliyun.ntp-update.com")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND requesturl NOT NULL AND (requesturl CONTAINS "a-fms.ntp-update.com" OR requesturl CONTAINS "plus.0g6666.com" OR requesturl CONTAINS "aprotect.sun-java.com" OR requesturl CONTAINS "og8888.0g6666.com" OR requesturl CONTAINS "adobe.javaupdate-cdn.com" OR requesturl CONTAINS "linux.0g6666.com" OR requesturl CONTAINS "ad.ntp-update.com" OR requesturl CONTAINS "www.0g6666.com" OR requesturl CONTAINS "wt.ntp-update.com" OR requesturl CONTAINS "aliyun.ntp-update.com")
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "a-ad-tml.ntp-update.com" OR destinationhostname CONTAINS "rps-a.ntp-update.com" OR destinationhostname CONTAINS "a-rps.ntp-update.com" OR destinationhostname CONTAINS "dns-a.ntp-update.com" OR destinationhostname CONTAINS "a-tb.ntp-update.com" OR destinationhostname CONTAINS "alast.sun-java.com" OR destinationhostname CONTAINS "alast.ntp-update.com" OR destinationhostname CONTAINS "dell-a.ntp-update.com" OR destinationhostname CONTAINS "a-sp-rps.0g6666.com" OR destinationhostname CONTAINS "windows.javaupdate-cdn.com" OR destinationhostname CONTAINS "javaupdatecdn.com" OR destinationhostname CONTAINS "flash.javaupdate-cdn.com" OR destinationhostname CONTAINS "linux.ntp-update.com" OR destinationhostname CONTAINS "esxi-lty.ntp-update.com" OR destinationhostname CONTAINS "windows.0g6666.com" OR destinationhostname CONTAINS "ubuntu-ndi.ntp-update.com" OR destinationhostname CONTAINS "h1.xpjpz400.com" OR destinationhostname CONTAINS "cg.xpjpz400.com" OR destinationhostname CONTAINS "letsencrypt.msupdatesync.com" OR destinationhostname CONTAINS "cloud.ntp-update.com" OR destinationhostname CONTAINS "fe.ntp-update.com" OR destinationhostname CONTAINS "wtech.ntp-update.com" OR destinationhostname CONTAINS "imp.ntp-update.com" OR destinationhostname CONTAINS "ogplus.ntp-update.com" OR destinationhostname CONTAINS "organization.0g6666.com" OR destinationhostname CONTAINS "global.ntp-update.com" OR destinationhostname CONTAINS "kaiy.0g6666.com" OR destinationhostname CONTAINS "kaiy.ntp-update.com" OR destinationhostname CONTAINS "ky.0g6666.com" OR destinationhostname CONTAINS "oriental.ntp-update.com" OR destinationhostname CONTAINS "guard.ntp-update.com" OR destinationhostname CONTAINS "oglive.ntp-update.com" OR destinationhostname CONTAINS "guard.0g6666.com" OR destinationhostname CONTAINS "plus.ntp-update.com" OR destinationhostname CONTAINS "oglty.0g6666.com" OR destinationhostname CONTAINS "oglty.ntp-update.com" OR destinationhostname CONTAINS "oglty-ml.ntp-update.com" OR destinationhostname CONTAINS "ml-lty.ntp-update.com" OR destinationhostname CONTAINS "telegram.ntp-update.com" OR destinationhostname CONTAINS "easyh.ntp-update.com" OR destinationhostname CONTAINS "weblog.ntp-update.com" OR destinationhostname CONTAINS "weblog-ml.ntp-update.com" OR destinationhostname CONTAINS "o-fsh.ntp-update.com" OR destinationhostname CONTAINS "idn-tb.ntp-update.com" OR destinationhostname CONTAINS "tb-ndi2.ntp-update.com" OR destinationhostname CONTAINS "ml-ndi.ntp-update.com" OR destinationhostname CONTAINS "vct.0g6666.com" OR destinationhostname CONTAINS "windows-i-tb.ntp-update.com" OR destinationhostname CONTAINS "windows-qc-tb-i.ntp-update.com" OR destinationhostname CONTAINS "windows-tb-i.ntp-update.com")
index=activity AND rg_functionality="Unix / Linux / AIX" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "a-ad-tml.ntp-update.com" OR sourcentdomain CONTAINS "rps-a.ntp-update.com" OR sourcentdomain CONTAINS "a-rps.ntp-update.com" OR sourcentdomain CONTAINS "dns-a.ntp-update.com" OR sourcentdomain CONTAINS "a-tb.ntp-update.com" OR sourcentdomain CONTAINS "alast.sun-java.com" OR sourcentdomain CONTAINS "alast.ntp-update.com" OR sourcentdomain CONTAINS "dell-a.ntp-update.com" OR sourcentdomain CONTAINS "a-sp-rps.0g6666.com" OR sourcentdomain CONTAINS "windows.javaupdate-cdn.com" OR sourcentdomain CONTAINS "javaupdatecdn.com" OR sourcentdomain CONTAINS "flash.javaupdate-cdn.com" OR sourcentdomain CONTAINS "linux.ntp-update.com" OR sourcentdomain CONTAINS "esxi-lty.ntp-update.com" OR sourcentdomain CONTAINS "windows.0g6666.com" OR sourcentdomain CONTAINS "ubuntu-ndi.ntp-update.com" OR sourcentdomain CONTAINS "h1.xpjpz400.com" OR sourcentdomain CONTAINS "cg.xpjpz400.com" OR sourcentdomain CONTAINS "letsencrypt.msupdatesync.com" OR sourcentdomain CONTAINS "cloud.ntp-update.com" OR sourcentdomain CONTAINS "fe.ntp-update.com" OR sourcentdomain CONTAINS "wtech.ntp-update.com" OR sourcentdomain CONTAINS "imp.ntp-update.com" OR sourcentdomain CONTAINS "ogplus.ntp-update.com" OR sourcentdomain CONTAINS "organization.0g6666.com" OR sourcentdomain CONTAINS "global.ntp-update.com" OR sourcentdomain CONTAINS "kaiy.0g6666.com" OR sourcentdomain CONTAINS "kaiy.ntp-update.com" OR sourcentdomain CONTAINS "ky.0g6666.com" OR sourcentdomain CONTAINS "oriental.ntp-update.com" OR sourcentdomain CONTAINS "guard.ntp-update.com" OR sourcentdomain CONTAINS "oglive.ntp-update.com" OR sourcentdomain CONTAINS "guard.0g6666.com" OR sourcentdomain CONTAINS "plus.ntp-update.com" OR sourcentdomain CONTAINS "oglty.0g6666.com" OR sourcentdomain CONTAINS "oglty.ntp-update.com" OR sourcentdomain CONTAINS "oglty-ml.ntp-update.com" OR sourcentdomain CONTAINS "ml-lty.ntp-update.com" OR sourcentdomain CONTAINS "telegram.ntp-update.com" OR sourcentdomain CONTAINS "easyh.ntp-update.com" OR sourcentdomain CONTAINS "weblog.ntp-update.com" OR sourcentdomain CONTAINS "weblog-ml.ntp-update.com" OR sourcentdomain CONTAINS "o-fsh.ntp-update.com" OR sourcentdomain CONTAINS "idn-tb.ntp-update.com" OR sourcentdomain CONTAINS "tb-ndi2.ntp-update.com" OR sourcentdomain CONTAINS "ml-ndi.ntp-update.com" OR sourcentdomain CONTAINS "vct.0g6666.com" OR sourcentdomain CONTAINS "windows-i-tb.ntp-update.com" OR sourcentdomain CONTAINS "windows-qc-tb-i.ntp-update.com" OR sourcentdomain CONTAINS "windows-tb-i.ntp-update.com")
index=activity AND rg_functionality="Unix / Linux / AIX" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "a-ad-tml.ntp-update.com" OR sourcehostname CONTAINS "rps-a.ntp-update.com" OR sourcehostname CONTAINS "a-rps.ntp-update.com" OR sourcehostname CONTAINS "dns-a.ntp-update.com" OR sourcehostname CONTAINS "a-tb.ntp-update.com" OR sourcehostname CONTAINS "alast.sun-java.com" OR sourcehostname CONTAINS "alast.ntp-update.com" OR sourcehostname CONTAINS "dell-a.ntp-update.com" OR sourcehostname CONTAINS "a-sp-rps.0g6666.com" OR sourcehostname CONTAINS "windows.javaupdate-cdn.com" OR sourcehostname CONTAINS "javaupdatecdn.com" OR sourcehostname CONTAINS "flash.javaupdate-cdn.com" OR sourcehostname CONTAINS "linux.ntp-update.com" OR sourcehostname CONTAINS "esxi-lty.ntp-update.com" OR sourcehostname CONTAINS "windows.0g6666.com" OR sourcehostname CONTAINS "ubuntu-ndi.ntp-update.com" OR sourcehostname CONTAINS "h1.xpjpz400.com" OR sourcehostname CONTAINS "cg.xpjpz400.com" OR sourcehostname CONTAINS "letsencrypt.msupdatesync.com" OR sourcehostname CONTAINS "cloud.ntp-update.com" OR sourcehostname CONTAINS "fe.ntp-update.com" OR sourcehostname CONTAINS "wtech.ntp-update.com" OR sourcehostname CONTAINS "imp.ntp-update.com" OR sourcehostname CONTAINS "ogplus.ntp-update.com" OR sourcehostname CONTAINS "organization.0g6666.com" OR sourcehostname CONTAINS "global.ntp-update.com" OR sourcehostname CONTAINS "kaiy.0g6666.com" OR sourcehostname CONTAINS "kaiy.ntp-update.com" OR sourcehostname CONTAINS "ky.0g6666.com" OR sourcehostname CONTAINS "oriental.ntp-update.com" OR sourcehostname CONTAINS "guard.ntp-update.com" OR sourcehostname CONTAINS "oglive.ntp-update.com" OR sourcehostname CONTAINS "guard.0g6666.com" OR sourcehostname CONTAINS "plus.ntp-update.com" OR sourcehostname CONTAINS "oglty.0g6666.com" OR sourcehostname CONTAINS "oglty.ntp-update.com" OR sourcehostname CONTAINS "oglty-ml.ntp-update.com" OR sourcehostname CONTAINS "ml-lty.ntp-update.com" OR sourcehostname CONTAINS "telegram.ntp-update.com" OR sourcehostname CONTAINS "easyh.ntp-update.com" OR sourcehostname CONTAINS "weblog.ntp-update.com" OR sourcehostname CONTAINS "weblog-ml.ntp-update.com" OR sourcehostname CONTAINS "o-fsh.ntp-update.com" OR sourcehostname CONTAINS "idn-tb.ntp-update.com" OR sourcehostname CONTAINS "tb-ndi2.ntp-update.com" OR sourcehostname CONTAINS "ml-ndi.ntp-update.com" OR sourcehostname CONTAINS "vct.0g6666.com" OR sourcehostname CONTAINS "windows-i-tb.ntp-update.com" OR sourcehostname CONTAINS "windows-qc-tb-i.ntp-update.com" OR sourcehostname CONTAINS "windows-tb-i.ntp-update.com")
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "a-ad-tml.ntp-update.com" OR destinationntdomain CONTAINS "rps-a.ntp-update.com" OR destinationntdomain CONTAINS "a-rps.ntp-update.com" OR destinationntdomain CONTAINS "dns-a.ntp-update.com" OR destinationntdomain CONTAINS "a-tb.ntp-update.com" OR destinationntdomain CONTAINS "alast.sun-java.com" OR destinationntdomain CONTAINS "alast.ntp-update.com" OR destinationntdomain CONTAINS "dell-a.ntp-update.com" OR destinationntdomain CONTAINS "a-sp-rps.0g6666.com" OR destinationntdomain CONTAINS "windows.javaupdate-cdn.com" OR destinationntdomain CONTAINS "javaupdatecdn.com" OR destinationntdomain CONTAINS "flash.javaupdate-cdn.com" OR destinationntdomain CONTAINS "linux.ntp-update.com" OR destinationntdomain CONTAINS "esxi-lty.ntp-update.com" OR destinationntdomain CONTAINS "windows.0g6666.com" OR destinationntdomain CONTAINS "ubuntu-ndi.ntp-update.com" OR destinationntdomain CONTAINS "h1.xpjpz400.com" OR destinationntdomain CONTAINS "cg.xpjpz400.com" OR destinationntdomain CONTAINS "letsencrypt.msupdatesync.com" OR destinationntdomain CONTAINS "cloud.ntp-update.com" OR destinationntdomain CONTAINS "fe.ntp-update.com" OR destinationntdomain CONTAINS "wtech.ntp-update.com" OR destinationntdomain CONTAINS "imp.ntp-update.com" OR destinationntdomain CONTAINS "ogplus.ntp-update.com" OR destinationntdomain CONTAINS "organization.0g6666.com" OR destinationntdomain CONTAINS "global.ntp-update.com" OR destinationntdomain CONTAINS "kaiy.0g6666.com" OR destinationntdomain CONTAINS "kaiy.ntp-update.com" OR destinationntdomain CONTAINS "ky.0g6666.com" OR destinationntdomain CONTAINS "oriental.ntp-update.com" OR destinationntdomain CONTAINS "guard.ntp-update.com" OR destinationntdomain CONTAINS "oglive.ntp-update.com" OR destinationntdomain CONTAINS "guard.0g6666.com" OR destinationntdomain CONTAINS "plus.ntp-update.com" OR destinationntdomain CONTAINS "oglty.0g6666.com" OR destinationntdomain CONTAINS "oglty.ntp-update.com" OR destinationntdomain CONTAINS "oglty-ml.ntp-update.com" OR destinationntdomain CONTAINS "ml-lty.ntp-update.com" OR destinationntdomain CONTAINS "telegram.ntp-update.com" OR destinationntdomain CONTAINS "easyh.ntp-update.com" OR destinationntdomain CONTAINS "weblog.ntp-update.com" OR destinationntdomain CONTAINS "weblog-ml.ntp-update.com" OR destinationntdomain CONTAINS "o-fsh.ntp-update.com" OR destinationntdomain CONTAINS "idn-tb.ntp-update.com" OR destinationntdomain CONTAINS "tb-ndi2.ntp-update.com" OR destinationntdomain CONTAINS "ml-ndi.ntp-update.com" OR destinationntdomain CONTAINS "vct.0g6666.com" OR destinationntdomain CONTAINS "windows-i-tb.ntp-update.com" OR destinationntdomain CONTAINS "windows-qc-tb-i.ntp-update.com" OR destinationntdomain CONTAINS "windows-tb-i.ntp-update.com")
index=activity AND rg_functionality="Unix / Linux / AIX" AND requesturl NOT NULL AND (requesturl CONTAINS "a-ad-tml.ntp-update.com" OR requesturl CONTAINS "rps-a.ntp-update.com" OR requesturl CONTAINS "a-rps.ntp-update.com" OR requesturl CONTAINS "dns-a.ntp-update.com" OR requesturl CONTAINS "a-tb.ntp-update.com" OR requesturl CONTAINS "alast.sun-java.com" OR requesturl CONTAINS "alast.ntp-update.com" OR requesturl CONTAINS "dell-a.ntp-update.com" OR requesturl CONTAINS "a-sp-rps.0g6666.com" OR requesturl CONTAINS "windows.javaupdate-cdn.com" OR requesturl CONTAINS "javaupdatecdn.com" OR requesturl CONTAINS "flash.javaupdate-cdn.com" OR requesturl CONTAINS "linux.ntp-update.com" OR requesturl CONTAINS "esxi-lty.ntp-update.com" OR requesturl CONTAINS "windows.0g6666.com" OR requesturl CONTAINS "ubuntu-ndi.ntp-update.com" OR requesturl CONTAINS "h1.xpjpz400.com" OR requesturl CONTAINS "cg.xpjpz400.com" OR requesturl CONTAINS "letsencrypt.msupdatesync.com" OR requesturl CONTAINS "cloud.ntp-update.com" OR requesturl CONTAINS "fe.ntp-update.com" OR requesturl CONTAINS "wtech.ntp-update.com" OR requesturl CONTAINS "imp.ntp-update.com" OR requesturl CONTAINS "ogplus.ntp-update.com" OR requesturl CONTAINS "organization.0g6666.com" OR requesturl CONTAINS "global.ntp-update.com" OR requesturl CONTAINS "kaiy.0g6666.com" OR requesturl CONTAINS "kaiy.ntp-update.com" OR requesturl CONTAINS "ky.0g6666.com" OR requesturl CONTAINS "oriental.ntp-update.com" OR requesturl CONTAINS "guard.ntp-update.com" OR requesturl CONTAINS "oglive.ntp-update.com" OR requesturl CONTAINS "guard.0g6666.com" OR requesturl CONTAINS "plus.ntp-update.com" OR requesturl CONTAINS "oglty.0g6666.com" OR requesturl CONTAINS "oglty.ntp-update.com" OR requesturl CONTAINS "oglty-ml.ntp-update.com" OR requesturl CONTAINS "ml-lty.ntp-update.com" OR requesturl CONTAINS "telegram.ntp-update.com" OR requesturl CONTAINS "easyh.ntp-update.com" OR requesturl CONTAINS "weblog.ntp-update.com" OR requesturl CONTAINS "weblog-ml.ntp-update.com" OR requesturl CONTAINS "o-fsh.ntp-update.com" OR requesturl CONTAINS "idn-tb.ntp-update.com" OR requesturl CONTAINS "tb-ndi2.ntp-update.com" OR requesturl CONTAINS "ml-ndi.ntp-update.com" OR requesturl CONTAINS "vct.0g6666.com" OR requesturl CONTAINS "windows-i-tb.ntp-update.com" OR requesturl CONTAINS "windows-qc-tb-i.ntp-update.com" OR requesturl CONTAINS "windows-tb-i.ntp-update.com")
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "a-fms.ntp-update.com" OR destinationhostname CONTAINS "plus.0g6666.com" OR destinationhostname CONTAINS "aprotect.sun-java.com" OR destinationhostname CONTAINS "og8888.0g6666.com" OR destinationhostname CONTAINS "adobe.javaupdate-cdn.com" OR destinationhostname CONTAINS "linux.0g6666.com" OR destinationhostname CONTAINS "ad.ntp-update.com" OR destinationhostname CONTAINS "www.0g6666.com" OR destinationhostname CONTAINS "wt.ntp-update.com" OR destinationhostname CONTAINS "aliyun.ntp-update.com")
index=activity AND rg_functionality="Unix / Linux / AIX" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "a-fms.ntp-update.com" OR sourcentdomain CONTAINS "plus.0g6666.com" OR sourcentdomain CONTAINS "aprotect.sun-java.com" OR sourcentdomain CONTAINS "og8888.0g6666.com" OR sourcentdomain CONTAINS "adobe.javaupdate-cdn.com" OR sourcentdomain CONTAINS "linux.0g6666.com" OR sourcentdomain CONTAINS "ad.ntp-update.com" OR sourcentdomain CONTAINS "www.0g6666.com" OR sourcentdomain CONTAINS "wt.ntp-update.com" OR sourcentdomain CONTAINS "aliyun.ntp-update.com")
index=activity AND rg_functionality="Unix / Linux / AIX" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "a-fms.ntp-update.com" OR sourcehostname CONTAINS "plus.0g6666.com" OR sourcehostname CONTAINS "aprotect.sun-java.com" OR sourcehostname CONTAINS "og8888.0g6666.com" OR sourcehostname CONTAINS "adobe.javaupdate-cdn.com" OR sourcehostname CONTAINS "linux.0g6666.com" OR sourcehostname CONTAINS "ad.ntp-update.com" OR sourcehostname CONTAINS "www.0g6666.com" OR sourcehostname CONTAINS "wt.ntp-update.com" OR sourcehostname CONTAINS "aliyun.ntp-update.com")
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "a-fms.ntp-update.com" OR destinationntdomain CONTAINS "plus.0g6666.com" OR destinationntdomain CONTAINS "aprotect.sun-java.com" OR destinationntdomain CONTAINS "og8888.0g6666.com" OR destinationntdomain CONTAINS "adobe.javaupdate-cdn.com" OR destinationntdomain CONTAINS "linux.0g6666.com" OR destinationntdomain CONTAINS "ad.ntp-update.com" OR destinationntdomain CONTAINS "www.0g6666.com" OR destinationntdomain CONTAINS "wt.ntp-update.com" OR destinationntdomain CONTAINS "aliyun.ntp-update.com")
index=activity AND rg_functionality="Unix / Linux / AIX" AND requesturl NOT NULL AND (requesturl CONTAINS "a-fms.ntp-update.com" OR requesturl CONTAINS "plus.0g6666.com" OR requesturl CONTAINS "aprotect.sun-java.com" OR requesturl CONTAINS "og8888.0g6666.com" OR requesturl CONTAINS "adobe.javaupdate-cdn.com" OR requesturl CONTAINS "linux.0g6666.com" OR requesturl CONTAINS "ad.ntp-update.com" OR requesturl CONTAINS "www.0g6666.com" OR requesturl CONTAINS "wt.ntp-update.com" OR requesturl CONTAINS "aliyun.ntp-update.com")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "a-ad-tml.ntp-update.com" OR destinationhostname CONTAINS "rps-a.ntp-update.com" OR destinationhostname CONTAINS "a-rps.ntp-update.com" OR destinationhostname CONTAINS "dns-a.ntp-update.com" OR destinationhostname CONTAINS "a-tb.ntp-update.com" OR destinationhostname CONTAINS "alast.sun-java.com" OR destinationhostname CONTAINS "alast.ntp-update.com" OR destinationhostname CONTAINS "dell-a.ntp-update.com" OR destinationhostname CONTAINS "a-sp-rps.0g6666.com" OR destinationhostname CONTAINS "windows.javaupdate-cdn.com" OR destinationhostname CONTAINS "javaupdatecdn.com" OR destinationhostname CONTAINS "flash.javaupdate-cdn.com" OR destinationhostname CONTAINS "linux.ntp-update.com" OR destinationhostname CONTAINS "esxi-lty.ntp-update.com" OR destinationhostname CONTAINS "windows.0g6666.com" OR destinationhostname CONTAINS "ubuntu-ndi.ntp-update.com" OR destinationhostname CONTAINS "h1.xpjpz400.com" OR destinationhostname CONTAINS "cg.xpjpz400.com" OR destinationhostname CONTAINS "letsencrypt.msupdatesync.com" OR destinationhostname CONTAINS "cloud.ntp-update.com" OR destinationhostname CONTAINS "fe.ntp-update.com" OR destinationhostname CONTAINS "wtech.ntp-update.com" OR destinationhostname CONTAINS "imp.ntp-update.com" OR destinationhostname CONTAINS "ogplus.ntp-update.com" OR destinationhostname CONTAINS "organization.0g6666.com" OR destinationhostname CONTAINS "global.ntp-update.com" OR destinationhostname CONTAINS "kaiy.0g6666.com" OR destinationhostname CONTAINS "kaiy.ntp-update.com" OR destinationhostname CONTAINS "ky.0g6666.com" OR destinationhostname CONTAINS "oriental.ntp-update.com" OR destinationhostname CONTAINS "guard.ntp-update.com" OR destinationhostname CONTAINS "oglive.ntp-update.com" OR destinationhostname CONTAINS "guard.0g6666.com" OR destinationhostname CONTAINS "plus.ntp-update.com" OR destinationhostname CONTAINS "oglty.0g6666.com" OR destinationhostname CONTAINS "oglty.ntp-update.com" OR destinationhostname CONTAINS "oglty-ml.ntp-update.com" OR destinationhostname CONTAINS "ml-lty.ntp-update.com" OR destinationhostname CONTAINS "telegram.ntp-update.com" OR destinationhostname CONTAINS "easyh.ntp-update.com" OR destinationhostname CONTAINS "weblog.ntp-update.com" OR destinationhostname CONTAINS "weblog-ml.ntp-update.com" OR destinationhostname CONTAINS "o-fsh.ntp-update.com" OR destinationhostname CONTAINS "idn-tb.ntp-update.com" OR destinationhostname CONTAINS "tb-ndi2.ntp-update.com" OR destinationhostname CONTAINS "ml-ndi.ntp-update.com" OR destinationhostname CONTAINS "vct.0g6666.com" OR destinationhostname CONTAINS "windows-i-tb.ntp-update.com" OR destinationhostname CONTAINS "windows-qc-tb-i.ntp-update.com" OR destinationhostname CONTAINS "windows-tb-i.ntp-update.com")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "a-ad-tml.ntp-update.com" OR sourcentdomain CONTAINS "rps-a.ntp-update.com" OR sourcentdomain CONTAINS "a-rps.ntp-update.com" OR sourcentdomain CONTAINS "dns-a.ntp-update.com" OR sourcentdomain CONTAINS "a-tb.ntp-update.com" OR sourcentdomain CONTAINS "alast.sun-java.com" OR sourcentdomain CONTAINS "alast.ntp-update.com" OR sourcentdomain CONTAINS "dell-a.ntp-update.com" OR sourcentdomain CONTAINS "a-sp-rps.0g6666.com" OR sourcentdomain CONTAINS "windows.javaupdate-cdn.com" OR sourcentdomain CONTAINS "javaupdatecdn.com" OR sourcentdomain CONTAINS "flash.javaupdate-cdn.com" OR sourcentdomain CONTAINS "linux.ntp-update.com" OR sourcentdomain CONTAINS "esxi-lty.ntp-update.com" OR sourcentdomain CONTAINS "windows.0g6666.com" OR sourcentdomain CONTAINS "ubuntu-ndi.ntp-update.com" OR sourcentdomain CONTAINS "h1.xpjpz400.com" OR sourcentdomain CONTAINS "cg.xpjpz400.com" OR sourcentdomain CONTAINS "letsencrypt.msupdatesync.com" OR sourcentdomain CONTAINS "cloud.ntp-update.com" OR sourcentdomain CONTAINS "fe.ntp-update.com" OR sourcentdomain CONTAINS "wtech.ntp-update.com" OR sourcentdomain CONTAINS "imp.ntp-update.com" OR sourcentdomain CONTAINS "ogplus.ntp-update.com" OR sourcentdomain CONTAINS "organization.0g6666.com" OR sourcentdomain CONTAINS "global.ntp-update.com" OR sourcentdomain CONTAINS "kaiy.0g6666.com" OR sourcentdomain CONTAINS "kaiy.ntp-update.com" OR sourcentdomain CONTAINS "ky.0g6666.com" OR sourcentdomain CONTAINS "oriental.ntp-update.com" OR sourcentdomain CONTAINS "guard.ntp-update.com" OR sourcentdomain CONTAINS "oglive.ntp-update.com" OR sourcentdomain CONTAINS "guard.0g6666.com" OR sourcentdomain CONTAINS "plus.ntp-update.com" OR sourcentdomain CONTAINS "oglty.0g6666.com" OR sourcentdomain CONTAINS "oglty.ntp-update.com" OR sourcentdomain CONTAINS "oglty-ml.ntp-update.com" OR sourcentdomain CONTAINS "ml-lty.ntp-update.com" OR sourcentdomain CONTAINS "telegram.ntp-update.com" OR sourcentdomain CONTAINS "easyh.ntp-update.com" OR sourcentdomain CONTAINS "weblog.ntp-update.com" OR sourcentdomain CONTAINS "weblog-ml.ntp-update.com" OR sourcentdomain CONTAINS "o-fsh.ntp-update.com" OR sourcentdomain CONTAINS "idn-tb.ntp-update.com" OR sourcentdomain CONTAINS "tb-ndi2.ntp-update.com" OR sourcentdomain CONTAINS "ml-ndi.ntp-update.com" OR sourcentdomain CONTAINS "vct.0g6666.com" OR sourcentdomain CONTAINS "windows-i-tb.ntp-update.com" OR sourcentdomain CONTAINS "windows-qc-tb-i.ntp-update.com" OR sourcentdomain CONTAINS "windows-tb-i.ntp-update.com")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "a-ad-tml.ntp-update.com" OR sourcehostname CONTAINS "rps-a.ntp-update.com" OR sourcehostname CONTAINS "a-rps.ntp-update.com" OR sourcehostname CONTAINS "dns-a.ntp-update.com" OR sourcehostname CONTAINS "a-tb.ntp-update.com" OR sourcehostname CONTAINS "alast.sun-java.com" OR sourcehostname CONTAINS "alast.ntp-update.com" OR sourcehostname CONTAINS "dell-a.ntp-update.com" OR sourcehostname CONTAINS "a-sp-rps.0g6666.com" OR sourcehostname CONTAINS "windows.javaupdate-cdn.com" OR sourcehostname CONTAINS "javaupdatecdn.com" OR sourcehostname CONTAINS "flash.javaupdate-cdn.com" OR sourcehostname CONTAINS "linux.ntp-update.com" OR sourcehostname CONTAINS "esxi-lty.ntp-update.com" OR sourcehostname CONTAINS "windows.0g6666.com" OR sourcehostname CONTAINS "ubuntu-ndi.ntp-update.com" OR sourcehostname CONTAINS "h1.xpjpz400.com" OR sourcehostname CONTAINS "cg.xpjpz400.com" OR sourcehostname CONTAINS "letsencrypt.msupdatesync.com" OR sourcehostname CONTAINS "cloud.ntp-update.com" OR sourcehostname CONTAINS "fe.ntp-update.com" OR sourcehostname CONTAINS "wtech.ntp-update.com" OR sourcehostname CONTAINS "imp.ntp-update.com" OR sourcehostname CONTAINS "ogplus.ntp-update.com" OR sourcehostname CONTAINS "organization.0g6666.com" OR sourcehostname CONTAINS "global.ntp-update.com" OR sourcehostname CONTAINS "kaiy.0g6666.com" OR sourcehostname CONTAINS "kaiy.ntp-update.com" OR sourcehostname CONTAINS "ky.0g6666.com" OR sourcehostname CONTAINS "oriental.ntp-update.com" OR sourcehostname CONTAINS "guard.ntp-update.com" OR sourcehostname CONTAINS "oglive.ntp-update.com" OR sourcehostname CONTAINS "guard.0g6666.com" OR sourcehostname CONTAINS "plus.ntp-update.com" OR sourcehostname CONTAINS "oglty.0g6666.com" OR sourcehostname CONTAINS "oglty.ntp-update.com" OR sourcehostname CONTAINS "oglty-ml.ntp-update.com" OR sourcehostname CONTAINS "ml-lty.ntp-update.com" OR sourcehostname CONTAINS "telegram.ntp-update.com" OR sourcehostname CONTAINS "easyh.ntp-update.com" OR sourcehostname CONTAINS "weblog.ntp-update.com" OR sourcehostname CONTAINS "weblog-ml.ntp-update.com" OR sourcehostname CONTAINS "o-fsh.ntp-update.com" OR sourcehostname CONTAINS "idn-tb.ntp-update.com" OR sourcehostname CONTAINS "tb-ndi2.ntp-update.com" OR sourcehostname CONTAINS "ml-ndi.ntp-update.com" OR sourcehostname CONTAINS "vct.0g6666.com" OR sourcehostname CONTAINS "windows-i-tb.ntp-update.com" OR sourcehostname CONTAINS "windows-qc-tb-i.ntp-update.com" OR sourcehostname CONTAINS "windows-tb-i.ntp-update.com")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "a-ad-tml.ntp-update.com" OR destinationntdomain CONTAINS "rps-a.ntp-update.com" OR destinationntdomain CONTAINS "a-rps.ntp-update.com" OR destinationntdomain CONTAINS "dns-a.ntp-update.com" OR destinationntdomain CONTAINS "a-tb.ntp-update.com" OR destinationntdomain CONTAINS "alast.sun-java.com" OR destinationntdomain CONTAINS "alast.ntp-update.com" OR destinationntdomain CONTAINS "dell-a.ntp-update.com" OR destinationntdomain CONTAINS "a-sp-rps.0g6666.com" OR destinationntdomain CONTAINS "windows.javaupdate-cdn.com" OR destinationntdomain CONTAINS "javaupdatecdn.com" OR destinationntdomain CONTAINS "flash.javaupdate-cdn.com" OR destinationntdomain CONTAINS "linux.ntp-update.com" OR destinationntdomain CONTAINS "esxi-lty.ntp-update.com" OR destinationntdomain CONTAINS "windows.0g6666.com" OR destinationntdomain CONTAINS "ubuntu-ndi.ntp-update.com" OR destinationntdomain CONTAINS "h1.xpjpz400.com" OR destinationntdomain CONTAINS "cg.xpjpz400.com" OR destinationntdomain CONTAINS "letsencrypt.msupdatesync.com" OR destinationntdomain CONTAINS "cloud.ntp-update.com" OR destinationntdomain CONTAINS "fe.ntp-update.com" OR destinationntdomain CONTAINS "wtech.ntp-update.com" OR destinationntdomain CONTAINS "imp.ntp-update.com" OR destinationntdomain CONTAINS "ogplus.ntp-update.com" OR destinationntdomain CONTAINS "organization.0g6666.com" OR destinationntdomain CONTAINS "global.ntp-update.com" OR destinationntdomain CONTAINS "kaiy.0g6666.com" OR destinationntdomain CONTAINS "kaiy.ntp-update.com" OR destinationntdomain CONTAINS "ky.0g6666.com" OR destinationntdomain CONTAINS "oriental.ntp-update.com" OR destinationntdomain CONTAINS "guard.ntp-update.com" OR destinationntdomain CONTAINS "oglive.ntp-update.com" OR destinationntdomain CONTAINS "guard.0g6666.com" OR destinationntdomain CONTAINS "plus.ntp-update.com" OR destinationntdomain CONTAINS "oglty.0g6666.com" OR destinationntdomain CONTAINS "oglty.ntp-update.com" OR destinationntdomain CONTAINS "oglty-ml.ntp-update.com" OR destinationntdomain CONTAINS "ml-lty.ntp-update.com" OR destinationntdomain CONTAINS "telegram.ntp-update.com" OR destinationntdomain CONTAINS "easyh.ntp-update.com" OR destinationntdomain CONTAINS "weblog.ntp-update.com" OR destinationntdomain CONTAINS "weblog-ml.ntp-update.com" OR destinationntdomain CONTAINS "o-fsh.ntp-update.com" OR destinationntdomain CONTAINS "idn-tb.ntp-update.com" OR destinationntdomain CONTAINS "tb-ndi2.ntp-update.com" OR destinationntdomain CONTAINS "ml-ndi.ntp-update.com" OR destinationntdomain CONTAINS "vct.0g6666.com" OR destinationntdomain CONTAINS "windows-i-tb.ntp-update.com" OR destinationntdomain CONTAINS "windows-qc-tb-i.ntp-update.com" OR destinationntdomain CONTAINS "windows-tb-i.ntp-update.com")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND requesturl NOT NULL AND (requesturl CONTAINS "a-ad-tml.ntp-update.com" OR requesturl CONTAINS "rps-a.ntp-update.com" OR requesturl CONTAINS "a-rps.ntp-update.com" OR requesturl CONTAINS "dns-a.ntp-update.com" OR requesturl CONTAINS "a-tb.ntp-update.com" OR requesturl CONTAINS "alast.sun-java.com" OR requesturl CONTAINS "alast.ntp-update.com" OR requesturl CONTAINS "dell-a.ntp-update.com" OR requesturl CONTAINS "a-sp-rps.0g6666.com" OR requesturl CONTAINS "windows.javaupdate-cdn.com" OR requesturl CONTAINS "javaupdatecdn.com" OR requesturl CONTAINS "flash.javaupdate-cdn.com" OR requesturl CONTAINS "linux.ntp-update.com" OR requesturl CONTAINS "esxi-lty.ntp-update.com" OR requesturl CONTAINS "windows.0g6666.com" OR requesturl CONTAINS "ubuntu-ndi.ntp-update.com" OR requesturl CONTAINS "h1.xpjpz400.com" OR requesturl CONTAINS "cg.xpjpz400.com" OR requesturl CONTAINS "letsencrypt.msupdatesync.com" OR requesturl CONTAINS "cloud.ntp-update.com" OR requesturl CONTAINS "fe.ntp-update.com" OR requesturl CONTAINS "wtech.ntp-update.com" OR requesturl CONTAINS "imp.ntp-update.com" OR requesturl CONTAINS "ogplus.ntp-update.com" OR requesturl CONTAINS "organization.0g6666.com" OR requesturl CONTAINS "global.ntp-update.com" OR requesturl CONTAINS "kaiy.0g6666.com" OR requesturl CONTAINS "kaiy.ntp-update.com" OR requesturl CONTAINS "ky.0g6666.com" OR requesturl CONTAINS "oriental.ntp-update.com" OR requesturl CONTAINS "guard.ntp-update.com" OR requesturl CONTAINS "oglive.ntp-update.com" OR requesturl CONTAINS "guard.0g6666.com" OR requesturl CONTAINS "plus.ntp-update.com" OR requesturl CONTAINS "oglty.0g6666.com" OR requesturl CONTAINS "oglty.ntp-update.com" OR requesturl CONTAINS "oglty-ml.ntp-update.com" OR requesturl CONTAINS "ml-lty.ntp-update.com" OR requesturl CONTAINS "telegram.ntp-update.com" OR requesturl CONTAINS "easyh.ntp-update.com" OR requesturl CONTAINS "weblog.ntp-update.com" OR requesturl CONTAINS "weblog-ml.ntp-update.com" OR requesturl CONTAINS "o-fsh.ntp-update.com" OR requesturl CONTAINS "idn-tb.ntp-update.com" OR requesturl CONTAINS "tb-ndi2.ntp-update.com" OR requesturl CONTAINS "ml-ndi.ntp-update.com" OR requesturl CONTAINS "vct.0g6666.com" OR requesturl CONTAINS "windows-i-tb.ntp-update.com" OR requesturl CONTAINS "windows-qc-tb-i.ntp-update.com" OR requesturl CONTAINS "windows-tb-i.ntp-update.com")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "a-fms.ntp-update.com" OR destinationhostname CONTAINS "plus.0g6666.com" OR destinationhostname CONTAINS "aprotect.sun-java.com" OR destinationhostname CONTAINS "og8888.0g6666.com" OR destinationhostname CONTAINS "adobe.javaupdate-cdn.com" OR destinationhostname CONTAINS "linux.0g6666.com" OR destinationhostname CONTAINS "ad.ntp-update.com" OR destinationhostname CONTAINS "www.0g6666.com" OR destinationhostname CONTAINS "wt.ntp-update.com" OR destinationhostname CONTAINS "aliyun.ntp-update.com")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "a-fms.ntp-update.com" OR sourcentdomain CONTAINS "plus.0g6666.com" OR sourcentdomain CONTAINS "aprotect.sun-java.com" OR sourcentdomain CONTAINS "og8888.0g6666.com" OR sourcentdomain CONTAINS "adobe.javaupdate-cdn.com" OR sourcentdomain CONTAINS "linux.0g6666.com" OR sourcentdomain CONTAINS "ad.ntp-update.com" OR sourcentdomain CONTAINS "www.0g6666.com" OR sourcentdomain CONTAINS "wt.ntp-update.com" OR sourcentdomain CONTAINS "aliyun.ntp-update.com")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "a-fms.ntp-update.com" OR sourcehostname CONTAINS "plus.0g6666.com" OR sourcehostname CONTAINS "aprotect.sun-java.com" OR sourcehostname CONTAINS "og8888.0g6666.com" OR sourcehostname CONTAINS "adobe.javaupdate-cdn.com" OR sourcehostname CONTAINS "linux.0g6666.com" OR sourcehostname CONTAINS "ad.ntp-update.com" OR sourcehostname CONTAINS "www.0g6666.com" OR sourcehostname CONTAINS "wt.ntp-update.com" OR sourcehostname CONTAINS "aliyun.ntp-update.com")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "a-fms.ntp-update.com" OR destinationntdomain CONTAINS "plus.0g6666.com" OR destinationntdomain CONTAINS "aprotect.sun-java.com" OR destinationntdomain CONTAINS "og8888.0g6666.com" OR destinationntdomain CONTAINS "adobe.javaupdate-cdn.com" OR destinationntdomain CONTAINS "linux.0g6666.com" OR destinationntdomain CONTAINS "ad.ntp-update.com" OR destinationntdomain CONTAINS "www.0g6666.com" OR destinationntdomain CONTAINS "wt.ntp-update.com" OR destinationntdomain CONTAINS "aliyun.ntp-update.com")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND requesturl NOT NULL AND (requesturl CONTAINS "a-fms.ntp-update.com" OR requesturl CONTAINS "plus.0g6666.com" OR requesturl CONTAINS "aprotect.sun-java.com" OR requesturl CONTAINS "og8888.0g6666.com" OR requesturl CONTAINS "adobe.javaupdate-cdn.com" OR requesturl CONTAINS "linux.0g6666.com" OR requesturl CONTAINS "ad.ntp-update.com" OR requesturl CONTAINS "www.0g6666.com" OR requesturl CONTAINS "wt.ntp-update.com" OR requesturl CONTAINS "aliyun.ntp-update.com")
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "a-ad-tml.ntp-update.com" OR destinationhostname CONTAINS "rps-a.ntp-update.com" OR destinationhostname CONTAINS "a-rps.ntp-update.com" OR destinationhostname CONTAINS "dns-a.ntp-update.com" OR destinationhostname CONTAINS "a-tb.ntp-update.com" OR destinationhostname CONTAINS "alast.sun-java.com" OR destinationhostname CONTAINS "alast.ntp-update.com" OR destinationhostname CONTAINS "dell-a.ntp-update.com" OR destinationhostname CONTAINS "a-sp-rps.0g6666.com" OR destinationhostname CONTAINS "windows.javaupdate-cdn.com" OR destinationhostname CONTAINS "javaupdatecdn.com" OR destinationhostname CONTAINS "flash.javaupdate-cdn.com" OR destinationhostname CONTAINS "linux.ntp-update.com" OR destinationhostname CONTAINS "esxi-lty.ntp-update.com" OR destinationhostname CONTAINS "windows.0g6666.com" OR destinationhostname CONTAINS "ubuntu-ndi.ntp-update.com" OR destinationhostname CONTAINS "h1.xpjpz400.com" OR destinationhostname CONTAINS "cg.xpjpz400.com" OR destinationhostname CONTAINS "letsencrypt.msupdatesync.com" OR destinationhostname CONTAINS "cloud.ntp-update.com" OR destinationhostname CONTAINS "fe.ntp-update.com" OR destinationhostname CONTAINS "wtech.ntp-update.com" OR destinationhostname CONTAINS "imp.ntp-update.com" OR destinationhostname CONTAINS "ogplus.ntp-update.com" OR destinationhostname CONTAINS "organization.0g6666.com" OR destinationhostname CONTAINS "global.ntp-update.com" OR destinationhostname CONTAINS "kaiy.0g6666.com" OR destinationhostname CONTAINS "kaiy.ntp-update.com" OR destinationhostname CONTAINS "ky.0g6666.com" OR destinationhostname CONTAINS "oriental.ntp-update.com" OR destinationhostname CONTAINS "guard.ntp-update.com" OR destinationhostname CONTAINS "oglive.ntp-update.com" OR destinationhostname CONTAINS "guard.0g6666.com" OR destinationhostname CONTAINS "plus.ntp-update.com" OR destinationhostname CONTAINS "oglty.0g6666.com" OR destinationhostname CONTAINS "oglty.ntp-update.com" OR destinationhostname CONTAINS "oglty-ml.ntp-update.com" OR destinationhostname CONTAINS "ml-lty.ntp-update.com" OR destinationhostname CONTAINS "telegram.ntp-update.com" OR destinationhostname CONTAINS "easyh.ntp-update.com" OR destinationhostname CONTAINS "weblog.ntp-update.com" OR destinationhostname CONTAINS "weblog-ml.ntp-update.com" OR destinationhostname CONTAINS "o-fsh.ntp-update.com" OR destinationhostname CONTAINS "idn-tb.ntp-update.com" OR destinationhostname CONTAINS "tb-ndi2.ntp-update.com" OR destinationhostname CONTAINS "ml-ndi.ntp-update.com" OR destinationhostname CONTAINS "vct.0g6666.com" OR destinationhostname CONTAINS "windows-i-tb.ntp-update.com" OR destinationhostname CONTAINS "windows-qc-tb-i.ntp-update.com" OR destinationhostname CONTAINS "windows-tb-i.ntp-update.com")
index=activity AND rg_functionality="Cloud Application Security Broker" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "a-ad-tml.ntp-update.com" OR sourcentdomain CONTAINS "rps-a.ntp-update.com" OR sourcentdomain CONTAINS "a-rps.ntp-update.com" OR sourcentdomain CONTAINS "dns-a.ntp-update.com" OR sourcentdomain CONTAINS "a-tb.ntp-update.com" OR sourcentdomain CONTAINS "alast.sun-java.com" OR sourcentdomain CONTAINS "alast.ntp-update.com" OR sourcentdomain CONTAINS "dell-a.ntp-update.com" OR sourcentdomain CONTAINS "a-sp-rps.0g6666.com" OR sourcentdomain CONTAINS "windows.javaupdate-cdn.com" OR sourcentdomain CONTAINS "javaupdatecdn.com" OR sourcentdomain CONTAINS "flash.javaupdate-cdn.com" OR sourcentdomain CONTAINS "linux.ntp-update.com" OR sourcentdomain CONTAINS "esxi-lty.ntp-update.com" OR sourcentdomain CONTAINS "windows.0g6666.com" OR sourcentdomain CONTAINS "ubuntu-ndi.ntp-update.com" OR sourcentdomain CONTAINS "h1.xpjpz400.com" OR sourcentdomain CONTAINS "cg.xpjpz400.com" OR sourcentdomain CONTAINS "letsencrypt.msupdatesync.com" OR sourcentdomain CONTAINS "cloud.ntp-update.com" OR sourcentdomain CONTAINS "fe.ntp-update.com" OR sourcentdomain CONTAINS "wtech.ntp-update.com" OR sourcentdomain CONTAINS "imp.ntp-update.com" OR sourcentdomain CONTAINS "ogplus.ntp-update.com" OR sourcentdomain CONTAINS "organization.0g6666.com" OR sourcentdomain CONTAINS "global.ntp-update.com" OR sourcentdomain CONTAINS "kaiy.0g6666.com" OR sourcentdomain CONTAINS "kaiy.ntp-update.com" OR sourcentdomain CONTAINS "ky.0g6666.com" OR sourcentdomain CONTAINS "oriental.ntp-update.com" OR sourcentdomain CONTAINS "guard.ntp-update.com" OR sourcentdomain CONTAINS "oglive.ntp-update.com" OR sourcentdomain CONTAINS "guard.0g6666.com" OR sourcentdomain CONTAINS "plus.ntp-update.com" OR sourcentdomain CONTAINS "oglty.0g6666.com" OR sourcentdomain CONTAINS "oglty.ntp-update.com" OR sourcentdomain CONTAINS "oglty-ml.ntp-update.com" OR sourcentdomain CONTAINS "ml-lty.ntp-update.com" OR sourcentdomain CONTAINS "telegram.ntp-update.com" OR sourcentdomain CONTAINS "easyh.ntp-update.com" OR sourcentdomain CONTAINS "weblog.ntp-update.com" OR sourcentdomain CONTAINS "weblog-ml.ntp-update.com" OR sourcentdomain CONTAINS "o-fsh.ntp-update.com" OR sourcentdomain CONTAINS "idn-tb.ntp-update.com" OR sourcentdomain CONTAINS "tb-ndi2.ntp-update.com" OR sourcentdomain CONTAINS "ml-ndi.ntp-update.com" OR sourcentdomain CONTAINS "vct.0g6666.com" OR sourcentdomain CONTAINS "windows-i-tb.ntp-update.com" OR sourcentdomain CONTAINS "windows-qc-tb-i.ntp-update.com" OR sourcentdomain CONTAINS "windows-tb-i.ntp-update.com")
index=activity AND rg_functionality="Cloud Application Security Broker" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "a-ad-tml.ntp-update.com" OR sourcehostname CONTAINS "rps-a.ntp-update.com" OR sourcehostname CONTAINS "a-rps.ntp-update.com" OR sourcehostname CONTAINS "dns-a.ntp-update.com" OR sourcehostname CONTAINS "a-tb.ntp-update.com" OR sourcehostname CONTAINS "alast.sun-java.com" OR sourcehostname CONTAINS "alast.ntp-update.com" OR sourcehostname CONTAINS "dell-a.ntp-update.com" OR sourcehostname CONTAINS "a-sp-rps.0g6666.com" OR sourcehostname CONTAINS "windows.javaupdate-cdn.com" OR sourcehostname CONTAINS "javaupdatecdn.com" OR sourcehostname CONTAINS "flash.javaupdate-cdn.com" OR sourcehostname CONTAINS "linux.ntp-update.com" OR sourcehostname CONTAINS "esxi-lty.ntp-update.com" OR sourcehostname CONTAINS "windows.0g6666.com" OR sourcehostname CONTAINS "ubuntu-ndi.ntp-update.com" OR sourcehostname CONTAINS "h1.xpjpz400.com" OR sourcehostname CONTAINS "cg.xpjpz400.com" OR sourcehostname CONTAINS "letsencrypt.msupdatesync.com" OR sourcehostname CONTAINS "cloud.ntp-update.com" OR sourcehostname CONTAINS "fe.ntp-update.com" OR sourcehostname CONTAINS "wtech.ntp-update.com" OR sourcehostname CONTAINS "imp.ntp-update.com" OR sourcehostname CONTAINS "ogplus.ntp-update.com" OR sourcehostname CONTAINS "organization.0g6666.com" OR sourcehostname CONTAINS "global.ntp-update.com" OR sourcehostname CONTAINS "kaiy.0g6666.com" OR sourcehostname CONTAINS "kaiy.ntp-update.com" OR sourcehostname CONTAINS "ky.0g6666.com" OR sourcehostname CONTAINS "oriental.ntp-update.com" OR sourcehostname CONTAINS "guard.ntp-update.com" OR sourcehostname CONTAINS "oglive.ntp-update.com" OR sourcehostname CONTAINS "guard.0g6666.com" OR sourcehostname CONTAINS "plus.ntp-update.com" OR sourcehostname CONTAINS "oglty.0g6666.com" OR sourcehostname CONTAINS "oglty.ntp-update.com" OR sourcehostname CONTAINS "oglty-ml.ntp-update.com" OR sourcehostname CONTAINS "ml-lty.ntp-update.com" OR sourcehostname CONTAINS "telegram.ntp-update.com" OR sourcehostname CONTAINS "easyh.ntp-update.com" OR sourcehostname CONTAINS "weblog.ntp-update.com" OR sourcehostname CONTAINS "weblog-ml.ntp-update.com" OR sourcehostname CONTAINS "o-fsh.ntp-update.com" OR sourcehostname CONTAINS "idn-tb.ntp-update.com" OR sourcehostname CONTAINS "tb-ndi2.ntp-update.com" OR sourcehostname CONTAINS "ml-ndi.ntp-update.com" OR sourcehostname CONTAINS "vct.0g6666.com" OR sourcehostname CONTAINS "windows-i-tb.ntp-update.com" OR sourcehostname CONTAINS "windows-qc-tb-i.ntp-update.com" OR sourcehostname CONTAINS "windows-tb-i.ntp-update.com")
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "a-ad-tml.ntp-update.com" OR destinationntdomain CONTAINS "rps-a.ntp-update.com" OR destinationntdomain CONTAINS "a-rps.ntp-update.com" OR destinationntdomain CONTAINS "dns-a.ntp-update.com" OR destinationntdomain CONTAINS "a-tb.ntp-update.com" OR destinationntdomain CONTAINS "alast.sun-java.com" OR destinationntdomain CONTAINS "alast.ntp-update.com" OR destinationntdomain CONTAINS "dell-a.ntp-update.com" OR destinationntdomain CONTAINS "a-sp-rps.0g6666.com" OR destinationntdomain CONTAINS "windows.javaupdate-cdn.com" OR destinationntdomain CONTAINS "javaupdatecdn.com" OR destinationntdomain CONTAINS "flash.javaupdate-cdn.com" OR destinationntdomain CONTAINS "linux.ntp-update.com" OR destinationntdomain CONTAINS "esxi-lty.ntp-update.com" OR destinationntdomain CONTAINS "windows.0g6666.com" OR destinationntdomain CONTAINS "ubuntu-ndi.ntp-update.com" OR destinationntdomain CONTAINS "h1.xpjpz400.com" OR destinationntdomain CONTAINS "cg.xpjpz400.com" OR destinationntdomain CONTAINS "letsencrypt.msupdatesync.com" OR destinationntdomain CONTAINS "cloud.ntp-update.com" OR destinationntdomain CONTAINS "fe.ntp-update.com" OR destinationntdomain CONTAINS "wtech.ntp-update.com" OR destinationntdomain CONTAINS "imp.ntp-update.com" OR destinationntdomain CONTAINS "ogplus.ntp-update.com" OR destinationntdomain CONTAINS "organization.0g6666.com" OR destinationntdomain CONTAINS "global.ntp-update.com" OR destinationntdomain CONTAINS "kaiy.0g6666.com" OR destinationntdomain CONTAINS "kaiy.ntp-update.com" OR destinationntdomain CONTAINS "ky.0g6666.com" OR destinationntdomain CONTAINS "oriental.ntp-update.com" OR destinationntdomain CONTAINS "guard.ntp-update.com" OR destinationntdomain CONTAINS "oglive.ntp-update.com" OR destinationntdomain CONTAINS "guard.0g6666.com" OR destinationntdomain CONTAINS "plus.ntp-update.com" OR destinationntdomain CONTAINS "oglty.0g6666.com" OR destinationntdomain CONTAINS "oglty.ntp-update.com" OR destinationntdomain CONTAINS "oglty-ml.ntp-update.com" OR destinationntdomain CONTAINS "ml-lty.ntp-update.com" OR destinationntdomain CONTAINS "telegram.ntp-update.com" OR destinationntdomain CONTAINS "easyh.ntp-update.com" OR destinationntdomain CONTAINS "weblog.ntp-update.com" OR destinationntdomain CONTAINS "weblog-ml.ntp-update.com" OR destinationntdomain CONTAINS "o-fsh.ntp-update.com" OR destinationntdomain CONTAINS "idn-tb.ntp-update.com" OR destinationntdomain CONTAINS "tb-ndi2.ntp-update.com" OR destinationntdomain CONTAINS "ml-ndi.ntp-update.com" OR destinationntdomain CONTAINS "vct.0g6666.com" OR destinationntdomain CONTAINS "windows-i-tb.ntp-update.com" OR destinationntdomain CONTAINS "windows-qc-tb-i.ntp-update.com" OR destinationntdomain CONTAINS "windows-tb-i.ntp-update.com")
index=activity AND rg_functionality="Cloud Application Security Broker" AND requesturl NOT NULL AND (requesturl CONTAINS "a-ad-tml.ntp-update.com" OR requesturl CONTAINS "rps-a.ntp-update.com" OR requesturl CONTAINS "a-rps.ntp-update.com" OR requesturl CONTAINS "dns-a.ntp-update.com" OR requesturl CONTAINS "a-tb.ntp-update.com" OR requesturl CONTAINS "alast.sun-java.com" OR requesturl CONTAINS "alast.ntp-update.com" OR requesturl CONTAINS "dell-a.ntp-update.com" OR requesturl CONTAINS "a-sp-rps.0g6666.com" OR requesturl CONTAINS "windows.javaupdate-cdn.com" OR requesturl CONTAINS "javaupdatecdn.com" OR requesturl CONTAINS "flash.javaupdate-cdn.com" OR requesturl CONTAINS "linux.ntp-update.com" OR requesturl CONTAINS "esxi-lty.ntp-update.com" OR requesturl CONTAINS "windows.0g6666.com" OR requesturl CONTAINS "ubuntu-ndi.ntp-update.com" OR requesturl CONTAINS "h1.xpjpz400.com" OR requesturl CONTAINS "cg.xpjpz400.com" OR requesturl CONTAINS "letsencrypt.msupdatesync.com" OR requesturl CONTAINS "cloud.ntp-update.com" OR requesturl CONTAINS "fe.ntp-update.com" OR requesturl CONTAINS "wtech.ntp-update.com" OR requesturl CONTAINS "imp.ntp-update.com" OR requesturl CONTAINS "ogplus.ntp-update.com" OR requesturl CONTAINS "organization.0g6666.com" OR requesturl CONTAINS "global.ntp-update.com" OR requesturl CONTAINS "kaiy.0g6666.com" OR requesturl CONTAINS "kaiy.ntp-update.com" OR requesturl CONTAINS "ky.0g6666.com" OR requesturl CONTAINS "oriental.ntp-update.com" OR requesturl CONTAINS "guard.ntp-update.com" OR requesturl CONTAINS "oglive.ntp-update.com" OR requesturl CONTAINS "guard.0g6666.com" OR requesturl CONTAINS "plus.ntp-update.com" OR requesturl CONTAINS "oglty.0g6666.com" OR requesturl CONTAINS "oglty.ntp-update.com" OR requesturl CONTAINS "oglty-ml.ntp-update.com" OR requesturl CONTAINS "ml-lty.ntp-update.com" OR requesturl CONTAINS "telegram.ntp-update.com" OR requesturl CONTAINS "easyh.ntp-update.com" OR requesturl CONTAINS "weblog.ntp-update.com" OR requesturl CONTAINS "weblog-ml.ntp-update.com" OR requesturl CONTAINS "o-fsh.ntp-update.com" OR requesturl CONTAINS "idn-tb.ntp-update.com" OR requesturl CONTAINS "tb-ndi2.ntp-update.com" OR requesturl CONTAINS "ml-ndi.ntp-update.com" OR requesturl CONTAINS "vct.0g6666.com" OR requesturl CONTAINS "windows-i-tb.ntp-update.com" OR requesturl CONTAINS "windows-qc-tb-i.ntp-update.com" OR requesturl CONTAINS "windows-tb-i.ntp-update.com")
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "a-fms.ntp-update.com" OR destinationhostname CONTAINS "plus.0g6666.com" OR destinationhostname CONTAINS "aprotect.sun-java.com" OR destinationhostname CONTAINS "og8888.0g6666.com" OR destinationhostname CONTAINS "adobe.javaupdate-cdn.com" OR destinationhostname CONTAINS "linux.0g6666.com" OR destinationhostname CONTAINS "ad.ntp-update.com" OR destinationhostname CONTAINS "www.0g6666.com" OR destinationhostname CONTAINS "wt.ntp-update.com" OR destinationhostname CONTAINS "aliyun.ntp-update.com")
index=activity AND rg_functionality="Cloud Application Security Broker" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "a-fms.ntp-update.com" OR sourcentdomain CONTAINS "plus.0g6666.com" OR sourcentdomain CONTAINS "aprotect.sun-java.com" OR sourcentdomain CONTAINS "og8888.0g6666.com" OR sourcentdomain CONTAINS "adobe.javaupdate-cdn.com" OR sourcentdomain CONTAINS "linux.0g6666.com" OR sourcentdomain CONTAINS "ad.ntp-update.com" OR sourcentdomain CONTAINS "www.0g6666.com" OR sourcentdomain CONTAINS "wt.ntp-update.com" OR sourcentdomain CONTAINS "aliyun.ntp-update.com")
index=activity AND rg_functionality="Cloud Application Security Broker" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "a-fms.ntp-update.com" OR sourcehostname CONTAINS "plus.0g6666.com" OR sourcehostname CONTAINS "aprotect.sun-java.com" OR sourcehostname CONTAINS "og8888.0g6666.com" OR sourcehostname CONTAINS "adobe.javaupdate-cdn.com" OR sourcehostname CONTAINS "linux.0g6666.com" OR sourcehostname CONTAINS "ad.ntp-update.com" OR sourcehostname CONTAINS "www.0g6666.com" OR sourcehostname CONTAINS "wt.ntp-update.com" OR sourcehostname CONTAINS "aliyun.ntp-update.com")
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "a-fms.ntp-update.com" OR destinationntdomain CONTAINS "plus.0g6666.com" OR destinationntdomain CONTAINS "aprotect.sun-java.com" OR destinationntdomain CONTAINS "og8888.0g6666.com" OR destinationntdomain CONTAINS "adobe.javaupdate-cdn.com" OR destinationntdomain CONTAINS "linux.0g6666.com" OR destinationntdomain CONTAINS "ad.ntp-update.com" OR destinationntdomain CONTAINS "www.0g6666.com" OR destinationntdomain CONTAINS "wt.ntp-update.com" OR destinationntdomain CONTAINS "aliyun.ntp-update.com")
index=activity AND rg_functionality="Cloud Application Security Broker" AND requesturl NOT NULL AND (requesturl CONTAINS "a-fms.ntp-update.com" OR requesturl CONTAINS "plus.0g6666.com" OR requesturl CONTAINS "aprotect.sun-java.com" OR requesturl CONTAINS "og8888.0g6666.com" OR requesturl CONTAINS "adobe.javaupdate-cdn.com" OR requesturl CONTAINS "linux.0g6666.com" OR requesturl CONTAINS "ad.ntp-update.com" OR requesturl CONTAINS "www.0g6666.com" OR requesturl CONTAINS "wt.ntp-update.com" OR requesturl CONTAINS "aliyun.ntp-update.com")
index=activity AND rg_functionality="Source Code Repository" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "a-ad-tml.ntp-update.com" OR destinationhostname CONTAINS "rps-a.ntp-update.com" OR destinationhostname CONTAINS "a-rps.ntp-update.com" OR destinationhostname CONTAINS "dns-a.ntp-update.com" OR destinationhostname CONTAINS "a-tb.ntp-update.com" OR destinationhostname CONTAINS "alast.sun-java.com" OR destinationhostname CONTAINS "alast.ntp-update.com" OR destinationhostname CONTAINS "dell-a.ntp-update.com" OR destinationhostname CONTAINS "a-sp-rps.0g6666.com" OR destinationhostname CONTAINS "windows.javaupdate-cdn.com" OR destinationhostname CONTAINS "javaupdatecdn.com" OR destinationhostname CONTAINS "flash.javaupdate-cdn.com" OR destinationhostname CONTAINS "linux.ntp-update.com" OR destinationhostname CONTAINS "esxi-lty.ntp-update.com" OR destinationhostname CONTAINS "windows.0g6666.com" OR destinationhostname CONTAINS "ubuntu-ndi.ntp-update.com" OR destinationhostname CONTAINS "h1.xpjpz400.com" OR destinationhostname CONTAINS "cg.xpjpz400.com" OR destinationhostname CONTAINS "letsencrypt.msupdatesync.com" OR destinationhostname CONTAINS "cloud.ntp-update.com" OR destinationhostname CONTAINS "fe.ntp-update.com" OR destinationhostname CONTAINS "wtech.ntp-update.com" OR destinationhostname CONTAINS "imp.ntp-update.com" OR destinationhostname CONTAINS "ogplus.ntp-update.com" OR destinationhostname CONTAINS "organization.0g6666.com" OR destinationhostname CONTAINS "global.ntp-update.com" OR destinationhostname CONTAINS "kaiy.0g6666.com" OR destinationhostname CONTAINS "kaiy.ntp-update.com" OR destinationhostname CONTAINS "ky.0g6666.com" OR destinationhostname CONTAINS "oriental.ntp-update.com" OR destinationhostname CONTAINS "guard.ntp-update.com" OR destinationhostname CONTAINS "oglive.ntp-update.com" OR destinationhostname CONTAINS "guard.0g6666.com" OR destinationhostname CONTAINS "plus.ntp-update.com" OR destinationhostname CONTAINS "oglty.0g6666.com" OR destinationhostname CONTAINS "oglty.ntp-update.com" OR destinationhostname CONTAINS "oglty-ml.ntp-update.com" OR destinationhostname CONTAINS "ml-lty.ntp-update.com" OR destinationhostname CONTAINS "telegram.ntp-update.com" OR destinationhostname CONTAINS "easyh.ntp-update.com" OR destinationhostname CONTAINS "weblog.ntp-update.com" OR destinationhostname CONTAINS "weblog-ml.ntp-update.com" OR destinationhostname CONTAINS "o-fsh.ntp-update.com" OR destinationhostname CONTAINS "idn-tb.ntp-update.com" OR destinationhostname CONTAINS "tb-ndi2.ntp-update.com" OR destinationhostname CONTAINS "ml-ndi.ntp-update.com" OR destinationhostname CONTAINS "vct.0g6666.com" OR destinationhostname CONTAINS "windows-i-tb.ntp-update.com" OR destinationhostname CONTAINS "windows-qc-tb-i.ntp-update.com" OR destinationhostname CONTAINS "windows-tb-i.ntp-update.com")
index=activity AND rg_functionality="Source Code Repository" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "a-ad-tml.ntp-update.com" OR sourcentdomain CONTAINS "rps-a.ntp-update.com" OR sourcentdomain CONTAINS "a-rps.ntp-update.com" OR sourcentdomain CONTAINS "dns-a.ntp-update.com" OR sourcentdomain CONTAINS "a-tb.ntp-update.com" OR sourcentdomain CONTAINS "alast.sun-java.com" OR sourcentdomain CONTAINS "alast.ntp-update.com" OR sourcentdomain CONTAINS "dell-a.ntp-update.com" OR sourcentdomain CONTAINS "a-sp-rps.0g6666.com" OR sourcentdomain CONTAINS "windows.javaupdate-cdn.com" OR sourcentdomain CONTAINS "javaupdatecdn.com" OR sourcentdomain CONTAINS "flash.javaupdate-cdn.com" OR sourcentdomain CONTAINS "linux.ntp-update.com" OR sourcentdomain CONTAINS "esxi-lty.ntp-update.com" OR sourcentdomain CONTAINS "windows.0g6666.com" OR sourcentdomain CONTAINS "ubuntu-ndi.ntp-update.com" OR sourcentdomain CONTAINS "h1.xpjpz400.com" OR sourcentdomain CONTAINS "cg.xpjpz400.com" OR sourcentdomain CONTAINS "letsencrypt.msupdatesync.com" OR sourcentdomain CONTAINS "cloud.ntp-update.com" OR sourcentdomain CONTAINS "fe.ntp-update.com" OR sourcentdomain CONTAINS "wtech.ntp-update.com" OR sourcentdomain CONTAINS "imp.ntp-update.com" OR sourcentdomain CONTAINS "ogplus.ntp-update.com" OR sourcentdomain CONTAINS "organization.0g6666.com" OR sourcentdomain CONTAINS "global.ntp-update.com" OR sourcentdomain CONTAINS "kaiy.0g6666.com" OR sourcentdomain CONTAINS "kaiy.ntp-update.com" OR sourcentdomain CONTAINS "ky.0g6666.com" OR sourcentdomain CONTAINS "oriental.ntp-update.com" OR sourcentdomain CONTAINS "guard.ntp-update.com" OR sourcentdomain CONTAINS "oglive.ntp-update.com" OR sourcentdomain CONTAINS "guard.0g6666.com" OR sourcentdomain CONTAINS "plus.ntp-update.com" OR sourcentdomain CONTAINS "oglty.0g6666.com" OR sourcentdomain CONTAINS "oglty.ntp-update.com" OR sourcentdomain CONTAINS "oglty-ml.ntp-update.com" OR sourcentdomain CONTAINS "ml-lty.ntp-update.com" OR sourcentdomain CONTAINS "telegram.ntp-update.com" OR sourcentdomain CONTAINS "easyh.ntp-update.com" OR sourcentdomain CONTAINS "weblog.ntp-update.com" OR sourcentdomain CONTAINS "weblog-ml.ntp-update.com" OR sourcentdomain CONTAINS "o-fsh.ntp-update.com" OR sourcentdomain CONTAINS "idn-tb.ntp-update.com" OR sourcentdomain CONTAINS "tb-ndi2.ntp-update.com" OR sourcentdomain CONTAINS "ml-ndi.ntp-update.com" OR sourcentdomain CONTAINS "vct.0g6666.com" OR sourcentdomain CONTAINS "windows-i-tb.ntp-update.com" OR sourcentdomain CONTAINS "windows-qc-tb-i.ntp-update.com" OR sourcentdomain CONTAINS "windows-tb-i.ntp-update.com")
index=activity AND rg_functionality="Source Code Repository" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "a-ad-tml.ntp-update.com" OR sourcehostname CONTAINS "rps-a.ntp-update.com" OR sourcehostname CONTAINS "a-rps.ntp-update.com" OR sourcehostname CONTAINS "dns-a.ntp-update.com" OR sourcehostname CONTAINS "a-tb.ntp-update.com" OR sourcehostname CONTAINS "alast.sun-java.com" OR sourcehostname CONTAINS "alast.ntp-update.com" OR sourcehostname CONTAINS "dell-a.ntp-update.com" OR sourcehostname CONTAINS "a-sp-rps.0g6666.com" OR sourcehostname CONTAINS "windows.javaupdate-cdn.com" OR sourcehostname CONTAINS "javaupdatecdn.com" OR sourcehostname CONTAINS "flash.javaupdate-cdn.com" OR sourcehostname CONTAINS "linux.ntp-update.com" OR sourcehostname CONTAINS "esxi-lty.ntp-update.com" OR sourcehostname CONTAINS "windows.0g6666.com" OR sourcehostname CONTAINS "ubuntu-ndi.ntp-update.com" OR sourcehostname CONTAINS "h1.xpjpz400.com" OR sourcehostname CONTAINS "cg.xpjpz400.com" OR sourcehostname CONTAINS "letsencrypt.msupdatesync.com" OR sourcehostname CONTAINS "cloud.ntp-update.com" OR sourcehostname CONTAINS "fe.ntp-update.com" OR sourcehostname CONTAINS "wtech.ntp-update.com" OR sourcehostname CONTAINS "imp.ntp-update.com" OR sourcehostname CONTAINS "ogplus.ntp-update.com" OR sourcehostname CONTAINS "organization.0g6666.com" OR sourcehostname CONTAINS "global.ntp-update.com" OR sourcehostname CONTAINS "kaiy.0g6666.com" OR sourcehostname CONTAINS "kaiy.ntp-update.com" OR sourcehostname CONTAINS "ky.0g6666.com" OR sourcehostname CONTAINS "oriental.ntp-update.com" OR sourcehostname CONTAINS "guard.ntp-update.com" OR sourcehostname CONTAINS "oglive.ntp-update.com" OR sourcehostname CONTAINS "guard.0g6666.com" OR sourcehostname CONTAINS "plus.ntp-update.com" OR sourcehostname CONTAINS "oglty.0g6666.com" OR sourcehostname CONTAINS "oglty.ntp-update.com" OR sourcehostname CONTAINS "oglty-ml.ntp-update.com" OR sourcehostname CONTAINS "ml-lty.ntp-update.com" OR sourcehostname CONTAINS "telegram.ntp-update.com" OR sourcehostname CONTAINS "easyh.ntp-update.com" OR sourcehostname CONTAINS "weblog.ntp-update.com" OR sourcehostname CONTAINS "weblog-ml.ntp-update.com" OR sourcehostname CONTAINS "o-fsh.ntp-update.com" OR sourcehostname CONTAINS "idn-tb.ntp-update.com" OR sourcehostname CONTAINS "tb-ndi2.ntp-update.com" OR sourcehostname CONTAINS "ml-ndi.ntp-update.com" OR sourcehostname CONTAINS "vct.0g6666.com" OR sourcehostname CONTAINS "windows-i-tb.ntp-update.com" OR sourcehostname CONTAINS "windows-qc-tb-i.ntp-update.com" OR sourcehostname CONTAINS "windows-tb-i.ntp-update.com")
index=activity AND rg_functionality="Source Code Repository" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "a-ad-tml.ntp-update.com" OR destinationntdomain CONTAINS "rps-a.ntp-update.com" OR destinationntdomain CONTAINS "a-rps.ntp-update.com" OR destinationntdomain CONTAINS "dns-a.ntp-update.com" OR destinationntdomain CONTAINS "a-tb.ntp-update.com" OR destinationntdomain CONTAINS "alast.sun-java.com" OR destinationntdomain CONTAINS "alast.ntp-update.com" OR destinationntdomain CONTAINS "dell-a.ntp-update.com" OR destinationntdomain CONTAINS "a-sp-rps.0g6666.com" OR destinationntdomain CONTAINS "windows.javaupdate-cdn.com" OR destinationntdomain CONTAINS "javaupdatecdn.com" OR destinationntdomain CONTAINS "flash.javaupdate-cdn.com" OR destinationntdomain CONTAINS "linux.ntp-update.com" OR destinationntdomain CONTAINS "esxi-lty.ntp-update.com" OR destinationntdomain CONTAINS "windows.0g6666.com" OR destinationntdomain CONTAINS "ubuntu-ndi.ntp-update.com" OR destinationntdomain CONTAINS "h1.xpjpz400.com" OR destinationntdomain CONTAINS "cg.xpjpz400.com" OR destinationntdomain CONTAINS "letsencrypt.msupdatesync.com" OR destinationntdomain CONTAINS "cloud.ntp-update.com" OR destinationntdomain CONTAINS "fe.ntp-update.com" OR destinationntdomain CONTAINS "wtech.ntp-update.com" OR destinationntdomain CONTAINS "imp.ntp-update.com" OR destinationntdomain CONTAINS "ogplus.ntp-update.com" OR destinationntdomain CONTAINS "organization.0g6666.com" OR destinationntdomain CONTAINS "global.ntp-update.com" OR destinationntdomain CONTAINS "kaiy.0g6666.com" OR destinationntdomain CONTAINS "kaiy.ntp-update.com" OR destinationntdomain CONTAINS "ky.0g6666.com" OR destinationntdomain CONTAINS "oriental.ntp-update.com" OR destinationntdomain CONTAINS "guard.ntp-update.com" OR destinationntdomain CONTAINS "oglive.ntp-update.com" OR destinationntdomain CONTAINS "guard.0g6666.com" OR destinationntdomain CONTAINS "plus.ntp-update.com" OR destinationntdomain CONTAINS "oglty.0g6666.com" OR destinationntdomain CONTAINS "oglty.ntp-update.com" OR destinationntdomain CONTAINS "oglty-ml.ntp-update.com" OR destinationntdomain CONTAINS "ml-lty.ntp-update.com" OR destinationntdomain CONTAINS "telegram.ntp-update.com" OR destinationntdomain CONTAINS "easyh.ntp-update.com" OR destinationntdomain CONTAINS "weblog.ntp-update.com" OR destinationntdomain CONTAINS "weblog-ml.ntp-update.com" OR destinationntdomain CONTAINS "o-fsh.ntp-update.com" OR destinationntdomain CONTAINS "idn-tb.ntp-update.com" OR destinationntdomain CONTAINS "tb-ndi2.ntp-update.com" OR destinationntdomain CONTAINS "ml-ndi.ntp-update.com" OR destinationntdomain CONTAINS "vct.0g6666.com" OR destinationntdomain CONTAINS "windows-i-tb.ntp-update.com" OR destinationntdomain CONTAINS "windows-qc-tb-i.ntp-update.com" OR destinationntdomain CONTAINS "windows-tb-i.ntp-update.com")
index=activity AND rg_functionality="Source Code Repository" AND requesturl NOT NULL AND (requesturl CONTAINS "a-ad-tml.ntp-update.com" OR requesturl CONTAINS "rps-a.ntp-update.com" OR requesturl CONTAINS "a-rps.ntp-update.com" OR requesturl CONTAINS "dns-a.ntp-update.com" OR requesturl CONTAINS "a-tb.ntp-update.com" OR requesturl CONTAINS "alast.sun-java.com" OR requesturl CONTAINS "alast.ntp-update.com" OR requesturl CONTAINS "dell-a.ntp-update.com" OR requesturl CONTAINS "a-sp-rps.0g6666.com" OR requesturl CONTAINS "windows.javaupdate-cdn.com" OR requesturl CONTAINS "javaupdatecdn.com" OR requesturl CONTAINS "flash.javaupdate-cdn.com" OR requesturl CONTAINS "linux.ntp-update.com" OR requesturl CONTAINS "esxi-lty.ntp-update.com" OR requesturl CONTAINS "windows.0g6666.com" OR requesturl CONTAINS "ubuntu-ndi.ntp-update.com" OR requesturl CONTAINS "h1.xpjpz400.com" OR requesturl CONTAINS "cg.xpjpz400.com" OR requesturl CONTAINS "letsencrypt.msupdatesync.com" OR requesturl CONTAINS "cloud.ntp-update.com" OR requesturl CONTAINS "fe.ntp-update.com" OR requesturl CONTAINS "wtech.ntp-update.com" OR requesturl CONTAINS "imp.ntp-update.com" OR requesturl CONTAINS "ogplus.ntp-update.com" OR requesturl CONTAINS "organization.0g6666.com" OR requesturl CONTAINS "global.ntp-update.com" OR requesturl CONTAINS "kaiy.0g6666.com" OR requesturl CONTAINS "kaiy.ntp-update.com" OR requesturl CONTAINS "ky.0g6666.com" OR requesturl CONTAINS "oriental.ntp-update.com" OR requesturl CONTAINS "guard.ntp-update.com" OR requesturl CONTAINS "oglive.ntp-update.com" OR requesturl CONTAINS "guard.0g6666.com" OR requesturl CONTAINS "plus.ntp-update.com" OR requesturl CONTAINS "oglty.0g6666.com" OR requesturl CONTAINS "oglty.ntp-update.com" OR requesturl CONTAINS "oglty-ml.ntp-update.com" OR requesturl CONTAINS "ml-lty.ntp-update.com" OR requesturl CONTAINS "telegram.ntp-update.com" OR requesturl CONTAINS "easyh.ntp-update.com" OR requesturl CONTAINS "weblog.ntp-update.com" OR requesturl CONTAINS "weblog-ml.ntp-update.com" OR requesturl CONTAINS "o-fsh.ntp-update.com" OR requesturl CONTAINS "idn-tb.ntp-update.com" OR requesturl CONTAINS "tb-ndi2.ntp-update.com" OR requesturl CONTAINS "ml-ndi.ntp-update.com" OR requesturl CONTAINS "vct.0g6666.com" OR requesturl CONTAINS "windows-i-tb.ntp-update.com" OR requesturl CONTAINS "windows-qc-tb-i.ntp-update.com" OR requesturl CONTAINS "windows-tb-i.ntp-update.com")
index=activity AND rg_functionality="Source Code Repository" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "a-fms.ntp-update.com" OR destinationhostname CONTAINS "plus.0g6666.com" OR destinationhostname CONTAINS "aprotect.sun-java.com" OR destinationhostname CONTAINS "og8888.0g6666.com" OR destinationhostname CONTAINS "adobe.javaupdate-cdn.com" OR destinationhostname CONTAINS "linux.0g6666.com" OR destinationhostname CONTAINS "ad.ntp-update.com" OR destinationhostname CONTAINS "www.0g6666.com" OR destinationhostname CONTAINS "wt.ntp-update.com" OR destinationhostname CONTAINS "aliyun.ntp-update.com")
index=activity AND rg_functionality="Source Code Repository" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "a-fms.ntp-update.com" OR sourcentdomain CONTAINS "plus.0g6666.com" OR sourcentdomain CONTAINS "aprotect.sun-java.com" OR sourcentdomain CONTAINS "og8888.0g6666.com" OR sourcentdomain CONTAINS "adobe.javaupdate-cdn.com" OR sourcentdomain CONTAINS "linux.0g6666.com" OR sourcentdomain CONTAINS "ad.ntp-update.com" OR sourcentdomain CONTAINS "www.0g6666.com" OR sourcentdomain CONTAINS "wt.ntp-update.com" OR sourcentdomain CONTAINS "aliyun.ntp-update.com")
index=activity AND rg_functionality="Source Code Repository" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "a-fms.ntp-update.com" OR sourcehostname CONTAINS "plus.0g6666.com" OR sourcehostname CONTAINS "aprotect.sun-java.com" OR sourcehostname CONTAINS "og8888.0g6666.com" OR sourcehostname CONTAINS "adobe.javaupdate-cdn.com" OR sourcehostname CONTAINS "linux.0g6666.com" OR sourcehostname CONTAINS "ad.ntp-update.com" OR sourcehostname CONTAINS "www.0g6666.com" OR sourcehostname CONTAINS "wt.ntp-update.com" OR sourcehostname CONTAINS "aliyun.ntp-update.com")
index=activity AND rg_functionality="Source Code Repository" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "a-fms.ntp-update.com" OR destinationntdomain CONTAINS "plus.0g6666.com" OR destinationntdomain CONTAINS "aprotect.sun-java.com" OR destinationntdomain CONTAINS "og8888.0g6666.com" OR destinationntdomain CONTAINS "adobe.javaupdate-cdn.com" OR destinationntdomain CONTAINS "linux.0g6666.com" OR destinationntdomain CONTAINS "ad.ntp-update.com" OR destinationntdomain CONTAINS "www.0g6666.com" OR destinationntdomain CONTAINS "wt.ntp-update.com" OR destinationntdomain CONTAINS "aliyun.ntp-update.com")
index=activity AND rg_functionality="Source Code Repository" AND requesturl NOT NULL AND (requesturl CONTAINS "a-fms.ntp-update.com" OR requesturl CONTAINS "plus.0g6666.com" OR requesturl CONTAINS "aprotect.sun-java.com" OR requesturl CONTAINS "og8888.0g6666.com" OR requesturl CONTAINS "adobe.javaupdate-cdn.com" OR requesturl CONTAINS "linux.0g6666.com" OR requesturl CONTAINS "ad.ntp-update.com" OR requesturl CONTAINS "www.0g6666.com" OR requesturl CONTAINS "wt.ntp-update.com" OR requesturl CONTAINS "aliyun.ntp-update.com")
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "a-ad-tml.ntp-update.com" OR destinationhostname CONTAINS "rps-a.ntp-update.com" OR destinationhostname CONTAINS "a-rps.ntp-update.com" OR destinationhostname CONTAINS "dns-a.ntp-update.com" OR destinationhostname CONTAINS "a-tb.ntp-update.com" OR destinationhostname CONTAINS "alast.sun-java.com" OR destinationhostname CONTAINS "alast.ntp-update.com" OR destinationhostname CONTAINS "dell-a.ntp-update.com" OR destinationhostname CONTAINS "a-sp-rps.0g6666.com" OR destinationhostname CONTAINS "windows.javaupdate-cdn.com" OR destinationhostname CONTAINS "javaupdatecdn.com" OR destinationhostname CONTAINS "flash.javaupdate-cdn.com" OR destinationhostname CONTAINS "linux.ntp-update.com" OR destinationhostname CONTAINS "esxi-lty.ntp-update.com" OR destinationhostname CONTAINS "windows.0g6666.com" OR destinationhostname CONTAINS "ubuntu-ndi.ntp-update.com" OR destinationhostname CONTAINS "h1.xpjpz400.com" OR destinationhostname CONTAINS "cg.xpjpz400.com" OR destinationhostname CONTAINS "letsencrypt.msupdatesync.com" OR destinationhostname CONTAINS "cloud.ntp-update.com" OR destinationhostname CONTAINS "fe.ntp-update.com" OR destinationhostname CONTAINS "wtech.ntp-update.com" OR destinationhostname CONTAINS "imp.ntp-update.com" OR destinationhostname CONTAINS "ogplus.ntp-update.com" OR destinationhostname CONTAINS "organization.0g6666.com" OR destinationhostname CONTAINS "global.ntp-update.com" OR destinationhostname CONTAINS "kaiy.0g6666.com" OR destinationhostname CONTAINS "kaiy.ntp-update.com" OR destinationhostname CONTAINS "ky.0g6666.com" OR destinationhostname CONTAINS "oriental.ntp-update.com" OR destinationhostname CONTAINS "guard.ntp-update.com" OR destinationhostname CONTAINS "oglive.ntp-update.com" OR destinationhostname CONTAINS "guard.0g6666.com" OR destinationhostname CONTAINS "plus.ntp-update.com" OR destinationhostname CONTAINS "oglty.0g6666.com" OR destinationhostname CONTAINS "oglty.ntp-update.com" OR destinationhostname CONTAINS "oglty-ml.ntp-update.com" OR destinationhostname CONTAINS "ml-lty.ntp-update.com" OR destinationhostname CONTAINS "telegram.ntp-update.com" OR destinationhostname CONTAINS "easyh.ntp-update.com" OR destinationhostname CONTAINS "weblog.ntp-update.com" OR destinationhostname CONTAINS "weblog-ml.ntp-update.com" OR destinationhostname CONTAINS "o-fsh.ntp-update.com" OR destinationhostname CONTAINS "idn-tb.ntp-update.com" OR destinationhostname CONTAINS "tb-ndi2.ntp-update.com" OR destinationhostname CONTAINS "ml-ndi.ntp-update.com" OR destinationhostname CONTAINS "vct.0g6666.com" OR destinationhostname CONTAINS "windows-i-tb.ntp-update.com" OR destinationhostname CONTAINS "windows-qc-tb-i.ntp-update.com" OR destinationhostname CONTAINS "windows-tb-i.ntp-update.com")
index=activity AND rg_functionality="Cloud Email / Email Security" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "a-ad-tml.ntp-update.com" OR sourcentdomain CONTAINS "rps-a.ntp-update.com" OR sourcentdomain CONTAINS "a-rps.ntp-update.com" OR sourcentdomain CONTAINS "dns-a.ntp-update.com" OR sourcentdomain CONTAINS "a-tb.ntp-update.com" OR sourcentdomain CONTAINS "alast.sun-java.com" OR sourcentdomain CONTAINS "alast.ntp-update.com" OR sourcentdomain CONTAINS "dell-a.ntp-update.com" OR sourcentdomain CONTAINS "a-sp-rps.0g6666.com" OR sourcentdomain CONTAINS "windows.javaupdate-cdn.com" OR sourcentdomain CONTAINS "javaupdatecdn.com" OR sourcentdomain CONTAINS "flash.javaupdate-cdn.com" OR sourcentdomain CONTAINS "linux.ntp-update.com" OR sourcentdomain CONTAINS "esxi-lty.ntp-update.com" OR sourcentdomain CONTAINS "windows.0g6666.com" OR sourcentdomain CONTAINS "ubuntu-ndi.ntp-update.com" OR sourcentdomain CONTAINS "h1.xpjpz400.com" OR sourcentdomain CONTAINS "cg.xpjpz400.com" OR sourcentdomain CONTAINS "letsencrypt.msupdatesync.com" OR sourcentdomain CONTAINS "cloud.ntp-update.com" OR sourcentdomain CONTAINS "fe.ntp-update.com" OR sourcentdomain CONTAINS "wtech.ntp-update.com" OR sourcentdomain CONTAINS "imp.ntp-update.com" OR sourcentdomain CONTAINS "ogplus.ntp-update.com" OR sourcentdomain CONTAINS "organization.0g6666.com" OR sourcentdomain CONTAINS "global.ntp-update.com" OR sourcentdomain CONTAINS "kaiy.0g6666.com" OR sourcentdomain CONTAINS "kaiy.ntp-update.com" OR sourcentdomain CONTAINS "ky.0g6666.com" OR sourcentdomain CONTAINS "oriental.ntp-update.com" OR sourcentdomain CONTAINS "guard.ntp-update.com" OR sourcentdomain CONTAINS "oglive.ntp-update.com" OR sourcentdomain CONTAINS "guard.0g6666.com" OR sourcentdomain CONTAINS "plus.ntp-update.com" OR sourcentdomain CONTAINS "oglty.0g6666.com" OR sourcentdomain CONTAINS "oglty.ntp-update.com" OR sourcentdomain CONTAINS "oglty-ml.ntp-update.com" OR sourcentdomain CONTAINS "ml-lty.ntp-update.com" OR sourcentdomain CONTAINS "telegram.ntp-update.com" OR sourcentdomain CONTAINS "easyh.ntp-update.com" OR sourcentdomain CONTAINS "weblog.ntp-update.com" OR sourcentdomain CONTAINS "weblog-ml.ntp-update.com" OR sourcentdomain CONTAINS "o-fsh.ntp-update.com" OR sourcentdomain CONTAINS "idn-tb.ntp-update.com" OR sourcentdomain CONTAINS "tb-ndi2.ntp-update.com" OR sourcentdomain CONTAINS "ml-ndi.ntp-update.com" OR sourcentdomain CONTAINS "vct.0g6666.com" OR sourcentdomain CONTAINS "windows-i-tb.ntp-update.com" OR sourcentdomain CONTAINS "windows-qc-tb-i.ntp-update.com" OR sourcentdomain CONTAINS "windows-tb-i.ntp-update.com")
index=activity AND rg_functionality="Cloud Email / Email Security" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "a-ad-tml.ntp-update.com" OR sourcehostname CONTAINS "rps-a.ntp-update.com" OR sourcehostname CONTAINS "a-rps.ntp-update.com" OR sourcehostname CONTAINS "dns-a.ntp-update.com" OR sourcehostname CONTAINS "a-tb.ntp-update.com" OR sourcehostname CONTAINS "alast.sun-java.com" OR sourcehostname CONTAINS "alast.ntp-update.com" OR sourcehostname CONTAINS "dell-a.ntp-update.com" OR sourcehostname CONTAINS "a-sp-rps.0g6666.com" OR sourcehostname CONTAINS "windows.javaupdate-cdn.com" OR sourcehostname CONTAINS "javaupdatecdn.com" OR sourcehostname CONTAINS "flash.javaupdate-cdn.com" OR sourcehostname CONTAINS "linux.ntp-update.com" OR sourcehostname CONTAINS "esxi-lty.ntp-update.com" OR sourcehostname CONTAINS "windows.0g6666.com" OR sourcehostname CONTAINS "ubuntu-ndi.ntp-update.com" OR sourcehostname CONTAINS "h1.xpjpz400.com" OR sourcehostname CONTAINS "cg.xpjpz400.com" OR sourcehostname CONTAINS "letsencrypt.msupdatesync.com" OR sourcehostname CONTAINS "cloud.ntp-update.com" OR sourcehostname CONTAINS "fe.ntp-update.com" OR sourcehostname CONTAINS "wtech.ntp-update.com" OR sourcehostname CONTAINS "imp.ntp-update.com" OR sourcehostname CONTAINS "ogplus.ntp-update.com" OR sourcehostname CONTAINS "organization.0g6666.com" OR sourcehostname CONTAINS "global.ntp-update.com" OR sourcehostname CONTAINS "kaiy.0g6666.com" OR sourcehostname CONTAINS "kaiy.ntp-update.com" OR sourcehostname CONTAINS "ky.0g6666.com" OR sourcehostname CONTAINS "oriental.ntp-update.com" OR sourcehostname CONTAINS "guard.ntp-update.com" OR sourcehostname CONTAINS "oglive.ntp-update.com" OR sourcehostname CONTAINS "guard.0g6666.com" OR sourcehostname CONTAINS "plus.ntp-update.com" OR sourcehostname CONTAINS "oglty.0g6666.com" OR sourcehostname CONTAINS "oglty.ntp-update.com" OR sourcehostname CONTAINS "oglty-ml.ntp-update.com" OR sourcehostname CONTAINS "ml-lty.ntp-update.com" OR sourcehostname CONTAINS "telegram.ntp-update.com" OR sourcehostname CONTAINS "easyh.ntp-update.com" OR sourcehostname CONTAINS "weblog.ntp-update.com" OR sourcehostname CONTAINS "weblog-ml.ntp-update.com" OR sourcehostname CONTAINS "o-fsh.ntp-update.com" OR sourcehostname CONTAINS "idn-tb.ntp-update.com" OR sourcehostname CONTAINS "tb-ndi2.ntp-update.com" OR sourcehostname CONTAINS "ml-ndi.ntp-update.com" OR sourcehostname CONTAINS "vct.0g6666.com" OR sourcehostname CONTAINS "windows-i-tb.ntp-update.com" OR sourcehostname CONTAINS "windows-qc-tb-i.ntp-update.com" OR sourcehostname CONTAINS "windows-tb-i.ntp-update.com")
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "a-ad-tml.ntp-update.com" OR destinationntdomain CONTAINS "rps-a.ntp-update.com" OR destinationntdomain CONTAINS "a-rps.ntp-update.com" OR destinationntdomain CONTAINS "dns-a.ntp-update.com" OR destinationntdomain CONTAINS "a-tb.ntp-update.com" OR destinationntdomain CONTAINS "alast.sun-java.com" OR destinationntdomain CONTAINS "alast.ntp-update.com" OR destinationntdomain CONTAINS "dell-a.ntp-update.com" OR destinationntdomain CONTAINS "a-sp-rps.0g6666.com" OR destinationntdomain CONTAINS "windows.javaupdate-cdn.com" OR destinationntdomain CONTAINS "javaupdatecdn.com" OR destinationntdomain CONTAINS "flash.javaupdate-cdn.com" OR destinationntdomain CONTAINS "linux.ntp-update.com" OR destinationntdomain CONTAINS "esxi-lty.ntp-update.com" OR destinationntdomain CONTAINS "windows.0g6666.com" OR destinationntdomain CONTAINS "ubuntu-ndi.ntp-update.com" OR destinationntdomain CONTAINS "h1.xpjpz400.com" OR destinationntdomain CONTAINS "cg.xpjpz400.com" OR destinationntdomain CONTAINS "letsencrypt.msupdatesync.com" OR destinationntdomain CONTAINS "cloud.ntp-update.com" OR destinationntdomain CONTAINS "fe.ntp-update.com" OR destinationntdomain CONTAINS "wtech.ntp-update.com" OR destinationntdomain CONTAINS "imp.ntp-update.com" OR destinationntdomain CONTAINS "ogplus.ntp-update.com" OR destinationntdomain CONTAINS "organization.0g6666.com" OR destinationntdomain CONTAINS "global.ntp-update.com" OR destinationntdomain CONTAINS "kaiy.0g6666.com" OR destinationntdomain CONTAINS "kaiy.ntp-update.com" OR destinationntdomain CONTAINS "ky.0g6666.com" OR destinationntdomain CONTAINS "oriental.ntp-update.com" OR destinationntdomain CONTAINS "guard.ntp-update.com" OR destinationntdomain CONTAINS "oglive.ntp-update.com" OR destinationntdomain CONTAINS "guard.0g6666.com" OR destinationntdomain CONTAINS "plus.ntp-update.com" OR destinationntdomain CONTAINS "oglty.0g6666.com" OR destinationntdomain CONTAINS "oglty.ntp-update.com" OR destinationntdomain CONTAINS "oglty-ml.ntp-update.com" OR destinationntdomain CONTAINS "ml-lty.ntp-update.com" OR destinationntdomain CONTAINS "telegram.ntp-update.com" OR destinationntdomain CONTAINS "easyh.ntp-update.com" OR destinationntdomain CONTAINS "weblog.ntp-update.com" OR destinationntdomain CONTAINS "weblog-ml.ntp-update.com" OR destinationntdomain CONTAINS "o-fsh.ntp-update.com" OR destinationntdomain CONTAINS "idn-tb.ntp-update.com" OR destinationntdomain CONTAINS "tb-ndi2.ntp-update.com" OR destinationntdomain CONTAINS "ml-ndi.ntp-update.com" OR destinationntdomain CONTAINS "vct.0g6666.com" OR destinationntdomain CONTAINS "windows-i-tb.ntp-update.com" OR destinationntdomain CONTAINS "windows-qc-tb-i.ntp-update.com" OR destinationntdomain CONTAINS "windows-tb-i.ntp-update.com")
index=activity AND rg_functionality="Cloud Email / Email Security" AND requesturl NOT NULL AND (requesturl CONTAINS "a-ad-tml.ntp-update.com" OR requesturl CONTAINS "rps-a.ntp-update.com" OR requesturl CONTAINS "a-rps.ntp-update.com" OR requesturl CONTAINS "dns-a.ntp-update.com" OR requesturl CONTAINS "a-tb.ntp-update.com" OR requesturl CONTAINS "alast.sun-java.com" OR requesturl CONTAINS "alast.ntp-update.com" OR requesturl CONTAINS "dell-a.ntp-update.com" OR requesturl CONTAINS "a-sp-rps.0g6666.com" OR requesturl CONTAINS "windows.javaupdate-cdn.com" OR requesturl CONTAINS "javaupdatecdn.com" OR requesturl CONTAINS "flash.javaupdate-cdn.com" OR requesturl CONTAINS "linux.ntp-update.com" OR requesturl CONTAINS "esxi-lty.ntp-update.com" OR requesturl CONTAINS "windows.0g6666.com" OR requesturl CONTAINS "ubuntu-ndi.ntp-update.com" OR requesturl CONTAINS "h1.xpjpz400.com" OR requesturl CONTAINS "cg.xpjpz400.com" OR requesturl CONTAINS "letsencrypt.msupdatesync.com" OR requesturl CONTAINS "cloud.ntp-update.com" OR requesturl CONTAINS "fe.ntp-update.com" OR requesturl CONTAINS "wtech.ntp-update.com" OR requesturl CONTAINS "imp.ntp-update.com" OR requesturl CONTAINS "ogplus.ntp-update.com" OR requesturl CONTAINS "organization.0g6666.com" OR requesturl CONTAINS "global.ntp-update.com" OR requesturl CONTAINS "kaiy.0g6666.com" OR requesturl CONTAINS "kaiy.ntp-update.com" OR requesturl CONTAINS "ky.0g6666.com" OR requesturl CONTAINS "oriental.ntp-update.com" OR requesturl CONTAINS "guard.ntp-update.com" OR requesturl CONTAINS "oglive.ntp-update.com" OR requesturl CONTAINS "guard.0g6666.com" OR requesturl CONTAINS "plus.ntp-update.com" OR requesturl CONTAINS "oglty.0g6666.com" OR requesturl CONTAINS "oglty.ntp-update.com" OR requesturl CONTAINS "oglty-ml.ntp-update.com" OR requesturl CONTAINS "ml-lty.ntp-update.com" OR requesturl CONTAINS "telegram.ntp-update.com" OR requesturl CONTAINS "easyh.ntp-update.com" OR requesturl CONTAINS "weblog.ntp-update.com" OR requesturl CONTAINS "weblog-ml.ntp-update.com" OR requesturl CONTAINS "o-fsh.ntp-update.com" OR requesturl CONTAINS "idn-tb.ntp-update.com" OR requesturl CONTAINS "tb-ndi2.ntp-update.com" OR requesturl CONTAINS "ml-ndi.ntp-update.com" OR requesturl CONTAINS "vct.0g6666.com" OR requesturl CONTAINS "windows-i-tb.ntp-update.com" OR requesturl CONTAINS "windows-qc-tb-i.ntp-update.com" OR requesturl CONTAINS "windows-tb-i.ntp-update.com")
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "a-fms.ntp-update.com" OR destinationhostname CONTAINS "plus.0g6666.com" OR destinationhostname CONTAINS "aprotect.sun-java.com" OR destinationhostname CONTAINS "og8888.0g6666.com" OR destinationhostname CONTAINS "adobe.javaupdate-cdn.com" OR destinationhostname CONTAINS "linux.0g6666.com" OR destinationhostname CONTAINS "ad.ntp-update.com" OR destinationhostname CONTAINS "www.0g6666.com" OR destinationhostname CONTAINS "wt.ntp-update.com" OR destinationhostname CONTAINS "aliyun.ntp-update.com")
index=activity AND rg_functionality="Cloud Email / Email Security" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "a-fms.ntp-update.com" OR sourcentdomain CONTAINS "plus.0g6666.com" OR sourcentdomain CONTAINS "aprotect.sun-java.com" OR sourcentdomain CONTAINS "og8888.0g6666.com" OR sourcentdomain CONTAINS "adobe.javaupdate-cdn.com" OR sourcentdomain CONTAINS "linux.0g6666.com" OR sourcentdomain CONTAINS "ad.ntp-update.com" OR sourcentdomain CONTAINS "www.0g6666.com" OR sourcentdomain CONTAINS "wt.ntp-update.com" OR sourcentdomain CONTAINS "aliyun.ntp-update.com")
index=activity AND rg_functionality="Cloud Email / Email Security" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "a-fms.ntp-update.com" OR sourcehostname CONTAINS "plus.0g6666.com" OR sourcehostname CONTAINS "aprotect.sun-java.com" OR sourcehostname CONTAINS "og8888.0g6666.com" OR sourcehostname CONTAINS "adobe.javaupdate-cdn.com" OR sourcehostname CONTAINS "linux.0g6666.com" OR sourcehostname CONTAINS "ad.ntp-update.com" OR sourcehostname CONTAINS "www.0g6666.com" OR sourcehostname CONTAINS "wt.ntp-update.com" OR sourcehostname CONTAINS "aliyun.ntp-update.com")
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "a-fms.ntp-update.com" OR destinationntdomain CONTAINS "plus.0g6666.com" OR destinationntdomain CONTAINS "aprotect.sun-java.com" OR destinationntdomain CONTAINS "og8888.0g6666.com" OR destinationntdomain CONTAINS "adobe.javaupdate-cdn.com" OR destinationntdomain CONTAINS "linux.0g6666.com" OR destinationntdomain CONTAINS "ad.ntp-update.com" OR destinationntdomain CONTAINS "www.0g6666.com" OR destinationntdomain CONTAINS "wt.ntp-update.com" OR destinationntdomain CONTAINS "aliyun.ntp-update.com")
index=activity AND rg_functionality="Cloud Email / Email Security" AND requesturl NOT NULL AND (requesturl CONTAINS "a-fms.ntp-update.com" OR requesturl CONTAINS "plus.0g6666.com" OR requesturl CONTAINS "aprotect.sun-java.com" OR requesturl CONTAINS "og8888.0g6666.com" OR requesturl CONTAINS "adobe.javaupdate-cdn.com" OR requesturl CONTAINS "linux.0g6666.com" OR requesturl CONTAINS "ad.ntp-update.com" OR requesturl CONTAINS "www.0g6666.com" OR requesturl CONTAINS "wt.ntp-update.com" OR requesturl CONTAINS "aliyun.ntp-update.com")
index=activity AND rg_functionality="DNS / DHCP" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "a-ad-tml.ntp-update.com" OR destinationhostname CONTAINS "rps-a.ntp-update.com" OR destinationhostname CONTAINS "a-rps.ntp-update.com" OR destinationhostname CONTAINS "dns-a.ntp-update.com" OR destinationhostname CONTAINS "a-tb.ntp-update.com" OR destinationhostname CONTAINS "alast.sun-java.com" OR destinationhostname CONTAINS "alast.ntp-update.com" OR destinationhostname CONTAINS "dell-a.ntp-update.com" OR destinationhostname CONTAINS "a-sp-rps.0g6666.com" OR destinationhostname CONTAINS "windows.javaupdate-cdn.com" OR destinationhostname CONTAINS "javaupdatecdn.com" OR destinationhostname CONTAINS "flash.javaupdate-cdn.com" OR destinationhostname CONTAINS "linux.ntp-update.com" OR destinationhostname CONTAINS "esxi-lty.ntp-update.com" OR destinationhostname CONTAINS "windows.0g6666.com" OR destinationhostname CONTAINS "ubuntu-ndi.ntp-update.com" OR destinationhostname CONTAINS "h1.xpjpz400.com" OR destinationhostname CONTAINS "cg.xpjpz400.com" OR destinationhostname CONTAINS "letsencrypt.msupdatesync.com" OR destinationhostname CONTAINS "cloud.ntp-update.com" OR destinationhostname CONTAINS "fe.ntp-update.com" OR destinationhostname CONTAINS "wtech.ntp-update.com" OR destinationhostname CONTAINS "imp.ntp-update.com" OR destinationhostname CONTAINS "ogplus.ntp-update.com" OR destinationhostname CONTAINS "organization.0g6666.com" OR destinationhostname CONTAINS "global.ntp-update.com" OR destinationhostname CONTAINS "kaiy.0g6666.com" OR destinationhostname CONTAINS "kaiy.ntp-update.com" OR destinationhostname CONTAINS "ky.0g6666.com" OR destinationhostname CONTAINS "oriental.ntp-update.com" OR destinationhostname CONTAINS "guard.ntp-update.com" OR destinationhostname CONTAINS "oglive.ntp-update.com" OR destinationhostname CONTAINS "guard.0g6666.com" OR destinationhostname CONTAINS "plus.ntp-update.com" OR destinationhostname CONTAINS "oglty.0g6666.com" OR destinationhostname CONTAINS "oglty.ntp-update.com" OR destinationhostname CONTAINS "oglty-ml.ntp-update.com" OR destinationhostname CONTAINS "ml-lty.ntp-update.com" OR destinationhostname CONTAINS "telegram.ntp-update.com" OR destinationhostname CONTAINS "easyh.ntp-update.com" OR destinationhostname CONTAINS "weblog.ntp-update.com" OR destinationhostname CONTAINS "weblog-ml.ntp-update.com" OR destinationhostname CONTAINS "o-fsh.ntp-update.com" OR destinationhostname CONTAINS "idn-tb.ntp-update.com" OR destinationhostname CONTAINS "tb-ndi2.ntp-update.com" OR destinationhostname CONTAINS "ml-ndi.ntp-update.com" OR destinationhostname CONTAINS "vct.0g6666.com" OR destinationhostname CONTAINS "windows-i-tb.ntp-update.com" OR destinationhostname CONTAINS "windows-qc-tb-i.ntp-update.com" OR destinationhostname CONTAINS "windows-tb-i.ntp-update.com")
index=activity AND rg_functionality="DNS / DHCP" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "a-ad-tml.ntp-update.com" OR sourcentdomain CONTAINS "rps-a.ntp-update.com" OR sourcentdomain CONTAINS "a-rps.ntp-update.com" OR sourcentdomain CONTAINS "dns-a.ntp-update.com" OR sourcentdomain CONTAINS "a-tb.ntp-update.com" OR sourcentdomain CONTAINS "alast.sun-java.com" OR sourcentdomain CONTAINS "alast.ntp-update.com" OR sourcentdomain CONTAINS "dell-a.ntp-update.com" OR sourcentdomain CONTAINS "a-sp-rps.0g6666.com" OR sourcentdomain CONTAINS "windows.javaupdate-cdn.com" OR sourcentdomain CONTAINS "javaupdatecdn.com" OR sourcentdomain CONTAINS "flash.javaupdate-cdn.com" OR sourcentdomain CONTAINS "linux.ntp-update.com" OR sourcentdomain CONTAINS "esxi-lty.ntp-update.com" OR sourcentdomain CONTAINS "windows.0g6666.com" OR sourcentdomain CONTAINS "ubuntu-ndi.ntp-update.com" OR sourcentdomain CONTAINS "h1.xpjpz400.com" OR sourcentdomain CONTAINS "cg.xpjpz400.com" OR sourcentdomain CONTAINS "letsencrypt.msupdatesync.com" OR sourcentdomain CONTAINS "cloud.ntp-update.com" OR sourcentdomain CONTAINS "fe.ntp-update.com" OR sourcentdomain CONTAINS "wtech.ntp-update.com" OR sourcentdomain CONTAINS "imp.ntp-update.com" OR sourcentdomain CONTAINS "ogplus.ntp-update.com" OR sourcentdomain CONTAINS "organization.0g6666.com" OR sourcentdomain CONTAINS "global.ntp-update.com" OR sourcentdomain CONTAINS "kaiy.0g6666.com" OR sourcentdomain CONTAINS "kaiy.ntp-update.com" OR sourcentdomain CONTAINS "ky.0g6666.com" OR sourcentdomain CONTAINS "oriental.ntp-update.com" OR sourcentdomain CONTAINS "guard.ntp-update.com" OR sourcentdomain CONTAINS "oglive.ntp-update.com" OR sourcentdomain CONTAINS "guard.0g6666.com" OR sourcentdomain CONTAINS "plus.ntp-update.com" OR sourcentdomain CONTAINS "oglty.0g6666.com" OR sourcentdomain CONTAINS "oglty.ntp-update.com" OR sourcentdomain CONTAINS "oglty-ml.ntp-update.com" OR sourcentdomain CONTAINS "ml-lty.ntp-update.com" OR sourcentdomain CONTAINS "telegram.ntp-update.com" OR sourcentdomain CONTAINS "easyh.ntp-update.com" OR sourcentdomain CONTAINS "weblog.ntp-update.com" OR sourcentdomain CONTAINS "weblog-ml.ntp-update.com" OR sourcentdomain CONTAINS "o-fsh.ntp-update.com" OR sourcentdomain CONTAINS "idn-tb.ntp-update.com" OR sourcentdomain CONTAINS "tb-ndi2.ntp-update.com" OR sourcentdomain CONTAINS "ml-ndi.ntp-update.com" OR sourcentdomain CONTAINS "vct.0g6666.com" OR sourcentdomain CONTAINS "windows-i-tb.ntp-update.com" OR sourcentdomain CONTAINS "windows-qc-tb-i.ntp-update.com" OR sourcentdomain CONTAINS "windows-tb-i.ntp-update.com")
index=activity AND rg_functionality="DNS / DHCP" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "a-ad-tml.ntp-update.com" OR sourcehostname CONTAINS "rps-a.ntp-update.com" OR sourcehostname CONTAINS "a-rps.ntp-update.com" OR sourcehostname CONTAINS "dns-a.ntp-update.com" OR sourcehostname CONTAINS "a-tb.ntp-update.com" OR sourcehostname CONTAINS "alast.sun-java.com" OR sourcehostname CONTAINS "alast.ntp-update.com" OR sourcehostname CONTAINS "dell-a.ntp-update.com" OR sourcehostname CONTAINS "a-sp-rps.0g6666.com" OR sourcehostname CONTAINS "windows.javaupdate-cdn.com" OR sourcehostname CONTAINS "javaupdatecdn.com" OR sourcehostname CONTAINS "flash.javaupdate-cdn.com" OR sourcehostname CONTAINS "linux.ntp-update.com" OR sourcehostname CONTAINS "esxi-lty.ntp-update.com" OR sourcehostname CONTAINS "windows.0g6666.com" OR sourcehostname CONTAINS "ubuntu-ndi.ntp-update.com" OR sourcehostname CONTAINS "h1.xpjpz400.com" OR sourcehostname CONTAINS "cg.xpjpz400.com" OR sourcehostname CONTAINS "letsencrypt.msupdatesync.com" OR sourcehostname CONTAINS "cloud.ntp-update.com" OR sourcehostname CONTAINS "fe.ntp-update.com" OR sourcehostname CONTAINS "wtech.ntp-update.com" OR sourcehostname CONTAINS "imp.ntp-update.com" OR sourcehostname CONTAINS "ogplus.ntp-update.com" OR sourcehostname CONTAINS "organization.0g6666.com" OR sourcehostname CONTAINS "global.ntp-update.com" OR sourcehostname CONTAINS "kaiy.0g6666.com" OR sourcehostname CONTAINS "kaiy.ntp-update.com" OR sourcehostname CONTAINS "ky.0g6666.com" OR sourcehostname CONTAINS "oriental.ntp-update.com" OR sourcehostname CONTAINS "guard.ntp-update.com" OR sourcehostname CONTAINS "oglive.ntp-update.com" OR sourcehostname CONTAINS "guard.0g6666.com" OR sourcehostname CONTAINS "plus.ntp-update.com" OR sourcehostname CONTAINS "oglty.0g6666.com" OR sourcehostname CONTAINS "oglty.ntp-update.com" OR sourcehostname CONTAINS "oglty-ml.ntp-update.com" OR sourcehostname CONTAINS "ml-lty.ntp-update.com" OR sourcehostname CONTAINS "telegram.ntp-update.com" OR sourcehostname CONTAINS "easyh.ntp-update.com" OR sourcehostname CONTAINS "weblog.ntp-update.com" OR sourcehostname CONTAINS "weblog-ml.ntp-update.com" OR sourcehostname CONTAINS "o-fsh.ntp-update.com" OR sourcehostname CONTAINS "idn-tb.ntp-update.com" OR sourcehostname CONTAINS "tb-ndi2.ntp-update.com" OR sourcehostname CONTAINS "ml-ndi.ntp-update.com" OR sourcehostname CONTAINS "vct.0g6666.com" OR sourcehostname CONTAINS "windows-i-tb.ntp-update.com" OR sourcehostname CONTAINS "windows-qc-tb-i.ntp-update.com" OR sourcehostname CONTAINS "windows-tb-i.ntp-update.com")
index=activity AND rg_functionality="DNS / DHCP" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "a-ad-tml.ntp-update.com" OR destinationntdomain CONTAINS "rps-a.ntp-update.com" OR destinationntdomain CONTAINS "a-rps.ntp-update.com" OR destinationntdomain CONTAINS "dns-a.ntp-update.com" OR destinationntdomain CONTAINS "a-tb.ntp-update.com" OR destinationntdomain CONTAINS "alast.sun-java.com" OR destinationntdomain CONTAINS "alast.ntp-update.com" OR destinationntdomain CONTAINS "dell-a.ntp-update.com" OR destinationntdomain CONTAINS "a-sp-rps.0g6666.com" OR destinationntdomain CONTAINS "windows.javaupdate-cdn.com" OR destinationntdomain CONTAINS "javaupdatecdn.com" OR destinationntdomain CONTAINS "flash.javaupdate-cdn.com" OR destinationntdomain CONTAINS "linux.ntp-update.com" OR destinationntdomain CONTAINS "esxi-lty.ntp-update.com" OR destinationntdomain CONTAINS "windows.0g6666.com" OR destinationntdomain CONTAINS "ubuntu-ndi.ntp-update.com" OR destinationntdomain CONTAINS "h1.xpjpz400.com" OR destinationntdomain CONTAINS "cg.xpjpz400.com" OR destinationntdomain CONTAINS "letsencrypt.msupdatesync.com" OR destinationntdomain CONTAINS "cloud.ntp-update.com" OR destinationntdomain CONTAINS "fe.ntp-update.com" OR destinationntdomain CONTAINS "wtech.ntp-update.com" OR destinationntdomain CONTAINS "imp.ntp-update.com" OR destinationntdomain CONTAINS "ogplus.ntp-update.com" OR destinationntdomain CONTAINS "organization.0g6666.com" OR destinationntdomain CONTAINS "global.ntp-update.com" OR destinationntdomain CONTAINS "kaiy.0g6666.com" OR destinationntdomain CONTAINS "kaiy.ntp-update.com" OR destinationntdomain CONTAINS "ky.0g6666.com" OR destinationntdomain CONTAINS "oriental.ntp-update.com" OR destinationntdomain CONTAINS "guard.ntp-update.com" OR destinationntdomain CONTAINS "oglive.ntp-update.com" OR destinationntdomain CONTAINS "guard.0g6666.com" OR destinationntdomain CONTAINS "plus.ntp-update.com" OR destinationntdomain CONTAINS "oglty.0g6666.com" OR destinationntdomain CONTAINS "oglty.ntp-update.com" OR destinationntdomain CONTAINS "oglty-ml.ntp-update.com" OR destinationntdomain CONTAINS "ml-lty.ntp-update.com" OR destinationntdomain CONTAINS "telegram.ntp-update.com" OR destinationntdomain CONTAINS "easyh.ntp-update.com" OR destinationntdomain CONTAINS "weblog.ntp-update.com" OR destinationntdomain CONTAINS "weblog-ml.ntp-update.com" OR destinationntdomain CONTAINS "o-fsh.ntp-update.com" OR destinationntdomain CONTAINS "idn-tb.ntp-update.com" OR destinationntdomain CONTAINS "tb-ndi2.ntp-update.com" OR destinationntdomain CONTAINS "ml-ndi.ntp-update.com" OR destinationntdomain CONTAINS "vct.0g6666.com" OR destinationntdomain CONTAINS "windows-i-tb.ntp-update.com" OR destinationntdomain CONTAINS "windows-qc-tb-i.ntp-update.com" OR destinationntdomain CONTAINS "windows-tb-i.ntp-update.com")
index=activity AND rg_functionality="DNS / DHCP" AND requesturl NOT NULL AND (requesturl CONTAINS "a-ad-tml.ntp-update.com" OR requesturl CONTAINS "rps-a.ntp-update.com" OR requesturl CONTAINS "a-rps.ntp-update.com" OR requesturl CONTAINS "dns-a.ntp-update.com" OR requesturl CONTAINS "a-tb.ntp-update.com" OR requesturl CONTAINS "alast.sun-java.com" OR requesturl CONTAINS "alast.ntp-update.com" OR requesturl CONTAINS "dell-a.ntp-update.com" OR requesturl CONTAINS "a-sp-rps.0g6666.com" OR requesturl CONTAINS "windows.javaupdate-cdn.com" OR requesturl CONTAINS "javaupdatecdn.com" OR requesturl CONTAINS "flash.javaupdate-cdn.com" OR requesturl CONTAINS "linux.ntp-update.com" OR requesturl CONTAINS "esxi-lty.ntp-update.com" OR requesturl CONTAINS "windows.0g6666.com" OR requesturl CONTAINS "ubuntu-ndi.ntp-update.com" OR requesturl CONTAINS "h1.xpjpz400.com" OR requesturl CONTAINS "cg.xpjpz400.com" OR requesturl CONTAINS "letsencrypt.msupdatesync.com" OR requesturl CONTAINS "cloud.ntp-update.com" OR requesturl CONTAINS "fe.ntp-update.com" OR requesturl CONTAINS "wtech.ntp-update.com" OR requesturl CONTAINS "imp.ntp-update.com" OR requesturl CONTAINS "ogplus.ntp-update.com" OR requesturl CONTAINS "organization.0g6666.com" OR requesturl CONTAINS "global.ntp-update.com" OR requesturl CONTAINS "kaiy.0g6666.com" OR requesturl CONTAINS "kaiy.ntp-update.com" OR requesturl CONTAINS "ky.0g6666.com" OR requesturl CONTAINS "oriental.ntp-update.com" OR requesturl CONTAINS "guard.ntp-update.com" OR requesturl CONTAINS "oglive.ntp-update.com" OR requesturl CONTAINS "guard.0g6666.com" OR requesturl CONTAINS "plus.ntp-update.com" OR requesturl CONTAINS "oglty.0g6666.com" OR requesturl CONTAINS "oglty.ntp-update.com" OR requesturl CONTAINS "oglty-ml.ntp-update.com" OR requesturl CONTAINS "ml-lty.ntp-update.com" OR requesturl CONTAINS "telegram.ntp-update.com" OR requesturl CONTAINS "easyh.ntp-update.com" OR requesturl CONTAINS "weblog.ntp-update.com" OR requesturl CONTAINS "weblog-ml.ntp-update.com" OR requesturl CONTAINS "o-fsh.ntp-update.com" OR requesturl CONTAINS "idn-tb.ntp-update.com" OR requesturl CONTAINS "tb-ndi2.ntp-update.com" OR requesturl CONTAINS "ml-ndi.ntp-update.com" OR requesturl CONTAINS "vct.0g6666.com" OR requesturl CONTAINS "windows-i-tb.ntp-update.com" OR requesturl CONTAINS "windows-qc-tb-i.ntp-update.com" OR requesturl CONTAINS "windows-tb-i.ntp-update.com")
index=activity AND rg_functionality="DNS / DHCP" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "a-fms.ntp-update.com" OR destinationhostname CONTAINS "plus.0g6666.com" OR destinationhostname CONTAINS "aprotect.sun-java.com" OR destinationhostname CONTAINS "og8888.0g6666.com" OR destinationhostname CONTAINS "adobe.javaupdate-cdn.com" OR destinationhostname CONTAINS "linux.0g6666.com" OR destinationhostname CONTAINS "ad.ntp-update.com" OR destinationhostname CONTAINS "www.0g6666.com" OR destinationhostname CONTAINS "wt.ntp-update.com" OR destinationhostname CONTAINS "aliyun.ntp-update.com")
index=activity AND rg_functionality="DNS / DHCP" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "a-fms.ntp-update.com" OR sourcentdomain CONTAINS "plus.0g6666.com" OR sourcentdomain CONTAINS "aprotect.sun-java.com" OR sourcentdomain CONTAINS "og8888.0g6666.com" OR sourcentdomain CONTAINS "adobe.javaupdate-cdn.com" OR sourcentdomain CONTAINS "linux.0g6666.com" OR sourcentdomain CONTAINS "ad.ntp-update.com" OR sourcentdomain CONTAINS "www.0g6666.com" OR sourcentdomain CONTAINS "wt.ntp-update.com" OR sourcentdomain CONTAINS "aliyun.ntp-update.com")
index=activity AND rg_functionality="DNS / DHCP" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "a-fms.ntp-update.com" OR sourcehostname CONTAINS "plus.0g6666.com" OR sourcehostname CONTAINS "aprotect.sun-java.com" OR sourcehostname CONTAINS "og8888.0g6666.com" OR sourcehostname CONTAINS "adobe.javaupdate-cdn.com" OR sourcehostname CONTAINS "linux.0g6666.com" OR sourcehostname CONTAINS "ad.ntp-update.com" OR sourcehostname CONTAINS "www.0g6666.com" OR sourcehostname CONTAINS "wt.ntp-update.com" OR sourcehostname CONTAINS "aliyun.ntp-update.com")
index=activity AND rg_functionality="DNS / DHCP" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "a-fms.ntp-update.com" OR destinationntdomain CONTAINS "plus.0g6666.com" OR destinationntdomain CONTAINS "aprotect.sun-java.com" OR destinationntdomain CONTAINS "og8888.0g6666.com" OR destinationntdomain CONTAINS "adobe.javaupdate-cdn.com" OR destinationntdomain CONTAINS "linux.0g6666.com" OR destinationntdomain CONTAINS "ad.ntp-update.com" OR destinationntdomain CONTAINS "www.0g6666.com" OR destinationntdomain CONTAINS "wt.ntp-update.com" OR destinationntdomain CONTAINS "aliyun.ntp-update.com")
index=activity AND rg_functionality="DNS / DHCP" AND requesturl NOT NULL AND (requesturl CONTAINS "a-fms.ntp-update.com" OR requesturl CONTAINS "plus.0g6666.com" OR requesturl CONTAINS "aprotect.sun-java.com" OR requesturl CONTAINS "og8888.0g6666.com" OR requesturl CONTAINS "adobe.javaupdate-cdn.com" OR requesturl CONTAINS "linux.0g6666.com" OR requesturl CONTAINS "ad.ntp-update.com" OR requesturl CONTAINS "www.0g6666.com" OR requesturl CONTAINS "wt.ntp-update.com" OR requesturl CONTAINS "aliyun.ntp-update.com")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "a-ad-tml.ntp-update.com" OR destinationhostname CONTAINS "rps-a.ntp-update.com" OR destinationhostname CONTAINS "a-rps.ntp-update.com" OR destinationhostname CONTAINS "dns-a.ntp-update.com" OR destinationhostname CONTAINS "a-tb.ntp-update.com" OR destinationhostname CONTAINS "alast.sun-java.com" OR destinationhostname CONTAINS "alast.ntp-update.com" OR destinationhostname CONTAINS "dell-a.ntp-update.com" OR destinationhostname CONTAINS "a-sp-rps.0g6666.com" OR destinationhostname CONTAINS "windows.javaupdate-cdn.com" OR destinationhostname CONTAINS "javaupdatecdn.com" OR destinationhostname CONTAINS "flash.javaupdate-cdn.com" OR destinationhostname CONTAINS "linux.ntp-update.com" OR destinationhostname CONTAINS "esxi-lty.ntp-update.com" OR destinationhostname CONTAINS "windows.0g6666.com" OR destinationhostname CONTAINS "ubuntu-ndi.ntp-update.com" OR destinationhostname CONTAINS "h1.xpjpz400.com" OR destinationhostname CONTAINS "cg.xpjpz400.com" OR destinationhostname CONTAINS "letsencrypt.msupdatesync.com" OR destinationhostname CONTAINS "cloud.ntp-update.com" OR destinationhostname CONTAINS "fe.ntp-update.com" OR destinationhostname CONTAINS "wtech.ntp-update.com" OR destinationhostname CONTAINS "imp.ntp-update.com" OR destinationhostname CONTAINS "ogplus.ntp-update.com" OR destinationhostname CONTAINS "organization.0g6666.com" OR destinationhostname CONTAINS "global.ntp-update.com" OR destinationhostname CONTAINS "kaiy.0g6666.com" OR destinationhostname CONTAINS "kaiy.ntp-update.com" OR destinationhostname CONTAINS "ky.0g6666.com" OR destinationhostname CONTAINS "oriental.ntp-update.com" OR destinationhostname CONTAINS "guard.ntp-update.com" OR destinationhostname CONTAINS "oglive.ntp-update.com" OR destinationhostname CONTAINS "guard.0g6666.com" OR destinationhostname CONTAINS "plus.ntp-update.com" OR destinationhostname CONTAINS "oglty.0g6666.com" OR destinationhostname CONTAINS "oglty.ntp-update.com" OR destinationhostname CONTAINS "oglty-ml.ntp-update.com" OR destinationhostname CONTAINS "ml-lty.ntp-update.com" OR destinationhostname CONTAINS "telegram.ntp-update.com" OR destinationhostname CONTAINS "easyh.ntp-update.com" OR destinationhostname CONTAINS "weblog.ntp-update.com" OR destinationhostname CONTAINS "weblog-ml.ntp-update.com" OR destinationhostname CONTAINS "o-fsh.ntp-update.com" OR destinationhostname CONTAINS "idn-tb.ntp-update.com" OR destinationhostname CONTAINS "tb-ndi2.ntp-update.com" OR destinationhostname CONTAINS "ml-ndi.ntp-update.com" OR destinationhostname CONTAINS "vct.0g6666.com" OR destinationhostname CONTAINS "windows-i-tb.ntp-update.com" OR destinationhostname CONTAINS "windows-qc-tb-i.ntp-update.com" OR destinationhostname CONTAINS "windows-tb-i.ntp-update.com")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "a-ad-tml.ntp-update.com" OR sourcentdomain CONTAINS "rps-a.ntp-update.com" OR sourcentdomain CONTAINS "a-rps.ntp-update.com" OR sourcentdomain CONTAINS "dns-a.ntp-update.com" OR sourcentdomain CONTAINS "a-tb.ntp-update.com" OR sourcentdomain CONTAINS "alast.sun-java.com" OR sourcentdomain CONTAINS "alast.ntp-update.com" OR sourcentdomain CONTAINS "dell-a.ntp-update.com" OR sourcentdomain CONTAINS "a-sp-rps.0g6666.com" OR sourcentdomain CONTAINS "windows.javaupdate-cdn.com" OR sourcentdomain CONTAINS "javaupdatecdn.com" OR sourcentdomain CONTAINS "flash.javaupdate-cdn.com" OR sourcentdomain CONTAINS "linux.ntp-update.com" OR sourcentdomain CONTAINS "esxi-lty.ntp-update.com" OR sourcentdomain CONTAINS "windows.0g6666.com" OR sourcentdomain CONTAINS "ubuntu-ndi.ntp-update.com" OR sourcentdomain CONTAINS "h1.xpjpz400.com" OR sourcentdomain CONTAINS "cg.xpjpz400.com" OR sourcentdomain CONTAINS "letsencrypt.msupdatesync.com" OR sourcentdomain CONTAINS "cloud.ntp-update.com" OR sourcentdomain CONTAINS "fe.ntp-update.com" OR sourcentdomain CONTAINS "wtech.ntp-update.com" OR sourcentdomain CONTAINS "imp.ntp-update.com" OR sourcentdomain CONTAINS "ogplus.ntp-update.com" OR sourcentdomain CONTAINS "organization.0g6666.com" OR sourcentdomain CONTAINS "global.ntp-update.com" OR sourcentdomain CONTAINS "kaiy.0g6666.com" OR sourcentdomain CONTAINS "kaiy.ntp-update.com" OR sourcentdomain CONTAINS "ky.0g6666.com" OR sourcentdomain CONTAINS "oriental.ntp-update.com" OR sourcentdomain CONTAINS "guard.ntp-update.com" OR sourcentdomain CONTAINS "oglive.ntp-update.com" OR sourcentdomain CONTAINS "guard.0g6666.com" OR sourcentdomain CONTAINS "plus.ntp-update.com" OR sourcentdomain CONTAINS "oglty.0g6666.com" OR sourcentdomain CONTAINS "oglty.ntp-update.com" OR sourcentdomain CONTAINS "oglty-ml.ntp-update.com" OR sourcentdomain CONTAINS "ml-lty.ntp-update.com" OR sourcentdomain CONTAINS "telegram.ntp-update.com" OR sourcentdomain CONTAINS "easyh.ntp-update.com" OR sourcentdomain CONTAINS "weblog.ntp-update.com" OR sourcentdomain CONTAINS "weblog-ml.ntp-update.com" OR sourcentdomain CONTAINS "o-fsh.ntp-update.com" OR sourcentdomain CONTAINS "idn-tb.ntp-update.com" OR sourcentdomain CONTAINS "tb-ndi2.ntp-update.com" OR sourcentdomain CONTAINS "ml-ndi.ntp-update.com" OR sourcentdomain CONTAINS "vct.0g6666.com" OR sourcentdomain CONTAINS "windows-i-tb.ntp-update.com" OR sourcentdomain CONTAINS "windows-qc-tb-i.ntp-update.com" OR sourcentdomain CONTAINS "windows-tb-i.ntp-update.com")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "a-ad-tml.ntp-update.com" OR sourcehostname CONTAINS "rps-a.ntp-update.com" OR sourcehostname CONTAINS "a-rps.ntp-update.com" OR sourcehostname CONTAINS "dns-a.ntp-update.com" OR sourcehostname CONTAINS "a-tb.ntp-update.com" OR sourcehostname CONTAINS "alast.sun-java.com" OR sourcehostname CONTAINS "alast.ntp-update.com" OR sourcehostname CONTAINS "dell-a.ntp-update.com" OR sourcehostname CONTAINS "a-sp-rps.0g6666.com" OR sourcehostname CONTAINS "windows.javaupdate-cdn.com" OR sourcehostname CONTAINS "javaupdatecdn.com" OR sourcehostname CONTAINS "flash.javaupdate-cdn.com" OR sourcehostname CONTAINS "linux.ntp-update.com" OR sourcehostname CONTAINS "esxi-lty.ntp-update.com" OR sourcehostname CONTAINS "windows.0g6666.com" OR sourcehostname CONTAINS "ubuntu-ndi.ntp-update.com" OR sourcehostname CONTAINS "h1.xpjpz400.com" OR sourcehostname CONTAINS "cg.xpjpz400.com" OR sourcehostname CONTAINS "letsencrypt.msupdatesync.com" OR sourcehostname CONTAINS "cloud.ntp-update.com" OR sourcehostname CONTAINS "fe.ntp-update.com" OR sourcehostname CONTAINS "wtech.ntp-update.com" OR sourcehostname CONTAINS "imp.ntp-update.com" OR sourcehostname CONTAINS "ogplus.ntp-update.com" OR sourcehostname CONTAINS "organization.0g6666.com" OR sourcehostname CONTAINS "global.ntp-update.com" OR sourcehostname CONTAINS "kaiy.0g6666.com" OR sourcehostname CONTAINS "kaiy.ntp-update.com" OR sourcehostname CONTAINS "ky.0g6666.com" OR sourcehostname CONTAINS "oriental.ntp-update.com" OR sourcehostname CONTAINS "guard.ntp-update.com" OR sourcehostname CONTAINS "oglive.ntp-update.com" OR sourcehostname CONTAINS "guard.0g6666.com" OR sourcehostname CONTAINS "plus.ntp-update.com" OR sourcehostname CONTAINS "oglty.0g6666.com" OR sourcehostname CONTAINS "oglty.ntp-update.com" OR sourcehostname CONTAINS "oglty-ml.ntp-update.com" OR sourcehostname CONTAINS "ml-lty.ntp-update.com" OR sourcehostname CONTAINS "telegram.ntp-update.com" OR sourcehostname CONTAINS "easyh.ntp-update.com" OR sourcehostname CONTAINS "weblog.ntp-update.com" OR sourcehostname CONTAINS "weblog-ml.ntp-update.com" OR sourcehostname CONTAINS "o-fsh.ntp-update.com" OR sourcehostname CONTAINS "idn-tb.ntp-update.com" OR sourcehostname CONTAINS "tb-ndi2.ntp-update.com" OR sourcehostname CONTAINS "ml-ndi.ntp-update.com" OR sourcehostname CONTAINS "vct.0g6666.com" OR sourcehostname CONTAINS "windows-i-tb.ntp-update.com" OR sourcehostname CONTAINS "windows-qc-tb-i.ntp-update.com" OR sourcehostname CONTAINS "windows-tb-i.ntp-update.com")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "a-ad-tml.ntp-update.com" OR destinationntdomain CONTAINS "rps-a.ntp-update.com" OR destinationntdomain CONTAINS "a-rps.ntp-update.com" OR destinationntdomain CONTAINS "dns-a.ntp-update.com" OR destinationntdomain CONTAINS "a-tb.ntp-update.com" OR destinationntdomain CONTAINS "alast.sun-java.com" OR destinationntdomain CONTAINS "alast.ntp-update.com" OR destinationntdomain CONTAINS "dell-a.ntp-update.com" OR destinationntdomain CONTAINS "a-sp-rps.0g6666.com" OR destinationntdomain CONTAINS "windows.javaupdate-cdn.com" OR destinationntdomain CONTAINS "javaupdatecdn.com" OR destinationntdomain CONTAINS "flash.javaupdate-cdn.com" OR destinationntdomain CONTAINS "linux.ntp-update.com" OR destinationntdomain CONTAINS "esxi-lty.ntp-update.com" OR destinationntdomain CONTAINS "windows.0g6666.com" OR destinationntdomain CONTAINS "ubuntu-ndi.ntp-update.com" OR destinationntdomain CONTAINS "h1.xpjpz400.com" OR destinationntdomain CONTAINS "cg.xpjpz400.com" OR destinationntdomain CONTAINS "letsencrypt.msupdatesync.com" OR destinationntdomain CONTAINS "cloud.ntp-update.com" OR destinationntdomain CONTAINS "fe.ntp-update.com" OR destinationntdomain CONTAINS "wtech.ntp-update.com" OR destinationntdomain CONTAINS "imp.ntp-update.com" OR destinationntdomain CONTAINS "ogplus.ntp-update.com" OR destinationntdomain CONTAINS "organization.0g6666.com" OR destinationntdomain CONTAINS "global.ntp-update.com" OR destinationntdomain CONTAINS "kaiy.0g6666.com" OR destinationntdomain CONTAINS "kaiy.ntp-update.com" OR destinationntdomain CONTAINS "ky.0g6666.com" OR destinationntdomain CONTAINS "oriental.ntp-update.com" OR destinationntdomain CONTAINS "guard.ntp-update.com" OR destinationntdomain CONTAINS "oglive.ntp-update.com" OR destinationntdomain CONTAINS "guard.0g6666.com" OR destinationntdomain CONTAINS "plus.ntp-update.com" OR destinationntdomain CONTAINS "oglty.0g6666.com" OR destinationntdomain CONTAINS "oglty.ntp-update.com" OR destinationntdomain CONTAINS "oglty-ml.ntp-update.com" OR destinationntdomain CONTAINS "ml-lty.ntp-update.com" OR destinationntdomain CONTAINS "telegram.ntp-update.com" OR destinationntdomain CONTAINS "easyh.ntp-update.com" OR destinationntdomain CONTAINS "weblog.ntp-update.com" OR destinationntdomain CONTAINS "weblog-ml.ntp-update.com" OR destinationntdomain CONTAINS "o-fsh.ntp-update.com" OR destinationntdomain CONTAINS "idn-tb.ntp-update.com" OR destinationntdomain CONTAINS "tb-ndi2.ntp-update.com" OR destinationntdomain CONTAINS "ml-ndi.ntp-update.com" OR destinationntdomain CONTAINS "vct.0g6666.com" OR destinationntdomain CONTAINS "windows-i-tb.ntp-update.com" OR destinationntdomain CONTAINS "windows-qc-tb-i.ntp-update.com" OR destinationntdomain CONTAINS "windows-tb-i.ntp-update.com")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND requesturl NOT NULL AND (requesturl CONTAINS "a-ad-tml.ntp-update.com" OR requesturl CONTAINS "rps-a.ntp-update.com" OR requesturl CONTAINS "a-rps.ntp-update.com" OR requesturl CONTAINS "dns-a.ntp-update.com" OR requesturl CONTAINS "a-tb.ntp-update.com" OR requesturl CONTAINS "alast.sun-java.com" OR requesturl CONTAINS "alast.ntp-update.com" OR requesturl CONTAINS "dell-a.ntp-update.com" OR requesturl CONTAINS "a-sp-rps.0g6666.com" OR requesturl CONTAINS "windows.javaupdate-cdn.com" OR requesturl CONTAINS "javaupdatecdn.com" OR requesturl CONTAINS "flash.javaupdate-cdn.com" OR requesturl CONTAINS "linux.ntp-update.com" OR requesturl CONTAINS "esxi-lty.ntp-update.com" OR requesturl CONTAINS "windows.0g6666.com" OR requesturl CONTAINS "ubuntu-ndi.ntp-update.com" OR requesturl CONTAINS "h1.xpjpz400.com" OR requesturl CONTAINS "cg.xpjpz400.com" OR requesturl CONTAINS "letsencrypt.msupdatesync.com" OR requesturl CONTAINS "cloud.ntp-update.com" OR requesturl CONTAINS "fe.ntp-update.com" OR requesturl CONTAINS "wtech.ntp-update.com" OR requesturl CONTAINS "imp.ntp-update.com" OR requesturl CONTAINS "ogplus.ntp-update.com" OR requesturl CONTAINS "organization.0g6666.com" OR requesturl CONTAINS "global.ntp-update.com" OR requesturl CONTAINS "kaiy.0g6666.com" OR requesturl CONTAINS "kaiy.ntp-update.com" OR requesturl CONTAINS "ky.0g6666.com" OR requesturl CONTAINS "oriental.ntp-update.com" OR requesturl CONTAINS "guard.ntp-update.com" OR requesturl CONTAINS "oglive.ntp-update.com" OR requesturl CONTAINS "guard.0g6666.com" OR requesturl CONTAINS "plus.ntp-update.com" OR requesturl CONTAINS "oglty.0g6666.com" OR requesturl CONTAINS "oglty.ntp-update.com" OR requesturl CONTAINS "oglty-ml.ntp-update.com" OR requesturl CONTAINS "ml-lty.ntp-update.com" OR requesturl CONTAINS "telegram.ntp-update.com" OR requesturl CONTAINS "easyh.ntp-update.com" OR requesturl CONTAINS "weblog.ntp-update.com" OR requesturl CONTAINS "weblog-ml.ntp-update.com" OR requesturl CONTAINS "o-fsh.ntp-update.com" OR requesturl CONTAINS "idn-tb.ntp-update.com" OR requesturl CONTAINS "tb-ndi2.ntp-update.com" OR requesturl CONTAINS "ml-ndi.ntp-update.com" OR requesturl CONTAINS "vct.0g6666.com" OR requesturl CONTAINS "windows-i-tb.ntp-update.com" OR requesturl CONTAINS "windows-qc-tb-i.ntp-update.com" OR requesturl CONTAINS "windows-tb-i.ntp-update.com")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "a-fms.ntp-update.com" OR destinationhostname CONTAINS "plus.0g6666.com" OR destinationhostname CONTAINS "aprotect.sun-java.com" OR destinationhostname CONTAINS "og8888.0g6666.com" OR destinationhostname CONTAINS "adobe.javaupdate-cdn.com" OR destinationhostname CONTAINS "linux.0g6666.com" OR destinationhostname CONTAINS "ad.ntp-update.com" OR destinationhostname CONTAINS "www.0g6666.com" OR destinationhostname CONTAINS "wt.ntp-update.com" OR destinationhostname CONTAINS "aliyun.ntp-update.com")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "a-fms.ntp-update.com" OR sourcentdomain CONTAINS "plus.0g6666.com" OR sourcentdomain CONTAINS "aprotect.sun-java.com" OR sourcentdomain CONTAINS "og8888.0g6666.com" OR sourcentdomain CONTAINS "adobe.javaupdate-cdn.com" OR sourcentdomain CONTAINS "linux.0g6666.com" OR sourcentdomain CONTAINS "ad.ntp-update.com" OR sourcentdomain CONTAINS "www.0g6666.com" OR sourcentdomain CONTAINS "wt.ntp-update.com" OR sourcentdomain CONTAINS "aliyun.ntp-update.com")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "a-fms.ntp-update.com" OR sourcehostname CONTAINS "plus.0g6666.com" OR sourcehostname CONTAINS "aprotect.sun-java.com" OR sourcehostname CONTAINS "og8888.0g6666.com" OR sourcehostname CONTAINS "adobe.javaupdate-cdn.com" OR sourcehostname CONTAINS "linux.0g6666.com" OR sourcehostname CONTAINS "ad.ntp-update.com" OR sourcehostname CONTAINS "www.0g6666.com" OR sourcehostname CONTAINS "wt.ntp-update.com" OR sourcehostname CONTAINS "aliyun.ntp-update.com")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "a-fms.ntp-update.com" OR destinationntdomain CONTAINS "plus.0g6666.com" OR destinationntdomain CONTAINS "aprotect.sun-java.com" OR destinationntdomain CONTAINS "og8888.0g6666.com" OR destinationntdomain CONTAINS "adobe.javaupdate-cdn.com" OR destinationntdomain CONTAINS "linux.0g6666.com" OR destinationntdomain CONTAINS "ad.ntp-update.com" OR destinationntdomain CONTAINS "www.0g6666.com" OR destinationntdomain CONTAINS "wt.ntp-update.com" OR destinationntdomain CONTAINS "aliyun.ntp-update.com")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND requesturl NOT NULL AND (requesturl CONTAINS "a-fms.ntp-update.com" OR requesturl CONTAINS "plus.0g6666.com" OR requesturl CONTAINS "aprotect.sun-java.com" OR requesturl CONTAINS "og8888.0g6666.com" OR requesturl CONTAINS "adobe.javaupdate-cdn.com" OR requesturl CONTAINS "linux.0g6666.com" OR requesturl CONTAINS "ad.ntp-update.com" OR requesturl CONTAINS "www.0g6666.com" OR requesturl CONTAINS "wt.ntp-update.com" OR requesturl CONTAINS "aliyun.ntp-update.com")
index=activity AND rg_functionality="Next Generation Firewall" AND ipaddress NOT NULL AND ipaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Next Generation Firewall" AND sourceaddress NOT NULL AND sourceaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Next Generation Firewall" AND translatedipaddress NOT NULL AND translatedipaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Next Generation Firewall" AND deviceaddress NOT NULL AND deviceaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Firewall" AND ipaddress NOT NULL AND ipaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Firewall" AND sourceaddress NOT NULL AND sourceaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Firewall" AND translatedipaddress NOT NULL AND translatedipaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Firewall" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Firewall" AND deviceaddress NOT NULL AND deviceaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Web Proxy" AND ipaddress NOT NULL AND ipaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Web Proxy" AND sourceaddress NOT NULL AND sourceaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Web Proxy" AND destinationaddress NOT NULL AND destinationaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Web Proxy" AND translatedipaddress NOT NULL AND translatedipaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Web Proxy" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Web Proxy" AND deviceaddress NOT NULL AND deviceaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Flow" AND ipaddress NOT NULL AND ipaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Flow" AND sourceaddress NOT NULL AND sourceaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Flow" AND destinationaddress NOT NULL AND destinationaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Flow" AND translatedipaddress NOT NULL AND translatedipaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Flow" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Flow" AND deviceaddress NOT NULL AND deviceaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Web Server" AND ipaddress NOT NULL AND ipaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Web Server" AND sourceaddress NOT NULL AND sourceaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Web Server" AND destinationaddress NOT NULL AND destinationaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Web Server" AND translatedipaddress NOT NULL AND translatedipaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Web Server" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Web Server" AND deviceaddress NOT NULL AND deviceaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND ipaddress NOT NULL AND ipaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND sourceaddress NOT NULL AND sourceaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationaddress NOT NULL AND destinationaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND translatedipaddress NOT NULL AND translatedipaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND deviceaddress NOT NULL AND deviceaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND ipaddress NOT NULL AND ipaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND sourceaddress NOT NULL AND sourceaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationaddress NOT NULL AND destinationaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND translatedipaddress NOT NULL AND translatedipaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND deviceaddress NOT NULL AND deviceaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Web Application Firewall" AND ipaddress NOT NULL AND ipaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Web Application Firewall" AND sourceaddress NOT NULL AND sourceaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Web Application Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Web Application Firewall" AND translatedipaddress NOT NULL AND translatedipaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Web Application Firewall" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Web Application Firewall" AND deviceaddress NOT NULL AND deviceaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Endpoint management systems" AND ipaddress NOT NULL AND ipaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Endpoint management systems" AND sourceaddress NOT NULL AND sourceaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Endpoint management systems" AND destinationaddress NOT NULL AND destinationaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Endpoint management systems" AND translatedipaddress NOT NULL AND translatedipaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Endpoint management systems" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Endpoint management systems" AND deviceaddress NOT NULL AND deviceaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND ipaddress NOT NULL AND ipaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourceaddress NOT NULL AND sourceaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationaddress NOT NULL AND destinationaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND translatedipaddress NOT NULL AND translatedipaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND deviceaddress NOT NULL AND deviceaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Cloud Application Audit" AND ipaddress NOT NULL AND ipaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Cloud Application Audit" AND sourceaddress NOT NULL AND sourceaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Cloud Application Audit" AND destinationaddress NOT NULL AND destinationaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Cloud Application Audit" AND translatedipaddress NOT NULL AND translatedipaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Cloud Application Audit" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Cloud Application Audit" AND deviceaddress NOT NULL AND deviceaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND ipaddress NOT NULL AND ipaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND sourceaddress NOT NULL AND sourceaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND destinationaddress NOT NULL AND destinationaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND translatedipaddress NOT NULL AND translatedipaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND deviceaddress NOT NULL AND deviceaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Unix / Linux / AIX" AND ipaddress NOT NULL AND ipaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Unix / Linux / AIX" AND sourceaddress NOT NULL AND sourceaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationaddress NOT NULL AND destinationaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Unix / Linux / AIX" AND translatedipaddress NOT NULL AND translatedipaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Unix / Linux / AIX" AND deviceaddress NOT NULL AND deviceaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND ipaddress NOT NULL AND ipaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND sourceaddress NOT NULL AND sourceaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND destinationaddress NOT NULL AND destinationaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND translatedipaddress NOT NULL AND translatedipaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND deviceaddress NOT NULL AND deviceaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Cloud Application Security Broker" AND ipaddress NOT NULL AND ipaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Cloud Application Security Broker" AND sourceaddress NOT NULL AND sourceaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationaddress NOT NULL AND destinationaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Cloud Application Security Broker" AND translatedipaddress NOT NULL AND translatedipaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Cloud Application Security Broker" AND deviceaddress NOT NULL AND deviceaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Source Code Repository" AND ipaddress NOT NULL AND ipaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Source Code Repository" AND sourceaddress NOT NULL AND sourceaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Source Code Repository" AND destinationaddress NOT NULL AND destinationaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Source Code Repository" AND translatedipaddress NOT NULL AND translatedipaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Source Code Repository" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Source Code Repository" AND deviceaddress NOT NULL AND deviceaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Cloud Email / Email Security" AND ipaddress NOT NULL AND ipaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Cloud Email / Email Security" AND sourceaddress NOT NULL AND sourceaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationaddress NOT NULL AND destinationaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Cloud Email / Email Security" AND translatedipaddress NOT NULL AND translatedipaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Cloud Email / Email Security" AND deviceaddress NOT NULL AND deviceaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="DNS / DHCP" AND ipaddress NOT NULL AND ipaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="DNS / DHCP" AND sourceaddress NOT NULL AND sourceaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="DNS / DHCP" AND destinationaddress NOT NULL AND destinationaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="DNS / DHCP" AND translatedipaddress NOT NULL AND translatedipaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="DNS / DHCP" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="DNS / DHCP" AND deviceaddress NOT NULL AND deviceaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND ipaddress NOT NULL AND ipaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND sourceaddress NOT NULL AND sourceaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND destinationaddress NOT NULL AND destinationaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND translatedipaddress NOT NULL AND translatedipaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND deviceaddress NOT NULL AND deviceaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Next Generation Firewall" AND ipaddress NOT NULL AND ipaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Next Generation Firewall" AND sourceaddress NOT NULL AND sourceaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Next Generation Firewall" AND translatedipaddress NOT NULL AND translatedipaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Next Generation Firewall" AND deviceaddress NOT NULL AND deviceaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Firewall" AND ipaddress NOT NULL AND ipaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Firewall" AND sourceaddress NOT NULL AND sourceaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Firewall" AND translatedipaddress NOT NULL AND translatedipaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Firewall" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Firewall" AND deviceaddress NOT NULL AND deviceaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Web Proxy" AND ipaddress NOT NULL AND ipaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Web Proxy" AND sourceaddress NOT NULL AND sourceaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Web Proxy" AND destinationaddress NOT NULL AND destinationaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Web Proxy" AND translatedipaddress NOT NULL AND translatedipaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Web Proxy" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Web Proxy" AND deviceaddress NOT NULL AND deviceaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Flow" AND ipaddress NOT NULL AND ipaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Flow" AND sourceaddress NOT NULL AND sourceaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Flow" AND destinationaddress NOT NULL AND destinationaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Flow" AND translatedipaddress NOT NULL AND translatedipaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Flow" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Flow" AND deviceaddress NOT NULL AND deviceaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Web Server" AND ipaddress NOT NULL AND ipaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Web Server" AND sourceaddress NOT NULL AND sourceaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Web Server" AND destinationaddress NOT NULL AND destinationaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Web Server" AND translatedipaddress NOT NULL AND translatedipaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Web Server" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Web Server" AND deviceaddress NOT NULL AND deviceaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="DNS / DHCP" AND ipaddress NOT NULL AND ipaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="DNS / DHCP" AND sourceaddress NOT NULL AND sourceaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="DNS / DHCP" AND destinationaddress NOT NULL AND destinationaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="DNS / DHCP" AND translatedipaddress NOT NULL AND translatedipaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="DNS / DHCP" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="DNS / DHCP" AND deviceaddress NOT NULL AND deviceaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND ipaddress NOT NULL AND ipaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND sourceaddress NOT NULL AND sourceaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND destinationaddress NOT NULL AND destinationaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND translatedipaddress NOT NULL AND translatedipaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND deviceaddress NOT NULL AND deviceaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND ipaddress NOT NULL AND ipaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND sourceaddress NOT NULL AND sourceaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND destinationaddress NOT NULL AND destinationaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND translatedipaddress NOT NULL AND translatedipaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND deviceaddress NOT NULL AND deviceaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Email / Email Security" AND ipaddress NOT NULL AND ipaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Email / Email Security" AND sourceaddress NOT NULL AND sourceaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Email / Email Security" AND destinationaddress NOT NULL AND destinationaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Email / Email Security" AND translatedipaddress NOT NULL AND translatedipaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Email / Email Security" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Email / Email Security" AND deviceaddress NOT NULL AND deviceaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Cloud Email / Email Security" AND ipaddress NOT NULL AND ipaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Cloud Email / Email Security" AND sourceaddress NOT NULL AND sourceaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationaddress NOT NULL AND destinationaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Cloud Email / Email Security" AND translatedipaddress NOT NULL AND translatedipaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Cloud Email / Email Security" AND deviceaddress NOT NULL AND deviceaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND ipaddress NOT NULL AND ipaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND sourceaddress NOT NULL AND sourceaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationaddress NOT NULL AND destinationaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND translatedipaddress NOT NULL AND translatedipaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND deviceaddress NOT NULL AND deviceaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND ipaddress NOT NULL AND ipaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND sourceaddress NOT NULL AND sourceaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationaddress NOT NULL AND destinationaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND translatedipaddress NOT NULL AND translatedipaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND deviceaddress NOT NULL AND deviceaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Web Application Firewall" AND ipaddress NOT NULL AND ipaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Web Application Firewall" AND sourceaddress NOT NULL AND sourceaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Web Application Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Web Application Firewall" AND translatedipaddress NOT NULL AND translatedipaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Web Application Firewall" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Web Application Firewall" AND deviceaddress NOT NULL AND deviceaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Endpoint management systems" AND ipaddress NOT NULL AND ipaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Endpoint management systems" AND sourceaddress NOT NULL AND sourceaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Endpoint management systems" AND destinationaddress NOT NULL AND destinationaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Endpoint management systems" AND translatedipaddress NOT NULL AND translatedipaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Endpoint management systems" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Endpoint management systems" AND deviceaddress NOT NULL AND deviceaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Cloud Content Management System" AND ipaddress NOT NULL AND ipaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Cloud Content Management System" AND sourceaddress NOT NULL AND sourceaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Cloud Content Management System" AND destinationaddress NOT NULL AND destinationaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Cloud Content Management System" AND translatedipaddress NOT NULL AND translatedipaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Cloud Content Management System" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Cloud Content Management System" AND deviceaddress NOT NULL AND deviceaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND ipaddress NOT NULL AND ipaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourceaddress NOT NULL AND sourceaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationaddress NOT NULL AND destinationaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND translatedipaddress NOT NULL AND translatedipaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND deviceaddress NOT NULL AND deviceaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Microsoft Windows" AND ipaddress NOT NULL AND ipaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Microsoft Windows" AND sourceaddress NOT NULL AND sourceaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Microsoft Windows" AND destinationaddress NOT NULL AND destinationaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Microsoft Windows" AND translatedipaddress NOT NULL AND translatedipaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Microsoft Windows" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Microsoft Windows" AND deviceaddress NOT NULL AND deviceaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Cloud Services / Applications" AND ipaddress NOT NULL AND ipaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Cloud Services / Applications" AND sourceaddress NOT NULL AND sourceaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Cloud Services / Applications" AND destinationaddress NOT NULL AND destinationaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Cloud Services / Applications" AND translatedipaddress NOT NULL AND translatedipaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Cloud Services / Applications" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Cloud Services / Applications" AND deviceaddress NOT NULL AND deviceaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Cloud Application Audit" AND ipaddress NOT NULL AND ipaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Cloud Application Audit" AND sourceaddress NOT NULL AND sourceaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Cloud Application Audit" AND destinationaddress NOT NULL AND destinationaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Cloud Application Audit" AND translatedipaddress NOT NULL AND translatedipaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Cloud Application Audit" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Cloud Application Audit" AND deviceaddress NOT NULL AND deviceaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND ipaddress NOT NULL AND ipaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND sourceaddress NOT NULL AND sourceaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND destinationaddress NOT NULL AND destinationaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND translatedipaddress NOT NULL AND translatedipaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND deviceaddress NOT NULL AND deviceaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Authentication / VPN" AND ipaddress NOT NULL AND ipaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Authentication / VPN" AND sourceaddress NOT NULL AND sourceaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Authentication / VPN" AND destinationaddress NOT NULL AND destinationaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Authentication / VPN" AND translatedipaddress NOT NULL AND translatedipaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Authentication / VPN" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Authentication / VPN" AND deviceaddress NOT NULL AND deviceaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Content Management System" AND ipaddress NOT NULL AND ipaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Content Management System" AND sourceaddress NOT NULL AND sourceaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Content Management System" AND destinationaddress NOT NULL AND destinationaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Content Management System" AND translatedipaddress NOT NULL AND translatedipaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Content Management System" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Content Management System" AND deviceaddress NOT NULL AND deviceaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Unix / Linux / AIX" AND ipaddress NOT NULL AND ipaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Unix / Linux / AIX" AND sourceaddress NOT NULL AND sourceaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationaddress NOT NULL AND destinationaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Unix / Linux / AIX" AND translatedipaddress NOT NULL AND translatedipaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Unix / Linux / AIX" AND deviceaddress NOT NULL AND deviceaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Network Access Control / NAC" AND ipaddress NOT NULL AND ipaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Network Access Control / NAC" AND sourceaddress NOT NULL AND sourceaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Network Access Control / NAC" AND destinationaddress NOT NULL AND destinationaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Network Access Control / NAC" AND translatedipaddress NOT NULL AND translatedipaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Network Access Control / NAC" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Network Access Control / NAC" AND deviceaddress NOT NULL AND deviceaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Virtualization / Containers" AND ipaddress NOT NULL AND ipaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Virtualization / Containers" AND sourceaddress NOT NULL AND sourceaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Virtualization / Containers" AND destinationaddress NOT NULL AND destinationaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Virtualization / Containers" AND translatedipaddress NOT NULL AND translatedipaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Virtualization / Containers" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Virtualization / Containers" AND deviceaddress NOT NULL AND deviceaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Access / Privileged User" AND ipaddress NOT NULL AND ipaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Access / Privileged User" AND sourceaddress NOT NULL AND sourceaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Access / Privileged User" AND destinationaddress NOT NULL AND destinationaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Access / Privileged User" AND translatedipaddress NOT NULL AND translatedipaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Access / Privileged User" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Access / Privileged User" AND deviceaddress NOT NULL AND deviceaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND ipaddress NOT NULL AND ipaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND sourceaddress NOT NULL AND sourceaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND destinationaddress NOT NULL AND destinationaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND translatedipaddress NOT NULL AND translatedipaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND deviceaddress NOT NULL AND deviceaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Access / Identity Management" AND ipaddress NOT NULL AND ipaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Access / Identity Management" AND sourceaddress NOT NULL AND sourceaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Access / Identity Management" AND destinationaddress NOT NULL AND destinationaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Access / Identity Management" AND translatedipaddress NOT NULL AND translatedipaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Access / Identity Management" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Access / Identity Management" AND deviceaddress NOT NULL AND deviceaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Identity Access Management" AND ipaddress NOT NULL AND ipaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Identity Access Management" AND sourceaddress NOT NULL AND sourceaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Identity Access Management" AND destinationaddress NOT NULL AND destinationaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Identity Access Management" AND translatedipaddress NOT NULL AND translatedipaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Identity Access Management" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Identity Access Management" AND deviceaddress NOT NULL AND deviceaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Application / Enterprise / SaaS" AND ipaddress NOT NULL AND ipaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Application / Enterprise / SaaS" AND sourceaddress NOT NULL AND sourceaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Application / Enterprise / SaaS" AND destinationaddress NOT NULL AND destinationaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Application / Enterprise / SaaS" AND translatedipaddress NOT NULL AND translatedipaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Application / Enterprise / SaaS" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Application / Enterprise / SaaS" AND deviceaddress NOT NULL AND deviceaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Authentication / WiFi" AND ipaddress NOT NULL AND ipaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Authentication / WiFi" AND sourceaddress NOT NULL AND sourceaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Authentication / WiFi" AND destinationaddress NOT NULL AND destinationaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Authentication / WiFi" AND translatedipaddress NOT NULL AND translatedipaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Authentication / WiFi" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Authentication / WiFi" AND deviceaddress NOT NULL AND deviceaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Cloud Application Security Broker" AND ipaddress NOT NULL AND ipaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Cloud Application Security Broker" AND sourceaddress NOT NULL AND sourceaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationaddress NOT NULL AND destinationaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Cloud Application Security Broker" AND translatedipaddress NOT NULL AND translatedipaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Cloud Application Security Broker" AND deviceaddress NOT NULL AND deviceaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Source Code Repository" AND ipaddress NOT NULL AND ipaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Source Code Repository" AND sourceaddress NOT NULL AND sourceaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Source Code Repository" AND destinationaddress NOT NULL AND destinationaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Source Code Repository" AND translatedipaddress NOT NULL AND translatedipaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Source Code Repository" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Source Code Repository" AND deviceaddress NOT NULL AND deviceaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND ipaddress NOT NULL AND ipaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND sourceaddress NOT NULL AND sourceaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND destinationaddress NOT NULL AND destinationaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND translatedipaddress NOT NULL AND translatedipaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND deviceaddress NOT NULL AND deviceaddress IN ("34.96.222.22","35.220.144.179","35.220.202.191","35.220.202.191","34.96.235.162","35.220.190.145","35.220.183.209","35.208.179.162","34.92.13.119")
index=activity AND rg_functionality="Next Generation Firewall" AND filehash NOT NULL AND filehash IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Next Generation Firewall" AND oldfilehash NOT NULL AND oldfilehash IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Next Generation Firewall" AND customstring3 NOT NULL AND customstring3 IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Next Generation Firewall" AND customstring64 NOT NULL AND customstring64 IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Firewall" AND filehash NOT NULL AND filehash IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Firewall" AND oldfilehash NOT NULL AND oldfilehash IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Firewall" AND customstring3 NOT NULL AND customstring3 IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Firewall" AND customstring64 NOT NULL AND customstring64 IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Web Proxy" AND filehash NOT NULL AND filehash IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Web Proxy" AND oldfilehash NOT NULL AND oldfilehash IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Web Proxy" AND customstring3 NOT NULL AND customstring3 IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Web Proxy" AND customstring64 NOT NULL AND customstring64 IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Flow" AND filehash NOT NULL AND filehash IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Flow" AND oldfilehash NOT NULL AND oldfilehash IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Flow" AND customstring3 NOT NULL AND customstring3 IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Flow" AND customstring64 NOT NULL AND customstring64 IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Web Server" AND filehash NOT NULL AND filehash IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Web Server" AND oldfilehash NOT NULL AND oldfilehash IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Web Server" AND customstring3 NOT NULL AND customstring3 IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Web Server" AND customstring64 NOT NULL AND customstring64 IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring64 NOT NULL AND customstring64 IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring64 NOT NULL AND customstring64 IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Web Application Firewall" AND filehash NOT NULL AND filehash IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Web Application Firewall" AND oldfilehash NOT NULL AND oldfilehash IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Web Application Firewall" AND customstring3 NOT NULL AND customstring3 IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Web Application Firewall" AND customstring64 NOT NULL AND customstring64 IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Endpoint management systems" AND filehash NOT NULL AND filehash IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Endpoint management systems" AND oldfilehash NOT NULL AND oldfilehash IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Endpoint management systems" AND customstring3 NOT NULL AND customstring3 IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Endpoint management systems" AND customstring64 NOT NULL AND customstring64 IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring64 NOT NULL AND customstring64 IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Cloud Application Audit" AND filehash NOT NULL AND filehash IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Cloud Application Audit" AND oldfilehash NOT NULL AND oldfilehash IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Cloud Application Audit" AND customstring3 NOT NULL AND customstring3 IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Cloud Application Audit" AND customstring64 NOT NULL AND customstring64 IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND filehash NOT NULL AND filehash IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND oldfilehash NOT NULL AND oldfilehash IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND customstring3 NOT NULL AND customstring3 IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND customstring64 NOT NULL AND customstring64 IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Unix / Linux / AIX" AND filehash NOT NULL AND filehash IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Unix / Linux / AIX" AND oldfilehash NOT NULL AND oldfilehash IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Unix / Linux / AIX" AND customstring3 NOT NULL AND customstring3 IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Unix / Linux / AIX" AND customstring64 NOT NULL AND customstring64 IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND filehash NOT NULL AND filehash IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND oldfilehash NOT NULL AND oldfilehash IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND customstring3 NOT NULL AND customstring3 IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND customstring64 NOT NULL AND customstring64 IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Cloud Application Security Broker" AND filehash NOT NULL AND filehash IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Cloud Application Security Broker" AND oldfilehash NOT NULL AND oldfilehash IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Cloud Application Security Broker" AND customstring3 NOT NULL AND customstring3 IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Cloud Application Security Broker" AND customstring64 NOT NULL AND customstring64 IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Source Code Repository" AND filehash NOT NULL AND filehash IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Source Code Repository" AND oldfilehash NOT NULL AND oldfilehash IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Source Code Repository" AND customstring3 NOT NULL AND customstring3 IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Source Code Repository" AND customstring64 NOT NULL AND customstring64 IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="DNS / DHCP" AND filehash NOT NULL AND filehash IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="DNS / DHCP" AND oldfilehash NOT NULL AND oldfilehash IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="DNS / DHCP" AND customstring3 NOT NULL AND customstring3 IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="DNS / DHCP" AND customstring64 NOT NULL AND customstring64 IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND filehash NOT NULL AND filehash IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND oldfilehash NOT NULL AND oldfilehash IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND customstring3 NOT NULL AND customstring3 IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND customstring64 NOT NULL AND customstring64 IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Next Generation Firewall" AND filehash NOT NULL AND filehash IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Next Generation Firewall" AND oldfilehash NOT NULL AND oldfilehash IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Next Generation Firewall" AND customstring3 NOT NULL AND customstring3 IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Next Generation Firewall" AND customstring64 NOT NULL AND customstring64 IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Firewall" AND filehash NOT NULL AND filehash IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Firewall" AND oldfilehash NOT NULL AND oldfilehash IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Firewall" AND customstring3 NOT NULL AND customstring3 IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Firewall" AND customstring64 NOT NULL AND customstring64 IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Web Proxy" AND filehash NOT NULL AND filehash IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Web Proxy" AND oldfilehash NOT NULL AND oldfilehash IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Web Proxy" AND customstring3 NOT NULL AND customstring3 IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Web Proxy" AND customstring64 NOT NULL AND customstring64 IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Flow" AND filehash NOT NULL AND filehash IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Flow" AND oldfilehash NOT NULL AND oldfilehash IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Flow" AND customstring3 NOT NULL AND customstring3 IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Flow" AND customstring64 NOT NULL AND customstring64 IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Web Server" AND filehash NOT NULL AND filehash IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Web Server" AND oldfilehash NOT NULL AND oldfilehash IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Web Server" AND customstring3 NOT NULL AND customstring3 IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Web Server" AND customstring64 NOT NULL AND customstring64 IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="DNS / DHCP" AND filehash NOT NULL AND filehash IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="DNS / DHCP" AND oldfilehash NOT NULL AND oldfilehash IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="DNS / DHCP" AND customstring3 NOT NULL AND customstring3 IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="DNS / DHCP" AND customstring64 NOT NULL AND customstring64 IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring64 NOT NULL AND customstring64 IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring64 NOT NULL AND customstring64 IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Web Application Firewall" AND filehash NOT NULL AND filehash IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Web Application Firewall" AND oldfilehash NOT NULL AND oldfilehash IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Web Application Firewall" AND customstring3 NOT NULL AND customstring3 IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Web Application Firewall" AND customstring64 NOT NULL AND customstring64 IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Endpoint management systems" AND filehash NOT NULL AND filehash IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Endpoint management systems" AND oldfilehash NOT NULL AND oldfilehash IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Endpoint management systems" AND customstring3 NOT NULL AND customstring3 IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Endpoint management systems" AND customstring64 NOT NULL AND customstring64 IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Cloud Content Management System" AND filehash NOT NULL AND filehash IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Cloud Content Management System" AND oldfilehash NOT NULL AND oldfilehash IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Cloud Content Management System" AND customstring3 NOT NULL AND customstring3 IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Cloud Content Management System" AND customstring64 NOT NULL AND customstring64 IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring64 NOT NULL AND customstring64 IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Microsoft Windows" AND filehash NOT NULL AND filehash IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Microsoft Windows" AND oldfilehash NOT NULL AND oldfilehash IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Microsoft Windows" AND customstring3 NOT NULL AND customstring3 IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Microsoft Windows" AND customstring64 NOT NULL AND customstring64 IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Cloud Services / Applications" AND filehash NOT NULL AND filehash IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Cloud Services / Applications" AND oldfilehash NOT NULL AND oldfilehash IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Cloud Services / Applications" AND customstring3 NOT NULL AND customstring3 IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Cloud Services / Applications" AND customstring64 NOT NULL AND customstring64 IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Cloud Application Audit" AND filehash NOT NULL AND filehash IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Cloud Application Audit" AND oldfilehash NOT NULL AND oldfilehash IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Cloud Application Audit" AND customstring3 NOT NULL AND customstring3 IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Cloud Application Audit" AND customstring64 NOT NULL AND customstring64 IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND filehash NOT NULL AND filehash IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND oldfilehash NOT NULL AND oldfilehash IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND customstring3 NOT NULL AND customstring3 IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND customstring64 NOT NULL AND customstring64 IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Authentication / VPN" AND filehash NOT NULL AND filehash IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Authentication / VPN" AND oldfilehash NOT NULL AND oldfilehash IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Authentication / VPN" AND customstring3 NOT NULL AND customstring3 IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Authentication / VPN" AND customstring64 NOT NULL AND customstring64 IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Content Management System" AND filehash NOT NULL AND filehash IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Content Management System" AND oldfilehash NOT NULL AND oldfilehash IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Content Management System" AND customstring3 NOT NULL AND customstring3 IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Content Management System" AND customstring64 NOT NULL AND customstring64 IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Unix / Linux / AIX" AND filehash NOT NULL AND filehash IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Unix / Linux / AIX" AND oldfilehash NOT NULL AND oldfilehash IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Unix / Linux / AIX" AND customstring3 NOT NULL AND customstring3 IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Unix / Linux / AIX" AND customstring64 NOT NULL AND customstring64 IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Network Access Control / NAC" AND filehash NOT NULL AND filehash IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Network Access Control / NAC" AND oldfilehash NOT NULL AND oldfilehash IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Network Access Control / NAC" AND customstring3 NOT NULL AND customstring3 IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Network Access Control / NAC" AND customstring64 NOT NULL AND customstring64 IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Virtualization / Containers" AND filehash NOT NULL AND filehash IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Virtualization / Containers" AND oldfilehash NOT NULL AND oldfilehash IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Virtualization / Containers" AND customstring3 NOT NULL AND customstring3 IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Virtualization / Containers" AND customstring64 NOT NULL AND customstring64 IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Access / Privileged User" AND filehash NOT NULL AND filehash IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Access / Privileged User" AND oldfilehash NOT NULL AND oldfilehash IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Access / Privileged User" AND customstring3 NOT NULL AND customstring3 IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Access / Privileged User" AND customstring64 NOT NULL AND customstring64 IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND filehash NOT NULL AND filehash IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND oldfilehash NOT NULL AND oldfilehash IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND customstring3 NOT NULL AND customstring3 IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND customstring64 NOT NULL AND customstring64 IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Access / Identity Management" AND filehash NOT NULL AND filehash IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Access / Identity Management" AND oldfilehash NOT NULL AND oldfilehash IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Access / Identity Management" AND customstring3 NOT NULL AND customstring3 IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Access / Identity Management" AND customstring64 NOT NULL AND customstring64 IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Identity Access Management" AND filehash NOT NULL AND filehash IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Identity Access Management" AND oldfilehash NOT NULL AND oldfilehash IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Identity Access Management" AND customstring3 NOT NULL AND customstring3 IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Identity Access Management" AND customstring64 NOT NULL AND customstring64 IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Application / Enterprise / SaaS" AND filehash NOT NULL AND filehash IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Application / Enterprise / SaaS" AND oldfilehash NOT NULL AND oldfilehash IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Application / Enterprise / SaaS" AND customstring3 NOT NULL AND customstring3 IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Application / Enterprise / SaaS" AND customstring64 NOT NULL AND customstring64 IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Authentication / WiFi" AND filehash NOT NULL AND filehash IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Authentication / WiFi" AND oldfilehash NOT NULL AND oldfilehash IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Authentication / WiFi" AND customstring3 NOT NULL AND customstring3 IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Authentication / WiFi" AND customstring64 NOT NULL AND customstring64 IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Cloud Application Security Broker" AND filehash NOT NULL AND filehash IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Cloud Application Security Broker" AND oldfilehash NOT NULL AND oldfilehash IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Cloud Application Security Broker" AND customstring3 NOT NULL AND customstring3 IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Cloud Application Security Broker" AND customstring64 NOT NULL AND customstring64 IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Source Code Repository" AND filehash NOT NULL AND filehash IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Source Code Repository" AND oldfilehash NOT NULL AND oldfilehash IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Source Code Repository" AND customstring3 NOT NULL AND customstring3 IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Source Code Repository" AND customstring64 NOT NULL AND customstring64 IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND filehash NOT NULL AND filehash IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND oldfilehash NOT NULL AND oldfilehash IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND customstring3 NOT NULL AND customstring3 IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND customstring64 NOT NULL AND customstring64 IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring64 NOT NULL AND customstring64 IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring64 NOT NULL AND customstring64 IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring64 NOT NULL AND customstring64 IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring64 NOT NULL AND customstring64 IN ("dec5b1c097b8d547666f76b55c5d0fdc","6cf0007b0d487f899fbd05ffc3401211","3294710063ee0dc7d6dfffc4de337b68","5a5e02256c0a8b65b2db8a0f88887744","1325ad15712a875ff61de3bbb0eccebd","b7538226437cea21297b94f37d2c2813","003d6351a2a2a2835f2b64a999963ec1","e89cb63e1352a1c9f86e03e4c744b5cd","20ef20fd88dc7a5e90908f1667c08d11","f18eb7a820f75e51b619b14967c83bb2","43b238bf6829e6f1056749bebdc01dbe","a83cdb7efbe7bbc4dafa1c11578e6372","f14a812c6c377e52fb98f8d4c1ed0abd","2a421eec6784f1675585e9b428c1b68c","5c613c1f1f426d7b4630673966a125ba","ea4cee8027df495c0da7b22e5a9d8457","32efbf302aaa2845d3a2b76a50840dc2","47a02b5f59bbc62b7f4be0f4ce7574cd","13f5490acf5f5fab2f43f71999563bb9","9fc12edb2e5f193ed4ae365a57c47ffb","f51e88b159b5661f0b83c3947f3e0b24","61ac19b0f812b10e7690109430cba4a5","d80827879b2e15b18a9c0feaf5a3c859","1d6b37bd2dfc9d6b4a811f90f6f48dce","2af313bdd3c54d95303c14786a3ad58d","d5cdeba19d1a31b5be424a82210e3417","de9233ed6689f84286fe0b7da8bc89e9","e7121980263c08d2a759df827f97ecae","78a7df158236edd372946347a156e5bc","2b1130775c44be96990b2916ba071f40","211ffebfbf679b713148c6dad94ec1df","3b8424499183af6f886f722d85353abf")
