index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("1a5f3ca6597fcccd3295ead4d22ce70b","31a359bfee00337bc9c6d23c2cb88737ac9b61c8","7501da197ff9bcd49198dce9cf668442b3a04122d1034effb29d74e0a09529d7","5715aa98a4105b944b810caa784c6f57","96c87499c3513731f4b4600411044225ddc801e1","d9e8440665f37ae16b60ba912c540ba1f689c8ef7454defbdbf6ce7d776b8e24","3a9cd09b118128408f9867a4d0e5fc27","4aadea291e072d082927bd3ef05460c3e656f541","1a72704edb713083e6404b950a3e6d86afca4d95f7871a98fe3648d776fbef8f","4fd94383d9c745ecc270bdd67889f1d8","7da18493faa8226e26b6b6e2f2842eace1d7c152","92db40988d314cea103ecc343b61188d8b472dc524c5b66a3776dad6fc7938f0","ae276a8143c07b4fc14c4eff07ffcadf","8ae6dde50fd3a5697076fed6d6b61acdc8b75e1d","8358c51b34f351da30450956f25bef9d5377a993a156c452b872b3e2f10004a8","6052ce3d36f46c65686b26fac5a18ed8","6c1d581b04c3d0dad70c7f13798669b579bf8874","5ad6dd1f4fa5b1a877f8ae61441076eb7ba3ec0d8aeb937e3db13742868babcd","0b5e0dd9764a3cd54bcd619c483b8ccb","b63d4dd1cdd9fd71e9d1f3789752cbd3dbc969f4","c5bd1b3ffea21877026db75251fd4e3c5036d4c4fbd4ff60f30c0cf9dda800d6")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("1a5f3ca6597fcccd3295ead4d22ce70b","31a359bfee00337bc9c6d23c2cb88737ac9b61c8","7501da197ff9bcd49198dce9cf668442b3a04122d1034effb29d74e0a09529d7","5715aa98a4105b944b810caa784c6f57","96c87499c3513731f4b4600411044225ddc801e1","d9e8440665f37ae16b60ba912c540ba1f689c8ef7454defbdbf6ce7d776b8e24","3a9cd09b118128408f9867a4d0e5fc27","4aadea291e072d082927bd3ef05460c3e656f541","1a72704edb713083e6404b950a3e6d86afca4d95f7871a98fe3648d776fbef8f","4fd94383d9c745ecc270bdd67889f1d8","7da18493faa8226e26b6b6e2f2842eace1d7c152","92db40988d314cea103ecc343b61188d8b472dc524c5b66a3776dad6fc7938f0","ae276a8143c07b4fc14c4eff07ffcadf","8ae6dde50fd3a5697076fed6d6b61acdc8b75e1d","8358c51b34f351da30450956f25bef9d5377a993a156c452b872b3e2f10004a8","6052ce3d36f46c65686b26fac5a18ed8","6c1d581b04c3d0dad70c7f13798669b579bf8874","5ad6dd1f4fa5b1a877f8ae61441076eb7ba3ec0d8aeb937e3db13742868babcd","0b5e0dd9764a3cd54bcd619c483b8ccb","b63d4dd1cdd9fd71e9d1f3789752cbd3dbc969f4","c5bd1b3ffea21877026db75251fd4e3c5036d4c4fbd4ff60f30c0cf9dda800d6")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("1a5f3ca6597fcccd3295ead4d22ce70b","31a359bfee00337bc9c6d23c2cb88737ac9b61c8","7501da197ff9bcd49198dce9cf668442b3a04122d1034effb29d74e0a09529d7","5715aa98a4105b944b810caa784c6f57","96c87499c3513731f4b4600411044225ddc801e1","d9e8440665f37ae16b60ba912c540ba1f689c8ef7454defbdbf6ce7d776b8e24","3a9cd09b118128408f9867a4d0e5fc27","4aadea291e072d082927bd3ef05460c3e656f541","1a72704edb713083e6404b950a3e6d86afca4d95f7871a98fe3648d776fbef8f","4fd94383d9c745ecc270bdd67889f1d8","7da18493faa8226e26b6b6e2f2842eace1d7c152","92db40988d314cea103ecc343b61188d8b472dc524c5b66a3776dad6fc7938f0","ae276a8143c07b4fc14c4eff07ffcadf","8ae6dde50fd3a5697076fed6d6b61acdc8b75e1d","8358c51b34f351da30450956f25bef9d5377a993a156c452b872b3e2f10004a8","6052ce3d36f46c65686b26fac5a18ed8","6c1d581b04c3d0dad70c7f13798669b579bf8874","5ad6dd1f4fa5b1a877f8ae61441076eb7ba3ec0d8aeb937e3db13742868babcd","0b5e0dd9764a3cd54bcd619c483b8ccb","b63d4dd1cdd9fd71e9d1f3789752cbd3dbc969f4","c5bd1b3ffea21877026db75251fd4e3c5036d4c4fbd4ff60f30c0cf9dda800d6")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("1a5f3ca6597fcccd3295ead4d22ce70b","31a359bfee00337bc9c6d23c2cb88737ac9b61c8","7501da197ff9bcd49198dce9cf668442b3a04122d1034effb29d74e0a09529d7","5715aa98a4105b944b810caa784c6f57","96c87499c3513731f4b4600411044225ddc801e1","d9e8440665f37ae16b60ba912c540ba1f689c8ef7454defbdbf6ce7d776b8e24","3a9cd09b118128408f9867a4d0e5fc27","4aadea291e072d082927bd3ef05460c3e656f541","1a72704edb713083e6404b950a3e6d86afca4d95f7871a98fe3648d776fbef8f","4fd94383d9c745ecc270bdd67889f1d8","7da18493faa8226e26b6b6e2f2842eace1d7c152","92db40988d314cea103ecc343b61188d8b472dc524c5b66a3776dad6fc7938f0","ae276a8143c07b4fc14c4eff07ffcadf","8ae6dde50fd3a5697076fed6d6b61acdc8b75e1d","8358c51b34f351da30450956f25bef9d5377a993a156c452b872b3e2f10004a8","6052ce3d36f46c65686b26fac5a18ed8","6c1d581b04c3d0dad70c7f13798669b579bf8874","5ad6dd1f4fa5b1a877f8ae61441076eb7ba3ec0d8aeb937e3db13742868babcd","0b5e0dd9764a3cd54bcd619c483b8ccb","b63d4dd1cdd9fd71e9d1f3789752cbd3dbc969f4","c5bd1b3ffea21877026db75251fd4e3c5036d4c4fbd4ff60f30c0cf9dda800d6")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("1a5f3ca6597fcccd3295ead4d22ce70b","31a359bfee00337bc9c6d23c2cb88737ac9b61c8","7501da197ff9bcd49198dce9cf668442b3a04122d1034effb29d74e0a09529d7","5715aa98a4105b944b810caa784c6f57","96c87499c3513731f4b4600411044225ddc801e1","d9e8440665f37ae16b60ba912c540ba1f689c8ef7454defbdbf6ce7d776b8e24","3a9cd09b118128408f9867a4d0e5fc27","4aadea291e072d082927bd3ef05460c3e656f541","1a72704edb713083e6404b950a3e6d86afca4d95f7871a98fe3648d776fbef8f","4fd94383d9c745ecc270bdd67889f1d8","7da18493faa8226e26b6b6e2f2842eace1d7c152","92db40988d314cea103ecc343b61188d8b472dc524c5b66a3776dad6fc7938f0","ae276a8143c07b4fc14c4eff07ffcadf","8ae6dde50fd3a5697076fed6d6b61acdc8b75e1d","8358c51b34f351da30450956f25bef9d5377a993a156c452b872b3e2f10004a8","6052ce3d36f46c65686b26fac5a18ed8","6c1d581b04c3d0dad70c7f13798669b579bf8874","5ad6dd1f4fa5b1a877f8ae61441076eb7ba3ec0d8aeb937e3db13742868babcd","0b5e0dd9764a3cd54bcd619c483b8ccb","b63d4dd1cdd9fd71e9d1f3789752cbd3dbc969f4","c5bd1b3ffea21877026db75251fd4e3c5036d4c4fbd4ff60f30c0cf9dda800d6")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("1a5f3ca6597fcccd3295ead4d22ce70b","31a359bfee00337bc9c6d23c2cb88737ac9b61c8","7501da197ff9bcd49198dce9cf668442b3a04122d1034effb29d74e0a09529d7","5715aa98a4105b944b810caa784c6f57","96c87499c3513731f4b4600411044225ddc801e1","d9e8440665f37ae16b60ba912c540ba1f689c8ef7454defbdbf6ce7d776b8e24","3a9cd09b118128408f9867a4d0e5fc27","4aadea291e072d082927bd3ef05460c3e656f541","1a72704edb713083e6404b950a3e6d86afca4d95f7871a98fe3648d776fbef8f","4fd94383d9c745ecc270bdd67889f1d8","7da18493faa8226e26b6b6e2f2842eace1d7c152","92db40988d314cea103ecc343b61188d8b472dc524c5b66a3776dad6fc7938f0","ae276a8143c07b4fc14c4eff07ffcadf","8ae6dde50fd3a5697076fed6d6b61acdc8b75e1d","8358c51b34f351da30450956f25bef9d5377a993a156c452b872b3e2f10004a8","6052ce3d36f46c65686b26fac5a18ed8","6c1d581b04c3d0dad70c7f13798669b579bf8874","5ad6dd1f4fa5b1a877f8ae61441076eb7ba3ec0d8aeb937e3db13742868babcd","0b5e0dd9764a3cd54bcd619c483b8ccb","b63d4dd1cdd9fd71e9d1f3789752cbd3dbc969f4","c5bd1b3ffea21877026db75251fd4e3c5036d4c4fbd4ff60f30c0cf9dda800d6")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "securityupdateav.com" OR destinationhostname CONTAINS "windowsupdatesc.com" OR destinationhostname CONTAINS "defenderupdateav.com")
index=activity AND rg_functionality="Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "securityupdateav.com" OR destinationhostname CONTAINS "windowsupdatesc.com" OR destinationhostname CONTAINS "defenderupdateav.com")
index=activity AND rg_functionality="Web Proxy" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "securityupdateav.com" OR destinationhostname CONTAINS "windowsupdatesc.com" OR destinationhostname CONTAINS "defenderupdateav.com")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationaddress NOT NULL AND destinationport NOT NULL AND ((destinationaddress="23.19.227.147" AND destinationport=80) OR (destinationaddress="23.19.227.147" AND destinationport=443) OR (destinationaddress="108.62.118.247" AND destinationport=443) OR (destinationaddress="212.114.52.180" AND destinationport=80) OR (destinationaddress="196.43.106.38" AND destinationport=443) OR (destinationaddress="186.97.172.178" AND destinationport=443) OR (destinationaddress="37.228.70.134" AND destinationport=443) OR (destinationaddress="144.48.139.206" AND destinationport=443) OR (destinationaddress="190.110.179.139" AND destinationport=443) OR (destinationaddress="172.105.15.152" AND destinationport=443))
index=activity AND rg_functionality="Firewall" AND destinationaddress NOT NULL AND destinationport NOT NULL AND ((destinationaddress="23.19.227.147" AND destinationport=80) OR (destinationaddress="23.19.227.147" AND destinationport=443) OR (destinationaddress="108.62.118.247" AND destinationport=443) OR (destinationaddress="212.114.52.180" AND destinationport=80) OR (destinationaddress="196.43.106.38" AND destinationport=443) OR (destinationaddress="186.97.172.178" AND destinationport=443) OR (destinationaddress="37.228.70.134" AND destinationport=443) OR (destinationaddress="144.48.139.206" AND destinationport=443) OR (destinationaddress="190.110.179.139" AND destinationport=443) OR (destinationaddress="172.105.15.152" AND destinationport=443))
index=activity AND rg_functionality="Next Generation Firewall" AND destinationaddress NOT NULL AND destinationport NOT NULL AND ((destinationaddress="177.67.137.111" AND destinationport=443) OR (destinationaddress="27.72.107.215" AND destinationport=443) OR (destinationaddress="186.66.15.10" AND destinationport=443) OR (destinationaddress="189.206.78.155" AND destinationport=443) OR (destinationaddress="202.131.227.229" AND destinationport=443) OR (destinationaddress="185.9.187.10" AND destinationport=443) OR (destinationaddress="196.41.57.46" AND destinationport=443) OR (destinationaddress="212.200.25.118" AND destinationport=443) OR (destinationaddress="197.254.14.238" AND destinationport=443) OR (destinationaddress="45.229.71.211" AND destinationport=443))
index=activity AND rg_functionality="Firewall" AND destinationaddress NOT NULL AND destinationport NOT NULL AND ((destinationaddress="177.67.137.111" AND destinationport=443) OR (destinationaddress="27.72.107.215" AND destinationport=443) OR (destinationaddress="186.66.15.10" AND destinationport=443) OR (destinationaddress="189.206.78.155" AND destinationport=443) OR (destinationaddress="202.131.227.229" AND destinationport=443) OR (destinationaddress="185.9.187.10" AND destinationport=443) OR (destinationaddress="196.41.57.46" AND destinationport=443) OR (destinationaddress="212.200.25.118" AND destinationport=443) OR (destinationaddress="197.254.14.238" AND destinationport=443) OR (destinationaddress="45.229.71.211" AND destinationport=443))
index=activity AND rg_functionality="Next Generation Firewall" AND destinationaddress NOT NULL AND destinationport NOT NULL AND ((destinationaddress="181.167.217.53" AND destinationport=443) OR (destinationaddress="181.129.116.58" AND destinationport=443) OR (destinationaddress="185.189.55.207" AND destinationport=443) OR (destinationaddress="172.104.241.29" AND destinationport=443) OR (destinationaddress="14.241.244.60" AND destinationport=443) OR (destinationaddress="144.48.138.213" AND destinationport=443) OR (destinationaddress="202.138.242.7" AND destinationport=443) OR (destinationaddress="202.166.196.111" AND destinationport=443) OR (destinationaddress="36.94.100.202" AND destinationport=443) OR (destinationaddress="187.19.167.233" AND destinationport=443))
index=activity AND rg_functionality="Firewall" AND destinationaddress NOT NULL AND destinationport NOT NULL AND ((destinationaddress="181.167.217.53" AND destinationport=443) OR (destinationaddress="181.129.116.58" AND destinationport=443) OR (destinationaddress="185.189.55.207" AND destinationport=443) OR (destinationaddress="172.104.241.29" AND destinationport=443) OR (destinationaddress="14.241.244.60" AND destinationport=443) OR (destinationaddress="144.48.138.213" AND destinationport=443) OR (destinationaddress="202.138.242.7" AND destinationport=443) OR (destinationaddress="202.166.196.111" AND destinationport=443) OR (destinationaddress="36.94.100.202" AND destinationport=443) OR (destinationaddress="187.19.167.233" AND destinationport=443))
index=activity AND rg_functionality="Next Generation Firewall" AND destinationaddress NOT NULL AND destinationport NOT NULL AND ((destinationaddress="181.129.242.202" AND destinationport=443) OR (destinationaddress="36.94.27.124" AND destinationport=443) OR (destinationaddress="43.245.216.116" AND destinationport=443) OR (destinationaddress="186.225.63.18" AND destinationport=443) OR (destinationaddress="41.77.134.250" AND destinationport=443))
index=activity AND rg_functionality="Firewall" AND destinationaddress NOT NULL AND destinationport NOT NULL AND ((destinationaddress="181.129.242.202" AND destinationport=443) OR (destinationaddress="36.94.27.124" AND destinationport=443) OR (destinationaddress="43.245.216.116" AND destinationport=443) OR (destinationaddress="186.225.63.18" AND destinationport=443) OR (destinationaddress="41.77.134.250" AND destinationport=443))
