index=activity AND rg_functionality="Next Generation Firewall" AND ipaddress NOT NULL AND ipaddress IN ("24.162.214.166 ","45.36.99.184 ","60.51.47.65 ","62.99.76.213 ","82.159.149.52 ","97.83.40.67 ","103.105.254.17 ","184.74.99.214")
index=activity AND rg_functionality="Firewall" AND ipaddress NOT NULL AND ipaddress IN ("24.162.214.166 ","45.36.99.184 ","60.51.47.65 ","62.99.76.213 ","82.159.149.52 ","97.83.40.67 ","103.105.254.17 ","184.74.99.214")
index=activity AND rg_functionality="Web Proxy" AND ipaddress NOT NULL AND ipaddress IN ("24.162.214.166 ","45.36.99.184 ","60.51.47.65 ","62.99.76.213 ","82.159.149.52 ","97.83.40.67 ","103.105.254.17 ","184.74.99.214")
index=activity AND rg_functionality="Web Application Firewall" AND ipaddress NOT NULL AND ipaddress IN ("24.162.214.166 ","45.36.99.184 ","60.51.47.65 ","62.99.76.213 ","82.159.149.52 ","97.83.40.67 ","103.105.254.17 ","184.74.99.214")
index=activity AND rg_functionality="DNS / DHCP" AND ipaddress NOT NULL AND ipaddress IN ("24.162.214.166 ","45.36.99.184 ","60.51.47.65 ","62.99.76.213 ","82.159.149.52 ","97.83.40.67 ","103.105.254.17 ","184.74.99.214")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND ipaddress NOT NULL AND ipaddress IN ("24.162.214.166 ","45.36.99.184 ","60.51.47.65 ","62.99.76.213 ","82.159.149.52 ","97.83.40.67 ","103.105.254.17 ","184.74.99.214")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("24.162.214.166 ","45.36.99.184 ","60.51.47.65 ","62.99.76.213 ","82.159.149.52 ","97.83.40.67 ","103.105.254.17 ","184.74.99.214")
index=activity AND rg_functionality="Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("24.162.214.166 ","45.36.99.184 ","60.51.47.65 ","62.99.76.213 ","82.159.149.52 ","97.83.40.67 ","103.105.254.17 ","184.74.99.214")
index=activity AND rg_functionality="Web Proxy" AND destinationaddress NOT NULL AND destinationaddress IN ("24.162.214.166 ","45.36.99.184 ","60.51.47.65 ","62.99.76.213 ","82.159.149.52 ","97.83.40.67 ","103.105.254.17 ","184.74.99.214")
index=activity AND rg_functionality="Web Application Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("24.162.214.166 ","45.36.99.184 ","60.51.47.65 ","62.99.76.213 ","82.159.149.52 ","97.83.40.67 ","103.105.254.17 ","184.74.99.214")
index=activity AND rg_functionality="DNS / DHCP" AND destinationaddress NOT NULL AND destinationaddress IN ("24.162.214.166 ","45.36.99.184 ","60.51.47.65 ","62.99.76.213 ","82.159.149.52 ","97.83.40.67 ","103.105.254.17 ","184.74.99.214")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationaddress NOT NULL AND destinationaddress IN ("24.162.214.166 ","45.36.99.184 ","60.51.47.65 ","62.99.76.213 ","82.159.149.52 ","97.83.40.67 ","103.105.254.17 ","184.74.99.214")
index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("6454414d0149be112aad7fcdc0af1bc1296824f87db5e4b8d7202ea042537f21","3d5853ab9ec4e2b24bf328dc526e09975d1b266f1684bbbc8f8e3292a1c3f2d0 ","800f6f0cbc307b6d39dd48563fb2a15a2119a76d97ec599f0995e3c4af0b2211","3f57051e3b62c87fb24df0fdc4b30ee91fd73d3cee3a6f7a962efceba2e99c7d")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("6454414d0149be112aad7fcdc0af1bc1296824f87db5e4b8d7202ea042537f21","3d5853ab9ec4e2b24bf328dc526e09975d1b266f1684bbbc8f8e3292a1c3f2d0 ","800f6f0cbc307b6d39dd48563fb2a15a2119a76d97ec599f0995e3c4af0b2211","3f57051e3b62c87fb24df0fdc4b30ee91fd73d3cee3a6f7a962efceba2e99c7d")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("6454414d0149be112aad7fcdc0af1bc1296824f87db5e4b8d7202ea042537f21","3d5853ab9ec4e2b24bf328dc526e09975d1b266f1684bbbc8f8e3292a1c3f2d0 ","800f6f0cbc307b6d39dd48563fb2a15a2119a76d97ec599f0995e3c4af0b2211","3f57051e3b62c87fb24df0fdc4b30ee91fd73d3cee3a6f7a962efceba2e99c7d")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("6454414d0149be112aad7fcdc0af1bc1296824f87db5e4b8d7202ea042537f21","3d5853ab9ec4e2b24bf328dc526e09975d1b266f1684bbbc8f8e3292a1c3f2d0 ","800f6f0cbc307b6d39dd48563fb2a15a2119a76d97ec599f0995e3c4af0b2211","3f57051e3b62c87fb24df0fdc4b30ee91fd73d3cee3a6f7a962efceba2e99c7d")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("6454414d0149be112aad7fcdc0af1bc1296824f87db5e4b8d7202ea042537f21","3d5853ab9ec4e2b24bf328dc526e09975d1b266f1684bbbc8f8e3292a1c3f2d0 ","800f6f0cbc307b6d39dd48563fb2a15a2119a76d97ec599f0995e3c4af0b2211","3f57051e3b62c87fb24df0fdc4b30ee91fd73d3cee3a6f7a962efceba2e99c7d")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("6454414d0149be112aad7fcdc0af1bc1296824f87db5e4b8d7202ea042537f21","3d5853ab9ec4e2b24bf328dc526e09975d1b266f1684bbbc8f8e3292a1c3f2d0 ","800f6f0cbc307b6d39dd48563fb2a15a2119a76d97ec599f0995e3c4af0b2211","3f57051e3b62c87fb24df0fdc4b30ee91fd73d3cee3a6f7a962efceba2e99c7d")
