index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("523613a7b9dfa398cbd5ebd2dd0f4f38","2a0d26b8b02bb2d17994d2a9a38d61db","4cd78b6cc1e3d3dde3e47852056f78ad","085c68576c60ca0361b9778268b0b3b9","b6aaced82b7c663a5922ce298831885a","7b2793902d106ba11d3369dff5799aa5","ad33f965d406c8f328bd71aff654ec4c","7e5cc9d086c93fa1af1d3453b3c6946e","e60d8a3f2190d78e94c7b952b72916ac","8434de0c058abb27c928a10b3ab79ff8","90b74cdc4b7763c6b25fdcd27f26377f","83e163afd5993320882452453c214932","a0766ad196626f28919c904d2ced6c85","903fce58cb4bfc39786c77fe0b5d9486","c2fb307aee872df475a7345d641d72da","88d49dad824344b8d6103c96b4f81d19","efc2a705c858ed08a76d20a8f5a11b1b","98e167e7c2999cbea30cc9342e944a4c","575575f5b6f9c4f7149ed6d86fb16c0f","547c02a9b01194a0fcbfef79aaa52e38","fd0fe2a3d154c412be6932e75a9a5ca1")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("523613a7b9dfa398cbd5ebd2dd0f4f38","2a0d26b8b02bb2d17994d2a9a38d61db","4cd78b6cc1e3d3dde3e47852056f78ad","085c68576c60ca0361b9778268b0b3b9","b6aaced82b7c663a5922ce298831885a","7b2793902d106ba11d3369dff5799aa5","ad33f965d406c8f328bd71aff654ec4c","7e5cc9d086c93fa1af1d3453b3c6946e","e60d8a3f2190d78e94c7b952b72916ac","8434de0c058abb27c928a10b3ab79ff8","90b74cdc4b7763c6b25fdcd27f26377f","83e163afd5993320882452453c214932","a0766ad196626f28919c904d2ced6c85","903fce58cb4bfc39786c77fe0b5d9486","c2fb307aee872df475a7345d641d72da","88d49dad824344b8d6103c96b4f81d19","efc2a705c858ed08a76d20a8f5a11b1b","98e167e7c2999cbea30cc9342e944a4c","575575f5b6f9c4f7149ed6d86fb16c0f","547c02a9b01194a0fcbfef79aaa52e38","fd0fe2a3d154c412be6932e75a9a5ca1")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("523613a7b9dfa398cbd5ebd2dd0f4f38","2a0d26b8b02bb2d17994d2a9a38d61db","4cd78b6cc1e3d3dde3e47852056f78ad","085c68576c60ca0361b9778268b0b3b9","b6aaced82b7c663a5922ce298831885a","7b2793902d106ba11d3369dff5799aa5","ad33f965d406c8f328bd71aff654ec4c","7e5cc9d086c93fa1af1d3453b3c6946e","e60d8a3f2190d78e94c7b952b72916ac","8434de0c058abb27c928a10b3ab79ff8","90b74cdc4b7763c6b25fdcd27f26377f","83e163afd5993320882452453c214932","a0766ad196626f28919c904d2ced6c85","903fce58cb4bfc39786c77fe0b5d9486","c2fb307aee872df475a7345d641d72da","88d49dad824344b8d6103c96b4f81d19","efc2a705c858ed08a76d20a8f5a11b1b","98e167e7c2999cbea30cc9342e944a4c","575575f5b6f9c4f7149ed6d86fb16c0f","547c02a9b01194a0fcbfef79aaa52e38","fd0fe2a3d154c412be6932e75a9a5ca1")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring64 NOT NULL AND customstring64 IN ("523613a7b9dfa398cbd5ebd2dd0f4f38","2a0d26b8b02bb2d17994d2a9a38d61db","4cd78b6cc1e3d3dde3e47852056f78ad","085c68576c60ca0361b9778268b0b3b9","b6aaced82b7c663a5922ce298831885a","7b2793902d106ba11d3369dff5799aa5","ad33f965d406c8f328bd71aff654ec4c","7e5cc9d086c93fa1af1d3453b3c6946e","e60d8a3f2190d78e94c7b952b72916ac","8434de0c058abb27c928a10b3ab79ff8","90b74cdc4b7763c6b25fdcd27f26377f","83e163afd5993320882452453c214932","a0766ad196626f28919c904d2ced6c85","903fce58cb4bfc39786c77fe0b5d9486","c2fb307aee872df475a7345d641d72da","88d49dad824344b8d6103c96b4f81d19","efc2a705c858ed08a76d20a8f5a11b1b","98e167e7c2999cbea30cc9342e944a4c","575575f5b6f9c4f7149ed6d86fb16c0f","547c02a9b01194a0fcbfef79aaa52e38","fd0fe2a3d154c412be6932e75a9a5ca1")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("523613a7b9dfa398cbd5ebd2dd0f4f38","2a0d26b8b02bb2d17994d2a9a38d61db","4cd78b6cc1e3d3dde3e47852056f78ad","085c68576c60ca0361b9778268b0b3b9","b6aaced82b7c663a5922ce298831885a","7b2793902d106ba11d3369dff5799aa5","ad33f965d406c8f328bd71aff654ec4c","7e5cc9d086c93fa1af1d3453b3c6946e","e60d8a3f2190d78e94c7b952b72916ac","8434de0c058abb27c928a10b3ab79ff8","90b74cdc4b7763c6b25fdcd27f26377f","83e163afd5993320882452453c214932","a0766ad196626f28919c904d2ced6c85","903fce58cb4bfc39786c77fe0b5d9486","c2fb307aee872df475a7345d641d72da","88d49dad824344b8d6103c96b4f81d19","efc2a705c858ed08a76d20a8f5a11b1b","98e167e7c2999cbea30cc9342e944a4c","575575f5b6f9c4f7149ed6d86fb16c0f","547c02a9b01194a0fcbfef79aaa52e38","fd0fe2a3d154c412be6932e75a9a5ca1")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("523613a7b9dfa398cbd5ebd2dd0f4f38","2a0d26b8b02bb2d17994d2a9a38d61db","4cd78b6cc1e3d3dde3e47852056f78ad","085c68576c60ca0361b9778268b0b3b9","b6aaced82b7c663a5922ce298831885a","7b2793902d106ba11d3369dff5799aa5","ad33f965d406c8f328bd71aff654ec4c","7e5cc9d086c93fa1af1d3453b3c6946e","e60d8a3f2190d78e94c7b952b72916ac","8434de0c058abb27c928a10b3ab79ff8","90b74cdc4b7763c6b25fdcd27f26377f","83e163afd5993320882452453c214932","a0766ad196626f28919c904d2ced6c85","903fce58cb4bfc39786c77fe0b5d9486","c2fb307aee872df475a7345d641d72da","88d49dad824344b8d6103c96b4f81d19","efc2a705c858ed08a76d20a8f5a11b1b","98e167e7c2999cbea30cc9342e944a4c","575575f5b6f9c4f7149ed6d86fb16c0f","547c02a9b01194a0fcbfef79aaa52e38","fd0fe2a3d154c412be6932e75a9a5ca1")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("523613a7b9dfa398cbd5ebd2dd0f4f38","2a0d26b8b02bb2d17994d2a9a38d61db","4cd78b6cc1e3d3dde3e47852056f78ad","085c68576c60ca0361b9778268b0b3b9","b6aaced82b7c663a5922ce298831885a","7b2793902d106ba11d3369dff5799aa5","ad33f965d406c8f328bd71aff654ec4c","7e5cc9d086c93fa1af1d3453b3c6946e","e60d8a3f2190d78e94c7b952b72916ac","8434de0c058abb27c928a10b3ab79ff8","90b74cdc4b7763c6b25fdcd27f26377f","83e163afd5993320882452453c214932","a0766ad196626f28919c904d2ced6c85","903fce58cb4bfc39786c77fe0b5d9486","c2fb307aee872df475a7345d641d72da","88d49dad824344b8d6103c96b4f81d19","efc2a705c858ed08a76d20a8f5a11b1b","98e167e7c2999cbea30cc9342e944a4c","575575f5b6f9c4f7149ed6d86fb16c0f","547c02a9b01194a0fcbfef79aaa52e38","fd0fe2a3d154c412be6932e75a9a5ca1")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("523613a7b9dfa398cbd5ebd2dd0f4f38","2a0d26b8b02bb2d17994d2a9a38d61db","4cd78b6cc1e3d3dde3e47852056f78ad","085c68576c60ca0361b9778268b0b3b9","b6aaced82b7c663a5922ce298831885a","7b2793902d106ba11d3369dff5799aa5","ad33f965d406c8f328bd71aff654ec4c","7e5cc9d086c93fa1af1d3453b3c6946e","e60d8a3f2190d78e94c7b952b72916ac","8434de0c058abb27c928a10b3ab79ff8","90b74cdc4b7763c6b25fdcd27f26377f","83e163afd5993320882452453c214932","a0766ad196626f28919c904d2ced6c85","903fce58cb4bfc39786c77fe0b5d9486","c2fb307aee872df475a7345d641d72da","88d49dad824344b8d6103c96b4f81d19","efc2a705c858ed08a76d20a8f5a11b1b","98e167e7c2999cbea30cc9342e944a4c","575575f5b6f9c4f7149ed6d86fb16c0f","547c02a9b01194a0fcbfef79aaa52e38","fd0fe2a3d154c412be6932e75a9a5ca1")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("523613a7b9dfa398cbd5ebd2dd0f4f38","2a0d26b8b02bb2d17994d2a9a38d61db","4cd78b6cc1e3d3dde3e47852056f78ad","085c68576c60ca0361b9778268b0b3b9","b6aaced82b7c663a5922ce298831885a","7b2793902d106ba11d3369dff5799aa5","ad33f965d406c8f328bd71aff654ec4c","7e5cc9d086c93fa1af1d3453b3c6946e","e60d8a3f2190d78e94c7b952b72916ac","8434de0c058abb27c928a10b3ab79ff8","90b74cdc4b7763c6b25fdcd27f26377f","83e163afd5993320882452453c214932","a0766ad196626f28919c904d2ced6c85","903fce58cb4bfc39786c77fe0b5d9486","c2fb307aee872df475a7345d641d72da","88d49dad824344b8d6103c96b4f81d19","efc2a705c858ed08a76d20a8f5a11b1b","98e167e7c2999cbea30cc9342e944a4c","575575f5b6f9c4f7149ed6d86fb16c0f","547c02a9b01194a0fcbfef79aaa52e38","fd0fe2a3d154c412be6932e75a9a5ca1")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("523613a7b9dfa398cbd5ebd2dd0f4f38","2a0d26b8b02bb2d17994d2a9a38d61db","4cd78b6cc1e3d3dde3e47852056f78ad","085c68576c60ca0361b9778268b0b3b9","b6aaced82b7c663a5922ce298831885a","7b2793902d106ba11d3369dff5799aa5","ad33f965d406c8f328bd71aff654ec4c","7e5cc9d086c93fa1af1d3453b3c6946e","e60d8a3f2190d78e94c7b952b72916ac","8434de0c058abb27c928a10b3ab79ff8","90b74cdc4b7763c6b25fdcd27f26377f","83e163afd5993320882452453c214932","a0766ad196626f28919c904d2ced6c85","903fce58cb4bfc39786c77fe0b5d9486","c2fb307aee872df475a7345d641d72da","88d49dad824344b8d6103c96b4f81d19","efc2a705c858ed08a76d20a8f5a11b1b","98e167e7c2999cbea30cc9342e944a4c","575575f5b6f9c4f7149ed6d86fb16c0f","547c02a9b01194a0fcbfef79aaa52e38","fd0fe2a3d154c412be6932e75a9a5ca1")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("523613a7b9dfa398cbd5ebd2dd0f4f38","2a0d26b8b02bb2d17994d2a9a38d61db","4cd78b6cc1e3d3dde3e47852056f78ad","085c68576c60ca0361b9778268b0b3b9","b6aaced82b7c663a5922ce298831885a","7b2793902d106ba11d3369dff5799aa5","ad33f965d406c8f328bd71aff654ec4c","7e5cc9d086c93fa1af1d3453b3c6946e","e60d8a3f2190d78e94c7b952b72916ac","8434de0c058abb27c928a10b3ab79ff8","90b74cdc4b7763c6b25fdcd27f26377f","83e163afd5993320882452453c214932","a0766ad196626f28919c904d2ced6c85","903fce58cb4bfc39786c77fe0b5d9486","c2fb307aee872df475a7345d641d72da","88d49dad824344b8d6103c96b4f81d19","efc2a705c858ed08a76d20a8f5a11b1b","98e167e7c2999cbea30cc9342e944a4c","575575f5b6f9c4f7149ed6d86fb16c0f","547c02a9b01194a0fcbfef79aaa52e38","fd0fe2a3d154c412be6932e75a9a5ca1")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("523613a7b9dfa398cbd5ebd2dd0f4f38","2a0d26b8b02bb2d17994d2a9a38d61db","4cd78b6cc1e3d3dde3e47852056f78ad","085c68576c60ca0361b9778268b0b3b9","b6aaced82b7c663a5922ce298831885a","7b2793902d106ba11d3369dff5799aa5","ad33f965d406c8f328bd71aff654ec4c","7e5cc9d086c93fa1af1d3453b3c6946e","e60d8a3f2190d78e94c7b952b72916ac","8434de0c058abb27c928a10b3ab79ff8","90b74cdc4b7763c6b25fdcd27f26377f","83e163afd5993320882452453c214932","a0766ad196626f28919c904d2ced6c85","903fce58cb4bfc39786c77fe0b5d9486","c2fb307aee872df475a7345d641d72da","88d49dad824344b8d6103c96b4f81d19","efc2a705c858ed08a76d20a8f5a11b1b","98e167e7c2999cbea30cc9342e944a4c","575575f5b6f9c4f7149ed6d86fb16c0f","547c02a9b01194a0fcbfef79aaa52e38","fd0fe2a3d154c412be6932e75a9a5ca1")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("523613a7b9dfa398cbd5ebd2dd0f4f38","2a0d26b8b02bb2d17994d2a9a38d61db","4cd78b6cc1e3d3dde3e47852056f78ad","085c68576c60ca0361b9778268b0b3b9","b6aaced82b7c663a5922ce298831885a","7b2793902d106ba11d3369dff5799aa5","ad33f965d406c8f328bd71aff654ec4c","7e5cc9d086c93fa1af1d3453b3c6946e","e60d8a3f2190d78e94c7b952b72916ac","8434de0c058abb27c928a10b3ab79ff8","90b74cdc4b7763c6b25fdcd27f26377f","83e163afd5993320882452453c214932","a0766ad196626f28919c904d2ced6c85","903fce58cb4bfc39786c77fe0b5d9486","c2fb307aee872df475a7345d641d72da","88d49dad824344b8d6103c96b4f81d19","efc2a705c858ed08a76d20a8f5a11b1b","98e167e7c2999cbea30cc9342e944a4c","575575f5b6f9c4f7149ed6d86fb16c0f","547c02a9b01194a0fcbfef79aaa52e38","fd0fe2a3d154c412be6932e75a9a5ca1")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("523613a7b9dfa398cbd5ebd2dd0f4f38","2a0d26b8b02bb2d17994d2a9a38d61db","4cd78b6cc1e3d3dde3e47852056f78ad","085c68576c60ca0361b9778268b0b3b9","b6aaced82b7c663a5922ce298831885a","7b2793902d106ba11d3369dff5799aa5","ad33f965d406c8f328bd71aff654ec4c","7e5cc9d086c93fa1af1d3453b3c6946e","e60d8a3f2190d78e94c7b952b72916ac","8434de0c058abb27c928a10b3ab79ff8","90b74cdc4b7763c6b25fdcd27f26377f","83e163afd5993320882452453c214932","a0766ad196626f28919c904d2ced6c85","903fce58cb4bfc39786c77fe0b5d9486","c2fb307aee872df475a7345d641d72da","88d49dad824344b8d6103c96b4f81d19","efc2a705c858ed08a76d20a8f5a11b1b","98e167e7c2999cbea30cc9342e944a4c","575575f5b6f9c4f7149ed6d86fb16c0f","547c02a9b01194a0fcbfef79aaa52e38","fd0fe2a3d154c412be6932e75a9a5ca1")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("523613a7b9dfa398cbd5ebd2dd0f4f38","2a0d26b8b02bb2d17994d2a9a38d61db","4cd78b6cc1e3d3dde3e47852056f78ad","085c68576c60ca0361b9778268b0b3b9","b6aaced82b7c663a5922ce298831885a","7b2793902d106ba11d3369dff5799aa5","ad33f965d406c8f328bd71aff654ec4c","7e5cc9d086c93fa1af1d3453b3c6946e","e60d8a3f2190d78e94c7b952b72916ac","8434de0c058abb27c928a10b3ab79ff8","90b74cdc4b7763c6b25fdcd27f26377f","83e163afd5993320882452453c214932","a0766ad196626f28919c904d2ced6c85","903fce58cb4bfc39786c77fe0b5d9486","c2fb307aee872df475a7345d641d72da","88d49dad824344b8d6103c96b4f81d19","efc2a705c858ed08a76d20a8f5a11b1b","98e167e7c2999cbea30cc9342e944a4c","575575f5b6f9c4f7149ed6d86fb16c0f","547c02a9b01194a0fcbfef79aaa52e38","fd0fe2a3d154c412be6932e75a9a5ca1")
index=activity AND rg_functionality="Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("523613a7b9dfa398cbd5ebd2dd0f4f38","2a0d26b8b02bb2d17994d2a9a38d61db","4cd78b6cc1e3d3dde3e47852056f78ad","085c68576c60ca0361b9778268b0b3b9","b6aaced82b7c663a5922ce298831885a","7b2793902d106ba11d3369dff5799aa5","ad33f965d406c8f328bd71aff654ec4c","7e5cc9d086c93fa1af1d3453b3c6946e","e60d8a3f2190d78e94c7b952b72916ac","8434de0c058abb27c928a10b3ab79ff8","90b74cdc4b7763c6b25fdcd27f26377f","83e163afd5993320882452453c214932","a0766ad196626f28919c904d2ced6c85","903fce58cb4bfc39786c77fe0b5d9486","c2fb307aee872df475a7345d641d72da","88d49dad824344b8d6103c96b4f81d19","efc2a705c858ed08a76d20a8f5a11b1b","98e167e7c2999cbea30cc9342e944a4c","575575f5b6f9c4f7149ed6d86fb16c0f","547c02a9b01194a0fcbfef79aaa52e38","fd0fe2a3d154c412be6932e75a9a5ca1")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("523613a7b9dfa398cbd5ebd2dd0f4f38","2a0d26b8b02bb2d17994d2a9a38d61db","4cd78b6cc1e3d3dde3e47852056f78ad","085c68576c60ca0361b9778268b0b3b9","b6aaced82b7c663a5922ce298831885a","7b2793902d106ba11d3369dff5799aa5","ad33f965d406c8f328bd71aff654ec4c","7e5cc9d086c93fa1af1d3453b3c6946e","e60d8a3f2190d78e94c7b952b72916ac","8434de0c058abb27c928a10b3ab79ff8","90b74cdc4b7763c6b25fdcd27f26377f","83e163afd5993320882452453c214932","a0766ad196626f28919c904d2ced6c85","903fce58cb4bfc39786c77fe0b5d9486","c2fb307aee872df475a7345d641d72da","88d49dad824344b8d6103c96b4f81d19","efc2a705c858ed08a76d20a8f5a11b1b","98e167e7c2999cbea30cc9342e944a4c","575575f5b6f9c4f7149ed6d86fb16c0f","547c02a9b01194a0fcbfef79aaa52e38","fd0fe2a3d154c412be6932e75a9a5ca1")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("523613a7b9dfa398cbd5ebd2dd0f4f38","2a0d26b8b02bb2d17994d2a9a38d61db","4cd78b6cc1e3d3dde3e47852056f78ad","085c68576c60ca0361b9778268b0b3b9","b6aaced82b7c663a5922ce298831885a","7b2793902d106ba11d3369dff5799aa5","ad33f965d406c8f328bd71aff654ec4c","7e5cc9d086c93fa1af1d3453b3c6946e","e60d8a3f2190d78e94c7b952b72916ac","8434de0c058abb27c928a10b3ab79ff8","90b74cdc4b7763c6b25fdcd27f26377f","83e163afd5993320882452453c214932","a0766ad196626f28919c904d2ced6c85","903fce58cb4bfc39786c77fe0b5d9486","c2fb307aee872df475a7345d641d72da","88d49dad824344b8d6103c96b4f81d19","efc2a705c858ed08a76d20a8f5a11b1b","98e167e7c2999cbea30cc9342e944a4c","575575f5b6f9c4f7149ed6d86fb16c0f","547c02a9b01194a0fcbfef79aaa52e38","fd0fe2a3d154c412be6932e75a9a5ca1")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("523613a7b9dfa398cbd5ebd2dd0f4f38","2a0d26b8b02bb2d17994d2a9a38d61db","4cd78b6cc1e3d3dde3e47852056f78ad","085c68576c60ca0361b9778268b0b3b9","b6aaced82b7c663a5922ce298831885a","7b2793902d106ba11d3369dff5799aa5","ad33f965d406c8f328bd71aff654ec4c","7e5cc9d086c93fa1af1d3453b3c6946e","e60d8a3f2190d78e94c7b952b72916ac","8434de0c058abb27c928a10b3ab79ff8","90b74cdc4b7763c6b25fdcd27f26377f","83e163afd5993320882452453c214932","a0766ad196626f28919c904d2ced6c85","903fce58cb4bfc39786c77fe0b5d9486","c2fb307aee872df475a7345d641d72da","88d49dad824344b8d6103c96b4f81d19","efc2a705c858ed08a76d20a8f5a11b1b","98e167e7c2999cbea30cc9342e944a4c","575575f5b6f9c4f7149ed6d86fb16c0f","547c02a9b01194a0fcbfef79aaa52e38","fd0fe2a3d154c412be6932e75a9a5ca1")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("523613a7b9dfa398cbd5ebd2dd0f4f38","2a0d26b8b02bb2d17994d2a9a38d61db","4cd78b6cc1e3d3dde3e47852056f78ad","085c68576c60ca0361b9778268b0b3b9","b6aaced82b7c663a5922ce298831885a","7b2793902d106ba11d3369dff5799aa5","ad33f965d406c8f328bd71aff654ec4c","7e5cc9d086c93fa1af1d3453b3c6946e","e60d8a3f2190d78e94c7b952b72916ac","8434de0c058abb27c928a10b3ab79ff8","90b74cdc4b7763c6b25fdcd27f26377f","83e163afd5993320882452453c214932","a0766ad196626f28919c904d2ced6c85","903fce58cb4bfc39786c77fe0b5d9486","c2fb307aee872df475a7345d641d72da","88d49dad824344b8d6103c96b4f81d19","efc2a705c858ed08a76d20a8f5a11b1b","98e167e7c2999cbea30cc9342e944a4c","575575f5b6f9c4f7149ed6d86fb16c0f","547c02a9b01194a0fcbfef79aaa52e38","fd0fe2a3d154c412be6932e75a9a5ca1")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("523613a7b9dfa398cbd5ebd2dd0f4f38","2a0d26b8b02bb2d17994d2a9a38d61db","4cd78b6cc1e3d3dde3e47852056f78ad","085c68576c60ca0361b9778268b0b3b9","b6aaced82b7c663a5922ce298831885a","7b2793902d106ba11d3369dff5799aa5","ad33f965d406c8f328bd71aff654ec4c","7e5cc9d086c93fa1af1d3453b3c6946e","e60d8a3f2190d78e94c7b952b72916ac","8434de0c058abb27c928a10b3ab79ff8","90b74cdc4b7763c6b25fdcd27f26377f","83e163afd5993320882452453c214932","a0766ad196626f28919c904d2ced6c85","903fce58cb4bfc39786c77fe0b5d9486","c2fb307aee872df475a7345d641d72da","88d49dad824344b8d6103c96b4f81d19","efc2a705c858ed08a76d20a8f5a11b1b","98e167e7c2999cbea30cc9342e944a4c","575575f5b6f9c4f7149ed6d86fb16c0f","547c02a9b01194a0fcbfef79aaa52e38","fd0fe2a3d154c412be6932e75a9a5ca1")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("523613a7b9dfa398cbd5ebd2dd0f4f38","2a0d26b8b02bb2d17994d2a9a38d61db","4cd78b6cc1e3d3dde3e47852056f78ad","085c68576c60ca0361b9778268b0b3b9","b6aaced82b7c663a5922ce298831885a","7b2793902d106ba11d3369dff5799aa5","ad33f965d406c8f328bd71aff654ec4c","7e5cc9d086c93fa1af1d3453b3c6946e","e60d8a3f2190d78e94c7b952b72916ac","8434de0c058abb27c928a10b3ab79ff8","90b74cdc4b7763c6b25fdcd27f26377f","83e163afd5993320882452453c214932","a0766ad196626f28919c904d2ced6c85","903fce58cb4bfc39786c77fe0b5d9486","c2fb307aee872df475a7345d641d72da","88d49dad824344b8d6103c96b4f81d19","efc2a705c858ed08a76d20a8f5a11b1b","98e167e7c2999cbea30cc9342e944a4c","575575f5b6f9c4f7149ed6d86fb16c0f","547c02a9b01194a0fcbfef79aaa52e38","fd0fe2a3d154c412be6932e75a9a5ca1")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("523613a7b9dfa398cbd5ebd2dd0f4f38","2a0d26b8b02bb2d17994d2a9a38d61db","4cd78b6cc1e3d3dde3e47852056f78ad","085c68576c60ca0361b9778268b0b3b9","b6aaced82b7c663a5922ce298831885a","7b2793902d106ba11d3369dff5799aa5","ad33f965d406c8f328bd71aff654ec4c","7e5cc9d086c93fa1af1d3453b3c6946e","e60d8a3f2190d78e94c7b952b72916ac","8434de0c058abb27c928a10b3ab79ff8","90b74cdc4b7763c6b25fdcd27f26377f","83e163afd5993320882452453c214932","a0766ad196626f28919c904d2ced6c85","903fce58cb4bfc39786c77fe0b5d9486","c2fb307aee872df475a7345d641d72da","88d49dad824344b8d6103c96b4f81d19","efc2a705c858ed08a76d20a8f5a11b1b","98e167e7c2999cbea30cc9342e944a4c","575575f5b6f9c4f7149ed6d86fb16c0f","547c02a9b01194a0fcbfef79aaa52e38","fd0fe2a3d154c412be6932e75a9a5ca1")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring64 NOT NULL AND customstring64 IN ("523613a7b9dfa398cbd5ebd2dd0f4f38","2a0d26b8b02bb2d17994d2a9a38d61db","4cd78b6cc1e3d3dde3e47852056f78ad","085c68576c60ca0361b9778268b0b3b9","b6aaced82b7c663a5922ce298831885a","7b2793902d106ba11d3369dff5799aa5","ad33f965d406c8f328bd71aff654ec4c","7e5cc9d086c93fa1af1d3453b3c6946e","e60d8a3f2190d78e94c7b952b72916ac","8434de0c058abb27c928a10b3ab79ff8","90b74cdc4b7763c6b25fdcd27f26377f","83e163afd5993320882452453c214932","a0766ad196626f28919c904d2ced6c85","903fce58cb4bfc39786c77fe0b5d9486","c2fb307aee872df475a7345d641d72da","88d49dad824344b8d6103c96b4f81d19","efc2a705c858ed08a76d20a8f5a11b1b","98e167e7c2999cbea30cc9342e944a4c","575575f5b6f9c4f7149ed6d86fb16c0f","547c02a9b01194a0fcbfef79aaa52e38","fd0fe2a3d154c412be6932e75a9a5ca1")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("523613a7b9dfa398cbd5ebd2dd0f4f38","2a0d26b8b02bb2d17994d2a9a38d61db","4cd78b6cc1e3d3dde3e47852056f78ad","085c68576c60ca0361b9778268b0b3b9","b6aaced82b7c663a5922ce298831885a","7b2793902d106ba11d3369dff5799aa5","ad33f965d406c8f328bd71aff654ec4c","7e5cc9d086c93fa1af1d3453b3c6946e","e60d8a3f2190d78e94c7b952b72916ac","8434de0c058abb27c928a10b3ab79ff8","90b74cdc4b7763c6b25fdcd27f26377f","83e163afd5993320882452453c214932","a0766ad196626f28919c904d2ced6c85","903fce58cb4bfc39786c77fe0b5d9486","c2fb307aee872df475a7345d641d72da","88d49dad824344b8d6103c96b4f81d19","efc2a705c858ed08a76d20a8f5a11b1b","98e167e7c2999cbea30cc9342e944a4c","575575f5b6f9c4f7149ed6d86fb16c0f","547c02a9b01194a0fcbfef79aaa52e38","fd0fe2a3d154c412be6932e75a9a5ca1")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("523613a7b9dfa398cbd5ebd2dd0f4f38","2a0d26b8b02bb2d17994d2a9a38d61db","4cd78b6cc1e3d3dde3e47852056f78ad","085c68576c60ca0361b9778268b0b3b9","b6aaced82b7c663a5922ce298831885a","7b2793902d106ba11d3369dff5799aa5","ad33f965d406c8f328bd71aff654ec4c","7e5cc9d086c93fa1af1d3453b3c6946e","e60d8a3f2190d78e94c7b952b72916ac","8434de0c058abb27c928a10b3ab79ff8","90b74cdc4b7763c6b25fdcd27f26377f","83e163afd5993320882452453c214932","a0766ad196626f28919c904d2ced6c85","903fce58cb4bfc39786c77fe0b5d9486","c2fb307aee872df475a7345d641d72da","88d49dad824344b8d6103c96b4f81d19","efc2a705c858ed08a76d20a8f5a11b1b","98e167e7c2999cbea30cc9342e944a4c","575575f5b6f9c4f7149ed6d86fb16c0f","547c02a9b01194a0fcbfef79aaa52e38","fd0fe2a3d154c412be6932e75a9a5ca1")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("523613a7b9dfa398cbd5ebd2dd0f4f38","2a0d26b8b02bb2d17994d2a9a38d61db","4cd78b6cc1e3d3dde3e47852056f78ad","085c68576c60ca0361b9778268b0b3b9","b6aaced82b7c663a5922ce298831885a","7b2793902d106ba11d3369dff5799aa5","ad33f965d406c8f328bd71aff654ec4c","7e5cc9d086c93fa1af1d3453b3c6946e","e60d8a3f2190d78e94c7b952b72916ac","8434de0c058abb27c928a10b3ab79ff8","90b74cdc4b7763c6b25fdcd27f26377f","83e163afd5993320882452453c214932","a0766ad196626f28919c904d2ced6c85","903fce58cb4bfc39786c77fe0b5d9486","c2fb307aee872df475a7345d641d72da","88d49dad824344b8d6103c96b4f81d19","efc2a705c858ed08a76d20a8f5a11b1b","98e167e7c2999cbea30cc9342e944a4c","575575f5b6f9c4f7149ed6d86fb16c0f","547c02a9b01194a0fcbfef79aaa52e38","fd0fe2a3d154c412be6932e75a9a5ca1")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring64 NOT NULL AND customstring64 IN ("523613a7b9dfa398cbd5ebd2dd0f4f38","2a0d26b8b02bb2d17994d2a9a38d61db","4cd78b6cc1e3d3dde3e47852056f78ad","085c68576c60ca0361b9778268b0b3b9","b6aaced82b7c663a5922ce298831885a","7b2793902d106ba11d3369dff5799aa5","ad33f965d406c8f328bd71aff654ec4c","7e5cc9d086c93fa1af1d3453b3c6946e","e60d8a3f2190d78e94c7b952b72916ac","8434de0c058abb27c928a10b3ab79ff8","90b74cdc4b7763c6b25fdcd27f26377f","83e163afd5993320882452453c214932","a0766ad196626f28919c904d2ced6c85","903fce58cb4bfc39786c77fe0b5d9486","c2fb307aee872df475a7345d641d72da","88d49dad824344b8d6103c96b4f81d19","efc2a705c858ed08a76d20a8f5a11b1b","98e167e7c2999cbea30cc9342e944a4c","575575f5b6f9c4f7149ed6d86fb16c0f","547c02a9b01194a0fcbfef79aaa52e38","fd0fe2a3d154c412be6932e75a9a5ca1")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("523613a7b9dfa398cbd5ebd2dd0f4f38","2a0d26b8b02bb2d17994d2a9a38d61db","4cd78b6cc1e3d3dde3e47852056f78ad","085c68576c60ca0361b9778268b0b3b9","b6aaced82b7c663a5922ce298831885a","7b2793902d106ba11d3369dff5799aa5","ad33f965d406c8f328bd71aff654ec4c","7e5cc9d086c93fa1af1d3453b3c6946e","e60d8a3f2190d78e94c7b952b72916ac","8434de0c058abb27c928a10b3ab79ff8","90b74cdc4b7763c6b25fdcd27f26377f","83e163afd5993320882452453c214932","a0766ad196626f28919c904d2ced6c85","903fce58cb4bfc39786c77fe0b5d9486","c2fb307aee872df475a7345d641d72da","88d49dad824344b8d6103c96b4f81d19","efc2a705c858ed08a76d20a8f5a11b1b","98e167e7c2999cbea30cc9342e944a4c","575575f5b6f9c4f7149ed6d86fb16c0f","547c02a9b01194a0fcbfef79aaa52e38","fd0fe2a3d154c412be6932e75a9a5ca1")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("523613a7b9dfa398cbd5ebd2dd0f4f38","2a0d26b8b02bb2d17994d2a9a38d61db","4cd78b6cc1e3d3dde3e47852056f78ad","085c68576c60ca0361b9778268b0b3b9","b6aaced82b7c663a5922ce298831885a","7b2793902d106ba11d3369dff5799aa5","ad33f965d406c8f328bd71aff654ec4c","7e5cc9d086c93fa1af1d3453b3c6946e","e60d8a3f2190d78e94c7b952b72916ac","8434de0c058abb27c928a10b3ab79ff8","90b74cdc4b7763c6b25fdcd27f26377f","83e163afd5993320882452453c214932","a0766ad196626f28919c904d2ced6c85","903fce58cb4bfc39786c77fe0b5d9486","c2fb307aee872df475a7345d641d72da","88d49dad824344b8d6103c96b4f81d19","efc2a705c858ed08a76d20a8f5a11b1b","98e167e7c2999cbea30cc9342e944a4c","575575f5b6f9c4f7149ed6d86fb16c0f","547c02a9b01194a0fcbfef79aaa52e38","fd0fe2a3d154c412be6932e75a9a5ca1")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("523613a7b9dfa398cbd5ebd2dd0f4f38","2a0d26b8b02bb2d17994d2a9a38d61db","4cd78b6cc1e3d3dde3e47852056f78ad","085c68576c60ca0361b9778268b0b3b9","b6aaced82b7c663a5922ce298831885a","7b2793902d106ba11d3369dff5799aa5","ad33f965d406c8f328bd71aff654ec4c","7e5cc9d086c93fa1af1d3453b3c6946e","e60d8a3f2190d78e94c7b952b72916ac","8434de0c058abb27c928a10b3ab79ff8","90b74cdc4b7763c6b25fdcd27f26377f","83e163afd5993320882452453c214932","a0766ad196626f28919c904d2ced6c85","903fce58cb4bfc39786c77fe0b5d9486","c2fb307aee872df475a7345d641d72da","88d49dad824344b8d6103c96b4f81d19","efc2a705c858ed08a76d20a8f5a11b1b","98e167e7c2999cbea30cc9342e944a4c","575575f5b6f9c4f7149ed6d86fb16c0f","547c02a9b01194a0fcbfef79aaa52e38","fd0fe2a3d154c412be6932e75a9a5ca1")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring64 NOT NULL AND customstring64 IN ("523613a7b9dfa398cbd5ebd2dd0f4f38","2a0d26b8b02bb2d17994d2a9a38d61db","4cd78b6cc1e3d3dde3e47852056f78ad","085c68576c60ca0361b9778268b0b3b9","b6aaced82b7c663a5922ce298831885a","7b2793902d106ba11d3369dff5799aa5","ad33f965d406c8f328bd71aff654ec4c","7e5cc9d086c93fa1af1d3453b3c6946e","e60d8a3f2190d78e94c7b952b72916ac","8434de0c058abb27c928a10b3ab79ff8","90b74cdc4b7763c6b25fdcd27f26377f","83e163afd5993320882452453c214932","a0766ad196626f28919c904d2ced6c85","903fce58cb4bfc39786c77fe0b5d9486","c2fb307aee872df475a7345d641d72da","88d49dad824344b8d6103c96b4f81d19","efc2a705c858ed08a76d20a8f5a11b1b","98e167e7c2999cbea30cc9342e944a4c","575575f5b6f9c4f7149ed6d86fb16c0f","547c02a9b01194a0fcbfef79aaa52e38","fd0fe2a3d154c412be6932e75a9a5ca1")
index=activity AND rg_functionality="Endpoint Management Systems" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="107.180.100.247" AND destinationport=88 OR destinationaddress="15.235.22.212" AND destinationport=5690 OR destinationaddress="15.235.22.213" AND destinationport=59240)
index=activity AND rg_functionality="Endpoint Management Systems" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="107.180.100.247" AND sourceport=88 OR sourceaddress="15.235.22.212" AND sourceport=5690 OR sourceaddress="15.235.22.213" AND sourceport=59240)
index=activity AND rg_functionality="Endpoint Management Systems" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="107.180.100.247" AND sourceport=88 OR translatedipaddress="15.235.22.212" AND sourceport=5690 OR translatedipaddress="15.235.22.213" AND sourceport=59240)
index=activity AND rg_functionality="Endpoint Management Systems" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="107.180.100.247" AND destinationport=88 OR destinationtranslatedaddress="15.235.22.212" AND destinationport=5690 OR destinationtranslatedaddress="15.235.22.213" AND destinationport=59240)
index=activity AND rg_functionality="Endpoint Management Systems" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="107.180.100.247" AND destinationtranslatedport=88 OR destinationtranslatedaddress="15.235.22.212" AND destinationtranslatedport=5690 OR destinationtranslatedaddress="15.235.22.213" AND destinationtranslatedport=59240)
index=activity AND rg_functionality="Endpoint Management Systems" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="107.180.100.247" AND translatedport=88 OR destinationtranslatedaddress="15.235.22.212" AND translatedport=5690 OR destinationtranslatedaddress="15.235.22.213" AND translatedport=59240)
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="107.180.100.247" AND destinationport=88 OR destinationaddress="15.235.22.212" AND destinationport=5690 OR destinationaddress="15.235.22.213" AND destinationport=59240)
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="107.180.100.247" AND sourceport=88 OR sourceaddress="15.235.22.212" AND sourceport=5690 OR sourceaddress="15.235.22.213" AND sourceport=59240)
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="107.180.100.247" AND sourceport=88 OR translatedipaddress="15.235.22.212" AND sourceport=5690 OR translatedipaddress="15.235.22.213" AND sourceport=59240)
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="107.180.100.247" AND destinationport=88 OR destinationtranslatedaddress="15.235.22.212" AND destinationport=5690 OR destinationtranslatedaddress="15.235.22.213" AND destinationport=59240)
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="107.180.100.247" AND destinationtranslatedport=88 OR destinationtranslatedaddress="15.235.22.212" AND destinationtranslatedport=5690 OR destinationtranslatedaddress="15.235.22.213" AND destinationtranslatedport=59240)
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="107.180.100.247" AND translatedport=88 OR destinationtranslatedaddress="15.235.22.212" AND translatedport=5690 OR destinationtranslatedaddress="15.235.22.213" AND translatedport=59240)
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="107.180.100.247" AND destinationport=88 OR destinationaddress="15.235.22.212" AND destinationport=5690 OR destinationaddress="15.235.22.213" AND destinationport=59240)
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="107.180.100.247" AND sourceport=88 OR sourceaddress="15.235.22.212" AND sourceport=5690 OR sourceaddress="15.235.22.213" AND sourceport=59240)
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="107.180.100.247" AND sourceport=88 OR translatedipaddress="15.235.22.212" AND sourceport=5690 OR translatedipaddress="15.235.22.213" AND sourceport=59240)
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="107.180.100.247" AND destinationport=88 OR destinationtranslatedaddress="15.235.22.212" AND destinationport=5690 OR destinationtranslatedaddress="15.235.22.213" AND destinationport=59240)
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="107.180.100.247" AND destinationtranslatedport=88 OR destinationtranslatedaddress="15.235.22.212" AND destinationtranslatedport=5690 OR destinationtranslatedaddress="15.235.22.213" AND destinationtranslatedport=59240)
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="107.180.100.247" AND translatedport=88 OR destinationtranslatedaddress="15.235.22.212" AND translatedport=5690 OR destinationtranslatedaddress="15.235.22.213" AND translatedport=59240)
index=activity AND rg_functionality="Email / Email Security" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="107.180.100.247" AND destinationport=88 OR destinationaddress="15.235.22.212" AND destinationport=5690 OR destinationaddress="15.235.22.213" AND destinationport=59240)
index=activity AND rg_functionality="Email / Email Security" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="107.180.100.247" AND sourceport=88 OR sourceaddress="15.235.22.212" AND sourceport=5690 OR sourceaddress="15.235.22.213" AND sourceport=59240)
index=activity AND rg_functionality="Email / Email Security" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="107.180.100.247" AND sourceport=88 OR translatedipaddress="15.235.22.212" AND sourceport=5690 OR translatedipaddress="15.235.22.213" AND sourceport=59240)
index=activity AND rg_functionality="Email / Email Security" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="107.180.100.247" AND destinationport=88 OR destinationtranslatedaddress="15.235.22.212" AND destinationport=5690 OR destinationtranslatedaddress="15.235.22.213" AND destinationport=59240)
index=activity AND rg_functionality="Email / Email Security" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="107.180.100.247" AND destinationtranslatedport=88 OR destinationtranslatedaddress="15.235.22.212" AND destinationtranslatedport=5690 OR destinationtranslatedaddress="15.235.22.213" AND destinationtranslatedport=59240)
index=activity AND rg_functionality="Email / Email Security" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="107.180.100.247" AND translatedport=88 OR destinationtranslatedaddress="15.235.22.212" AND translatedport=5690 OR destinationtranslatedaddress="15.235.22.213" AND translatedport=59240)
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="107.180.100.247" AND destinationport=88 OR destinationaddress="15.235.22.212" AND destinationport=5690 OR destinationaddress="15.235.22.213" AND destinationport=59240)
index=activity AND rg_functionality="Cloud Email / Email Security" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="107.180.100.247" AND sourceport=88 OR sourceaddress="15.235.22.212" AND sourceport=5690 OR sourceaddress="15.235.22.213" AND sourceport=59240)
index=activity AND rg_functionality="Cloud Email / Email Security" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="107.180.100.247" AND sourceport=88 OR translatedipaddress="15.235.22.212" AND sourceport=5690 OR translatedipaddress="15.235.22.213" AND sourceport=59240)
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="107.180.100.247" AND destinationport=88 OR destinationtranslatedaddress="15.235.22.212" AND destinationport=5690 OR destinationtranslatedaddress="15.235.22.213" AND destinationport=59240)
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="107.180.100.247" AND destinationtranslatedport=88 OR destinationtranslatedaddress="15.235.22.212" AND destinationtranslatedport=5690 OR destinationtranslatedaddress="15.235.22.213" AND destinationtranslatedport=59240)
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="107.180.100.247" AND translatedport=88 OR destinationtranslatedaddress="15.235.22.212" AND translatedport=5690 OR destinationtranslatedaddress="15.235.22.213" AND translatedport=59240)
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="107.180.100.247" AND destinationport=88 OR destinationaddress="15.235.22.212" AND destinationport=5690 OR destinationaddress="15.235.22.213" AND destinationport=59240)
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="107.180.100.247" AND sourceport=88 OR sourceaddress="15.235.22.212" AND sourceport=5690 OR sourceaddress="15.235.22.213" AND sourceport=59240)
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="107.180.100.247" AND sourceport=88 OR translatedipaddress="15.235.22.212" AND sourceport=5690 OR translatedipaddress="15.235.22.213" AND sourceport=59240)
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="107.180.100.247" AND destinationport=88 OR destinationtranslatedaddress="15.235.22.212" AND destinationport=5690 OR destinationtranslatedaddress="15.235.22.213" AND destinationport=59240)
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="107.180.100.247" AND destinationtranslatedport=88 OR destinationtranslatedaddress="15.235.22.212" AND destinationtranslatedport=5690 OR destinationtranslatedaddress="15.235.22.213" AND destinationtranslatedport=59240)
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="107.180.100.247" AND translatedport=88 OR destinationtranslatedaddress="15.235.22.212" AND translatedport=5690 OR destinationtranslatedaddress="15.235.22.213" AND translatedport=59240)
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="107.180.100.247" AND destinationport=88 OR destinationaddress="15.235.22.212" AND destinationport=5690 OR destinationaddress="15.235.22.213" AND destinationport=59240)
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="107.180.100.247" AND sourceport=88 OR sourceaddress="15.235.22.212" AND sourceport=5690 OR sourceaddress="15.235.22.213" AND sourceport=59240)
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="107.180.100.247" AND sourceport=88 OR translatedipaddress="15.235.22.212" AND sourceport=5690 OR translatedipaddress="15.235.22.213" AND sourceport=59240)
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="107.180.100.247" AND destinationport=88 OR destinationtranslatedaddress="15.235.22.212" AND destinationport=5690 OR destinationtranslatedaddress="15.235.22.213" AND destinationport=59240)
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="107.180.100.247" AND destinationtranslatedport=88 OR destinationtranslatedaddress="15.235.22.212" AND destinationtranslatedport=5690 OR destinationtranslatedaddress="15.235.22.213" AND destinationtranslatedport=59240)
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="107.180.100.247" AND translatedport=88 OR destinationtranslatedaddress="15.235.22.212" AND translatedport=5690 OR destinationtranslatedaddress="15.235.22.213" AND translatedport=59240)
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="107.180.100.247" AND destinationport=88 OR destinationaddress="15.235.22.212" AND destinationport=5690 OR destinationaddress="15.235.22.213" AND destinationport=59240)
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="107.180.100.247" AND sourceport=88 OR sourceaddress="15.235.22.212" AND sourceport=5690 OR sourceaddress="15.235.22.213" AND sourceport=59240)
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="107.180.100.247" AND sourceport=88 OR translatedipaddress="15.235.22.212" AND sourceport=5690 OR translatedipaddress="15.235.22.213" AND sourceport=59240)
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="107.180.100.247" AND destinationport=88 OR destinationtranslatedaddress="15.235.22.212" AND destinationport=5690 OR destinationtranslatedaddress="15.235.22.213" AND destinationport=59240)
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="107.180.100.247" AND destinationtranslatedport=88 OR destinationtranslatedaddress="15.235.22.212" AND destinationtranslatedport=5690 OR destinationtranslatedaddress="15.235.22.213" AND destinationtranslatedport=59240)
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="107.180.100.247" AND translatedport=88 OR destinationtranslatedaddress="15.235.22.212" AND translatedport=5690 OR destinationtranslatedaddress="15.235.22.213" AND translatedport=59240)
index=activity AND rg_functionality="Next Generation Firewall" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="107.180.100.247" AND destinationport=88 OR destinationaddress="15.235.22.212" AND destinationport=5690 OR destinationaddress="15.235.22.213" AND destinationport=59240)
index=activity AND rg_functionality="Next Generation Firewall" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="107.180.100.247" AND sourceport=88 OR sourceaddress="15.235.22.212" AND sourceport=5690 OR sourceaddress="15.235.22.213" AND sourceport=59240)
index=activity AND rg_functionality="Next Generation Firewall" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="107.180.100.247" AND sourceport=88 OR translatedipaddress="15.235.22.212" AND sourceport=5690 OR translatedipaddress="15.235.22.213" AND sourceport=59240)
index=activity AND rg_functionality="Next Generation Firewall" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="107.180.100.247" AND destinationport=88 OR destinationtranslatedaddress="15.235.22.212" AND destinationport=5690 OR destinationtranslatedaddress="15.235.22.213" AND destinationport=59240)
index=activity AND rg_functionality="Next Generation Firewall" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="107.180.100.247" AND destinationtranslatedport=88 OR destinationtranslatedaddress="15.235.22.212" AND destinationtranslatedport=5690 OR destinationtranslatedaddress="15.235.22.213" AND destinationtranslatedport=59240)
index=activity AND rg_functionality="Next Generation Firewall" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="107.180.100.247" AND translatedport=88 OR destinationtranslatedaddress="15.235.22.212" AND translatedport=5690 OR destinationtranslatedaddress="15.235.22.213" AND translatedport=59240)
index=activity AND rg_functionality="Firewall" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="107.180.100.247" AND destinationport=88 OR destinationaddress="15.235.22.212" AND destinationport=5690 OR destinationaddress="15.235.22.213" AND destinationport=59240)
index=activity AND rg_functionality="Firewall" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="107.180.100.247" AND sourceport=88 OR sourceaddress="15.235.22.212" AND sourceport=5690 OR sourceaddress="15.235.22.213" AND sourceport=59240)
index=activity AND rg_functionality="Firewall" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="107.180.100.247" AND sourceport=88 OR translatedipaddress="15.235.22.212" AND sourceport=5690 OR translatedipaddress="15.235.22.213" AND sourceport=59240)
index=activity AND rg_functionality="Firewall" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="107.180.100.247" AND destinationport=88 OR destinationtranslatedaddress="15.235.22.212" AND destinationport=5690 OR destinationtranslatedaddress="15.235.22.213" AND destinationport=59240)
index=activity AND rg_functionality="Firewall" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="107.180.100.247" AND destinationtranslatedport=88 OR destinationtranslatedaddress="15.235.22.212" AND destinationtranslatedport=5690 OR destinationtranslatedaddress="15.235.22.213" AND destinationtranslatedport=59240)
index=activity AND rg_functionality="Firewall" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="107.180.100.247" AND translatedport=88 OR destinationtranslatedaddress="15.235.22.212" AND translatedport=5690 OR destinationtranslatedaddress="15.235.22.213" AND translatedport=59240)
index=activity AND rg_functionality="Web Proxy" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="107.180.100.247" AND destinationport=88 OR destinationaddress="15.235.22.212" AND destinationport=5690 OR destinationaddress="15.235.22.213" AND destinationport=59240)
index=activity AND rg_functionality="Web Proxy" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="107.180.100.247" AND sourceport=88 OR sourceaddress="15.235.22.212" AND sourceport=5690 OR sourceaddress="15.235.22.213" AND sourceport=59240)
index=activity AND rg_functionality="Web Proxy" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="107.180.100.247" AND sourceport=88 OR translatedipaddress="15.235.22.212" AND sourceport=5690 OR translatedipaddress="15.235.22.213" AND sourceport=59240)
index=activity AND rg_functionality="Web Proxy" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="107.180.100.247" AND destinationport=88 OR destinationtranslatedaddress="15.235.22.212" AND destinationport=5690 OR destinationtranslatedaddress="15.235.22.213" AND destinationport=59240)
index=activity AND rg_functionality="Web Proxy" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="107.180.100.247" AND destinationtranslatedport=88 OR destinationtranslatedaddress="15.235.22.212" AND destinationtranslatedport=5690 OR destinationtranslatedaddress="15.235.22.213" AND destinationtranslatedport=59240)
index=activity AND rg_functionality="Web Proxy" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="107.180.100.247" AND translatedport=88 OR destinationtranslatedaddress="15.235.22.212" AND translatedport=5690 OR destinationtranslatedaddress="15.235.22.213" AND translatedport=59240)
index=activity AND rg_functionality="Flow" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="107.180.100.247" AND destinationport=88 OR destinationaddress="15.235.22.212" AND destinationport=5690 OR destinationaddress="15.235.22.213" AND destinationport=59240)
index=activity AND rg_functionality="Flow" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="107.180.100.247" AND sourceport=88 OR sourceaddress="15.235.22.212" AND sourceport=5690 OR sourceaddress="15.235.22.213" AND sourceport=59240)
index=activity AND rg_functionality="Flow" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="107.180.100.247" AND sourceport=88 OR translatedipaddress="15.235.22.212" AND sourceport=5690 OR translatedipaddress="15.235.22.213" AND sourceport=59240)
index=activity AND rg_functionality="Flow" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="107.180.100.247" AND destinationport=88 OR destinationtranslatedaddress="15.235.22.212" AND destinationport=5690 OR destinationtranslatedaddress="15.235.22.213" AND destinationport=59240)
index=activity AND rg_functionality="Flow" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="107.180.100.247" AND destinationtranslatedport=88 OR destinationtranslatedaddress="15.235.22.212" AND destinationtranslatedport=5690 OR destinationtranslatedaddress="15.235.22.213" AND destinationtranslatedport=59240)
index=activity AND rg_functionality="Flow" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="107.180.100.247" AND translatedport=88 OR destinationtranslatedaddress="15.235.22.212" AND translatedport=5690 OR destinationtranslatedaddress="15.235.22.213" AND translatedport=59240)
index=activity AND rg_functionality="Web Server" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="107.180.100.247" AND destinationport=88 OR destinationaddress="15.235.22.212" AND destinationport=5690 OR destinationaddress="15.235.22.213" AND destinationport=59240)
index=activity AND rg_functionality="Web Server" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="107.180.100.247" AND sourceport=88 OR sourceaddress="15.235.22.212" AND sourceport=5690 OR sourceaddress="15.235.22.213" AND sourceport=59240)
index=activity AND rg_functionality="Web Server" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="107.180.100.247" AND sourceport=88 OR translatedipaddress="15.235.22.212" AND sourceport=5690 OR translatedipaddress="15.235.22.213" AND sourceport=59240)
index=activity AND rg_functionality="Web Server" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="107.180.100.247" AND destinationport=88 OR destinationtranslatedaddress="15.235.22.212" AND destinationport=5690 OR destinationtranslatedaddress="15.235.22.213" AND destinationport=59240)
index=activity AND rg_functionality="Web Server" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="107.180.100.247" AND destinationtranslatedport=88 OR destinationtranslatedaddress="15.235.22.212" AND destinationtranslatedport=5690 OR destinationtranslatedaddress="15.235.22.213" AND destinationtranslatedport=59240)
index=activity AND rg_functionality="Web Server" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="107.180.100.247" AND translatedport=88 OR destinationtranslatedaddress="15.235.22.212" AND translatedport=5690 OR destinationtranslatedaddress="15.235.22.213" AND translatedport=59240)
index=activity AND rg_functionality="Web Application Firewall" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="107.180.100.247" AND destinationport=88 OR destinationaddress="15.235.22.212" AND destinationport=5690 OR destinationaddress="15.235.22.213" AND destinationport=59240)
index=activity AND rg_functionality="Web Application Firewall" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="107.180.100.247" AND sourceport=88 OR sourceaddress="15.235.22.212" AND sourceport=5690 OR sourceaddress="15.235.22.213" AND sourceport=59240)
index=activity AND rg_functionality="Web Application Firewall" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="107.180.100.247" AND sourceport=88 OR translatedipaddress="15.235.22.212" AND sourceport=5690 OR translatedipaddress="15.235.22.213" AND sourceport=59240)
index=activity AND rg_functionality="Web Application Firewall" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="107.180.100.247" AND destinationport=88 OR destinationtranslatedaddress="15.235.22.212" AND destinationport=5690 OR destinationtranslatedaddress="15.235.22.213" AND destinationport=59240)
index=activity AND rg_functionality="Web Application Firewall" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="107.180.100.247" AND destinationtranslatedport=88 OR destinationtranslatedaddress="15.235.22.212" AND destinationtranslatedport=5690 OR destinationtranslatedaddress="15.235.22.213" AND destinationtranslatedport=59240)
index=activity AND rg_functionality="Web Application Firewall" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="107.180.100.247" AND translatedport=88 OR destinationtranslatedaddress="15.235.22.212" AND translatedport=5690 OR destinationtranslatedaddress="15.235.22.213" AND translatedport=59240)
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="107.180.100.247" AND destinationport=88 OR destinationaddress="15.235.22.212" AND destinationport=5690 OR destinationaddress="15.235.22.213" AND destinationport=59240)
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="107.180.100.247" AND sourceport=88 OR sourceaddress="15.235.22.212" AND sourceport=5690 OR sourceaddress="15.235.22.213" AND sourceport=59240)
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="107.180.100.247" AND sourceport=88 OR translatedipaddress="15.235.22.212" AND sourceport=5690 OR translatedipaddress="15.235.22.213" AND sourceport=59240)
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="107.180.100.247" AND destinationport=88 OR destinationtranslatedaddress="15.235.22.212" AND destinationport=5690 OR destinationtranslatedaddress="15.235.22.213" AND destinationport=59240)
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="107.180.100.247" AND destinationtranslatedport=88 OR destinationtranslatedaddress="15.235.22.212" AND destinationtranslatedport=5690 OR destinationtranslatedaddress="15.235.22.213" AND destinationtranslatedport=59240)
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="107.180.100.247" AND translatedport=88 OR destinationtranslatedaddress="15.235.22.212" AND translatedport=5690 OR destinationtranslatedaddress="15.235.22.213" AND translatedport=59240)
index=activity AND rg_functionality="Cloud Services / Applications" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="107.180.100.247" AND destinationport=88 OR destinationaddress="15.235.22.212" AND destinationport=5690 OR destinationaddress="15.235.22.213" AND destinationport=59240)
index=activity AND rg_functionality="Cloud Services / Applications" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="107.180.100.247" AND sourceport=88 OR sourceaddress="15.235.22.212" AND sourceport=5690 OR sourceaddress="15.235.22.213" AND sourceport=59240)
index=activity AND rg_functionality="Cloud Services / Applications" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="107.180.100.247" AND sourceport=88 OR translatedipaddress="15.235.22.212" AND sourceport=5690 OR translatedipaddress="15.235.22.213" AND sourceport=59240)
index=activity AND rg_functionality="Cloud Services / Applications" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="107.180.100.247" AND destinationport=88 OR destinationtranslatedaddress="15.235.22.212" AND destinationport=5690 OR destinationtranslatedaddress="15.235.22.213" AND destinationport=59240)
index=activity AND rg_functionality="Cloud Services / Applications" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="107.180.100.247" AND destinationtranslatedport=88 OR destinationtranslatedaddress="15.235.22.212" AND destinationtranslatedport=5690 OR destinationtranslatedaddress="15.235.22.213" AND destinationtranslatedport=59240)
index=activity AND rg_functionality="Cloud Services / Applications" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="107.180.100.247" AND translatedport=88 OR destinationtranslatedaddress="15.235.22.212" AND translatedport=5690 OR destinationtranslatedaddress="15.235.22.213" AND translatedport=59240)
index=activity AND rg_functionality="Cloud Application Audit" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="107.180.100.247" AND destinationport=88 OR destinationaddress="15.235.22.212" AND destinationport=5690 OR destinationaddress="15.235.22.213" AND destinationport=59240)
index=activity AND rg_functionality="Cloud Application Audit" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="107.180.100.247" AND sourceport=88 OR sourceaddress="15.235.22.212" AND sourceport=5690 OR sourceaddress="15.235.22.213" AND sourceport=59240)
index=activity AND rg_functionality="Cloud Application Audit" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="107.180.100.247" AND sourceport=88 OR translatedipaddress="15.235.22.212" AND sourceport=5690 OR translatedipaddress="15.235.22.213" AND sourceport=59240)
index=activity AND rg_functionality="Cloud Application Audit" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="107.180.100.247" AND destinationport=88 OR destinationtranslatedaddress="15.235.22.212" AND destinationport=5690 OR destinationtranslatedaddress="15.235.22.213" AND destinationport=59240)
index=activity AND rg_functionality="Cloud Application Audit" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="107.180.100.247" AND destinationtranslatedport=88 OR destinationtranslatedaddress="15.235.22.212" AND destinationtranslatedport=5690 OR destinationtranslatedaddress="15.235.22.213" AND destinationtranslatedport=59240)
index=activity AND rg_functionality="Cloud Application Audit" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="107.180.100.247" AND translatedport=88 OR destinationtranslatedaddress="15.235.22.212" AND translatedport=5690 OR destinationtranslatedaddress="15.235.22.213" AND translatedport=59240)
index=activity AND rg_functionality="Authentication / VPN" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="107.180.100.247" AND destinationport=88 OR destinationaddress="15.235.22.212" AND destinationport=5690 OR destinationaddress="15.235.22.213" AND destinationport=59240)
index=activity AND rg_functionality="Authentication / VPN" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="107.180.100.247" AND sourceport=88 OR sourceaddress="15.235.22.212" AND sourceport=5690 OR sourceaddress="15.235.22.213" AND sourceport=59240)
index=activity AND rg_functionality="Authentication / VPN" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="107.180.100.247" AND sourceport=88 OR translatedipaddress="15.235.22.212" AND sourceport=5690 OR translatedipaddress="15.235.22.213" AND sourceport=59240)
index=activity AND rg_functionality="Authentication / VPN" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="107.180.100.247" AND destinationport=88 OR destinationtranslatedaddress="15.235.22.212" AND destinationport=5690 OR destinationtranslatedaddress="15.235.22.213" AND destinationport=59240)
index=activity AND rg_functionality="Authentication / VPN" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="107.180.100.247" AND destinationtranslatedport=88 OR destinationtranslatedaddress="15.235.22.212" AND destinationtranslatedport=5690 OR destinationtranslatedaddress="15.235.22.213" AND destinationtranslatedport=59240)
index=activity AND rg_functionality="Authentication / VPN" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="107.180.100.247" AND translatedport=88 OR destinationtranslatedaddress="15.235.22.212" AND translatedport=5690 OR destinationtranslatedaddress="15.235.22.213" AND translatedport=59240)
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="107.180.100.247" AND destinationport=88 OR destinationaddress="15.235.22.212" AND destinationport=5690 OR destinationaddress="15.235.22.213" AND destinationport=59240)
index=activity AND rg_functionality="Unix / Linux / AIX" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="107.180.100.247" AND sourceport=88 OR sourceaddress="15.235.22.212" AND sourceport=5690 OR sourceaddress="15.235.22.213" AND sourceport=59240)
index=activity AND rg_functionality="Unix / Linux / AIX" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="107.180.100.247" AND sourceport=88 OR translatedipaddress="15.235.22.212" AND sourceport=5690 OR translatedipaddress="15.235.22.213" AND sourceport=59240)
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="107.180.100.247" AND destinationport=88 OR destinationtranslatedaddress="15.235.22.212" AND destinationport=5690 OR destinationtranslatedaddress="15.235.22.213" AND destinationport=59240)
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="107.180.100.247" AND destinationtranslatedport=88 OR destinationtranslatedaddress="15.235.22.212" AND destinationtranslatedport=5690 OR destinationtranslatedaddress="15.235.22.213" AND destinationtranslatedport=59240)
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="107.180.100.247" AND translatedport=88 OR destinationtranslatedaddress="15.235.22.212" AND translatedport=5690 OR destinationtranslatedaddress="15.235.22.213" AND translatedport=59240)
index=activity AND rg_functionality="Authentication / WiFi" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="107.180.100.247" AND destinationport=88 OR destinationaddress="15.235.22.212" AND destinationport=5690 OR destinationaddress="15.235.22.213" AND destinationport=59240)
index=activity AND rg_functionality="Authentication / WiFi" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="107.180.100.247" AND sourceport=88 OR sourceaddress="15.235.22.212" AND sourceport=5690 OR sourceaddress="15.235.22.213" AND sourceport=59240)
index=activity AND rg_functionality="Authentication / WiFi" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="107.180.100.247" AND sourceport=88 OR translatedipaddress="15.235.22.212" AND sourceport=5690 OR translatedipaddress="15.235.22.213" AND sourceport=59240)
index=activity AND rg_functionality="Authentication / WiFi" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="107.180.100.247" AND destinationport=88 OR destinationtranslatedaddress="15.235.22.212" AND destinationport=5690 OR destinationtranslatedaddress="15.235.22.213" AND destinationport=59240)
index=activity AND rg_functionality="Authentication / WiFi" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="107.180.100.247" AND destinationtranslatedport=88 OR destinationtranslatedaddress="15.235.22.212" AND destinationtranslatedport=5690 OR destinationtranslatedaddress="15.235.22.213" AND destinationtranslatedport=59240)
index=activity AND rg_functionality="Authentication / WiFi" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="107.180.100.247" AND translatedport=88 OR destinationtranslatedaddress="15.235.22.212" AND translatedport=5690 OR destinationtranslatedaddress="15.235.22.213" AND translatedport=59240)
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="107.180.100.247" AND destinationport=88 OR destinationaddress="15.235.22.212" AND destinationport=5690 OR destinationaddress="15.235.22.213" AND destinationport=59240)
index=activity AND rg_functionality="Cloud Application Security Broker" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="107.180.100.247" AND sourceport=88 OR sourceaddress="15.235.22.212" AND sourceport=5690 OR sourceaddress="15.235.22.213" AND sourceport=59240)
index=activity AND rg_functionality="Cloud Application Security Broker" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="107.180.100.247" AND sourceport=88 OR translatedipaddress="15.235.22.212" AND sourceport=5690 OR translatedipaddress="15.235.22.213" AND sourceport=59240)
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="107.180.100.247" AND destinationport=88 OR destinationtranslatedaddress="15.235.22.212" AND destinationport=5690 OR destinationtranslatedaddress="15.235.22.213" AND destinationport=59240)
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="107.180.100.247" AND destinationtranslatedport=88 OR destinationtranslatedaddress="15.235.22.212" AND destinationtranslatedport=5690 OR destinationtranslatedaddress="15.235.22.213" AND destinationtranslatedport=59240)
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="107.180.100.247" AND translatedport=88 OR destinationtranslatedaddress="15.235.22.212" AND translatedport=5690 OR destinationtranslatedaddress="15.235.22.213" AND translatedport=59240)
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="107.180.100.247" AND destinationport=88 OR destinationaddress="15.235.22.212" AND destinationport=5690 OR destinationaddress="15.235.22.213" AND destinationport=59240)
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="107.180.100.247" AND sourceport=88 OR sourceaddress="15.235.22.212" AND sourceport=5690 OR sourceaddress="15.235.22.213" AND sourceport=59240)
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="107.180.100.247" AND sourceport=88 OR translatedipaddress="15.235.22.212" AND sourceport=5690 OR translatedipaddress="15.235.22.213" AND sourceport=59240)
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="107.180.100.247" AND destinationport=88 OR destinationtranslatedaddress="15.235.22.212" AND destinationport=5690 OR destinationtranslatedaddress="15.235.22.213" AND destinationport=59240)
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="107.180.100.247" AND destinationtranslatedport=88 OR destinationtranslatedaddress="15.235.22.212" AND destinationtranslatedport=5690 OR destinationtranslatedaddress="15.235.22.213" AND destinationtranslatedport=59240)
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="107.180.100.247" AND translatedport=88 OR destinationtranslatedaddress="15.235.22.212" AND translatedport=5690 OR destinationtranslatedaddress="15.235.22.213" AND translatedport=59240)
