index=activity AND rg_functionality="Next Generation Firewall" AND ipaddress NOT NULL AND ipaddress IN ("170.130.55.120","104.168.132.128")
index=activity AND rg_functionality="Firewall" AND ipaddress NOT NULL AND ipaddress IN ("170.130.55.120","104.168.132.128")
index=activity AND rg_functionality="Web Proxy" AND ipaddress NOT NULL AND ipaddress IN ("170.130.55.120","104.168.132.128")
index=activity AND rg_functionality="Web Application Firewall" AND ipaddress NOT NULL AND ipaddress IN ("170.130.55.120","104.168.132.128")
index=activity AND rg_functionality="DNS / DHCP" AND ipaddress NOT NULL AND ipaddress IN ("170.130.55.120","104.168.132.128")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND ipaddress NOT NULL AND ipaddress IN ("170.130.55.120","104.168.132.128")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("170.130.55.120","104.168.132.128")
index=activity AND rg_functionality="Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("170.130.55.120","104.168.132.128")
index=activity AND rg_functionality="Web Proxy" AND destinationaddress NOT NULL AND destinationaddress IN ("170.130.55.120","104.168.132.128")
index=activity AND rg_functionality="Web Application Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("170.130.55.120","104.168.132.128")
index=activity AND rg_functionality="DNS / DHCP" AND destinationaddress NOT NULL AND destinationaddress IN ("170.130.55.120","104.168.132.128")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationaddress NOT NULL AND destinationaddress IN ("170.130.55.120","104.168.132.128")
index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("655c3c304a2fe76d178f7878d6748439","6ffa106ac8d923ca32bc6162374f488b ","fb3de0512d1ee5f615edee5ef3206a95 ","4a03238e31e3e90b38870ffc0a3ceb3b","Beffdd959b1f7e11e1c2b31af2804a07","d9f5a846726f11ae2f785f55842c630f","087f82581b65e3d4af6f74c8400be00e")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("655c3c304a2fe76d178f7878d6748439","6ffa106ac8d923ca32bc6162374f488b ","fb3de0512d1ee5f615edee5ef3206a95 ","4a03238e31e3e90b38870ffc0a3ceb3b","Beffdd959b1f7e11e1c2b31af2804a07","d9f5a846726f11ae2f785f55842c630f","087f82581b65e3d4af6f74c8400be00e")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("655c3c304a2fe76d178f7878d6748439","6ffa106ac8d923ca32bc6162374f488b ","fb3de0512d1ee5f615edee5ef3206a95 ","4a03238e31e3e90b38870ffc0a3ceb3b","Beffdd959b1f7e11e1c2b31af2804a07","d9f5a846726f11ae2f785f55842c630f","087f82581b65e3d4af6f74c8400be00e")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("655c3c304a2fe76d178f7878d6748439","6ffa106ac8d923ca32bc6162374f488b ","fb3de0512d1ee5f615edee5ef3206a95 ","4a03238e31e3e90b38870ffc0a3ceb3b","Beffdd959b1f7e11e1c2b31af2804a07","d9f5a846726f11ae2f785f55842c630f","087f82581b65e3d4af6f74c8400be00e")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("655c3c304a2fe76d178f7878d6748439","6ffa106ac8d923ca32bc6162374f488b ","fb3de0512d1ee5f615edee5ef3206a95 ","4a03238e31e3e90b38870ffc0a3ceb3b","Beffdd959b1f7e11e1c2b31af2804a07","d9f5a846726f11ae2f785f55842c630f","087f82581b65e3d4af6f74c8400be00e")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("655c3c304a2fe76d178f7878d6748439","6ffa106ac8d923ca32bc6162374f488b ","fb3de0512d1ee5f615edee5ef3206a95 ","4a03238e31e3e90b38870ffc0a3ceb3b","Beffdd959b1f7e11e1c2b31af2804a07","d9f5a846726f11ae2f785f55842c630f","087f82581b65e3d4af6f74c8400be00e")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "104-168.132.128.nip.io")
index=activity AND rg_functionality="Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "104-168.132.128.nip.io")
index=activity AND rg_functionality="Web Proxy" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "104-168.132.128.nip.io")
index=activity AND rg_functionality="Web Proxy" AND requesturl NOT NULL AND requesturl IN ("https://104-168-132-128.nip.io /51b16c","http://va5vkfdihi5forrzsnmins436z3cbvf3sqqkl4lf6l6kn3t5kc5efrad.onion")
