index=activity AND rg_functionality="Next Generation Firewall" AND ipaddress NOT NULL AND ipaddress IN ("94.156.189.122","193.37.213.135")
index=activity AND rg_functionality="Firewall" AND ipaddress NOT NULL AND ipaddress IN ("94.156.189.122","193.37.213.135")
index=activity AND rg_functionality="Web Proxy" AND ipaddress NOT NULL AND ipaddress IN ("94.156.189.122","193.37.213.135")
index=activity AND rg_functionality="Web Application Firewall" AND ipaddress NOT NULL AND ipaddress IN ("94.156.189.122","193.37.213.135")
index=activity AND rg_functionality="DNS / DHCP" AND ipaddress NOT NULL AND ipaddress IN ("94.156.189.122","193.37.213.135")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND ipaddress NOT NULL AND ipaddress IN ("94.156.189.122","193.37.213.135")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("94.156.189.122","193.37.213.135")
index=activity AND rg_functionality="Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("94.156.189.122","193.37.213.135")
index=activity AND rg_functionality="Web Proxy" AND destinationaddress NOT NULL AND destinationaddress IN ("94.156.189.122","193.37.213.135")
index=activity AND rg_functionality="Web Application Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("94.156.189.122","193.37.213.135")
index=activity AND rg_functionality="DNS / DHCP" AND destinationaddress NOT NULL AND destinationaddress IN ("94.156.189.122","193.37.213.135")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationaddress NOT NULL AND destinationaddress IN ("94.156.189.122","193.37.213.135")
index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("15265520a6622fc5a254854768da0545","f6aea82e0be4863e5535759f9ddea659","7bdb4b03eaf03db90f02c5b2e59a8282","5e149c121a1015cb90132645c44bf87a","9a958fd2053d610dd380f75f028da308baa39eb1","672629577295fa71192a737bc196de2bfea65c9b","42e32d40607e29b761b6be42ccf93ea78cd65021","50203cbf82be50616d2992c2d8cad5a432a22d6a","7e187735d3701b681e60605563e4bb9c0febab5f4af2cbf40ba92722bf3e8f9e","3e59b5a07becf6956ee9271d57135d4d6524bfc3f4e9bd7866c16810f4ff3020","3f99e107781c531db626e94a457bb630df4f4f37893ec2dfb2789a0b3115064b","50483830696fd3b1be3a893e39c98fdcf615412dd7f4c02fe462304ff6d6136e")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("15265520a6622fc5a254854768da0545","f6aea82e0be4863e5535759f9ddea659","7bdb4b03eaf03db90f02c5b2e59a8282","5e149c121a1015cb90132645c44bf87a","9a958fd2053d610dd380f75f028da308baa39eb1","672629577295fa71192a737bc196de2bfea65c9b","42e32d40607e29b761b6be42ccf93ea78cd65021","50203cbf82be50616d2992c2d8cad5a432a22d6a","7e187735d3701b681e60605563e4bb9c0febab5f4af2cbf40ba92722bf3e8f9e","3e59b5a07becf6956ee9271d57135d4d6524bfc3f4e9bd7866c16810f4ff3020","3f99e107781c531db626e94a457bb630df4f4f37893ec2dfb2789a0b3115064b","50483830696fd3b1be3a893e39c98fdcf615412dd7f4c02fe462304ff6d6136e")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("15265520a6622fc5a254854768da0545","f6aea82e0be4863e5535759f9ddea659","7bdb4b03eaf03db90f02c5b2e59a8282","5e149c121a1015cb90132645c44bf87a","9a958fd2053d610dd380f75f028da308baa39eb1","672629577295fa71192a737bc196de2bfea65c9b","42e32d40607e29b761b6be42ccf93ea78cd65021","50203cbf82be50616d2992c2d8cad5a432a22d6a","7e187735d3701b681e60605563e4bb9c0febab5f4af2cbf40ba92722bf3e8f9e","3e59b5a07becf6956ee9271d57135d4d6524bfc3f4e9bd7866c16810f4ff3020","3f99e107781c531db626e94a457bb630df4f4f37893ec2dfb2789a0b3115064b","50483830696fd3b1be3a893e39c98fdcf615412dd7f4c02fe462304ff6d6136e")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("15265520a6622fc5a254854768da0545","f6aea82e0be4863e5535759f9ddea659","7bdb4b03eaf03db90f02c5b2e59a8282","5e149c121a1015cb90132645c44bf87a","9a958fd2053d610dd380f75f028da308baa39eb1","672629577295fa71192a737bc196de2bfea65c9b","42e32d40607e29b761b6be42ccf93ea78cd65021","50203cbf82be50616d2992c2d8cad5a432a22d6a","7e187735d3701b681e60605563e4bb9c0febab5f4af2cbf40ba92722bf3e8f9e","3e59b5a07becf6956ee9271d57135d4d6524bfc3f4e9bd7866c16810f4ff3020","3f99e107781c531db626e94a457bb630df4f4f37893ec2dfb2789a0b3115064b","50483830696fd3b1be3a893e39c98fdcf615412dd7f4c02fe462304ff6d6136e")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("15265520a6622fc5a254854768da0545","f6aea82e0be4863e5535759f9ddea659","7bdb4b03eaf03db90f02c5b2e59a8282","5e149c121a1015cb90132645c44bf87a","9a958fd2053d610dd380f75f028da308baa39eb1","672629577295fa71192a737bc196de2bfea65c9b","42e32d40607e29b761b6be42ccf93ea78cd65021","50203cbf82be50616d2992c2d8cad5a432a22d6a","7e187735d3701b681e60605563e4bb9c0febab5f4af2cbf40ba92722bf3e8f9e","3e59b5a07becf6956ee9271d57135d4d6524bfc3f4e9bd7866c16810f4ff3020","3f99e107781c531db626e94a457bb630df4f4f37893ec2dfb2789a0b3115064b","50483830696fd3b1be3a893e39c98fdcf615412dd7f4c02fe462304ff6d6136e")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("15265520a6622fc5a254854768da0545","f6aea82e0be4863e5535759f9ddea659","7bdb4b03eaf03db90f02c5b2e59a8282","5e149c121a1015cb90132645c44bf87a","9a958fd2053d610dd380f75f028da308baa39eb1","672629577295fa71192a737bc196de2bfea65c9b","42e32d40607e29b761b6be42ccf93ea78cd65021","50203cbf82be50616d2992c2d8cad5a432a22d6a","7e187735d3701b681e60605563e4bb9c0febab5f4af2cbf40ba92722bf3e8f9e","3e59b5a07becf6956ee9271d57135d4d6524bfc3f4e9bd7866c16810f4ff3020","3f99e107781c531db626e94a457bb630df4f4f37893ec2dfb2789a0b3115064b","50483830696fd3b1be3a893e39c98fdcf615412dd7f4c02fe462304ff6d6136e")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "onedrive-login.us" OR destinationhostname CONTAINS "windows.system-update.org" OR destinationhostname CONTAINS "vladars.co" OR destinationhostname CONTAINS "onedrive-login.net" OR destinationhostname CONTAINS "system-update.org")
index=activity AND rg_functionality="Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "onedrive-login.us" OR destinationhostname CONTAINS "windows.system-update.org" OR destinationhostname CONTAINS "vladars.co" OR destinationhostname CONTAINS "onedrive-login.net" OR destinationhostname CONTAINS "system-update.org")
index=activity AND rg_functionality="Web Proxy" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "onedrive-login.us" OR destinationhostname CONTAINS "windows.system-update.org" OR destinationhostname CONTAINS "vladars.co" OR destinationhostname CONTAINS "onedrive-login.net" OR destinationhostname CONTAINS "system-update.org")
