index=activity AND rg_functionality="Next Generation Firewall" AND ipaddress NOT NULL AND ipaddress IN ("191.252.219.71","194.145.227.21")
index=activity AND rg_functionality="Firewall" AND ipaddress NOT NULL AND ipaddress IN ("191.252.219.71","194.145.227.21")
index=activity AND rg_functionality="Web Proxy" AND ipaddress NOT NULL AND ipaddress IN ("191.252.219.71","194.145.227.21")
index=activity AND rg_functionality="Web Application Firewall" AND ipaddress NOT NULL AND ipaddress IN ("191.252.219.71","194.145.227.21")
index=activity AND rg_functionality="DNS / DHCP" AND ipaddress NOT NULL AND ipaddress IN ("191.252.219.71","194.145.227.21")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND ipaddress NOT NULL AND ipaddress IN ("191.252.219.71","194.145.227.21")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("191.252.219.71","194.145.227.21")
index=activity AND rg_functionality="Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("191.252.219.71","194.145.227.21")
index=activity AND rg_functionality="Web Proxy" AND destinationaddress NOT NULL AND destinationaddress IN ("191.252.219.71","194.145.227.21")
index=activity AND rg_functionality="Web Application Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("191.252.219.71","194.145.227.21")
index=activity AND rg_functionality="DNS / DHCP" AND destinationaddress NOT NULL AND destinationaddress IN ("191.252.219.71","194.145.227.21")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationaddress NOT NULL AND destinationaddress IN ("191.252.219.71","194.145.227.21")
index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("d8a0ad2486c9662c8ac8c4370c7986bdc02dc6bdb8155dcc537f10dd00252d1d","618a1d0e1e1f6d0a34a5ab6c08acf058ffe46938f53b3357f388df1c7909fc45","80bc76202b75201c740793ea9cd33b31cc262ef01738b053e335ee5d07a5ba96","a2f3ecd329d2713855257bf922b8a092cbb1193327ba197351804275286df7dd")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("d8a0ad2486c9662c8ac8c4370c7986bdc02dc6bdb8155dcc537f10dd00252d1d","618a1d0e1e1f6d0a34a5ab6c08acf058ffe46938f53b3357f388df1c7909fc45","80bc76202b75201c740793ea9cd33b31cc262ef01738b053e335ee5d07a5ba96","a2f3ecd329d2713855257bf922b8a092cbb1193327ba197351804275286df7dd")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("d8a0ad2486c9662c8ac8c4370c7986bdc02dc6bdb8155dcc537f10dd00252d1d","618a1d0e1e1f6d0a34a5ab6c08acf058ffe46938f53b3357f388df1c7909fc45","80bc76202b75201c740793ea9cd33b31cc262ef01738b053e335ee5d07a5ba96","a2f3ecd329d2713855257bf922b8a092cbb1193327ba197351804275286df7dd")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("d8a0ad2486c9662c8ac8c4370c7986bdc02dc6bdb8155dcc537f10dd00252d1d","618a1d0e1e1f6d0a34a5ab6c08acf058ffe46938f53b3357f388df1c7909fc45","80bc76202b75201c740793ea9cd33b31cc262ef01738b053e335ee5d07a5ba96","a2f3ecd329d2713855257bf922b8a092cbb1193327ba197351804275286df7dd")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("d8a0ad2486c9662c8ac8c4370c7986bdc02dc6bdb8155dcc537f10dd00252d1d","618a1d0e1e1f6d0a34a5ab6c08acf058ffe46938f53b3357f388df1c7909fc45","80bc76202b75201c740793ea9cd33b31cc262ef01738b053e335ee5d07a5ba96","a2f3ecd329d2713855257bf922b8a092cbb1193327ba197351804275286df7dd")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("d8a0ad2486c9662c8ac8c4370c7986bdc02dc6bdb8155dcc537f10dd00252d1d","618a1d0e1e1f6d0a34a5ab6c08acf058ffe46938f53b3357f388df1c7909fc45","80bc76202b75201c740793ea9cd33b31cc262ef01738b053e335ee5d07a5ba96","a2f3ecd329d2713855257bf922b8a092cbb1193327ba197351804275286df7dd")
index=activity AND rg_functionality="Web Proxy" AND requesturl NOT NULL AND requesturl IN ("http://194.145.227.21/poc.xml","http://194.145.227.21/pocwin.xml","http://194.145.227.21/ldr.ps1")
