index=activity AND rg_functionality="Next Generation Firewall" AND ipaddress NOT NULL AND ipaddress IN ("45.76.184.227","45.32.23.140","139.162.87.180","107.191.61.40","172.104.109.217")
index=activity AND rg_functionality="Firewall" AND ipaddress NOT NULL AND ipaddress IN ("45.76.184.227","45.32.23.140","139.162.87.180","107.191.61.40","172.104.109.217")
index=activity AND rg_functionality="Web Proxy" AND ipaddress NOT NULL AND ipaddress IN ("45.76.184.227","45.32.23.140","139.162.87.180","107.191.61.40","172.104.109.217")
index=activity AND rg_functionality="Web Application Firewall" AND ipaddress NOT NULL AND ipaddress IN ("45.76.184.227","45.32.23.140","139.162.87.180","107.191.61.40","172.104.109.217")
index=activity AND rg_functionality="DNS / DHCP" AND ipaddress NOT NULL AND ipaddress IN ("45.76.184.227","45.32.23.140","139.162.87.180","107.191.61.40","172.104.109.217")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND ipaddress NOT NULL AND ipaddress IN ("45.76.184.227","45.32.23.140","139.162.87.180","107.191.61.40","172.104.109.217")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("45.76.184.227","45.32.23.140","139.162.87.180","107.191.61.40","172.104.109.217")
index=activity AND rg_functionality="Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("45.76.184.227","45.32.23.140","139.162.87.180","107.191.61.40","172.104.109.217")
index=activity AND rg_functionality="Web Proxy" AND destinationaddress NOT NULL AND destinationaddress IN ("45.76.184.227","45.32.23.140","139.162.87.180","107.191.61.40","172.104.109.217")
index=activity AND rg_functionality="Web Application Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("45.76.184.227","45.32.23.140","139.162.87.180","107.191.61.40","172.104.109.217")
index=activity AND rg_functionality="DNS / DHCP" AND destinationaddress NOT NULL AND destinationaddress IN ("45.76.184.227","45.32.23.140","139.162.87.180","107.191.61.40","172.104.109.217")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationaddress NOT NULL AND destinationaddress IN ("45.76.184.227","45.32.23.140","139.162.87.180","107.191.61.40","172.104.109.217")
index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("54e6ea47eb04634d3e87fd7787e2136ccfbcc80ade34f246a12cf93bab527f6b","e197c583f57e6c560b576278233e3ab050e38aa9424a5d95b172de66f9cfe970","655ca39beb2413803af099879401e6d634942a169d2f57eb30f96154a78b2ad5","840ce62f92fc519cd1a33b62f4b9f92a962b7fb28c12d2f607dec0b520e6a4b2","ba27ae12e6f3c2c87fd2478072dfa2747d368a507c69cd90b653c9e707254a1d","77680fb906476f0d84e15d5032f09108fdef8933bcad0b941c9f375fedd0b2c9","e81255ff6e0ed937603748c1442ce9d6588decf6922537037cf3f1a7369a8876")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("54e6ea47eb04634d3e87fd7787e2136ccfbcc80ade34f246a12cf93bab527f6b","e197c583f57e6c560b576278233e3ab050e38aa9424a5d95b172de66f9cfe970","655ca39beb2413803af099879401e6d634942a169d2f57eb30f96154a78b2ad5","840ce62f92fc519cd1a33b62f4b9f92a962b7fb28c12d2f607dec0b520e6a4b2","ba27ae12e6f3c2c87fd2478072dfa2747d368a507c69cd90b653c9e707254a1d","77680fb906476f0d84e15d5032f09108fdef8933bcad0b941c9f375fedd0b2c9","e81255ff6e0ed937603748c1442ce9d6588decf6922537037cf3f1a7369a8876")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("54e6ea47eb04634d3e87fd7787e2136ccfbcc80ade34f246a12cf93bab527f6b","e197c583f57e6c560b576278233e3ab050e38aa9424a5d95b172de66f9cfe970","655ca39beb2413803af099879401e6d634942a169d2f57eb30f96154a78b2ad5","840ce62f92fc519cd1a33b62f4b9f92a962b7fb28c12d2f607dec0b520e6a4b2","ba27ae12e6f3c2c87fd2478072dfa2747d368a507c69cd90b653c9e707254a1d","77680fb906476f0d84e15d5032f09108fdef8933bcad0b941c9f375fedd0b2c9","e81255ff6e0ed937603748c1442ce9d6588decf6922537037cf3f1a7369a8876")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("54e6ea47eb04634d3e87fd7787e2136ccfbcc80ade34f246a12cf93bab527f6b","e197c583f57e6c560b576278233e3ab050e38aa9424a5d95b172de66f9cfe970","655ca39beb2413803af099879401e6d634942a169d2f57eb30f96154a78b2ad5","840ce62f92fc519cd1a33b62f4b9f92a962b7fb28c12d2f607dec0b520e6a4b2","ba27ae12e6f3c2c87fd2478072dfa2747d368a507c69cd90b653c9e707254a1d","77680fb906476f0d84e15d5032f09108fdef8933bcad0b941c9f375fedd0b2c9","e81255ff6e0ed937603748c1442ce9d6588decf6922537037cf3f1a7369a8876")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("54e6ea47eb04634d3e87fd7787e2136ccfbcc80ade34f246a12cf93bab527f6b","e197c583f57e6c560b576278233e3ab050e38aa9424a5d95b172de66f9cfe970","655ca39beb2413803af099879401e6d634942a169d2f57eb30f96154a78b2ad5","840ce62f92fc519cd1a33b62f4b9f92a962b7fb28c12d2f607dec0b520e6a4b2","ba27ae12e6f3c2c87fd2478072dfa2747d368a507c69cd90b653c9e707254a1d","77680fb906476f0d84e15d5032f09108fdef8933bcad0b941c9f375fedd0b2c9","e81255ff6e0ed937603748c1442ce9d6588decf6922537037cf3f1a7369a8876")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("54e6ea47eb04634d3e87fd7787e2136ccfbcc80ade34f246a12cf93bab527f6b","e197c583f57e6c560b576278233e3ab050e38aa9424a5d95b172de66f9cfe970","655ca39beb2413803af099879401e6d634942a169d2f57eb30f96154a78b2ad5","840ce62f92fc519cd1a33b62f4b9f92a962b7fb28c12d2f607dec0b520e6a4b2","ba27ae12e6f3c2c87fd2478072dfa2747d368a507c69cd90b653c9e707254a1d","77680fb906476f0d84e15d5032f09108fdef8933bcad0b941c9f375fedd0b2c9","e81255ff6e0ed937603748c1442ce9d6588decf6922537037cf3f1a7369a8876")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "org.misecure.com" OR destinationhostname CONTAINS "update.centosupdates.com")
index=activity AND rg_functionality="Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "org.misecure.com" OR destinationhostname CONTAINS "update.centosupdates.com")
index=activity AND rg_functionality="Web Proxy" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "org.misecure.com" OR destinationhostname CONTAINS "update.centosupdates.com")
index=activity AND rg_functionality="Web Proxy" AND requesturl NOT NULL AND requesturl IN ("org.misecure.com","update.centosupdates.com")
