index=activity AND rg_functionality="Next Generation Firewall" AND ipaddress NOT NULL AND ipaddress IN ("160.202.163.100")
index=activity AND rg_functionality="Firewall" AND ipaddress NOT NULL AND ipaddress IN ("160.202.163.100")
index=activity AND rg_functionality="Web Proxy" AND ipaddress NOT NULL AND ipaddress IN ("160.202.163.100")
index=activity AND rg_functionality="Web Application Firewall" AND ipaddress NOT NULL AND ipaddress IN ("160.202.163.100")
index=activity AND rg_functionality="DNS / DHCP" AND ipaddress NOT NULL AND ipaddress IN ("160.202.163.100")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND ipaddress NOT NULL AND ipaddress IN ("160.202.163.100")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("160.202.163.100")
index=activity AND rg_functionality="Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("160.202.163.100")
index=activity AND rg_functionality="Web Proxy" AND destinationaddress NOT NULL AND destinationaddress IN ("160.202.163.100")
index=activity AND rg_functionality="Web Application Firewall" AND destinationaddress NOT NULL AND destinationaddress IN ("160.202.163.100")
index=activity AND rg_functionality="DNS / DHCP" AND destinationaddress NOT NULL AND destinationaddress IN ("160.202.163.100")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationaddress NOT NULL AND destinationaddress IN ("160.202.163.100")
index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("294b8db1f2702b60fb2e42fdc50c2cee6a5046112da9a5703a548a4fa50477bc","3ad119d4f2f1d8ce3851181120a292f41189e4417ad20a6c86b6f45f6a9fbcfc","7129434afc1fec276525acfeee5bb08923ccd9b32269638a54c7b452f5493492","c49631db0b2e41125ccade68a0fe7fb70939315f1c580510e40e5b30ead868f5","07b815cee2b85a41820cd8157a68f35aa1ed0aa5f4093b8cb79a1d645a16273f","e40370f463b4a4feb2d515a3fb64af1573523f03917b2fd9e7a9d0a741ef89a5")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("294b8db1f2702b60fb2e42fdc50c2cee6a5046112da9a5703a548a4fa50477bc","3ad119d4f2f1d8ce3851181120a292f41189e4417ad20a6c86b6f45f6a9fbcfc","7129434afc1fec276525acfeee5bb08923ccd9b32269638a54c7b452f5493492","c49631db0b2e41125ccade68a0fe7fb70939315f1c580510e40e5b30ead868f5","07b815cee2b85a41820cd8157a68f35aa1ed0aa5f4093b8cb79a1d645a16273f","e40370f463b4a4feb2d515a3fb64af1573523f03917b2fd9e7a9d0a741ef89a5")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("294b8db1f2702b60fb2e42fdc50c2cee6a5046112da9a5703a548a4fa50477bc","3ad119d4f2f1d8ce3851181120a292f41189e4417ad20a6c86b6f45f6a9fbcfc","7129434afc1fec276525acfeee5bb08923ccd9b32269638a54c7b452f5493492","c49631db0b2e41125ccade68a0fe7fb70939315f1c580510e40e5b30ead868f5","07b815cee2b85a41820cd8157a68f35aa1ed0aa5f4093b8cb79a1d645a16273f","e40370f463b4a4feb2d515a3fb64af1573523f03917b2fd9e7a9d0a741ef89a5")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("294b8db1f2702b60fb2e42fdc50c2cee6a5046112da9a5703a548a4fa50477bc","3ad119d4f2f1d8ce3851181120a292f41189e4417ad20a6c86b6f45f6a9fbcfc","7129434afc1fec276525acfeee5bb08923ccd9b32269638a54c7b452f5493492","c49631db0b2e41125ccade68a0fe7fb70939315f1c580510e40e5b30ead868f5","07b815cee2b85a41820cd8157a68f35aa1ed0aa5f4093b8cb79a1d645a16273f","e40370f463b4a4feb2d515a3fb64af1573523f03917b2fd9e7a9d0a741ef89a5")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("294b8db1f2702b60fb2e42fdc50c2cee6a5046112da9a5703a548a4fa50477bc","3ad119d4f2f1d8ce3851181120a292f41189e4417ad20a6c86b6f45f6a9fbcfc","7129434afc1fec276525acfeee5bb08923ccd9b32269638a54c7b452f5493492","c49631db0b2e41125ccade68a0fe7fb70939315f1c580510e40e5b30ead868f5","07b815cee2b85a41820cd8157a68f35aa1ed0aa5f4093b8cb79a1d645a16273f","e40370f463b4a4feb2d515a3fb64af1573523f03917b2fd9e7a9d0a741ef89a5")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("294b8db1f2702b60fb2e42fdc50c2cee6a5046112da9a5703a548a4fa50477bc","3ad119d4f2f1d8ce3851181120a292f41189e4417ad20a6c86b6f45f6a9fbcfc","7129434afc1fec276525acfeee5bb08923ccd9b32269638a54c7b452f5493492","c49631db0b2e41125ccade68a0fe7fb70939315f1c580510e40e5b30ead868f5","07b815cee2b85a41820cd8157a68f35aa1ed0aa5f4093b8cb79a1d645a16273f","e40370f463b4a4feb2d515a3fb64af1573523f03917b2fd9e7a9d0a741ef89a5")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "update.microsofthk.com" OR destinationhostname CONTAINS "update.microsoftkernel.com" OR destinationhostname CONTAINS "amazon.hksupd.com" OR destinationhostname CONTAINS "")
index=activity AND rg_functionality="Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "update.microsofthk.com" OR destinationhostname CONTAINS "update.microsoftkernel.com" OR destinationhostname CONTAINS "amazon.hksupd.com" OR destinationhostname CONTAINS "")
index=activity AND rg_functionality="Web Proxy" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "update.microsofthk.com" OR destinationhostname CONTAINS "update.microsoftkernel.com" OR destinationhostname CONTAINS "amazon.hksupd.com" OR destinationhostname CONTAINS "")
