Remember, Threat, URL and Data logs are all classified in the same 'pool'.

( subtype eq wildfire-virus ) and ( severity eq medium )

( subtype eq virus ) and ( severity eq medium )

( subtype eq spyware ) and ( action eq sinkhole )

( subtype eq spyware ) and ( name-of-threatid eq 344426259 )  and ( action eq sinkhole )

( subtype eq spyware ) and ( name-of-threatid eq 'generic:www.groupenci.com' ) and ( action eq sinkhole )

( subtype eq vulnerability ) and ( name-of-threatid eq 'HTTP Unauthorized Brute Force Attack' ) and ( severity eq high )

( subtype eq vulnerability ) and ( name-of-threatid eq 'HTTP: User Authentication Brute Force Attempt' ) and ( severity eq high )

( subtype eq vulnerability ) and ( name-of-threatid eq 'SMB: User Password Brute Force Attempt' ) and ( severity eq high )

( subtype eq spyware ) and ( name-of-threatid eq 'DNS Tunnel Data Infiltration Traffic' ) and ( severity eq informational )

( subtype eq scan ) and ( name-of-threatid eq 'SCAN: Host Sweep' ) and ( severity eq medium)

( subtype eq scan ) and ( name-of-threatid eq 'SCAN: TCP Port Scan' ) and ( severity eq medium)

( subtype eq scan ) and ( name-of-threatid eq 'SCAN: UDP Port Scan' ) and ( severity eq medium)

( subtype eq packet ) and ( name-of-threatid eq 'TCP SYN with data' ) and ( severity eq informational )

( subtype eq packet ) and ( name-of-threatid eq 'TCP SYN with data' ) and ( severity eq informational )

( subtype eq packet ) and ( name-of-threatid eq 'TCP Fast Open' ) and ( severity eq informational )

( subtype eq packet ) and ( name-of-threatid eq 'IP Option Record Route' ) and ( severity eq informational )

( subtype eq flood ) and ( name-of-threatid eq 'UDP Flood' ) and ( action eq allow ) and ( severity eq critical )

( subtype eq flood ) and ( name-of-threatid eq 'TCP Flood' ) and ( action eq allow ) and ( severity eq critical )

( subtype eq flood ) and ( name-of-threatid eq 'ICMP Flood' ) and ( action eq allow ) and ( severity eq critical )

( subtype eq flood ) and ( name-of-threatid eq 'UDP Flood' ) and ( action eq drop ) and ( severity eq critical )

( subtype eq flood ) and ( name-of-threatid eq 'TCP Flood' ) and ( action eq drop ) and ( severity eq critical )

( subtype eq flood ) and ( name-of-threatid eq 'ICMP Flood' ) and ( action eq drop ) and ( severity eq critical )