(http.user_agent contains "Linux") or (http.user_agent contains "Firefox") or (ip.geoip.asnum eq 213230) or (ip.geoip.country eq "DE") or (ip.geoip.country eq "IN") or (ip.geoip.country eq "ID") or (ip.geoip.country eq "US") or (ip.geoip.country eq "JP") or (ip.geoip.country eq "CN") or (ip.geoip.country eq "KP") or (ip.geoip.country eq "KR") or (ip.geoip.asnum eq 14061) or (http.request.uri.query contains " ?query=") or (http.request.version eq "HTTP/1.0") or (http.request.version eq "HTTP/1.1") or (cf.threat_score ge 1) or (ip.geoip.country eq "T1") or (ip.geoip.country eq "TH") or (ip.geoip.country eq "CA") or (ip.geoip.country eq "BR")