index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("5897e67e491a9d8143f6d45803bc8ac8","d91ffc6d48f79e0b55918fb73365b9fca37c9efa","91965ee08504eeb01e76e17007497852","0c1e1fd94383efc5a3de8f0117c154b2","85f8bfb3b859a35e342e35d7c35e8746","0c993a406be04b806222a130fb5a18e8","dfaa28a53310a43031e406ff927a6866","0c4540f659d3942a28f158bce7be1143","1d65ef16d1f161ae3faa5ed7896734cd","176d11c9bafac6153f728d8afb692f6f","5897e67e491a9d8143f6d45803bc8ac8","50eb199e188594a42262a5bbea260470","c89eaa7f40fc75f9a34e0f0a3b59b88b","0c1e1fd94383efc5a3de8f0117c154b2","640e6ecad629bd33c09ccec52f4aa6da","11010e139010697a94a8feb3704519f9","099c7d85d0d26a31469465d333329778","8b4c1f0ff1cee413f5f2999fa21f94f9","8148aeef6995c99c6f93ebce65b60bf57109914c45aa86d26a5cdc6ad8bba634","fd05e69d1f094b3a28bb5ae2a936607aa0db3866","3785d9c4bdf6812f753d93b70781d3db68141ce7","ff5e78218198dd5ca5dc2eb46ec8afdd1b6260e9","49307f1091251dd7a498cf69d0465ddd59859cf8","c694e99f8690114c77a6099856d61a3cd4cd814d","d1cc0f861f162dfbf9df1493fe861d02b80483f6","144493b13df06bab3f290b260b997b71164a25f7","ef0f61c32a3ae2494000f36a700a151c8b10c134","d91ffc6d48f79e0b55918fb73365b9fca37c9efa","af33573bc8e507875acdb3db52bcfea13bb1286e","f3c600ba1d1d0cb1f3383805dbcac19e9423bdcb","3785d9c4bdf6812f753d93b70781d3db68141ce7","584fd63ab925c532cf40818886487714b3de317e","52999153cc7d3a3771a8ee9b8e55f913829109a7","d25a68289fc1268d7c548787373a6235895716fb","97e19f67a8d6af78c181f05198aa7d200b243ea5","d7c1668c903a92f20bdeaee0f6e94b2ef3fefd700ca8daa4c4ff34a26f1323af","aee1bf1f7e70f5cbd34a59b312573a6c7e34b1e412e4518a55a5b14af2102063","a56003dc199224113e9c85b0edb2197d4a4af91b15e7d0710873e2ef848c3221","256d3065de2345a6beff9458ad0b519bed8363ac0b984247768bd788e633e371","4a5e9ab0e65e08ceb2adb2d150abb620684e98d79483b6c9f786c56c95fea573","37e259d6564071807b7b4266ed1dd8bf2059f3e7f438b8487dd0149e5e0487ec","0a5fb4a480b1748dc7f963a491a9aa32ff8c8fed01bea0cfd250a5ef01654eb3","ea9429fa66ba14b99ff756b8497ccbd3403437d4150eaed6c5c0fe4a3cdf78a8","8148aeef6995c99c6f93ebce65b60bf57109914c45aa86d26a5cdc6ad8bba634","0afeef5a4ac1b0bc778e66a1420587697dbfdb87d74a0b935db69b7d804089c4","98b5cfa14dd805e1172b36415c71730fa3454ffbaababc7d4c7b1fcfb47dfbd7","aee1bf1f7e70f5cbd34a59b312573a6c7e34b1e412e4518a55a5b14af2102063","add70042c65cd683925936aa04c79a8644e40dd93aa5ff1913bf533457daccf3","c2b769f40b1ec2ee57e4d36f545d6de93bbd54d2514347fb54cc20b1bfb9ca97","c3382ebff9dcd0e8776820f70faaa8cd4c0c93578444e5cfe3720e0b232fa6d8","f49999f1d7327921e63097b4f90f437a0122361676b73a81f0ff2b681b1dd8de")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("5897e67e491a9d8143f6d45803bc8ac8","d91ffc6d48f79e0b55918fb73365b9fca37c9efa","91965ee08504eeb01e76e17007497852","0c1e1fd94383efc5a3de8f0117c154b2","85f8bfb3b859a35e342e35d7c35e8746","0c993a406be04b806222a130fb5a18e8","dfaa28a53310a43031e406ff927a6866","0c4540f659d3942a28f158bce7be1143","1d65ef16d1f161ae3faa5ed7896734cd","176d11c9bafac6153f728d8afb692f6f","5897e67e491a9d8143f6d45803bc8ac8","50eb199e188594a42262a5bbea260470","c89eaa7f40fc75f9a34e0f0a3b59b88b","0c1e1fd94383efc5a3de8f0117c154b2","640e6ecad629bd33c09ccec52f4aa6da","11010e139010697a94a8feb3704519f9","099c7d85d0d26a31469465d333329778","8b4c1f0ff1cee413f5f2999fa21f94f9","8148aeef6995c99c6f93ebce65b60bf57109914c45aa86d26a5cdc6ad8bba634","fd05e69d1f094b3a28bb5ae2a936607aa0db3866","3785d9c4bdf6812f753d93b70781d3db68141ce7","ff5e78218198dd5ca5dc2eb46ec8afdd1b6260e9","49307f1091251dd7a498cf69d0465ddd59859cf8","c694e99f8690114c77a6099856d61a3cd4cd814d","d1cc0f861f162dfbf9df1493fe861d02b80483f6","144493b13df06bab3f290b260b997b71164a25f7","ef0f61c32a3ae2494000f36a700a151c8b10c134","d91ffc6d48f79e0b55918fb73365b9fca37c9efa","af33573bc8e507875acdb3db52bcfea13bb1286e","f3c600ba1d1d0cb1f3383805dbcac19e9423bdcb","3785d9c4bdf6812f753d93b70781d3db68141ce7","584fd63ab925c532cf40818886487714b3de317e","52999153cc7d3a3771a8ee9b8e55f913829109a7","d25a68289fc1268d7c548787373a6235895716fb","97e19f67a8d6af78c181f05198aa7d200b243ea5","d7c1668c903a92f20bdeaee0f6e94b2ef3fefd700ca8daa4c4ff34a26f1323af","aee1bf1f7e70f5cbd34a59b312573a6c7e34b1e412e4518a55a5b14af2102063","a56003dc199224113e9c85b0edb2197d4a4af91b15e7d0710873e2ef848c3221","256d3065de2345a6beff9458ad0b519bed8363ac0b984247768bd788e633e371","4a5e9ab0e65e08ceb2adb2d150abb620684e98d79483b6c9f786c56c95fea573","37e259d6564071807b7b4266ed1dd8bf2059f3e7f438b8487dd0149e5e0487ec","0a5fb4a480b1748dc7f963a491a9aa32ff8c8fed01bea0cfd250a5ef01654eb3","ea9429fa66ba14b99ff756b8497ccbd3403437d4150eaed6c5c0fe4a3cdf78a8","8148aeef6995c99c6f93ebce65b60bf57109914c45aa86d26a5cdc6ad8bba634","0afeef5a4ac1b0bc778e66a1420587697dbfdb87d74a0b935db69b7d804089c4","98b5cfa14dd805e1172b36415c71730fa3454ffbaababc7d4c7b1fcfb47dfbd7","aee1bf1f7e70f5cbd34a59b312573a6c7e34b1e412e4518a55a5b14af2102063","add70042c65cd683925936aa04c79a8644e40dd93aa5ff1913bf533457daccf3","c2b769f40b1ec2ee57e4d36f545d6de93bbd54d2514347fb54cc20b1bfb9ca97","c3382ebff9dcd0e8776820f70faaa8cd4c0c93578444e5cfe3720e0b232fa6d8","f49999f1d7327921e63097b4f90f437a0122361676b73a81f0ff2b681b1dd8de")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("5897e67e491a9d8143f6d45803bc8ac8","d91ffc6d48f79e0b55918fb73365b9fca37c9efa","91965ee08504eeb01e76e17007497852","0c1e1fd94383efc5a3de8f0117c154b2","85f8bfb3b859a35e342e35d7c35e8746","0c993a406be04b806222a130fb5a18e8","dfaa28a53310a43031e406ff927a6866","0c4540f659d3942a28f158bce7be1143","1d65ef16d1f161ae3faa5ed7896734cd","176d11c9bafac6153f728d8afb692f6f","5897e67e491a9d8143f6d45803bc8ac8","50eb199e188594a42262a5bbea260470","c89eaa7f40fc75f9a34e0f0a3b59b88b","0c1e1fd94383efc5a3de8f0117c154b2","640e6ecad629bd33c09ccec52f4aa6da","11010e139010697a94a8feb3704519f9","099c7d85d0d26a31469465d333329778","8b4c1f0ff1cee413f5f2999fa21f94f9","8148aeef6995c99c6f93ebce65b60bf57109914c45aa86d26a5cdc6ad8bba634","fd05e69d1f094b3a28bb5ae2a936607aa0db3866","3785d9c4bdf6812f753d93b70781d3db68141ce7","ff5e78218198dd5ca5dc2eb46ec8afdd1b6260e9","49307f1091251dd7a498cf69d0465ddd59859cf8","c694e99f8690114c77a6099856d61a3cd4cd814d","d1cc0f861f162dfbf9df1493fe861d02b80483f6","144493b13df06bab3f290b260b997b71164a25f7","ef0f61c32a3ae2494000f36a700a151c8b10c134","d91ffc6d48f79e0b55918fb73365b9fca37c9efa","af33573bc8e507875acdb3db52bcfea13bb1286e","f3c600ba1d1d0cb1f3383805dbcac19e9423bdcb","3785d9c4bdf6812f753d93b70781d3db68141ce7","584fd63ab925c532cf40818886487714b3de317e","52999153cc7d3a3771a8ee9b8e55f913829109a7","d25a68289fc1268d7c548787373a6235895716fb","97e19f67a8d6af78c181f05198aa7d200b243ea5","d7c1668c903a92f20bdeaee0f6e94b2ef3fefd700ca8daa4c4ff34a26f1323af","aee1bf1f7e70f5cbd34a59b312573a6c7e34b1e412e4518a55a5b14af2102063","a56003dc199224113e9c85b0edb2197d4a4af91b15e7d0710873e2ef848c3221","256d3065de2345a6beff9458ad0b519bed8363ac0b984247768bd788e633e371","4a5e9ab0e65e08ceb2adb2d150abb620684e98d79483b6c9f786c56c95fea573","37e259d6564071807b7b4266ed1dd8bf2059f3e7f438b8487dd0149e5e0487ec","0a5fb4a480b1748dc7f963a491a9aa32ff8c8fed01bea0cfd250a5ef01654eb3","ea9429fa66ba14b99ff756b8497ccbd3403437d4150eaed6c5c0fe4a3cdf78a8","8148aeef6995c99c6f93ebce65b60bf57109914c45aa86d26a5cdc6ad8bba634","0afeef5a4ac1b0bc778e66a1420587697dbfdb87d74a0b935db69b7d804089c4","98b5cfa14dd805e1172b36415c71730fa3454ffbaababc7d4c7b1fcfb47dfbd7","aee1bf1f7e70f5cbd34a59b312573a6c7e34b1e412e4518a55a5b14af2102063","add70042c65cd683925936aa04c79a8644e40dd93aa5ff1913bf533457daccf3","c2b769f40b1ec2ee57e4d36f545d6de93bbd54d2514347fb54cc20b1bfb9ca97","c3382ebff9dcd0e8776820f70faaa8cd4c0c93578444e5cfe3720e0b232fa6d8","f49999f1d7327921e63097b4f90f437a0122361676b73a81f0ff2b681b1dd8de")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("5897e67e491a9d8143f6d45803bc8ac8","d91ffc6d48f79e0b55918fb73365b9fca37c9efa","91965ee08504eeb01e76e17007497852","0c1e1fd94383efc5a3de8f0117c154b2","85f8bfb3b859a35e342e35d7c35e8746","0c993a406be04b806222a130fb5a18e8","dfaa28a53310a43031e406ff927a6866","0c4540f659d3942a28f158bce7be1143","1d65ef16d1f161ae3faa5ed7896734cd","176d11c9bafac6153f728d8afb692f6f","5897e67e491a9d8143f6d45803bc8ac8","50eb199e188594a42262a5bbea260470","c89eaa7f40fc75f9a34e0f0a3b59b88b","0c1e1fd94383efc5a3de8f0117c154b2","640e6ecad629bd33c09ccec52f4aa6da","11010e139010697a94a8feb3704519f9","099c7d85d0d26a31469465d333329778","8b4c1f0ff1cee413f5f2999fa21f94f9","8148aeef6995c99c6f93ebce65b60bf57109914c45aa86d26a5cdc6ad8bba634","fd05e69d1f094b3a28bb5ae2a936607aa0db3866","3785d9c4bdf6812f753d93b70781d3db68141ce7","ff5e78218198dd5ca5dc2eb46ec8afdd1b6260e9","49307f1091251dd7a498cf69d0465ddd59859cf8","c694e99f8690114c77a6099856d61a3cd4cd814d","d1cc0f861f162dfbf9df1493fe861d02b80483f6","144493b13df06bab3f290b260b997b71164a25f7","ef0f61c32a3ae2494000f36a700a151c8b10c134","d91ffc6d48f79e0b55918fb73365b9fca37c9efa","af33573bc8e507875acdb3db52bcfea13bb1286e","f3c600ba1d1d0cb1f3383805dbcac19e9423bdcb","3785d9c4bdf6812f753d93b70781d3db68141ce7","584fd63ab925c532cf40818886487714b3de317e","52999153cc7d3a3771a8ee9b8e55f913829109a7","d25a68289fc1268d7c548787373a6235895716fb","97e19f67a8d6af78c181f05198aa7d200b243ea5","d7c1668c903a92f20bdeaee0f6e94b2ef3fefd700ca8daa4c4ff34a26f1323af","aee1bf1f7e70f5cbd34a59b312573a6c7e34b1e412e4518a55a5b14af2102063","a56003dc199224113e9c85b0edb2197d4a4af91b15e7d0710873e2ef848c3221","256d3065de2345a6beff9458ad0b519bed8363ac0b984247768bd788e633e371","4a5e9ab0e65e08ceb2adb2d150abb620684e98d79483b6c9f786c56c95fea573","37e259d6564071807b7b4266ed1dd8bf2059f3e7f438b8487dd0149e5e0487ec","0a5fb4a480b1748dc7f963a491a9aa32ff8c8fed01bea0cfd250a5ef01654eb3","ea9429fa66ba14b99ff756b8497ccbd3403437d4150eaed6c5c0fe4a3cdf78a8","8148aeef6995c99c6f93ebce65b60bf57109914c45aa86d26a5cdc6ad8bba634","0afeef5a4ac1b0bc778e66a1420587697dbfdb87d74a0b935db69b7d804089c4","98b5cfa14dd805e1172b36415c71730fa3454ffbaababc7d4c7b1fcfb47dfbd7","aee1bf1f7e70f5cbd34a59b312573a6c7e34b1e412e4518a55a5b14af2102063","add70042c65cd683925936aa04c79a8644e40dd93aa5ff1913bf533457daccf3","c2b769f40b1ec2ee57e4d36f545d6de93bbd54d2514347fb54cc20b1bfb9ca97","c3382ebff9dcd0e8776820f70faaa8cd4c0c93578444e5cfe3720e0b232fa6d8","f49999f1d7327921e63097b4f90f437a0122361676b73a81f0ff2b681b1dd8de")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("5897e67e491a9d8143f6d45803bc8ac8","d91ffc6d48f79e0b55918fb73365b9fca37c9efa","91965ee08504eeb01e76e17007497852","0c1e1fd94383efc5a3de8f0117c154b2","85f8bfb3b859a35e342e35d7c35e8746","0c993a406be04b806222a130fb5a18e8","dfaa28a53310a43031e406ff927a6866","0c4540f659d3942a28f158bce7be1143","1d65ef16d1f161ae3faa5ed7896734cd","176d11c9bafac6153f728d8afb692f6f","5897e67e491a9d8143f6d45803bc8ac8","50eb199e188594a42262a5bbea260470","c89eaa7f40fc75f9a34e0f0a3b59b88b","0c1e1fd94383efc5a3de8f0117c154b2","640e6ecad629bd33c09ccec52f4aa6da","11010e139010697a94a8feb3704519f9","099c7d85d0d26a31469465d333329778","8b4c1f0ff1cee413f5f2999fa21f94f9","8148aeef6995c99c6f93ebce65b60bf57109914c45aa86d26a5cdc6ad8bba634","fd05e69d1f094b3a28bb5ae2a936607aa0db3866","3785d9c4bdf6812f753d93b70781d3db68141ce7","ff5e78218198dd5ca5dc2eb46ec8afdd1b6260e9","49307f1091251dd7a498cf69d0465ddd59859cf8","c694e99f8690114c77a6099856d61a3cd4cd814d","d1cc0f861f162dfbf9df1493fe861d02b80483f6","144493b13df06bab3f290b260b997b71164a25f7","ef0f61c32a3ae2494000f36a700a151c8b10c134","d91ffc6d48f79e0b55918fb73365b9fca37c9efa","af33573bc8e507875acdb3db52bcfea13bb1286e","f3c600ba1d1d0cb1f3383805dbcac19e9423bdcb","3785d9c4bdf6812f753d93b70781d3db68141ce7","584fd63ab925c532cf40818886487714b3de317e","52999153cc7d3a3771a8ee9b8e55f913829109a7","d25a68289fc1268d7c548787373a6235895716fb","97e19f67a8d6af78c181f05198aa7d200b243ea5","d7c1668c903a92f20bdeaee0f6e94b2ef3fefd700ca8daa4c4ff34a26f1323af","aee1bf1f7e70f5cbd34a59b312573a6c7e34b1e412e4518a55a5b14af2102063","a56003dc199224113e9c85b0edb2197d4a4af91b15e7d0710873e2ef848c3221","256d3065de2345a6beff9458ad0b519bed8363ac0b984247768bd788e633e371","4a5e9ab0e65e08ceb2adb2d150abb620684e98d79483b6c9f786c56c95fea573","37e259d6564071807b7b4266ed1dd8bf2059f3e7f438b8487dd0149e5e0487ec","0a5fb4a480b1748dc7f963a491a9aa32ff8c8fed01bea0cfd250a5ef01654eb3","ea9429fa66ba14b99ff756b8497ccbd3403437d4150eaed6c5c0fe4a3cdf78a8","8148aeef6995c99c6f93ebce65b60bf57109914c45aa86d26a5cdc6ad8bba634","0afeef5a4ac1b0bc778e66a1420587697dbfdb87d74a0b935db69b7d804089c4","98b5cfa14dd805e1172b36415c71730fa3454ffbaababc7d4c7b1fcfb47dfbd7","aee1bf1f7e70f5cbd34a59b312573a6c7e34b1e412e4518a55a5b14af2102063","add70042c65cd683925936aa04c79a8644e40dd93aa5ff1913bf533457daccf3","c2b769f40b1ec2ee57e4d36f545d6de93bbd54d2514347fb54cc20b1bfb9ca97","c3382ebff9dcd0e8776820f70faaa8cd4c0c93578444e5cfe3720e0b232fa6d8","f49999f1d7327921e63097b4f90f437a0122361676b73a81f0ff2b681b1dd8de")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("5897e67e491a9d8143f6d45803bc8ac8","d91ffc6d48f79e0b55918fb73365b9fca37c9efa","91965ee08504eeb01e76e17007497852","0c1e1fd94383efc5a3de8f0117c154b2","85f8bfb3b859a35e342e35d7c35e8746","0c993a406be04b806222a130fb5a18e8","dfaa28a53310a43031e406ff927a6866","0c4540f659d3942a28f158bce7be1143","1d65ef16d1f161ae3faa5ed7896734cd","176d11c9bafac6153f728d8afb692f6f","5897e67e491a9d8143f6d45803bc8ac8","50eb199e188594a42262a5bbea260470","c89eaa7f40fc75f9a34e0f0a3b59b88b","0c1e1fd94383efc5a3de8f0117c154b2","640e6ecad629bd33c09ccec52f4aa6da","11010e139010697a94a8feb3704519f9","099c7d85d0d26a31469465d333329778","8b4c1f0ff1cee413f5f2999fa21f94f9","8148aeef6995c99c6f93ebce65b60bf57109914c45aa86d26a5cdc6ad8bba634","fd05e69d1f094b3a28bb5ae2a936607aa0db3866","3785d9c4bdf6812f753d93b70781d3db68141ce7","ff5e78218198dd5ca5dc2eb46ec8afdd1b6260e9","49307f1091251dd7a498cf69d0465ddd59859cf8","c694e99f8690114c77a6099856d61a3cd4cd814d","d1cc0f861f162dfbf9df1493fe861d02b80483f6","144493b13df06bab3f290b260b997b71164a25f7","ef0f61c32a3ae2494000f36a700a151c8b10c134","d91ffc6d48f79e0b55918fb73365b9fca37c9efa","af33573bc8e507875acdb3db52bcfea13bb1286e","f3c600ba1d1d0cb1f3383805dbcac19e9423bdcb","3785d9c4bdf6812f753d93b70781d3db68141ce7","584fd63ab925c532cf40818886487714b3de317e","52999153cc7d3a3771a8ee9b8e55f913829109a7","d25a68289fc1268d7c548787373a6235895716fb","97e19f67a8d6af78c181f05198aa7d200b243ea5","d7c1668c903a92f20bdeaee0f6e94b2ef3fefd700ca8daa4c4ff34a26f1323af","aee1bf1f7e70f5cbd34a59b312573a6c7e34b1e412e4518a55a5b14af2102063","a56003dc199224113e9c85b0edb2197d4a4af91b15e7d0710873e2ef848c3221","256d3065de2345a6beff9458ad0b519bed8363ac0b984247768bd788e633e371","4a5e9ab0e65e08ceb2adb2d150abb620684e98d79483b6c9f786c56c95fea573","37e259d6564071807b7b4266ed1dd8bf2059f3e7f438b8487dd0149e5e0487ec","0a5fb4a480b1748dc7f963a491a9aa32ff8c8fed01bea0cfd250a5ef01654eb3","ea9429fa66ba14b99ff756b8497ccbd3403437d4150eaed6c5c0fe4a3cdf78a8","8148aeef6995c99c6f93ebce65b60bf57109914c45aa86d26a5cdc6ad8bba634","0afeef5a4ac1b0bc778e66a1420587697dbfdb87d74a0b935db69b7d804089c4","98b5cfa14dd805e1172b36415c71730fa3454ffbaababc7d4c7b1fcfb47dfbd7","aee1bf1f7e70f5cbd34a59b312573a6c7e34b1e412e4518a55a5b14af2102063","add70042c65cd683925936aa04c79a8644e40dd93aa5ff1913bf533457daccf3","c2b769f40b1ec2ee57e4d36f545d6de93bbd54d2514347fb54cc20b1bfb9ca97","c3382ebff9dcd0e8776820f70faaa8cd4c0c93578444e5cfe3720e0b232fa6d8","f49999f1d7327921e63097b4f90f437a0122361676b73a81f0ff2b681b1dd8de")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("5897e67e491a9d8143f6d45803bc8ac8","d91ffc6d48f79e0b55918fb73365b9fca37c9efa","91965ee08504eeb01e76e17007497852","0c1e1fd94383efc5a3de8f0117c154b2","85f8bfb3b859a35e342e35d7c35e8746","0c993a406be04b806222a130fb5a18e8","dfaa28a53310a43031e406ff927a6866","0c4540f659d3942a28f158bce7be1143","1d65ef16d1f161ae3faa5ed7896734cd","176d11c9bafac6153f728d8afb692f6f","5897e67e491a9d8143f6d45803bc8ac8","50eb199e188594a42262a5bbea260470","c89eaa7f40fc75f9a34e0f0a3b59b88b","0c1e1fd94383efc5a3de8f0117c154b2","640e6ecad629bd33c09ccec52f4aa6da","11010e139010697a94a8feb3704519f9","099c7d85d0d26a31469465d333329778","8b4c1f0ff1cee413f5f2999fa21f94f9","8148aeef6995c99c6f93ebce65b60bf57109914c45aa86d26a5cdc6ad8bba634","fd05e69d1f094b3a28bb5ae2a936607aa0db3866","3785d9c4bdf6812f753d93b70781d3db68141ce7","ff5e78218198dd5ca5dc2eb46ec8afdd1b6260e9","49307f1091251dd7a498cf69d0465ddd59859cf8","c694e99f8690114c77a6099856d61a3cd4cd814d","d1cc0f861f162dfbf9df1493fe861d02b80483f6","144493b13df06bab3f290b260b997b71164a25f7","ef0f61c32a3ae2494000f36a700a151c8b10c134","d91ffc6d48f79e0b55918fb73365b9fca37c9efa","af33573bc8e507875acdb3db52bcfea13bb1286e","f3c600ba1d1d0cb1f3383805dbcac19e9423bdcb","3785d9c4bdf6812f753d93b70781d3db68141ce7","584fd63ab925c532cf40818886487714b3de317e","52999153cc7d3a3771a8ee9b8e55f913829109a7","d25a68289fc1268d7c548787373a6235895716fb","97e19f67a8d6af78c181f05198aa7d200b243ea5","d7c1668c903a92f20bdeaee0f6e94b2ef3fefd700ca8daa4c4ff34a26f1323af","aee1bf1f7e70f5cbd34a59b312573a6c7e34b1e412e4518a55a5b14af2102063","a56003dc199224113e9c85b0edb2197d4a4af91b15e7d0710873e2ef848c3221","256d3065de2345a6beff9458ad0b519bed8363ac0b984247768bd788e633e371","4a5e9ab0e65e08ceb2adb2d150abb620684e98d79483b6c9f786c56c95fea573","37e259d6564071807b7b4266ed1dd8bf2059f3e7f438b8487dd0149e5e0487ec","0a5fb4a480b1748dc7f963a491a9aa32ff8c8fed01bea0cfd250a5ef01654eb3","ea9429fa66ba14b99ff756b8497ccbd3403437d4150eaed6c5c0fe4a3cdf78a8","8148aeef6995c99c6f93ebce65b60bf57109914c45aa86d26a5cdc6ad8bba634","0afeef5a4ac1b0bc778e66a1420587697dbfdb87d74a0b935db69b7d804089c4","98b5cfa14dd805e1172b36415c71730fa3454ffbaababc7d4c7b1fcfb47dfbd7","aee1bf1f7e70f5cbd34a59b312573a6c7e34b1e412e4518a55a5b14af2102063","add70042c65cd683925936aa04c79a8644e40dd93aa5ff1913bf533457daccf3","c2b769f40b1ec2ee57e4d36f545d6de93bbd54d2514347fb54cc20b1bfb9ca97","c3382ebff9dcd0e8776820f70faaa8cd4c0c93578444e5cfe3720e0b232fa6d8","f49999f1d7327921e63097b4f90f437a0122361676b73a81f0ff2b681b1dd8de")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("5897e67e491a9d8143f6d45803bc8ac8","d91ffc6d48f79e0b55918fb73365b9fca37c9efa","91965ee08504eeb01e76e17007497852","0c1e1fd94383efc5a3de8f0117c154b2","85f8bfb3b859a35e342e35d7c35e8746","0c993a406be04b806222a130fb5a18e8","dfaa28a53310a43031e406ff927a6866","0c4540f659d3942a28f158bce7be1143","1d65ef16d1f161ae3faa5ed7896734cd","176d11c9bafac6153f728d8afb692f6f","5897e67e491a9d8143f6d45803bc8ac8","50eb199e188594a42262a5bbea260470","c89eaa7f40fc75f9a34e0f0a3b59b88b","0c1e1fd94383efc5a3de8f0117c154b2","640e6ecad629bd33c09ccec52f4aa6da","11010e139010697a94a8feb3704519f9","099c7d85d0d26a31469465d333329778","8b4c1f0ff1cee413f5f2999fa21f94f9","8148aeef6995c99c6f93ebce65b60bf57109914c45aa86d26a5cdc6ad8bba634","fd05e69d1f094b3a28bb5ae2a936607aa0db3866","3785d9c4bdf6812f753d93b70781d3db68141ce7","ff5e78218198dd5ca5dc2eb46ec8afdd1b6260e9","49307f1091251dd7a498cf69d0465ddd59859cf8","c694e99f8690114c77a6099856d61a3cd4cd814d","d1cc0f861f162dfbf9df1493fe861d02b80483f6","144493b13df06bab3f290b260b997b71164a25f7","ef0f61c32a3ae2494000f36a700a151c8b10c134","d91ffc6d48f79e0b55918fb73365b9fca37c9efa","af33573bc8e507875acdb3db52bcfea13bb1286e","f3c600ba1d1d0cb1f3383805dbcac19e9423bdcb","3785d9c4bdf6812f753d93b70781d3db68141ce7","584fd63ab925c532cf40818886487714b3de317e","52999153cc7d3a3771a8ee9b8e55f913829109a7","d25a68289fc1268d7c548787373a6235895716fb","97e19f67a8d6af78c181f05198aa7d200b243ea5","d7c1668c903a92f20bdeaee0f6e94b2ef3fefd700ca8daa4c4ff34a26f1323af","aee1bf1f7e70f5cbd34a59b312573a6c7e34b1e412e4518a55a5b14af2102063","a56003dc199224113e9c85b0edb2197d4a4af91b15e7d0710873e2ef848c3221","256d3065de2345a6beff9458ad0b519bed8363ac0b984247768bd788e633e371","4a5e9ab0e65e08ceb2adb2d150abb620684e98d79483b6c9f786c56c95fea573","37e259d6564071807b7b4266ed1dd8bf2059f3e7f438b8487dd0149e5e0487ec","0a5fb4a480b1748dc7f963a491a9aa32ff8c8fed01bea0cfd250a5ef01654eb3","ea9429fa66ba14b99ff756b8497ccbd3403437d4150eaed6c5c0fe4a3cdf78a8","8148aeef6995c99c6f93ebce65b60bf57109914c45aa86d26a5cdc6ad8bba634","0afeef5a4ac1b0bc778e66a1420587697dbfdb87d74a0b935db69b7d804089c4","98b5cfa14dd805e1172b36415c71730fa3454ffbaababc7d4c7b1fcfb47dfbd7","aee1bf1f7e70f5cbd34a59b312573a6c7e34b1e412e4518a55a5b14af2102063","add70042c65cd683925936aa04c79a8644e40dd93aa5ff1913bf533457daccf3","c2b769f40b1ec2ee57e4d36f545d6de93bbd54d2514347fb54cc20b1bfb9ca97","c3382ebff9dcd0e8776820f70faaa8cd4c0c93578444e5cfe3720e0b232fa6d8","f49999f1d7327921e63097b4f90f437a0122361676b73a81f0ff2b681b1dd8de")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("5897e67e491a9d8143f6d45803bc8ac8","d91ffc6d48f79e0b55918fb73365b9fca37c9efa","91965ee08504eeb01e76e17007497852","0c1e1fd94383efc5a3de8f0117c154b2","85f8bfb3b859a35e342e35d7c35e8746","0c993a406be04b806222a130fb5a18e8","dfaa28a53310a43031e406ff927a6866","0c4540f659d3942a28f158bce7be1143","1d65ef16d1f161ae3faa5ed7896734cd","176d11c9bafac6153f728d8afb692f6f","5897e67e491a9d8143f6d45803bc8ac8","50eb199e188594a42262a5bbea260470","c89eaa7f40fc75f9a34e0f0a3b59b88b","0c1e1fd94383efc5a3de8f0117c154b2","640e6ecad629bd33c09ccec52f4aa6da","11010e139010697a94a8feb3704519f9","099c7d85d0d26a31469465d333329778","8b4c1f0ff1cee413f5f2999fa21f94f9","8148aeef6995c99c6f93ebce65b60bf57109914c45aa86d26a5cdc6ad8bba634","fd05e69d1f094b3a28bb5ae2a936607aa0db3866","3785d9c4bdf6812f753d93b70781d3db68141ce7","ff5e78218198dd5ca5dc2eb46ec8afdd1b6260e9","49307f1091251dd7a498cf69d0465ddd59859cf8","c694e99f8690114c77a6099856d61a3cd4cd814d","d1cc0f861f162dfbf9df1493fe861d02b80483f6","144493b13df06bab3f290b260b997b71164a25f7","ef0f61c32a3ae2494000f36a700a151c8b10c134","d91ffc6d48f79e0b55918fb73365b9fca37c9efa","af33573bc8e507875acdb3db52bcfea13bb1286e","f3c600ba1d1d0cb1f3383805dbcac19e9423bdcb","3785d9c4bdf6812f753d93b70781d3db68141ce7","584fd63ab925c532cf40818886487714b3de317e","52999153cc7d3a3771a8ee9b8e55f913829109a7","d25a68289fc1268d7c548787373a6235895716fb","97e19f67a8d6af78c181f05198aa7d200b243ea5","d7c1668c903a92f20bdeaee0f6e94b2ef3fefd700ca8daa4c4ff34a26f1323af","aee1bf1f7e70f5cbd34a59b312573a6c7e34b1e412e4518a55a5b14af2102063","a56003dc199224113e9c85b0edb2197d4a4af91b15e7d0710873e2ef848c3221","256d3065de2345a6beff9458ad0b519bed8363ac0b984247768bd788e633e371","4a5e9ab0e65e08ceb2adb2d150abb620684e98d79483b6c9f786c56c95fea573","37e259d6564071807b7b4266ed1dd8bf2059f3e7f438b8487dd0149e5e0487ec","0a5fb4a480b1748dc7f963a491a9aa32ff8c8fed01bea0cfd250a5ef01654eb3","ea9429fa66ba14b99ff756b8497ccbd3403437d4150eaed6c5c0fe4a3cdf78a8","8148aeef6995c99c6f93ebce65b60bf57109914c45aa86d26a5cdc6ad8bba634","0afeef5a4ac1b0bc778e66a1420587697dbfdb87d74a0b935db69b7d804089c4","98b5cfa14dd805e1172b36415c71730fa3454ffbaababc7d4c7b1fcfb47dfbd7","aee1bf1f7e70f5cbd34a59b312573a6c7e34b1e412e4518a55a5b14af2102063","add70042c65cd683925936aa04c79a8644e40dd93aa5ff1913bf533457daccf3","c2b769f40b1ec2ee57e4d36f545d6de93bbd54d2514347fb54cc20b1bfb9ca97","c3382ebff9dcd0e8776820f70faaa8cd4c0c93578444e5cfe3720e0b232fa6d8","f49999f1d7327921e63097b4f90f437a0122361676b73a81f0ff2b681b1dd8de")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("5897e67e491a9d8143f6d45803bc8ac8","d91ffc6d48f79e0b55918fb73365b9fca37c9efa","91965ee08504eeb01e76e17007497852","0c1e1fd94383efc5a3de8f0117c154b2","85f8bfb3b859a35e342e35d7c35e8746","0c993a406be04b806222a130fb5a18e8","dfaa28a53310a43031e406ff927a6866","0c4540f659d3942a28f158bce7be1143","1d65ef16d1f161ae3faa5ed7896734cd","176d11c9bafac6153f728d8afb692f6f","5897e67e491a9d8143f6d45803bc8ac8","50eb199e188594a42262a5bbea260470","c89eaa7f40fc75f9a34e0f0a3b59b88b","0c1e1fd94383efc5a3de8f0117c154b2","640e6ecad629bd33c09ccec52f4aa6da","11010e139010697a94a8feb3704519f9","099c7d85d0d26a31469465d333329778","8b4c1f0ff1cee413f5f2999fa21f94f9","8148aeef6995c99c6f93ebce65b60bf57109914c45aa86d26a5cdc6ad8bba634","fd05e69d1f094b3a28bb5ae2a936607aa0db3866","3785d9c4bdf6812f753d93b70781d3db68141ce7","ff5e78218198dd5ca5dc2eb46ec8afdd1b6260e9","49307f1091251dd7a498cf69d0465ddd59859cf8","c694e99f8690114c77a6099856d61a3cd4cd814d","d1cc0f861f162dfbf9df1493fe861d02b80483f6","144493b13df06bab3f290b260b997b71164a25f7","ef0f61c32a3ae2494000f36a700a151c8b10c134","d91ffc6d48f79e0b55918fb73365b9fca37c9efa","af33573bc8e507875acdb3db52bcfea13bb1286e","f3c600ba1d1d0cb1f3383805dbcac19e9423bdcb","3785d9c4bdf6812f753d93b70781d3db68141ce7","584fd63ab925c532cf40818886487714b3de317e","52999153cc7d3a3771a8ee9b8e55f913829109a7","d25a68289fc1268d7c548787373a6235895716fb","97e19f67a8d6af78c181f05198aa7d200b243ea5","d7c1668c903a92f20bdeaee0f6e94b2ef3fefd700ca8daa4c4ff34a26f1323af","aee1bf1f7e70f5cbd34a59b312573a6c7e34b1e412e4518a55a5b14af2102063","a56003dc199224113e9c85b0edb2197d4a4af91b15e7d0710873e2ef848c3221","256d3065de2345a6beff9458ad0b519bed8363ac0b984247768bd788e633e371","4a5e9ab0e65e08ceb2adb2d150abb620684e98d79483b6c9f786c56c95fea573","37e259d6564071807b7b4266ed1dd8bf2059f3e7f438b8487dd0149e5e0487ec","0a5fb4a480b1748dc7f963a491a9aa32ff8c8fed01bea0cfd250a5ef01654eb3","ea9429fa66ba14b99ff756b8497ccbd3403437d4150eaed6c5c0fe4a3cdf78a8","8148aeef6995c99c6f93ebce65b60bf57109914c45aa86d26a5cdc6ad8bba634","0afeef5a4ac1b0bc778e66a1420587697dbfdb87d74a0b935db69b7d804089c4","98b5cfa14dd805e1172b36415c71730fa3454ffbaababc7d4c7b1fcfb47dfbd7","aee1bf1f7e70f5cbd34a59b312573a6c7e34b1e412e4518a55a5b14af2102063","add70042c65cd683925936aa04c79a8644e40dd93aa5ff1913bf533457daccf3","c2b769f40b1ec2ee57e4d36f545d6de93bbd54d2514347fb54cc20b1bfb9ca97","c3382ebff9dcd0e8776820f70faaa8cd4c0c93578444e5cfe3720e0b232fa6d8","f49999f1d7327921e63097b4f90f437a0122361676b73a81f0ff2b681b1dd8de")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("5897e67e491a9d8143f6d45803bc8ac8","d91ffc6d48f79e0b55918fb73365b9fca37c9efa","91965ee08504eeb01e76e17007497852","0c1e1fd94383efc5a3de8f0117c154b2","85f8bfb3b859a35e342e35d7c35e8746","0c993a406be04b806222a130fb5a18e8","dfaa28a53310a43031e406ff927a6866","0c4540f659d3942a28f158bce7be1143","1d65ef16d1f161ae3faa5ed7896734cd","176d11c9bafac6153f728d8afb692f6f","5897e67e491a9d8143f6d45803bc8ac8","50eb199e188594a42262a5bbea260470","c89eaa7f40fc75f9a34e0f0a3b59b88b","0c1e1fd94383efc5a3de8f0117c154b2","640e6ecad629bd33c09ccec52f4aa6da","11010e139010697a94a8feb3704519f9","099c7d85d0d26a31469465d333329778","8b4c1f0ff1cee413f5f2999fa21f94f9","8148aeef6995c99c6f93ebce65b60bf57109914c45aa86d26a5cdc6ad8bba634","fd05e69d1f094b3a28bb5ae2a936607aa0db3866","3785d9c4bdf6812f753d93b70781d3db68141ce7","ff5e78218198dd5ca5dc2eb46ec8afdd1b6260e9","49307f1091251dd7a498cf69d0465ddd59859cf8","c694e99f8690114c77a6099856d61a3cd4cd814d","d1cc0f861f162dfbf9df1493fe861d02b80483f6","144493b13df06bab3f290b260b997b71164a25f7","ef0f61c32a3ae2494000f36a700a151c8b10c134","d91ffc6d48f79e0b55918fb73365b9fca37c9efa","af33573bc8e507875acdb3db52bcfea13bb1286e","f3c600ba1d1d0cb1f3383805dbcac19e9423bdcb","3785d9c4bdf6812f753d93b70781d3db68141ce7","584fd63ab925c532cf40818886487714b3de317e","52999153cc7d3a3771a8ee9b8e55f913829109a7","d25a68289fc1268d7c548787373a6235895716fb","97e19f67a8d6af78c181f05198aa7d200b243ea5","d7c1668c903a92f20bdeaee0f6e94b2ef3fefd700ca8daa4c4ff34a26f1323af","aee1bf1f7e70f5cbd34a59b312573a6c7e34b1e412e4518a55a5b14af2102063","a56003dc199224113e9c85b0edb2197d4a4af91b15e7d0710873e2ef848c3221","256d3065de2345a6beff9458ad0b519bed8363ac0b984247768bd788e633e371","4a5e9ab0e65e08ceb2adb2d150abb620684e98d79483b6c9f786c56c95fea573","37e259d6564071807b7b4266ed1dd8bf2059f3e7f438b8487dd0149e5e0487ec","0a5fb4a480b1748dc7f963a491a9aa32ff8c8fed01bea0cfd250a5ef01654eb3","ea9429fa66ba14b99ff756b8497ccbd3403437d4150eaed6c5c0fe4a3cdf78a8","8148aeef6995c99c6f93ebce65b60bf57109914c45aa86d26a5cdc6ad8bba634","0afeef5a4ac1b0bc778e66a1420587697dbfdb87d74a0b935db69b7d804089c4","98b5cfa14dd805e1172b36415c71730fa3454ffbaababc7d4c7b1fcfb47dfbd7","aee1bf1f7e70f5cbd34a59b312573a6c7e34b1e412e4518a55a5b14af2102063","add70042c65cd683925936aa04c79a8644e40dd93aa5ff1913bf533457daccf3","c2b769f40b1ec2ee57e4d36f545d6de93bbd54d2514347fb54cc20b1bfb9ca97","c3382ebff9dcd0e8776820f70faaa8cd4c0c93578444e5cfe3720e0b232fa6d8","f49999f1d7327921e63097b4f90f437a0122361676b73a81f0ff2b681b1dd8de")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("5897e67e491a9d8143f6d45803bc8ac8","d91ffc6d48f79e0b55918fb73365b9fca37c9efa","91965ee08504eeb01e76e17007497852","0c1e1fd94383efc5a3de8f0117c154b2","85f8bfb3b859a35e342e35d7c35e8746","0c993a406be04b806222a130fb5a18e8","dfaa28a53310a43031e406ff927a6866","0c4540f659d3942a28f158bce7be1143","1d65ef16d1f161ae3faa5ed7896734cd","176d11c9bafac6153f728d8afb692f6f","5897e67e491a9d8143f6d45803bc8ac8","50eb199e188594a42262a5bbea260470","c89eaa7f40fc75f9a34e0f0a3b59b88b","0c1e1fd94383efc5a3de8f0117c154b2","640e6ecad629bd33c09ccec52f4aa6da","11010e139010697a94a8feb3704519f9","099c7d85d0d26a31469465d333329778","8b4c1f0ff1cee413f5f2999fa21f94f9","8148aeef6995c99c6f93ebce65b60bf57109914c45aa86d26a5cdc6ad8bba634","fd05e69d1f094b3a28bb5ae2a936607aa0db3866","3785d9c4bdf6812f753d93b70781d3db68141ce7","ff5e78218198dd5ca5dc2eb46ec8afdd1b6260e9","49307f1091251dd7a498cf69d0465ddd59859cf8","c694e99f8690114c77a6099856d61a3cd4cd814d","d1cc0f861f162dfbf9df1493fe861d02b80483f6","144493b13df06bab3f290b260b997b71164a25f7","ef0f61c32a3ae2494000f36a700a151c8b10c134","d91ffc6d48f79e0b55918fb73365b9fca37c9efa","af33573bc8e507875acdb3db52bcfea13bb1286e","f3c600ba1d1d0cb1f3383805dbcac19e9423bdcb","3785d9c4bdf6812f753d93b70781d3db68141ce7","584fd63ab925c532cf40818886487714b3de317e","52999153cc7d3a3771a8ee9b8e55f913829109a7","d25a68289fc1268d7c548787373a6235895716fb","97e19f67a8d6af78c181f05198aa7d200b243ea5","d7c1668c903a92f20bdeaee0f6e94b2ef3fefd700ca8daa4c4ff34a26f1323af","aee1bf1f7e70f5cbd34a59b312573a6c7e34b1e412e4518a55a5b14af2102063","a56003dc199224113e9c85b0edb2197d4a4af91b15e7d0710873e2ef848c3221","256d3065de2345a6beff9458ad0b519bed8363ac0b984247768bd788e633e371","4a5e9ab0e65e08ceb2adb2d150abb620684e98d79483b6c9f786c56c95fea573","37e259d6564071807b7b4266ed1dd8bf2059f3e7f438b8487dd0149e5e0487ec","0a5fb4a480b1748dc7f963a491a9aa32ff8c8fed01bea0cfd250a5ef01654eb3","ea9429fa66ba14b99ff756b8497ccbd3403437d4150eaed6c5c0fe4a3cdf78a8","8148aeef6995c99c6f93ebce65b60bf57109914c45aa86d26a5cdc6ad8bba634","0afeef5a4ac1b0bc778e66a1420587697dbfdb87d74a0b935db69b7d804089c4","98b5cfa14dd805e1172b36415c71730fa3454ffbaababc7d4c7b1fcfb47dfbd7","aee1bf1f7e70f5cbd34a59b312573a6c7e34b1e412e4518a55a5b14af2102063","add70042c65cd683925936aa04c79a8644e40dd93aa5ff1913bf533457daccf3","c2b769f40b1ec2ee57e4d36f545d6de93bbd54d2514347fb54cc20b1bfb9ca97","c3382ebff9dcd0e8776820f70faaa8cd4c0c93578444e5cfe3720e0b232fa6d8","f49999f1d7327921e63097b4f90f437a0122361676b73a81f0ff2b681b1dd8de")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("5897e67e491a9d8143f6d45803bc8ac8","d91ffc6d48f79e0b55918fb73365b9fca37c9efa","91965ee08504eeb01e76e17007497852","0c1e1fd94383efc5a3de8f0117c154b2","85f8bfb3b859a35e342e35d7c35e8746","0c993a406be04b806222a130fb5a18e8","dfaa28a53310a43031e406ff927a6866","0c4540f659d3942a28f158bce7be1143","1d65ef16d1f161ae3faa5ed7896734cd","176d11c9bafac6153f728d8afb692f6f","5897e67e491a9d8143f6d45803bc8ac8","50eb199e188594a42262a5bbea260470","c89eaa7f40fc75f9a34e0f0a3b59b88b","0c1e1fd94383efc5a3de8f0117c154b2","640e6ecad629bd33c09ccec52f4aa6da","11010e139010697a94a8feb3704519f9","099c7d85d0d26a31469465d333329778","8b4c1f0ff1cee413f5f2999fa21f94f9","8148aeef6995c99c6f93ebce65b60bf57109914c45aa86d26a5cdc6ad8bba634","fd05e69d1f094b3a28bb5ae2a936607aa0db3866","3785d9c4bdf6812f753d93b70781d3db68141ce7","ff5e78218198dd5ca5dc2eb46ec8afdd1b6260e9","49307f1091251dd7a498cf69d0465ddd59859cf8","c694e99f8690114c77a6099856d61a3cd4cd814d","d1cc0f861f162dfbf9df1493fe861d02b80483f6","144493b13df06bab3f290b260b997b71164a25f7","ef0f61c32a3ae2494000f36a700a151c8b10c134","d91ffc6d48f79e0b55918fb73365b9fca37c9efa","af33573bc8e507875acdb3db52bcfea13bb1286e","f3c600ba1d1d0cb1f3383805dbcac19e9423bdcb","3785d9c4bdf6812f753d93b70781d3db68141ce7","584fd63ab925c532cf40818886487714b3de317e","52999153cc7d3a3771a8ee9b8e55f913829109a7","d25a68289fc1268d7c548787373a6235895716fb","97e19f67a8d6af78c181f05198aa7d200b243ea5","d7c1668c903a92f20bdeaee0f6e94b2ef3fefd700ca8daa4c4ff34a26f1323af","aee1bf1f7e70f5cbd34a59b312573a6c7e34b1e412e4518a55a5b14af2102063","a56003dc199224113e9c85b0edb2197d4a4af91b15e7d0710873e2ef848c3221","256d3065de2345a6beff9458ad0b519bed8363ac0b984247768bd788e633e371","4a5e9ab0e65e08ceb2adb2d150abb620684e98d79483b6c9f786c56c95fea573","37e259d6564071807b7b4266ed1dd8bf2059f3e7f438b8487dd0149e5e0487ec","0a5fb4a480b1748dc7f963a491a9aa32ff8c8fed01bea0cfd250a5ef01654eb3","ea9429fa66ba14b99ff756b8497ccbd3403437d4150eaed6c5c0fe4a3cdf78a8","8148aeef6995c99c6f93ebce65b60bf57109914c45aa86d26a5cdc6ad8bba634","0afeef5a4ac1b0bc778e66a1420587697dbfdb87d74a0b935db69b7d804089c4","98b5cfa14dd805e1172b36415c71730fa3454ffbaababc7d4c7b1fcfb47dfbd7","aee1bf1f7e70f5cbd34a59b312573a6c7e34b1e412e4518a55a5b14af2102063","add70042c65cd683925936aa04c79a8644e40dd93aa5ff1913bf533457daccf3","c2b769f40b1ec2ee57e4d36f545d6de93bbd54d2514347fb54cc20b1bfb9ca97","c3382ebff9dcd0e8776820f70faaa8cd4c0c93578444e5cfe3720e0b232fa6d8","f49999f1d7327921e63097b4f90f437a0122361676b73a81f0ff2b681b1dd8de")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("5897e67e491a9d8143f6d45803bc8ac8","d91ffc6d48f79e0b55918fb73365b9fca37c9efa","91965ee08504eeb01e76e17007497852","0c1e1fd94383efc5a3de8f0117c154b2","85f8bfb3b859a35e342e35d7c35e8746","0c993a406be04b806222a130fb5a18e8","dfaa28a53310a43031e406ff927a6866","0c4540f659d3942a28f158bce7be1143","1d65ef16d1f161ae3faa5ed7896734cd","176d11c9bafac6153f728d8afb692f6f","5897e67e491a9d8143f6d45803bc8ac8","50eb199e188594a42262a5bbea260470","c89eaa7f40fc75f9a34e0f0a3b59b88b","0c1e1fd94383efc5a3de8f0117c154b2","640e6ecad629bd33c09ccec52f4aa6da","11010e139010697a94a8feb3704519f9","099c7d85d0d26a31469465d333329778","8b4c1f0ff1cee413f5f2999fa21f94f9","8148aeef6995c99c6f93ebce65b60bf57109914c45aa86d26a5cdc6ad8bba634","fd05e69d1f094b3a28bb5ae2a936607aa0db3866","3785d9c4bdf6812f753d93b70781d3db68141ce7","ff5e78218198dd5ca5dc2eb46ec8afdd1b6260e9","49307f1091251dd7a498cf69d0465ddd59859cf8","c694e99f8690114c77a6099856d61a3cd4cd814d","d1cc0f861f162dfbf9df1493fe861d02b80483f6","144493b13df06bab3f290b260b997b71164a25f7","ef0f61c32a3ae2494000f36a700a151c8b10c134","d91ffc6d48f79e0b55918fb73365b9fca37c9efa","af33573bc8e507875acdb3db52bcfea13bb1286e","f3c600ba1d1d0cb1f3383805dbcac19e9423bdcb","3785d9c4bdf6812f753d93b70781d3db68141ce7","584fd63ab925c532cf40818886487714b3de317e","52999153cc7d3a3771a8ee9b8e55f913829109a7","d25a68289fc1268d7c548787373a6235895716fb","97e19f67a8d6af78c181f05198aa7d200b243ea5","d7c1668c903a92f20bdeaee0f6e94b2ef3fefd700ca8daa4c4ff34a26f1323af","aee1bf1f7e70f5cbd34a59b312573a6c7e34b1e412e4518a55a5b14af2102063","a56003dc199224113e9c85b0edb2197d4a4af91b15e7d0710873e2ef848c3221","256d3065de2345a6beff9458ad0b519bed8363ac0b984247768bd788e633e371","4a5e9ab0e65e08ceb2adb2d150abb620684e98d79483b6c9f786c56c95fea573","37e259d6564071807b7b4266ed1dd8bf2059f3e7f438b8487dd0149e5e0487ec","0a5fb4a480b1748dc7f963a491a9aa32ff8c8fed01bea0cfd250a5ef01654eb3","ea9429fa66ba14b99ff756b8497ccbd3403437d4150eaed6c5c0fe4a3cdf78a8","8148aeef6995c99c6f93ebce65b60bf57109914c45aa86d26a5cdc6ad8bba634","0afeef5a4ac1b0bc778e66a1420587697dbfdb87d74a0b935db69b7d804089c4","98b5cfa14dd805e1172b36415c71730fa3454ffbaababc7d4c7b1fcfb47dfbd7","aee1bf1f7e70f5cbd34a59b312573a6c7e34b1e412e4518a55a5b14af2102063","add70042c65cd683925936aa04c79a8644e40dd93aa5ff1913bf533457daccf3","c2b769f40b1ec2ee57e4d36f545d6de93bbd54d2514347fb54cc20b1bfb9ca97","c3382ebff9dcd0e8776820f70faaa8cd4c0c93578444e5cfe3720e0b232fa6d8","f49999f1d7327921e63097b4f90f437a0122361676b73a81f0ff2b681b1dd8de")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("5897e67e491a9d8143f6d45803bc8ac8","d91ffc6d48f79e0b55918fb73365b9fca37c9efa","91965ee08504eeb01e76e17007497852","0c1e1fd94383efc5a3de8f0117c154b2","85f8bfb3b859a35e342e35d7c35e8746","0c993a406be04b806222a130fb5a18e8","dfaa28a53310a43031e406ff927a6866","0c4540f659d3942a28f158bce7be1143","1d65ef16d1f161ae3faa5ed7896734cd","176d11c9bafac6153f728d8afb692f6f","5897e67e491a9d8143f6d45803bc8ac8","50eb199e188594a42262a5bbea260470","c89eaa7f40fc75f9a34e0f0a3b59b88b","0c1e1fd94383efc5a3de8f0117c154b2","640e6ecad629bd33c09ccec52f4aa6da","11010e139010697a94a8feb3704519f9","099c7d85d0d26a31469465d333329778","8b4c1f0ff1cee413f5f2999fa21f94f9","8148aeef6995c99c6f93ebce65b60bf57109914c45aa86d26a5cdc6ad8bba634","fd05e69d1f094b3a28bb5ae2a936607aa0db3866","3785d9c4bdf6812f753d93b70781d3db68141ce7","ff5e78218198dd5ca5dc2eb46ec8afdd1b6260e9","49307f1091251dd7a498cf69d0465ddd59859cf8","c694e99f8690114c77a6099856d61a3cd4cd814d","d1cc0f861f162dfbf9df1493fe861d02b80483f6","144493b13df06bab3f290b260b997b71164a25f7","ef0f61c32a3ae2494000f36a700a151c8b10c134","d91ffc6d48f79e0b55918fb73365b9fca37c9efa","af33573bc8e507875acdb3db52bcfea13bb1286e","f3c600ba1d1d0cb1f3383805dbcac19e9423bdcb","3785d9c4bdf6812f753d93b70781d3db68141ce7","584fd63ab925c532cf40818886487714b3de317e","52999153cc7d3a3771a8ee9b8e55f913829109a7","d25a68289fc1268d7c548787373a6235895716fb","97e19f67a8d6af78c181f05198aa7d200b243ea5","d7c1668c903a92f20bdeaee0f6e94b2ef3fefd700ca8daa4c4ff34a26f1323af","aee1bf1f7e70f5cbd34a59b312573a6c7e34b1e412e4518a55a5b14af2102063","a56003dc199224113e9c85b0edb2197d4a4af91b15e7d0710873e2ef848c3221","256d3065de2345a6beff9458ad0b519bed8363ac0b984247768bd788e633e371","4a5e9ab0e65e08ceb2adb2d150abb620684e98d79483b6c9f786c56c95fea573","37e259d6564071807b7b4266ed1dd8bf2059f3e7f438b8487dd0149e5e0487ec","0a5fb4a480b1748dc7f963a491a9aa32ff8c8fed01bea0cfd250a5ef01654eb3","ea9429fa66ba14b99ff756b8497ccbd3403437d4150eaed6c5c0fe4a3cdf78a8","8148aeef6995c99c6f93ebce65b60bf57109914c45aa86d26a5cdc6ad8bba634","0afeef5a4ac1b0bc778e66a1420587697dbfdb87d74a0b935db69b7d804089c4","98b5cfa14dd805e1172b36415c71730fa3454ffbaababc7d4c7b1fcfb47dfbd7","aee1bf1f7e70f5cbd34a59b312573a6c7e34b1e412e4518a55a5b14af2102063","add70042c65cd683925936aa04c79a8644e40dd93aa5ff1913bf533457daccf3","c2b769f40b1ec2ee57e4d36f545d6de93bbd54d2514347fb54cc20b1bfb9ca97","c3382ebff9dcd0e8776820f70faaa8cd4c0c93578444e5cfe3720e0b232fa6d8","f49999f1d7327921e63097b4f90f437a0122361676b73a81f0ff2b681b1dd8de")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("5897e67e491a9d8143f6d45803bc8ac8","d91ffc6d48f79e0b55918fb73365b9fca37c9efa","91965ee08504eeb01e76e17007497852","0c1e1fd94383efc5a3de8f0117c154b2","85f8bfb3b859a35e342e35d7c35e8746","0c993a406be04b806222a130fb5a18e8","dfaa28a53310a43031e406ff927a6866","0c4540f659d3942a28f158bce7be1143","1d65ef16d1f161ae3faa5ed7896734cd","176d11c9bafac6153f728d8afb692f6f","5897e67e491a9d8143f6d45803bc8ac8","50eb199e188594a42262a5bbea260470","c89eaa7f40fc75f9a34e0f0a3b59b88b","0c1e1fd94383efc5a3de8f0117c154b2","640e6ecad629bd33c09ccec52f4aa6da","11010e139010697a94a8feb3704519f9","099c7d85d0d26a31469465d333329778","8b4c1f0ff1cee413f5f2999fa21f94f9","8148aeef6995c99c6f93ebce65b60bf57109914c45aa86d26a5cdc6ad8bba634","fd05e69d1f094b3a28bb5ae2a936607aa0db3866","3785d9c4bdf6812f753d93b70781d3db68141ce7","ff5e78218198dd5ca5dc2eb46ec8afdd1b6260e9","49307f1091251dd7a498cf69d0465ddd59859cf8","c694e99f8690114c77a6099856d61a3cd4cd814d","d1cc0f861f162dfbf9df1493fe861d02b80483f6","144493b13df06bab3f290b260b997b71164a25f7","ef0f61c32a3ae2494000f36a700a151c8b10c134","d91ffc6d48f79e0b55918fb73365b9fca37c9efa","af33573bc8e507875acdb3db52bcfea13bb1286e","f3c600ba1d1d0cb1f3383805dbcac19e9423bdcb","3785d9c4bdf6812f753d93b70781d3db68141ce7","584fd63ab925c532cf40818886487714b3de317e","52999153cc7d3a3771a8ee9b8e55f913829109a7","d25a68289fc1268d7c548787373a6235895716fb","97e19f67a8d6af78c181f05198aa7d200b243ea5","d7c1668c903a92f20bdeaee0f6e94b2ef3fefd700ca8daa4c4ff34a26f1323af","aee1bf1f7e70f5cbd34a59b312573a6c7e34b1e412e4518a55a5b14af2102063","a56003dc199224113e9c85b0edb2197d4a4af91b15e7d0710873e2ef848c3221","256d3065de2345a6beff9458ad0b519bed8363ac0b984247768bd788e633e371","4a5e9ab0e65e08ceb2adb2d150abb620684e98d79483b6c9f786c56c95fea573","37e259d6564071807b7b4266ed1dd8bf2059f3e7f438b8487dd0149e5e0487ec","0a5fb4a480b1748dc7f963a491a9aa32ff8c8fed01bea0cfd250a5ef01654eb3","ea9429fa66ba14b99ff756b8497ccbd3403437d4150eaed6c5c0fe4a3cdf78a8","8148aeef6995c99c6f93ebce65b60bf57109914c45aa86d26a5cdc6ad8bba634","0afeef5a4ac1b0bc778e66a1420587697dbfdb87d74a0b935db69b7d804089c4","98b5cfa14dd805e1172b36415c71730fa3454ffbaababc7d4c7b1fcfb47dfbd7","aee1bf1f7e70f5cbd34a59b312573a6c7e34b1e412e4518a55a5b14af2102063","add70042c65cd683925936aa04c79a8644e40dd93aa5ff1913bf533457daccf3","c2b769f40b1ec2ee57e4d36f545d6de93bbd54d2514347fb54cc20b1bfb9ca97","c3382ebff9dcd0e8776820f70faaa8cd4c0c93578444e5cfe3720e0b232fa6d8","f49999f1d7327921e63097b4f90f437a0122361676b73a81f0ff2b681b1dd8de")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("5897e67e491a9d8143f6d45803bc8ac8","d91ffc6d48f79e0b55918fb73365b9fca37c9efa","91965ee08504eeb01e76e17007497852","0c1e1fd94383efc5a3de8f0117c154b2","85f8bfb3b859a35e342e35d7c35e8746","0c993a406be04b806222a130fb5a18e8","dfaa28a53310a43031e406ff927a6866","0c4540f659d3942a28f158bce7be1143","1d65ef16d1f161ae3faa5ed7896734cd","176d11c9bafac6153f728d8afb692f6f","5897e67e491a9d8143f6d45803bc8ac8","50eb199e188594a42262a5bbea260470","c89eaa7f40fc75f9a34e0f0a3b59b88b","0c1e1fd94383efc5a3de8f0117c154b2","640e6ecad629bd33c09ccec52f4aa6da","11010e139010697a94a8feb3704519f9","099c7d85d0d26a31469465d333329778","8b4c1f0ff1cee413f5f2999fa21f94f9","8148aeef6995c99c6f93ebce65b60bf57109914c45aa86d26a5cdc6ad8bba634","fd05e69d1f094b3a28bb5ae2a936607aa0db3866","3785d9c4bdf6812f753d93b70781d3db68141ce7","ff5e78218198dd5ca5dc2eb46ec8afdd1b6260e9","49307f1091251dd7a498cf69d0465ddd59859cf8","c694e99f8690114c77a6099856d61a3cd4cd814d","d1cc0f861f162dfbf9df1493fe861d02b80483f6","144493b13df06bab3f290b260b997b71164a25f7","ef0f61c32a3ae2494000f36a700a151c8b10c134","d91ffc6d48f79e0b55918fb73365b9fca37c9efa","af33573bc8e507875acdb3db52bcfea13bb1286e","f3c600ba1d1d0cb1f3383805dbcac19e9423bdcb","3785d9c4bdf6812f753d93b70781d3db68141ce7","584fd63ab925c532cf40818886487714b3de317e","52999153cc7d3a3771a8ee9b8e55f913829109a7","d25a68289fc1268d7c548787373a6235895716fb","97e19f67a8d6af78c181f05198aa7d200b243ea5","d7c1668c903a92f20bdeaee0f6e94b2ef3fefd700ca8daa4c4ff34a26f1323af","aee1bf1f7e70f5cbd34a59b312573a6c7e34b1e412e4518a55a5b14af2102063","a56003dc199224113e9c85b0edb2197d4a4af91b15e7d0710873e2ef848c3221","256d3065de2345a6beff9458ad0b519bed8363ac0b984247768bd788e633e371","4a5e9ab0e65e08ceb2adb2d150abb620684e98d79483b6c9f786c56c95fea573","37e259d6564071807b7b4266ed1dd8bf2059f3e7f438b8487dd0149e5e0487ec","0a5fb4a480b1748dc7f963a491a9aa32ff8c8fed01bea0cfd250a5ef01654eb3","ea9429fa66ba14b99ff756b8497ccbd3403437d4150eaed6c5c0fe4a3cdf78a8","8148aeef6995c99c6f93ebce65b60bf57109914c45aa86d26a5cdc6ad8bba634","0afeef5a4ac1b0bc778e66a1420587697dbfdb87d74a0b935db69b7d804089c4","98b5cfa14dd805e1172b36415c71730fa3454ffbaababc7d4c7b1fcfb47dfbd7","aee1bf1f7e70f5cbd34a59b312573a6c7e34b1e412e4518a55a5b14af2102063","add70042c65cd683925936aa04c79a8644e40dd93aa5ff1913bf533457daccf3","c2b769f40b1ec2ee57e4d36f545d6de93bbd54d2514347fb54cc20b1bfb9ca97","c3382ebff9dcd0e8776820f70faaa8cd4c0c93578444e5cfe3720e0b232fa6d8","f49999f1d7327921e63097b4f90f437a0122361676b73a81f0ff2b681b1dd8de")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("5897e67e491a9d8143f6d45803bc8ac8","d91ffc6d48f79e0b55918fb73365b9fca37c9efa","91965ee08504eeb01e76e17007497852","0c1e1fd94383efc5a3de8f0117c154b2","85f8bfb3b859a35e342e35d7c35e8746","0c993a406be04b806222a130fb5a18e8","dfaa28a53310a43031e406ff927a6866","0c4540f659d3942a28f158bce7be1143","1d65ef16d1f161ae3faa5ed7896734cd","176d11c9bafac6153f728d8afb692f6f","5897e67e491a9d8143f6d45803bc8ac8","50eb199e188594a42262a5bbea260470","c89eaa7f40fc75f9a34e0f0a3b59b88b","0c1e1fd94383efc5a3de8f0117c154b2","640e6ecad629bd33c09ccec52f4aa6da","11010e139010697a94a8feb3704519f9","099c7d85d0d26a31469465d333329778","8b4c1f0ff1cee413f5f2999fa21f94f9","8148aeef6995c99c6f93ebce65b60bf57109914c45aa86d26a5cdc6ad8bba634","fd05e69d1f094b3a28bb5ae2a936607aa0db3866","3785d9c4bdf6812f753d93b70781d3db68141ce7","ff5e78218198dd5ca5dc2eb46ec8afdd1b6260e9","49307f1091251dd7a498cf69d0465ddd59859cf8","c694e99f8690114c77a6099856d61a3cd4cd814d","d1cc0f861f162dfbf9df1493fe861d02b80483f6","144493b13df06bab3f290b260b997b71164a25f7","ef0f61c32a3ae2494000f36a700a151c8b10c134","d91ffc6d48f79e0b55918fb73365b9fca37c9efa","af33573bc8e507875acdb3db52bcfea13bb1286e","f3c600ba1d1d0cb1f3383805dbcac19e9423bdcb","3785d9c4bdf6812f753d93b70781d3db68141ce7","584fd63ab925c532cf40818886487714b3de317e","52999153cc7d3a3771a8ee9b8e55f913829109a7","d25a68289fc1268d7c548787373a6235895716fb","97e19f67a8d6af78c181f05198aa7d200b243ea5","d7c1668c903a92f20bdeaee0f6e94b2ef3fefd700ca8daa4c4ff34a26f1323af","aee1bf1f7e70f5cbd34a59b312573a6c7e34b1e412e4518a55a5b14af2102063","a56003dc199224113e9c85b0edb2197d4a4af91b15e7d0710873e2ef848c3221","256d3065de2345a6beff9458ad0b519bed8363ac0b984247768bd788e633e371","4a5e9ab0e65e08ceb2adb2d150abb620684e98d79483b6c9f786c56c95fea573","37e259d6564071807b7b4266ed1dd8bf2059f3e7f438b8487dd0149e5e0487ec","0a5fb4a480b1748dc7f963a491a9aa32ff8c8fed01bea0cfd250a5ef01654eb3","ea9429fa66ba14b99ff756b8497ccbd3403437d4150eaed6c5c0fe4a3cdf78a8","8148aeef6995c99c6f93ebce65b60bf57109914c45aa86d26a5cdc6ad8bba634","0afeef5a4ac1b0bc778e66a1420587697dbfdb87d74a0b935db69b7d804089c4","98b5cfa14dd805e1172b36415c71730fa3454ffbaababc7d4c7b1fcfb47dfbd7","aee1bf1f7e70f5cbd34a59b312573a6c7e34b1e412e4518a55a5b14af2102063","add70042c65cd683925936aa04c79a8644e40dd93aa5ff1913bf533457daccf3","c2b769f40b1ec2ee57e4d36f545d6de93bbd54d2514347fb54cc20b1bfb9ca97","c3382ebff9dcd0e8776820f70faaa8cd4c0c93578444e5cfe3720e0b232fa6d8","f49999f1d7327921e63097b4f90f437a0122361676b73a81f0ff2b681b1dd8de")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("5897e67e491a9d8143f6d45803bc8ac8","d91ffc6d48f79e0b55918fb73365b9fca37c9efa","91965ee08504eeb01e76e17007497852","0c1e1fd94383efc5a3de8f0117c154b2","85f8bfb3b859a35e342e35d7c35e8746","0c993a406be04b806222a130fb5a18e8","dfaa28a53310a43031e406ff927a6866","0c4540f659d3942a28f158bce7be1143","1d65ef16d1f161ae3faa5ed7896734cd","176d11c9bafac6153f728d8afb692f6f","5897e67e491a9d8143f6d45803bc8ac8","50eb199e188594a42262a5bbea260470","c89eaa7f40fc75f9a34e0f0a3b59b88b","0c1e1fd94383efc5a3de8f0117c154b2","640e6ecad629bd33c09ccec52f4aa6da","11010e139010697a94a8feb3704519f9","099c7d85d0d26a31469465d333329778","8b4c1f0ff1cee413f5f2999fa21f94f9","8148aeef6995c99c6f93ebce65b60bf57109914c45aa86d26a5cdc6ad8bba634","fd05e69d1f094b3a28bb5ae2a936607aa0db3866","3785d9c4bdf6812f753d93b70781d3db68141ce7","ff5e78218198dd5ca5dc2eb46ec8afdd1b6260e9","49307f1091251dd7a498cf69d0465ddd59859cf8","c694e99f8690114c77a6099856d61a3cd4cd814d","d1cc0f861f162dfbf9df1493fe861d02b80483f6","144493b13df06bab3f290b260b997b71164a25f7","ef0f61c32a3ae2494000f36a700a151c8b10c134","d91ffc6d48f79e0b55918fb73365b9fca37c9efa","af33573bc8e507875acdb3db52bcfea13bb1286e","f3c600ba1d1d0cb1f3383805dbcac19e9423bdcb","3785d9c4bdf6812f753d93b70781d3db68141ce7","584fd63ab925c532cf40818886487714b3de317e","52999153cc7d3a3771a8ee9b8e55f913829109a7","d25a68289fc1268d7c548787373a6235895716fb","97e19f67a8d6af78c181f05198aa7d200b243ea5","d7c1668c903a92f20bdeaee0f6e94b2ef3fefd700ca8daa4c4ff34a26f1323af","aee1bf1f7e70f5cbd34a59b312573a6c7e34b1e412e4518a55a5b14af2102063","a56003dc199224113e9c85b0edb2197d4a4af91b15e7d0710873e2ef848c3221","256d3065de2345a6beff9458ad0b519bed8363ac0b984247768bd788e633e371","4a5e9ab0e65e08ceb2adb2d150abb620684e98d79483b6c9f786c56c95fea573","37e259d6564071807b7b4266ed1dd8bf2059f3e7f438b8487dd0149e5e0487ec","0a5fb4a480b1748dc7f963a491a9aa32ff8c8fed01bea0cfd250a5ef01654eb3","ea9429fa66ba14b99ff756b8497ccbd3403437d4150eaed6c5c0fe4a3cdf78a8","8148aeef6995c99c6f93ebce65b60bf57109914c45aa86d26a5cdc6ad8bba634","0afeef5a4ac1b0bc778e66a1420587697dbfdb87d74a0b935db69b7d804089c4","98b5cfa14dd805e1172b36415c71730fa3454ffbaababc7d4c7b1fcfb47dfbd7","aee1bf1f7e70f5cbd34a59b312573a6c7e34b1e412e4518a55a5b14af2102063","add70042c65cd683925936aa04c79a8644e40dd93aa5ff1913bf533457daccf3","c2b769f40b1ec2ee57e4d36f545d6de93bbd54d2514347fb54cc20b1bfb9ca97","c3382ebff9dcd0e8776820f70faaa8cd4c0c93578444e5cfe3720e0b232fa6d8","f49999f1d7327921e63097b4f90f437a0122361676b73a81f0ff2b681b1dd8de")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("5897e67e491a9d8143f6d45803bc8ac8","d91ffc6d48f79e0b55918fb73365b9fca37c9efa","91965ee08504eeb01e76e17007497852","0c1e1fd94383efc5a3de8f0117c154b2","85f8bfb3b859a35e342e35d7c35e8746","0c993a406be04b806222a130fb5a18e8","dfaa28a53310a43031e406ff927a6866","0c4540f659d3942a28f158bce7be1143","1d65ef16d1f161ae3faa5ed7896734cd","176d11c9bafac6153f728d8afb692f6f","5897e67e491a9d8143f6d45803bc8ac8","50eb199e188594a42262a5bbea260470","c89eaa7f40fc75f9a34e0f0a3b59b88b","0c1e1fd94383efc5a3de8f0117c154b2","640e6ecad629bd33c09ccec52f4aa6da","11010e139010697a94a8feb3704519f9","099c7d85d0d26a31469465d333329778","8b4c1f0ff1cee413f5f2999fa21f94f9","8148aeef6995c99c6f93ebce65b60bf57109914c45aa86d26a5cdc6ad8bba634","fd05e69d1f094b3a28bb5ae2a936607aa0db3866","3785d9c4bdf6812f753d93b70781d3db68141ce7","ff5e78218198dd5ca5dc2eb46ec8afdd1b6260e9","49307f1091251dd7a498cf69d0465ddd59859cf8","c694e99f8690114c77a6099856d61a3cd4cd814d","d1cc0f861f162dfbf9df1493fe861d02b80483f6","144493b13df06bab3f290b260b997b71164a25f7","ef0f61c32a3ae2494000f36a700a151c8b10c134","d91ffc6d48f79e0b55918fb73365b9fca37c9efa","af33573bc8e507875acdb3db52bcfea13bb1286e","f3c600ba1d1d0cb1f3383805dbcac19e9423bdcb","3785d9c4bdf6812f753d93b70781d3db68141ce7","584fd63ab925c532cf40818886487714b3de317e","52999153cc7d3a3771a8ee9b8e55f913829109a7","d25a68289fc1268d7c548787373a6235895716fb","97e19f67a8d6af78c181f05198aa7d200b243ea5","d7c1668c903a92f20bdeaee0f6e94b2ef3fefd700ca8daa4c4ff34a26f1323af","aee1bf1f7e70f5cbd34a59b312573a6c7e34b1e412e4518a55a5b14af2102063","a56003dc199224113e9c85b0edb2197d4a4af91b15e7d0710873e2ef848c3221","256d3065de2345a6beff9458ad0b519bed8363ac0b984247768bd788e633e371","4a5e9ab0e65e08ceb2adb2d150abb620684e98d79483b6c9f786c56c95fea573","37e259d6564071807b7b4266ed1dd8bf2059f3e7f438b8487dd0149e5e0487ec","0a5fb4a480b1748dc7f963a491a9aa32ff8c8fed01bea0cfd250a5ef01654eb3","ea9429fa66ba14b99ff756b8497ccbd3403437d4150eaed6c5c0fe4a3cdf78a8","8148aeef6995c99c6f93ebce65b60bf57109914c45aa86d26a5cdc6ad8bba634","0afeef5a4ac1b0bc778e66a1420587697dbfdb87d74a0b935db69b7d804089c4","98b5cfa14dd805e1172b36415c71730fa3454ffbaababc7d4c7b1fcfb47dfbd7","aee1bf1f7e70f5cbd34a59b312573a6c7e34b1e412e4518a55a5b14af2102063","add70042c65cd683925936aa04c79a8644e40dd93aa5ff1913bf533457daccf3","c2b769f40b1ec2ee57e4d36f545d6de93bbd54d2514347fb54cc20b1bfb9ca97","c3382ebff9dcd0e8776820f70faaa8cd4c0c93578444e5cfe3720e0b232fa6d8","f49999f1d7327921e63097b4f90f437a0122361676b73a81f0ff2b681b1dd8de")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("5897e67e491a9d8143f6d45803bc8ac8","d91ffc6d48f79e0b55918fb73365b9fca37c9efa","91965ee08504eeb01e76e17007497852","0c1e1fd94383efc5a3de8f0117c154b2","85f8bfb3b859a35e342e35d7c35e8746","0c993a406be04b806222a130fb5a18e8","dfaa28a53310a43031e406ff927a6866","0c4540f659d3942a28f158bce7be1143","1d65ef16d1f161ae3faa5ed7896734cd","176d11c9bafac6153f728d8afb692f6f","5897e67e491a9d8143f6d45803bc8ac8","50eb199e188594a42262a5bbea260470","c89eaa7f40fc75f9a34e0f0a3b59b88b","0c1e1fd94383efc5a3de8f0117c154b2","640e6ecad629bd33c09ccec52f4aa6da","11010e139010697a94a8feb3704519f9","099c7d85d0d26a31469465d333329778","8b4c1f0ff1cee413f5f2999fa21f94f9","8148aeef6995c99c6f93ebce65b60bf57109914c45aa86d26a5cdc6ad8bba634","fd05e69d1f094b3a28bb5ae2a936607aa0db3866","3785d9c4bdf6812f753d93b70781d3db68141ce7","ff5e78218198dd5ca5dc2eb46ec8afdd1b6260e9","49307f1091251dd7a498cf69d0465ddd59859cf8","c694e99f8690114c77a6099856d61a3cd4cd814d","d1cc0f861f162dfbf9df1493fe861d02b80483f6","144493b13df06bab3f290b260b997b71164a25f7","ef0f61c32a3ae2494000f36a700a151c8b10c134","d91ffc6d48f79e0b55918fb73365b9fca37c9efa","af33573bc8e507875acdb3db52bcfea13bb1286e","f3c600ba1d1d0cb1f3383805dbcac19e9423bdcb","3785d9c4bdf6812f753d93b70781d3db68141ce7","584fd63ab925c532cf40818886487714b3de317e","52999153cc7d3a3771a8ee9b8e55f913829109a7","d25a68289fc1268d7c548787373a6235895716fb","97e19f67a8d6af78c181f05198aa7d200b243ea5","d7c1668c903a92f20bdeaee0f6e94b2ef3fefd700ca8daa4c4ff34a26f1323af","aee1bf1f7e70f5cbd34a59b312573a6c7e34b1e412e4518a55a5b14af2102063","a56003dc199224113e9c85b0edb2197d4a4af91b15e7d0710873e2ef848c3221","256d3065de2345a6beff9458ad0b519bed8363ac0b984247768bd788e633e371","4a5e9ab0e65e08ceb2adb2d150abb620684e98d79483b6c9f786c56c95fea573","37e259d6564071807b7b4266ed1dd8bf2059f3e7f438b8487dd0149e5e0487ec","0a5fb4a480b1748dc7f963a491a9aa32ff8c8fed01bea0cfd250a5ef01654eb3","ea9429fa66ba14b99ff756b8497ccbd3403437d4150eaed6c5c0fe4a3cdf78a8","8148aeef6995c99c6f93ebce65b60bf57109914c45aa86d26a5cdc6ad8bba634","0afeef5a4ac1b0bc778e66a1420587697dbfdb87d74a0b935db69b7d804089c4","98b5cfa14dd805e1172b36415c71730fa3454ffbaababc7d4c7b1fcfb47dfbd7","aee1bf1f7e70f5cbd34a59b312573a6c7e34b1e412e4518a55a5b14af2102063","add70042c65cd683925936aa04c79a8644e40dd93aa5ff1913bf533457daccf3","c2b769f40b1ec2ee57e4d36f545d6de93bbd54d2514347fb54cc20b1bfb9ca97","c3382ebff9dcd0e8776820f70faaa8cd4c0c93578444e5cfe3720e0b232fa6d8","f49999f1d7327921e63097b4f90f437a0122361676b73a81f0ff2b681b1dd8de")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("5897e67e491a9d8143f6d45803bc8ac8","d91ffc6d48f79e0b55918fb73365b9fca37c9efa","91965ee08504eeb01e76e17007497852","0c1e1fd94383efc5a3de8f0117c154b2","85f8bfb3b859a35e342e35d7c35e8746","0c993a406be04b806222a130fb5a18e8","dfaa28a53310a43031e406ff927a6866","0c4540f659d3942a28f158bce7be1143","1d65ef16d1f161ae3faa5ed7896734cd","176d11c9bafac6153f728d8afb692f6f","5897e67e491a9d8143f6d45803bc8ac8","50eb199e188594a42262a5bbea260470","c89eaa7f40fc75f9a34e0f0a3b59b88b","0c1e1fd94383efc5a3de8f0117c154b2","640e6ecad629bd33c09ccec52f4aa6da","11010e139010697a94a8feb3704519f9","099c7d85d0d26a31469465d333329778","8b4c1f0ff1cee413f5f2999fa21f94f9","8148aeef6995c99c6f93ebce65b60bf57109914c45aa86d26a5cdc6ad8bba634","fd05e69d1f094b3a28bb5ae2a936607aa0db3866","3785d9c4bdf6812f753d93b70781d3db68141ce7","ff5e78218198dd5ca5dc2eb46ec8afdd1b6260e9","49307f1091251dd7a498cf69d0465ddd59859cf8","c694e99f8690114c77a6099856d61a3cd4cd814d","d1cc0f861f162dfbf9df1493fe861d02b80483f6","144493b13df06bab3f290b260b997b71164a25f7","ef0f61c32a3ae2494000f36a700a151c8b10c134","d91ffc6d48f79e0b55918fb73365b9fca37c9efa","af33573bc8e507875acdb3db52bcfea13bb1286e","f3c600ba1d1d0cb1f3383805dbcac19e9423bdcb","3785d9c4bdf6812f753d93b70781d3db68141ce7","584fd63ab925c532cf40818886487714b3de317e","52999153cc7d3a3771a8ee9b8e55f913829109a7","d25a68289fc1268d7c548787373a6235895716fb","97e19f67a8d6af78c181f05198aa7d200b243ea5","d7c1668c903a92f20bdeaee0f6e94b2ef3fefd700ca8daa4c4ff34a26f1323af","aee1bf1f7e70f5cbd34a59b312573a6c7e34b1e412e4518a55a5b14af2102063","a56003dc199224113e9c85b0edb2197d4a4af91b15e7d0710873e2ef848c3221","256d3065de2345a6beff9458ad0b519bed8363ac0b984247768bd788e633e371","4a5e9ab0e65e08ceb2adb2d150abb620684e98d79483b6c9f786c56c95fea573","37e259d6564071807b7b4266ed1dd8bf2059f3e7f438b8487dd0149e5e0487ec","0a5fb4a480b1748dc7f963a491a9aa32ff8c8fed01bea0cfd250a5ef01654eb3","ea9429fa66ba14b99ff756b8497ccbd3403437d4150eaed6c5c0fe4a3cdf78a8","8148aeef6995c99c6f93ebce65b60bf57109914c45aa86d26a5cdc6ad8bba634","0afeef5a4ac1b0bc778e66a1420587697dbfdb87d74a0b935db69b7d804089c4","98b5cfa14dd805e1172b36415c71730fa3454ffbaababc7d4c7b1fcfb47dfbd7","aee1bf1f7e70f5cbd34a59b312573a6c7e34b1e412e4518a55a5b14af2102063","add70042c65cd683925936aa04c79a8644e40dd93aa5ff1913bf533457daccf3","c2b769f40b1ec2ee57e4d36f545d6de93bbd54d2514347fb54cc20b1bfb9ca97","c3382ebff9dcd0e8776820f70faaa8cd4c0c93578444e5cfe3720e0b232fa6d8","f49999f1d7327921e63097b4f90f437a0122361676b73a81f0ff2b681b1dd8de")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("5897e67e491a9d8143f6d45803bc8ac8","d91ffc6d48f79e0b55918fb73365b9fca37c9efa","91965ee08504eeb01e76e17007497852","0c1e1fd94383efc5a3de8f0117c154b2","85f8bfb3b859a35e342e35d7c35e8746","0c993a406be04b806222a130fb5a18e8","dfaa28a53310a43031e406ff927a6866","0c4540f659d3942a28f158bce7be1143","1d65ef16d1f161ae3faa5ed7896734cd","176d11c9bafac6153f728d8afb692f6f","5897e67e491a9d8143f6d45803bc8ac8","50eb199e188594a42262a5bbea260470","c89eaa7f40fc75f9a34e0f0a3b59b88b","0c1e1fd94383efc5a3de8f0117c154b2","640e6ecad629bd33c09ccec52f4aa6da","11010e139010697a94a8feb3704519f9","099c7d85d0d26a31469465d333329778","8b4c1f0ff1cee413f5f2999fa21f94f9","8148aeef6995c99c6f93ebce65b60bf57109914c45aa86d26a5cdc6ad8bba634","fd05e69d1f094b3a28bb5ae2a936607aa0db3866","3785d9c4bdf6812f753d93b70781d3db68141ce7","ff5e78218198dd5ca5dc2eb46ec8afdd1b6260e9","49307f1091251dd7a498cf69d0465ddd59859cf8","c694e99f8690114c77a6099856d61a3cd4cd814d","d1cc0f861f162dfbf9df1493fe861d02b80483f6","144493b13df06bab3f290b260b997b71164a25f7","ef0f61c32a3ae2494000f36a700a151c8b10c134","d91ffc6d48f79e0b55918fb73365b9fca37c9efa","af33573bc8e507875acdb3db52bcfea13bb1286e","f3c600ba1d1d0cb1f3383805dbcac19e9423bdcb","3785d9c4bdf6812f753d93b70781d3db68141ce7","584fd63ab925c532cf40818886487714b3de317e","52999153cc7d3a3771a8ee9b8e55f913829109a7","d25a68289fc1268d7c548787373a6235895716fb","97e19f67a8d6af78c181f05198aa7d200b243ea5","d7c1668c903a92f20bdeaee0f6e94b2ef3fefd700ca8daa4c4ff34a26f1323af","aee1bf1f7e70f5cbd34a59b312573a6c7e34b1e412e4518a55a5b14af2102063","a56003dc199224113e9c85b0edb2197d4a4af91b15e7d0710873e2ef848c3221","256d3065de2345a6beff9458ad0b519bed8363ac0b984247768bd788e633e371","4a5e9ab0e65e08ceb2adb2d150abb620684e98d79483b6c9f786c56c95fea573","37e259d6564071807b7b4266ed1dd8bf2059f3e7f438b8487dd0149e5e0487ec","0a5fb4a480b1748dc7f963a491a9aa32ff8c8fed01bea0cfd250a5ef01654eb3","ea9429fa66ba14b99ff756b8497ccbd3403437d4150eaed6c5c0fe4a3cdf78a8","8148aeef6995c99c6f93ebce65b60bf57109914c45aa86d26a5cdc6ad8bba634","0afeef5a4ac1b0bc778e66a1420587697dbfdb87d74a0b935db69b7d804089c4","98b5cfa14dd805e1172b36415c71730fa3454ffbaababc7d4c7b1fcfb47dfbd7","aee1bf1f7e70f5cbd34a59b312573a6c7e34b1e412e4518a55a5b14af2102063","add70042c65cd683925936aa04c79a8644e40dd93aa5ff1913bf533457daccf3","c2b769f40b1ec2ee57e4d36f545d6de93bbd54d2514347fb54cc20b1bfb9ca97","c3382ebff9dcd0e8776820f70faaa8cd4c0c93578444e5cfe3720e0b232fa6d8","f49999f1d7327921e63097b4f90f437a0122361676b73a81f0ff2b681b1dd8de")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("5897e67e491a9d8143f6d45803bc8ac8","d91ffc6d48f79e0b55918fb73365b9fca37c9efa","91965ee08504eeb01e76e17007497852","0c1e1fd94383efc5a3de8f0117c154b2","85f8bfb3b859a35e342e35d7c35e8746","0c993a406be04b806222a130fb5a18e8","dfaa28a53310a43031e406ff927a6866","0c4540f659d3942a28f158bce7be1143","1d65ef16d1f161ae3faa5ed7896734cd","176d11c9bafac6153f728d8afb692f6f","5897e67e491a9d8143f6d45803bc8ac8","50eb199e188594a42262a5bbea260470","c89eaa7f40fc75f9a34e0f0a3b59b88b","0c1e1fd94383efc5a3de8f0117c154b2","640e6ecad629bd33c09ccec52f4aa6da","11010e139010697a94a8feb3704519f9","099c7d85d0d26a31469465d333329778","8b4c1f0ff1cee413f5f2999fa21f94f9","8148aeef6995c99c6f93ebce65b60bf57109914c45aa86d26a5cdc6ad8bba634","fd05e69d1f094b3a28bb5ae2a936607aa0db3866","3785d9c4bdf6812f753d93b70781d3db68141ce7","ff5e78218198dd5ca5dc2eb46ec8afdd1b6260e9","49307f1091251dd7a498cf69d0465ddd59859cf8","c694e99f8690114c77a6099856d61a3cd4cd814d","d1cc0f861f162dfbf9df1493fe861d02b80483f6","144493b13df06bab3f290b260b997b71164a25f7","ef0f61c32a3ae2494000f36a700a151c8b10c134","d91ffc6d48f79e0b55918fb73365b9fca37c9efa","af33573bc8e507875acdb3db52bcfea13bb1286e","f3c600ba1d1d0cb1f3383805dbcac19e9423bdcb","3785d9c4bdf6812f753d93b70781d3db68141ce7","584fd63ab925c532cf40818886487714b3de317e","52999153cc7d3a3771a8ee9b8e55f913829109a7","d25a68289fc1268d7c548787373a6235895716fb","97e19f67a8d6af78c181f05198aa7d200b243ea5","d7c1668c903a92f20bdeaee0f6e94b2ef3fefd700ca8daa4c4ff34a26f1323af","aee1bf1f7e70f5cbd34a59b312573a6c7e34b1e412e4518a55a5b14af2102063","a56003dc199224113e9c85b0edb2197d4a4af91b15e7d0710873e2ef848c3221","256d3065de2345a6beff9458ad0b519bed8363ac0b984247768bd788e633e371","4a5e9ab0e65e08ceb2adb2d150abb620684e98d79483b6c9f786c56c95fea573","37e259d6564071807b7b4266ed1dd8bf2059f3e7f438b8487dd0149e5e0487ec","0a5fb4a480b1748dc7f963a491a9aa32ff8c8fed01bea0cfd250a5ef01654eb3","ea9429fa66ba14b99ff756b8497ccbd3403437d4150eaed6c5c0fe4a3cdf78a8","8148aeef6995c99c6f93ebce65b60bf57109914c45aa86d26a5cdc6ad8bba634","0afeef5a4ac1b0bc778e66a1420587697dbfdb87d74a0b935db69b7d804089c4","98b5cfa14dd805e1172b36415c71730fa3454ffbaababc7d4c7b1fcfb47dfbd7","aee1bf1f7e70f5cbd34a59b312573a6c7e34b1e412e4518a55a5b14af2102063","add70042c65cd683925936aa04c79a8644e40dd93aa5ff1913bf533457daccf3","c2b769f40b1ec2ee57e4d36f545d6de93bbd54d2514347fb54cc20b1bfb9ca97","c3382ebff9dcd0e8776820f70faaa8cd4c0c93578444e5cfe3720e0b232fa6d8","f49999f1d7327921e63097b4f90f437a0122361676b73a81f0ff2b681b1dd8de")
index=activity AND rg_functionality="Endpoint Management Systems" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "portal.super-encrypt.com" OR destinationhostname CONTAINS "super-encrypt.com" OR destinationhostname CONTAINS "portal.intranet-rsnet.com" OR destinationhostname CONTAINS "intranet-rsnet.com" OR destinationhostname CONTAINS "p1.offline-microsoft.com" OR destinationhostname CONTAINS "offline-microsoft.com" OR destinationhostname CONTAINS "cdn.microsoft-official.com" OR destinationhostname CONTAINS "microsoft-official.com" OR destinationhostname CONTAINS "ramblercloud.com" OR destinationhostname CONTAINS "yandexpro.net")
index=activity AND rg_functionality="Endpoint Management Systems" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "portal.super-encrypt.com" OR sourcentdomain CONTAINS "super-encrypt.com" OR sourcentdomain CONTAINS "portal.intranet-rsnet.com" OR sourcentdomain CONTAINS "intranet-rsnet.com" OR sourcentdomain CONTAINS "p1.offline-microsoft.com" OR sourcentdomain CONTAINS "offline-microsoft.com" OR sourcentdomain CONTAINS "cdn.microsoft-official.com" OR sourcentdomain CONTAINS "microsoft-official.com" OR sourcentdomain CONTAINS "ramblercloud.com" OR sourcentdomain CONTAINS "yandexpro.net")
index=activity AND rg_functionality="Endpoint Management Systems" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "portal.super-encrypt.com" OR sourcehostname CONTAINS "super-encrypt.com" OR sourcehostname CONTAINS "portal.intranet-rsnet.com" OR sourcehostname CONTAINS "intranet-rsnet.com" OR sourcehostname CONTAINS "p1.offline-microsoft.com" OR sourcehostname CONTAINS "offline-microsoft.com" OR sourcehostname CONTAINS "cdn.microsoft-official.com" OR sourcehostname CONTAINS "microsoft-official.com" OR sourcehostname CONTAINS "ramblercloud.com" OR sourcehostname CONTAINS "yandexpro.net")
index=activity AND rg_functionality="Endpoint Management Systems" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "portal.super-encrypt.com" OR destinationntdomain CONTAINS "super-encrypt.com" OR destinationntdomain CONTAINS "portal.intranet-rsnet.com" OR destinationntdomain CONTAINS "intranet-rsnet.com" OR destinationntdomain CONTAINS "p1.offline-microsoft.com" OR destinationntdomain CONTAINS "offline-microsoft.com" OR destinationntdomain CONTAINS "cdn.microsoft-official.com" OR destinationntdomain CONTAINS "microsoft-official.com" OR destinationntdomain CONTAINS "ramblercloud.com" OR destinationntdomain CONTAINS "yandexpro.net")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "portal.super-encrypt.com" OR destinationhostname CONTAINS "super-encrypt.com" OR destinationhostname CONTAINS "portal.intranet-rsnet.com" OR destinationhostname CONTAINS "intranet-rsnet.com" OR destinationhostname CONTAINS "p1.offline-microsoft.com" OR destinationhostname CONTAINS "offline-microsoft.com" OR destinationhostname CONTAINS "cdn.microsoft-official.com" OR destinationhostname CONTAINS "microsoft-official.com" OR destinationhostname CONTAINS "ramblercloud.com" OR destinationhostname CONTAINS "yandexpro.net")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "portal.super-encrypt.com" OR sourcentdomain CONTAINS "super-encrypt.com" OR sourcentdomain CONTAINS "portal.intranet-rsnet.com" OR sourcentdomain CONTAINS "intranet-rsnet.com" OR sourcentdomain CONTAINS "p1.offline-microsoft.com" OR sourcentdomain CONTAINS "offline-microsoft.com" OR sourcentdomain CONTAINS "cdn.microsoft-official.com" OR sourcentdomain CONTAINS "microsoft-official.com" OR sourcentdomain CONTAINS "ramblercloud.com" OR sourcentdomain CONTAINS "yandexpro.net")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "portal.super-encrypt.com" OR sourcehostname CONTAINS "super-encrypt.com" OR sourcehostname CONTAINS "portal.intranet-rsnet.com" OR sourcehostname CONTAINS "intranet-rsnet.com" OR sourcehostname CONTAINS "p1.offline-microsoft.com" OR sourcehostname CONTAINS "offline-microsoft.com" OR sourcehostname CONTAINS "cdn.microsoft-official.com" OR sourcehostname CONTAINS "microsoft-official.com" OR sourcehostname CONTAINS "ramblercloud.com" OR sourcehostname CONTAINS "yandexpro.net")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "portal.super-encrypt.com" OR destinationntdomain CONTAINS "super-encrypt.com" OR destinationntdomain CONTAINS "portal.intranet-rsnet.com" OR destinationntdomain CONTAINS "intranet-rsnet.com" OR destinationntdomain CONTAINS "p1.offline-microsoft.com" OR destinationntdomain CONTAINS "offline-microsoft.com" OR destinationntdomain CONTAINS "cdn.microsoft-official.com" OR destinationntdomain CONTAINS "microsoft-official.com" OR destinationntdomain CONTAINS "ramblercloud.com" OR destinationntdomain CONTAINS "yandexpro.net")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "portal.super-encrypt.com" OR destinationhostname CONTAINS "super-encrypt.com" OR destinationhostname CONTAINS "portal.intranet-rsnet.com" OR destinationhostname CONTAINS "intranet-rsnet.com" OR destinationhostname CONTAINS "p1.offline-microsoft.com" OR destinationhostname CONTAINS "offline-microsoft.com" OR destinationhostname CONTAINS "cdn.microsoft-official.com" OR destinationhostname CONTAINS "microsoft-official.com" OR destinationhostname CONTAINS "ramblercloud.com" OR destinationhostname CONTAINS "yandexpro.net")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "portal.super-encrypt.com" OR sourcentdomain CONTAINS "super-encrypt.com" OR sourcentdomain CONTAINS "portal.intranet-rsnet.com" OR sourcentdomain CONTAINS "intranet-rsnet.com" OR sourcentdomain CONTAINS "p1.offline-microsoft.com" OR sourcentdomain CONTAINS "offline-microsoft.com" OR sourcentdomain CONTAINS "cdn.microsoft-official.com" OR sourcentdomain CONTAINS "microsoft-official.com" OR sourcentdomain CONTAINS "ramblercloud.com" OR sourcentdomain CONTAINS "yandexpro.net")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "portal.super-encrypt.com" OR sourcehostname CONTAINS "super-encrypt.com" OR sourcehostname CONTAINS "portal.intranet-rsnet.com" OR sourcehostname CONTAINS "intranet-rsnet.com" OR sourcehostname CONTAINS "p1.offline-microsoft.com" OR sourcehostname CONTAINS "offline-microsoft.com" OR sourcehostname CONTAINS "cdn.microsoft-official.com" OR sourcehostname CONTAINS "microsoft-official.com" OR sourcehostname CONTAINS "ramblercloud.com" OR sourcehostname CONTAINS "yandexpro.net")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "portal.super-encrypt.com" OR destinationntdomain CONTAINS "super-encrypt.com" OR destinationntdomain CONTAINS "portal.intranet-rsnet.com" OR destinationntdomain CONTAINS "intranet-rsnet.com" OR destinationntdomain CONTAINS "p1.offline-microsoft.com" OR destinationntdomain CONTAINS "offline-microsoft.com" OR destinationntdomain CONTAINS "cdn.microsoft-official.com" OR destinationntdomain CONTAINS "microsoft-official.com" OR destinationntdomain CONTAINS "ramblercloud.com" OR destinationntdomain CONTAINS "yandexpro.net")
index=activity AND rg_functionality="Email / Email Security" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "portal.super-encrypt.com" OR destinationhostname CONTAINS "super-encrypt.com" OR destinationhostname CONTAINS "portal.intranet-rsnet.com" OR destinationhostname CONTAINS "intranet-rsnet.com" OR destinationhostname CONTAINS "p1.offline-microsoft.com" OR destinationhostname CONTAINS "offline-microsoft.com" OR destinationhostname CONTAINS "cdn.microsoft-official.com" OR destinationhostname CONTAINS "microsoft-official.com" OR destinationhostname CONTAINS "ramblercloud.com" OR destinationhostname CONTAINS "yandexpro.net")
index=activity AND rg_functionality="Email / Email Security" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "portal.super-encrypt.com" OR sourcentdomain CONTAINS "super-encrypt.com" OR sourcentdomain CONTAINS "portal.intranet-rsnet.com" OR sourcentdomain CONTAINS "intranet-rsnet.com" OR sourcentdomain CONTAINS "p1.offline-microsoft.com" OR sourcentdomain CONTAINS "offline-microsoft.com" OR sourcentdomain CONTAINS "cdn.microsoft-official.com" OR sourcentdomain CONTAINS "microsoft-official.com" OR sourcentdomain CONTAINS "ramblercloud.com" OR sourcentdomain CONTAINS "yandexpro.net")
index=activity AND rg_functionality="Email / Email Security" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "portal.super-encrypt.com" OR sourcehostname CONTAINS "super-encrypt.com" OR sourcehostname CONTAINS "portal.intranet-rsnet.com" OR sourcehostname CONTAINS "intranet-rsnet.com" OR sourcehostname CONTAINS "p1.offline-microsoft.com" OR sourcehostname CONTAINS "offline-microsoft.com" OR sourcehostname CONTAINS "cdn.microsoft-official.com" OR sourcehostname CONTAINS "microsoft-official.com" OR sourcehostname CONTAINS "ramblercloud.com" OR sourcehostname CONTAINS "yandexpro.net")
index=activity AND rg_functionality="Email / Email Security" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "portal.super-encrypt.com" OR destinationntdomain CONTAINS "super-encrypt.com" OR destinationntdomain CONTAINS "portal.intranet-rsnet.com" OR destinationntdomain CONTAINS "intranet-rsnet.com" OR destinationntdomain CONTAINS "p1.offline-microsoft.com" OR destinationntdomain CONTAINS "offline-microsoft.com" OR destinationntdomain CONTAINS "cdn.microsoft-official.com" OR destinationntdomain CONTAINS "microsoft-official.com" OR destinationntdomain CONTAINS "ramblercloud.com" OR destinationntdomain CONTAINS "yandexpro.net")
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "portal.super-encrypt.com" OR destinationhostname CONTAINS "super-encrypt.com" OR destinationhostname CONTAINS "portal.intranet-rsnet.com" OR destinationhostname CONTAINS "intranet-rsnet.com" OR destinationhostname CONTAINS "p1.offline-microsoft.com" OR destinationhostname CONTAINS "offline-microsoft.com" OR destinationhostname CONTAINS "cdn.microsoft-official.com" OR destinationhostname CONTAINS "microsoft-official.com" OR destinationhostname CONTAINS "ramblercloud.com" OR destinationhostname CONTAINS "yandexpro.net")
index=activity AND rg_functionality="Cloud Email / Email Security" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "portal.super-encrypt.com" OR sourcentdomain CONTAINS "super-encrypt.com" OR sourcentdomain CONTAINS "portal.intranet-rsnet.com" OR sourcentdomain CONTAINS "intranet-rsnet.com" OR sourcentdomain CONTAINS "p1.offline-microsoft.com" OR sourcentdomain CONTAINS "offline-microsoft.com" OR sourcentdomain CONTAINS "cdn.microsoft-official.com" OR sourcentdomain CONTAINS "microsoft-official.com" OR sourcentdomain CONTAINS "ramblercloud.com" OR sourcentdomain CONTAINS "yandexpro.net")
index=activity AND rg_functionality="Cloud Email / Email Security" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "portal.super-encrypt.com" OR sourcehostname CONTAINS "super-encrypt.com" OR sourcehostname CONTAINS "portal.intranet-rsnet.com" OR sourcehostname CONTAINS "intranet-rsnet.com" OR sourcehostname CONTAINS "p1.offline-microsoft.com" OR sourcehostname CONTAINS "offline-microsoft.com" OR sourcehostname CONTAINS "cdn.microsoft-official.com" OR sourcehostname CONTAINS "microsoft-official.com" OR sourcehostname CONTAINS "ramblercloud.com" OR sourcehostname CONTAINS "yandexpro.net")
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "portal.super-encrypt.com" OR destinationntdomain CONTAINS "super-encrypt.com" OR destinationntdomain CONTAINS "portal.intranet-rsnet.com" OR destinationntdomain CONTAINS "intranet-rsnet.com" OR destinationntdomain CONTAINS "p1.offline-microsoft.com" OR destinationntdomain CONTAINS "offline-microsoft.com" OR destinationntdomain CONTAINS "cdn.microsoft-official.com" OR destinationntdomain CONTAINS "microsoft-official.com" OR destinationntdomain CONTAINS "ramblercloud.com" OR destinationntdomain CONTAINS "yandexpro.net")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "portal.super-encrypt.com" OR destinationhostname CONTAINS "super-encrypt.com" OR destinationhostname CONTAINS "portal.intranet-rsnet.com" OR destinationhostname CONTAINS "intranet-rsnet.com" OR destinationhostname CONTAINS "p1.offline-microsoft.com" OR destinationhostname CONTAINS "offline-microsoft.com" OR destinationhostname CONTAINS "cdn.microsoft-official.com" OR destinationhostname CONTAINS "microsoft-official.com" OR destinationhostname CONTAINS "ramblercloud.com" OR destinationhostname CONTAINS "yandexpro.net")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "portal.super-encrypt.com" OR sourcentdomain CONTAINS "super-encrypt.com" OR sourcentdomain CONTAINS "portal.intranet-rsnet.com" OR sourcentdomain CONTAINS "intranet-rsnet.com" OR sourcentdomain CONTAINS "p1.offline-microsoft.com" OR sourcentdomain CONTAINS "offline-microsoft.com" OR sourcentdomain CONTAINS "cdn.microsoft-official.com" OR sourcentdomain CONTAINS "microsoft-official.com" OR sourcentdomain CONTAINS "ramblercloud.com" OR sourcentdomain CONTAINS "yandexpro.net")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "portal.super-encrypt.com" OR sourcehostname CONTAINS "super-encrypt.com" OR sourcehostname CONTAINS "portal.intranet-rsnet.com" OR sourcehostname CONTAINS "intranet-rsnet.com" OR sourcehostname CONTAINS "p1.offline-microsoft.com" OR sourcehostname CONTAINS "offline-microsoft.com" OR sourcehostname CONTAINS "cdn.microsoft-official.com" OR sourcehostname CONTAINS "microsoft-official.com" OR sourcehostname CONTAINS "ramblercloud.com" OR sourcehostname CONTAINS "yandexpro.net")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "portal.super-encrypt.com" OR destinationntdomain CONTAINS "super-encrypt.com" OR destinationntdomain CONTAINS "portal.intranet-rsnet.com" OR destinationntdomain CONTAINS "intranet-rsnet.com" OR destinationntdomain CONTAINS "p1.offline-microsoft.com" OR destinationntdomain CONTAINS "offline-microsoft.com" OR destinationntdomain CONTAINS "cdn.microsoft-official.com" OR destinationntdomain CONTAINS "microsoft-official.com" OR destinationntdomain CONTAINS "ramblercloud.com" OR destinationntdomain CONTAINS "yandexpro.net")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "portal.super-encrypt.com" OR destinationhostname CONTAINS "super-encrypt.com" OR destinationhostname CONTAINS "portal.intranet-rsnet.com" OR destinationhostname CONTAINS "intranet-rsnet.com" OR destinationhostname CONTAINS "p1.offline-microsoft.com" OR destinationhostname CONTAINS "offline-microsoft.com" OR destinationhostname CONTAINS "cdn.microsoft-official.com" OR destinationhostname CONTAINS "microsoft-official.com" OR destinationhostname CONTAINS "ramblercloud.com" OR destinationhostname CONTAINS "yandexpro.net")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "portal.super-encrypt.com" OR sourcentdomain CONTAINS "super-encrypt.com" OR sourcentdomain CONTAINS "portal.intranet-rsnet.com" OR sourcentdomain CONTAINS "intranet-rsnet.com" OR sourcentdomain CONTAINS "p1.offline-microsoft.com" OR sourcentdomain CONTAINS "offline-microsoft.com" OR sourcentdomain CONTAINS "cdn.microsoft-official.com" OR sourcentdomain CONTAINS "microsoft-official.com" OR sourcentdomain CONTAINS "ramblercloud.com" OR sourcentdomain CONTAINS "yandexpro.net")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "portal.super-encrypt.com" OR sourcehostname CONTAINS "super-encrypt.com" OR sourcehostname CONTAINS "portal.intranet-rsnet.com" OR sourcehostname CONTAINS "intranet-rsnet.com" OR sourcehostname CONTAINS "p1.offline-microsoft.com" OR sourcehostname CONTAINS "offline-microsoft.com" OR sourcehostname CONTAINS "cdn.microsoft-official.com" OR sourcehostname CONTAINS "microsoft-official.com" OR sourcehostname CONTAINS "ramblercloud.com" OR sourcehostname CONTAINS "yandexpro.net")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "portal.super-encrypt.com" OR destinationntdomain CONTAINS "super-encrypt.com" OR destinationntdomain CONTAINS "portal.intranet-rsnet.com" OR destinationntdomain CONTAINS "intranet-rsnet.com" OR destinationntdomain CONTAINS "p1.offline-microsoft.com" OR destinationntdomain CONTAINS "offline-microsoft.com" OR destinationntdomain CONTAINS "cdn.microsoft-official.com" OR destinationntdomain CONTAINS "microsoft-official.com" OR destinationntdomain CONTAINS "ramblercloud.com" OR destinationntdomain CONTAINS "yandexpro.net")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "portal.super-encrypt.com" OR destinationhostname CONTAINS "super-encrypt.com" OR destinationhostname CONTAINS "portal.intranet-rsnet.com" OR destinationhostname CONTAINS "intranet-rsnet.com" OR destinationhostname CONTAINS "p1.offline-microsoft.com" OR destinationhostname CONTAINS "offline-microsoft.com" OR destinationhostname CONTAINS "cdn.microsoft-official.com" OR destinationhostname CONTAINS "microsoft-official.com" OR destinationhostname CONTAINS "ramblercloud.com" OR destinationhostname CONTAINS "yandexpro.net")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "portal.super-encrypt.com" OR sourcentdomain CONTAINS "super-encrypt.com" OR sourcentdomain CONTAINS "portal.intranet-rsnet.com" OR sourcentdomain CONTAINS "intranet-rsnet.com" OR sourcentdomain CONTAINS "p1.offline-microsoft.com" OR sourcentdomain CONTAINS "offline-microsoft.com" OR sourcentdomain CONTAINS "cdn.microsoft-official.com" OR sourcentdomain CONTAINS "microsoft-official.com" OR sourcentdomain CONTAINS "ramblercloud.com" OR sourcentdomain CONTAINS "yandexpro.net")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "portal.super-encrypt.com" OR sourcehostname CONTAINS "super-encrypt.com" OR sourcehostname CONTAINS "portal.intranet-rsnet.com" OR sourcehostname CONTAINS "intranet-rsnet.com" OR sourcehostname CONTAINS "p1.offline-microsoft.com" OR sourcehostname CONTAINS "offline-microsoft.com" OR sourcehostname CONTAINS "cdn.microsoft-official.com" OR sourcehostname CONTAINS "microsoft-official.com" OR sourcehostname CONTAINS "ramblercloud.com" OR sourcehostname CONTAINS "yandexpro.net")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "portal.super-encrypt.com" OR destinationntdomain CONTAINS "super-encrypt.com" OR destinationntdomain CONTAINS "portal.intranet-rsnet.com" OR destinationntdomain CONTAINS "intranet-rsnet.com" OR destinationntdomain CONTAINS "p1.offline-microsoft.com" OR destinationntdomain CONTAINS "offline-microsoft.com" OR destinationntdomain CONTAINS "cdn.microsoft-official.com" OR destinationntdomain CONTAINS "microsoft-official.com" OR destinationntdomain CONTAINS "ramblercloud.com" OR destinationntdomain CONTAINS "yandexpro.net")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "portal.super-encrypt.com" OR destinationhostname CONTAINS "super-encrypt.com" OR destinationhostname CONTAINS "portal.intranet-rsnet.com" OR destinationhostname CONTAINS "intranet-rsnet.com" OR destinationhostname CONTAINS "p1.offline-microsoft.com" OR destinationhostname CONTAINS "offline-microsoft.com" OR destinationhostname CONTAINS "cdn.microsoft-official.com" OR destinationhostname CONTAINS "microsoft-official.com" OR destinationhostname CONTAINS "ramblercloud.com" OR destinationhostname CONTAINS "yandexpro.net")
index=activity AND rg_functionality="Next Generation Firewall" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "portal.super-encrypt.com" OR sourcentdomain CONTAINS "super-encrypt.com" OR sourcentdomain CONTAINS "portal.intranet-rsnet.com" OR sourcentdomain CONTAINS "intranet-rsnet.com" OR sourcentdomain CONTAINS "p1.offline-microsoft.com" OR sourcentdomain CONTAINS "offline-microsoft.com" OR sourcentdomain CONTAINS "cdn.microsoft-official.com" OR sourcentdomain CONTAINS "microsoft-official.com" OR sourcentdomain CONTAINS "ramblercloud.com" OR sourcentdomain CONTAINS "yandexpro.net")
index=activity AND rg_functionality="Next Generation Firewall" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "portal.super-encrypt.com" OR sourcehostname CONTAINS "super-encrypt.com" OR sourcehostname CONTAINS "portal.intranet-rsnet.com" OR sourcehostname CONTAINS "intranet-rsnet.com" OR sourcehostname CONTAINS "p1.offline-microsoft.com" OR sourcehostname CONTAINS "offline-microsoft.com" OR sourcehostname CONTAINS "cdn.microsoft-official.com" OR sourcehostname CONTAINS "microsoft-official.com" OR sourcehostname CONTAINS "ramblercloud.com" OR sourcehostname CONTAINS "yandexpro.net")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "portal.super-encrypt.com" OR destinationntdomain CONTAINS "super-encrypt.com" OR destinationntdomain CONTAINS "portal.intranet-rsnet.com" OR destinationntdomain CONTAINS "intranet-rsnet.com" OR destinationntdomain CONTAINS "p1.offline-microsoft.com" OR destinationntdomain CONTAINS "offline-microsoft.com" OR destinationntdomain CONTAINS "cdn.microsoft-official.com" OR destinationntdomain CONTAINS "microsoft-official.com" OR destinationntdomain CONTAINS "ramblercloud.com" OR destinationntdomain CONTAINS "yandexpro.net")
index=activity AND rg_functionality="Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "portal.super-encrypt.com" OR destinationhostname CONTAINS "super-encrypt.com" OR destinationhostname CONTAINS "portal.intranet-rsnet.com" OR destinationhostname CONTAINS "intranet-rsnet.com" OR destinationhostname CONTAINS "p1.offline-microsoft.com" OR destinationhostname CONTAINS "offline-microsoft.com" OR destinationhostname CONTAINS "cdn.microsoft-official.com" OR destinationhostname CONTAINS "microsoft-official.com" OR destinationhostname CONTAINS "ramblercloud.com" OR destinationhostname CONTAINS "yandexpro.net")
index=activity AND rg_functionality="Firewall" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "portal.super-encrypt.com" OR sourcentdomain CONTAINS "super-encrypt.com" OR sourcentdomain CONTAINS "portal.intranet-rsnet.com" OR sourcentdomain CONTAINS "intranet-rsnet.com" OR sourcentdomain CONTAINS "p1.offline-microsoft.com" OR sourcentdomain CONTAINS "offline-microsoft.com" OR sourcentdomain CONTAINS "cdn.microsoft-official.com" OR sourcentdomain CONTAINS "microsoft-official.com" OR sourcentdomain CONTAINS "ramblercloud.com" OR sourcentdomain CONTAINS "yandexpro.net")
index=activity AND rg_functionality="Firewall" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "portal.super-encrypt.com" OR sourcehostname CONTAINS "super-encrypt.com" OR sourcehostname CONTAINS "portal.intranet-rsnet.com" OR sourcehostname CONTAINS "intranet-rsnet.com" OR sourcehostname CONTAINS "p1.offline-microsoft.com" OR sourcehostname CONTAINS "offline-microsoft.com" OR sourcehostname CONTAINS "cdn.microsoft-official.com" OR sourcehostname CONTAINS "microsoft-official.com" OR sourcehostname CONTAINS "ramblercloud.com" OR sourcehostname CONTAINS "yandexpro.net")
index=activity AND rg_functionality="Firewall" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "portal.super-encrypt.com" OR destinationntdomain CONTAINS "super-encrypt.com" OR destinationntdomain CONTAINS "portal.intranet-rsnet.com" OR destinationntdomain CONTAINS "intranet-rsnet.com" OR destinationntdomain CONTAINS "p1.offline-microsoft.com" OR destinationntdomain CONTAINS "offline-microsoft.com" OR destinationntdomain CONTAINS "cdn.microsoft-official.com" OR destinationntdomain CONTAINS "microsoft-official.com" OR destinationntdomain CONTAINS "ramblercloud.com" OR destinationntdomain CONTAINS "yandexpro.net")
index=activity AND rg_functionality="Web Proxy" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "portal.super-encrypt.com" OR destinationhostname CONTAINS "super-encrypt.com" OR destinationhostname CONTAINS "portal.intranet-rsnet.com" OR destinationhostname CONTAINS "intranet-rsnet.com" OR destinationhostname CONTAINS "p1.offline-microsoft.com" OR destinationhostname CONTAINS "offline-microsoft.com" OR destinationhostname CONTAINS "cdn.microsoft-official.com" OR destinationhostname CONTAINS "microsoft-official.com" OR destinationhostname CONTAINS "ramblercloud.com" OR destinationhostname CONTAINS "yandexpro.net")
index=activity AND rg_functionality="Web Proxy" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "portal.super-encrypt.com" OR sourcentdomain CONTAINS "super-encrypt.com" OR sourcentdomain CONTAINS "portal.intranet-rsnet.com" OR sourcentdomain CONTAINS "intranet-rsnet.com" OR sourcentdomain CONTAINS "p1.offline-microsoft.com" OR sourcentdomain CONTAINS "offline-microsoft.com" OR sourcentdomain CONTAINS "cdn.microsoft-official.com" OR sourcentdomain CONTAINS "microsoft-official.com" OR sourcentdomain CONTAINS "ramblercloud.com" OR sourcentdomain CONTAINS "yandexpro.net")
index=activity AND rg_functionality="Web Proxy" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "portal.super-encrypt.com" OR sourcehostname CONTAINS "super-encrypt.com" OR sourcehostname CONTAINS "portal.intranet-rsnet.com" OR sourcehostname CONTAINS "intranet-rsnet.com" OR sourcehostname CONTAINS "p1.offline-microsoft.com" OR sourcehostname CONTAINS "offline-microsoft.com" OR sourcehostname CONTAINS "cdn.microsoft-official.com" OR sourcehostname CONTAINS "microsoft-official.com" OR sourcehostname CONTAINS "ramblercloud.com" OR sourcehostname CONTAINS "yandexpro.net")
index=activity AND rg_functionality="Web Proxy" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "portal.super-encrypt.com" OR destinationntdomain CONTAINS "super-encrypt.com" OR destinationntdomain CONTAINS "portal.intranet-rsnet.com" OR destinationntdomain CONTAINS "intranet-rsnet.com" OR destinationntdomain CONTAINS "p1.offline-microsoft.com" OR destinationntdomain CONTAINS "offline-microsoft.com" OR destinationntdomain CONTAINS "cdn.microsoft-official.com" OR destinationntdomain CONTAINS "microsoft-official.com" OR destinationntdomain CONTAINS "ramblercloud.com" OR destinationntdomain CONTAINS "yandexpro.net")
index=activity AND rg_functionality="Flow" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "portal.super-encrypt.com" OR destinationhostname CONTAINS "super-encrypt.com" OR destinationhostname CONTAINS "portal.intranet-rsnet.com" OR destinationhostname CONTAINS "intranet-rsnet.com" OR destinationhostname CONTAINS "p1.offline-microsoft.com" OR destinationhostname CONTAINS "offline-microsoft.com" OR destinationhostname CONTAINS "cdn.microsoft-official.com" OR destinationhostname CONTAINS "microsoft-official.com" OR destinationhostname CONTAINS "ramblercloud.com" OR destinationhostname CONTAINS "yandexpro.net")
index=activity AND rg_functionality="Flow" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "portal.super-encrypt.com" OR sourcentdomain CONTAINS "super-encrypt.com" OR sourcentdomain CONTAINS "portal.intranet-rsnet.com" OR sourcentdomain CONTAINS "intranet-rsnet.com" OR sourcentdomain CONTAINS "p1.offline-microsoft.com" OR sourcentdomain CONTAINS "offline-microsoft.com" OR sourcentdomain CONTAINS "cdn.microsoft-official.com" OR sourcentdomain CONTAINS "microsoft-official.com" OR sourcentdomain CONTAINS "ramblercloud.com" OR sourcentdomain CONTAINS "yandexpro.net")
index=activity AND rg_functionality="Flow" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "portal.super-encrypt.com" OR sourcehostname CONTAINS "super-encrypt.com" OR sourcehostname CONTAINS "portal.intranet-rsnet.com" OR sourcehostname CONTAINS "intranet-rsnet.com" OR sourcehostname CONTAINS "p1.offline-microsoft.com" OR sourcehostname CONTAINS "offline-microsoft.com" OR sourcehostname CONTAINS "cdn.microsoft-official.com" OR sourcehostname CONTAINS "microsoft-official.com" OR sourcehostname CONTAINS "ramblercloud.com" OR sourcehostname CONTAINS "yandexpro.net")
index=activity AND rg_functionality="Flow" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "portal.super-encrypt.com" OR destinationntdomain CONTAINS "super-encrypt.com" OR destinationntdomain CONTAINS "portal.intranet-rsnet.com" OR destinationntdomain CONTAINS "intranet-rsnet.com" OR destinationntdomain CONTAINS "p1.offline-microsoft.com" OR destinationntdomain CONTAINS "offline-microsoft.com" OR destinationntdomain CONTAINS "cdn.microsoft-official.com" OR destinationntdomain CONTAINS "microsoft-official.com" OR destinationntdomain CONTAINS "ramblercloud.com" OR destinationntdomain CONTAINS "yandexpro.net")
index=activity AND rg_functionality="Web Server" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "portal.super-encrypt.com" OR destinationhostname CONTAINS "super-encrypt.com" OR destinationhostname CONTAINS "portal.intranet-rsnet.com" OR destinationhostname CONTAINS "intranet-rsnet.com" OR destinationhostname CONTAINS "p1.offline-microsoft.com" OR destinationhostname CONTAINS "offline-microsoft.com" OR destinationhostname CONTAINS "cdn.microsoft-official.com" OR destinationhostname CONTAINS "microsoft-official.com" OR destinationhostname CONTAINS "ramblercloud.com" OR destinationhostname CONTAINS "yandexpro.net")
index=activity AND rg_functionality="Web Server" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "portal.super-encrypt.com" OR sourcentdomain CONTAINS "super-encrypt.com" OR sourcentdomain CONTAINS "portal.intranet-rsnet.com" OR sourcentdomain CONTAINS "intranet-rsnet.com" OR sourcentdomain CONTAINS "p1.offline-microsoft.com" OR sourcentdomain CONTAINS "offline-microsoft.com" OR sourcentdomain CONTAINS "cdn.microsoft-official.com" OR sourcentdomain CONTAINS "microsoft-official.com" OR sourcentdomain CONTAINS "ramblercloud.com" OR sourcentdomain CONTAINS "yandexpro.net")
index=activity AND rg_functionality="Web Server" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "portal.super-encrypt.com" OR sourcehostname CONTAINS "super-encrypt.com" OR sourcehostname CONTAINS "portal.intranet-rsnet.com" OR sourcehostname CONTAINS "intranet-rsnet.com" OR sourcehostname CONTAINS "p1.offline-microsoft.com" OR sourcehostname CONTAINS "offline-microsoft.com" OR sourcehostname CONTAINS "cdn.microsoft-official.com" OR sourcehostname CONTAINS "microsoft-official.com" OR sourcehostname CONTAINS "ramblercloud.com" OR sourcehostname CONTAINS "yandexpro.net")
index=activity AND rg_functionality="Web Server" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "portal.super-encrypt.com" OR destinationntdomain CONTAINS "super-encrypt.com" OR destinationntdomain CONTAINS "portal.intranet-rsnet.com" OR destinationntdomain CONTAINS "intranet-rsnet.com" OR destinationntdomain CONTAINS "p1.offline-microsoft.com" OR destinationntdomain CONTAINS "offline-microsoft.com" OR destinationntdomain CONTAINS "cdn.microsoft-official.com" OR destinationntdomain CONTAINS "microsoft-official.com" OR destinationntdomain CONTAINS "ramblercloud.com" OR destinationntdomain CONTAINS "yandexpro.net")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "portal.super-encrypt.com" OR destinationhostname CONTAINS "super-encrypt.com" OR destinationhostname CONTAINS "portal.intranet-rsnet.com" OR destinationhostname CONTAINS "intranet-rsnet.com" OR destinationhostname CONTAINS "p1.offline-microsoft.com" OR destinationhostname CONTAINS "offline-microsoft.com" OR destinationhostname CONTAINS "cdn.microsoft-official.com" OR destinationhostname CONTAINS "microsoft-official.com" OR destinationhostname CONTAINS "ramblercloud.com" OR destinationhostname CONTAINS "yandexpro.net")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "portal.super-encrypt.com" OR sourcentdomain CONTAINS "super-encrypt.com" OR sourcentdomain CONTAINS "portal.intranet-rsnet.com" OR sourcentdomain CONTAINS "intranet-rsnet.com" OR sourcentdomain CONTAINS "p1.offline-microsoft.com" OR sourcentdomain CONTAINS "offline-microsoft.com" OR sourcentdomain CONTAINS "cdn.microsoft-official.com" OR sourcentdomain CONTAINS "microsoft-official.com" OR sourcentdomain CONTAINS "ramblercloud.com" OR sourcentdomain CONTAINS "yandexpro.net")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "portal.super-encrypt.com" OR sourcehostname CONTAINS "super-encrypt.com" OR sourcehostname CONTAINS "portal.intranet-rsnet.com" OR sourcehostname CONTAINS "intranet-rsnet.com" OR sourcehostname CONTAINS "p1.offline-microsoft.com" OR sourcehostname CONTAINS "offline-microsoft.com" OR sourcehostname CONTAINS "cdn.microsoft-official.com" OR sourcehostname CONTAINS "microsoft-official.com" OR sourcehostname CONTAINS "ramblercloud.com" OR sourcehostname CONTAINS "yandexpro.net")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "portal.super-encrypt.com" OR destinationntdomain CONTAINS "super-encrypt.com" OR destinationntdomain CONTAINS "portal.intranet-rsnet.com" OR destinationntdomain CONTAINS "intranet-rsnet.com" OR destinationntdomain CONTAINS "p1.offline-microsoft.com" OR destinationntdomain CONTAINS "offline-microsoft.com" OR destinationntdomain CONTAINS "cdn.microsoft-official.com" OR destinationntdomain CONTAINS "microsoft-official.com" OR destinationntdomain CONTAINS "ramblercloud.com" OR destinationntdomain CONTAINS "yandexpro.net")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "portal.super-encrypt.com" OR destinationhostname CONTAINS "super-encrypt.com" OR destinationhostname CONTAINS "portal.intranet-rsnet.com" OR destinationhostname CONTAINS "intranet-rsnet.com" OR destinationhostname CONTAINS "p1.offline-microsoft.com" OR destinationhostname CONTAINS "offline-microsoft.com" OR destinationhostname CONTAINS "cdn.microsoft-official.com" OR destinationhostname CONTAINS "microsoft-official.com" OR destinationhostname CONTAINS "ramblercloud.com" OR destinationhostname CONTAINS "yandexpro.net")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "portal.super-encrypt.com" OR sourcentdomain CONTAINS "super-encrypt.com" OR sourcentdomain CONTAINS "portal.intranet-rsnet.com" OR sourcentdomain CONTAINS "intranet-rsnet.com" OR sourcentdomain CONTAINS "p1.offline-microsoft.com" OR sourcentdomain CONTAINS "offline-microsoft.com" OR sourcentdomain CONTAINS "cdn.microsoft-official.com" OR sourcentdomain CONTAINS "microsoft-official.com" OR sourcentdomain CONTAINS "ramblercloud.com" OR sourcentdomain CONTAINS "yandexpro.net")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "portal.super-encrypt.com" OR sourcehostname CONTAINS "super-encrypt.com" OR sourcehostname CONTAINS "portal.intranet-rsnet.com" OR sourcehostname CONTAINS "intranet-rsnet.com" OR sourcehostname CONTAINS "p1.offline-microsoft.com" OR sourcehostname CONTAINS "offline-microsoft.com" OR sourcehostname CONTAINS "cdn.microsoft-official.com" OR sourcehostname CONTAINS "microsoft-official.com" OR sourcehostname CONTAINS "ramblercloud.com" OR sourcehostname CONTAINS "yandexpro.net")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "portal.super-encrypt.com" OR destinationntdomain CONTAINS "super-encrypt.com" OR destinationntdomain CONTAINS "portal.intranet-rsnet.com" OR destinationntdomain CONTAINS "intranet-rsnet.com" OR destinationntdomain CONTAINS "p1.offline-microsoft.com" OR destinationntdomain CONTAINS "offline-microsoft.com" OR destinationntdomain CONTAINS "cdn.microsoft-official.com" OR destinationntdomain CONTAINS "microsoft-official.com" OR destinationntdomain CONTAINS "ramblercloud.com" OR destinationntdomain CONTAINS "yandexpro.net")
index=activity AND rg_functionality="Web Application Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "portal.super-encrypt.com" OR destinationhostname CONTAINS "super-encrypt.com" OR destinationhostname CONTAINS "portal.intranet-rsnet.com" OR destinationhostname CONTAINS "intranet-rsnet.com" OR destinationhostname CONTAINS "p1.offline-microsoft.com" OR destinationhostname CONTAINS "offline-microsoft.com" OR destinationhostname CONTAINS "cdn.microsoft-official.com" OR destinationhostname CONTAINS "microsoft-official.com" OR destinationhostname CONTAINS "ramblercloud.com" OR destinationhostname CONTAINS "yandexpro.net")
index=activity AND rg_functionality="Web Application Firewall" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "portal.super-encrypt.com" OR sourcentdomain CONTAINS "super-encrypt.com" OR sourcentdomain CONTAINS "portal.intranet-rsnet.com" OR sourcentdomain CONTAINS "intranet-rsnet.com" OR sourcentdomain CONTAINS "p1.offline-microsoft.com" OR sourcentdomain CONTAINS "offline-microsoft.com" OR sourcentdomain CONTAINS "cdn.microsoft-official.com" OR sourcentdomain CONTAINS "microsoft-official.com" OR sourcentdomain CONTAINS "ramblercloud.com" OR sourcentdomain CONTAINS "yandexpro.net")
index=activity AND rg_functionality="Web Application Firewall" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "portal.super-encrypt.com" OR sourcehostname CONTAINS "super-encrypt.com" OR sourcehostname CONTAINS "portal.intranet-rsnet.com" OR sourcehostname CONTAINS "intranet-rsnet.com" OR sourcehostname CONTAINS "p1.offline-microsoft.com" OR sourcehostname CONTAINS "offline-microsoft.com" OR sourcehostname CONTAINS "cdn.microsoft-official.com" OR sourcehostname CONTAINS "microsoft-official.com" OR sourcehostname CONTAINS "ramblercloud.com" OR sourcehostname CONTAINS "yandexpro.net")
index=activity AND rg_functionality="Web Application Firewall" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "portal.super-encrypt.com" OR destinationntdomain CONTAINS "super-encrypt.com" OR destinationntdomain CONTAINS "portal.intranet-rsnet.com" OR destinationntdomain CONTAINS "intranet-rsnet.com" OR destinationntdomain CONTAINS "p1.offline-microsoft.com" OR destinationntdomain CONTAINS "offline-microsoft.com" OR destinationntdomain CONTAINS "cdn.microsoft-official.com" OR destinationntdomain CONTAINS "microsoft-official.com" OR destinationntdomain CONTAINS "ramblercloud.com" OR destinationntdomain CONTAINS "yandexpro.net")
index=activity AND rg_functionality="Endpoint management systems" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "portal.super-encrypt.com" OR destinationhostname CONTAINS "super-encrypt.com" OR destinationhostname CONTAINS "portal.intranet-rsnet.com" OR destinationhostname CONTAINS "intranet-rsnet.com" OR destinationhostname CONTAINS "p1.offline-microsoft.com" OR destinationhostname CONTAINS "offline-microsoft.com" OR destinationhostname CONTAINS "cdn.microsoft-official.com" OR destinationhostname CONTAINS "microsoft-official.com" OR destinationhostname CONTAINS "ramblercloud.com" OR destinationhostname CONTAINS "yandexpro.net")
index=activity AND rg_functionality="Endpoint management systems" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "portal.super-encrypt.com" OR sourcentdomain CONTAINS "super-encrypt.com" OR sourcentdomain CONTAINS "portal.intranet-rsnet.com" OR sourcentdomain CONTAINS "intranet-rsnet.com" OR sourcentdomain CONTAINS "p1.offline-microsoft.com" OR sourcentdomain CONTAINS "offline-microsoft.com" OR sourcentdomain CONTAINS "cdn.microsoft-official.com" OR sourcentdomain CONTAINS "microsoft-official.com" OR sourcentdomain CONTAINS "ramblercloud.com" OR sourcentdomain CONTAINS "yandexpro.net")
index=activity AND rg_functionality="Endpoint management systems" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "portal.super-encrypt.com" OR sourcehostname CONTAINS "super-encrypt.com" OR sourcehostname CONTAINS "portal.intranet-rsnet.com" OR sourcehostname CONTAINS "intranet-rsnet.com" OR sourcehostname CONTAINS "p1.offline-microsoft.com" OR sourcehostname CONTAINS "offline-microsoft.com" OR sourcehostname CONTAINS "cdn.microsoft-official.com" OR sourcehostname CONTAINS "microsoft-official.com" OR sourcehostname CONTAINS "ramblercloud.com" OR sourcehostname CONTAINS "yandexpro.net")
index=activity AND rg_functionality="Endpoint management systems" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "portal.super-encrypt.com" OR destinationntdomain CONTAINS "super-encrypt.com" OR destinationntdomain CONTAINS "portal.intranet-rsnet.com" OR destinationntdomain CONTAINS "intranet-rsnet.com" OR destinationntdomain CONTAINS "p1.offline-microsoft.com" OR destinationntdomain CONTAINS "offline-microsoft.com" OR destinationntdomain CONTAINS "cdn.microsoft-official.com" OR destinationntdomain CONTAINS "microsoft-official.com" OR destinationntdomain CONTAINS "ramblercloud.com" OR destinationntdomain CONTAINS "yandexpro.net")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "portal.super-encrypt.com" OR destinationhostname CONTAINS "super-encrypt.com" OR destinationhostname CONTAINS "portal.intranet-rsnet.com" OR destinationhostname CONTAINS "intranet-rsnet.com" OR destinationhostname CONTAINS "p1.offline-microsoft.com" OR destinationhostname CONTAINS "offline-microsoft.com" OR destinationhostname CONTAINS "cdn.microsoft-official.com" OR destinationhostname CONTAINS "microsoft-official.com" OR destinationhostname CONTAINS "ramblercloud.com" OR destinationhostname CONTAINS "yandexpro.net")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "portal.super-encrypt.com" OR sourcentdomain CONTAINS "super-encrypt.com" OR sourcentdomain CONTAINS "portal.intranet-rsnet.com" OR sourcentdomain CONTAINS "intranet-rsnet.com" OR sourcentdomain CONTAINS "p1.offline-microsoft.com" OR sourcentdomain CONTAINS "offline-microsoft.com" OR sourcentdomain CONTAINS "cdn.microsoft-official.com" OR sourcentdomain CONTAINS "microsoft-official.com" OR sourcentdomain CONTAINS "ramblercloud.com" OR sourcentdomain CONTAINS "yandexpro.net")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "portal.super-encrypt.com" OR sourcehostname CONTAINS "super-encrypt.com" OR sourcehostname CONTAINS "portal.intranet-rsnet.com" OR sourcehostname CONTAINS "intranet-rsnet.com" OR sourcehostname CONTAINS "p1.offline-microsoft.com" OR sourcehostname CONTAINS "offline-microsoft.com" OR sourcehostname CONTAINS "cdn.microsoft-official.com" OR sourcehostname CONTAINS "microsoft-official.com" OR sourcehostname CONTAINS "ramblercloud.com" OR sourcehostname CONTAINS "yandexpro.net")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "portal.super-encrypt.com" OR destinationntdomain CONTAINS "super-encrypt.com" OR destinationntdomain CONTAINS "portal.intranet-rsnet.com" OR destinationntdomain CONTAINS "intranet-rsnet.com" OR destinationntdomain CONTAINS "p1.offline-microsoft.com" OR destinationntdomain CONTAINS "offline-microsoft.com" OR destinationntdomain CONTAINS "cdn.microsoft-official.com" OR destinationntdomain CONTAINS "microsoft-official.com" OR destinationntdomain CONTAINS "ramblercloud.com" OR destinationntdomain CONTAINS "yandexpro.net")
index=activity AND rg_functionality="Cloud Application Audit" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "portal.super-encrypt.com" OR destinationhostname CONTAINS "super-encrypt.com" OR destinationhostname CONTAINS "portal.intranet-rsnet.com" OR destinationhostname CONTAINS "intranet-rsnet.com" OR destinationhostname CONTAINS "p1.offline-microsoft.com" OR destinationhostname CONTAINS "offline-microsoft.com" OR destinationhostname CONTAINS "cdn.microsoft-official.com" OR destinationhostname CONTAINS "microsoft-official.com" OR destinationhostname CONTAINS "ramblercloud.com" OR destinationhostname CONTAINS "yandexpro.net")
index=activity AND rg_functionality="Cloud Application Audit" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "portal.super-encrypt.com" OR sourcentdomain CONTAINS "super-encrypt.com" OR sourcentdomain CONTAINS "portal.intranet-rsnet.com" OR sourcentdomain CONTAINS "intranet-rsnet.com" OR sourcentdomain CONTAINS "p1.offline-microsoft.com" OR sourcentdomain CONTAINS "offline-microsoft.com" OR sourcentdomain CONTAINS "cdn.microsoft-official.com" OR sourcentdomain CONTAINS "microsoft-official.com" OR sourcentdomain CONTAINS "ramblercloud.com" OR sourcentdomain CONTAINS "yandexpro.net")
index=activity AND rg_functionality="Cloud Application Audit" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "portal.super-encrypt.com" OR sourcehostname CONTAINS "super-encrypt.com" OR sourcehostname CONTAINS "portal.intranet-rsnet.com" OR sourcehostname CONTAINS "intranet-rsnet.com" OR sourcehostname CONTAINS "p1.offline-microsoft.com" OR sourcehostname CONTAINS "offline-microsoft.com" OR sourcehostname CONTAINS "cdn.microsoft-official.com" OR sourcehostname CONTAINS "microsoft-official.com" OR sourcehostname CONTAINS "ramblercloud.com" OR sourcehostname CONTAINS "yandexpro.net")
index=activity AND rg_functionality="Cloud Application Audit" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "portal.super-encrypt.com" OR destinationntdomain CONTAINS "super-encrypt.com" OR destinationntdomain CONTAINS "portal.intranet-rsnet.com" OR destinationntdomain CONTAINS "intranet-rsnet.com" OR destinationntdomain CONTAINS "p1.offline-microsoft.com" OR destinationntdomain CONTAINS "offline-microsoft.com" OR destinationntdomain CONTAINS "cdn.microsoft-official.com" OR destinationntdomain CONTAINS "microsoft-official.com" OR destinationntdomain CONTAINS "ramblercloud.com" OR destinationntdomain CONTAINS "yandexpro.net")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "portal.super-encrypt.com" OR destinationhostname CONTAINS "super-encrypt.com" OR destinationhostname CONTAINS "portal.intranet-rsnet.com" OR destinationhostname CONTAINS "intranet-rsnet.com" OR destinationhostname CONTAINS "p1.offline-microsoft.com" OR destinationhostname CONTAINS "offline-microsoft.com" OR destinationhostname CONTAINS "cdn.microsoft-official.com" OR destinationhostname CONTAINS "microsoft-official.com" OR destinationhostname CONTAINS "ramblercloud.com" OR destinationhostname CONTAINS "yandexpro.net")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "portal.super-encrypt.com" OR sourcentdomain CONTAINS "super-encrypt.com" OR sourcentdomain CONTAINS "portal.intranet-rsnet.com" OR sourcentdomain CONTAINS "intranet-rsnet.com" OR sourcentdomain CONTAINS "p1.offline-microsoft.com" OR sourcentdomain CONTAINS "offline-microsoft.com" OR sourcentdomain CONTAINS "cdn.microsoft-official.com" OR sourcentdomain CONTAINS "microsoft-official.com" OR sourcentdomain CONTAINS "ramblercloud.com" OR sourcentdomain CONTAINS "yandexpro.net")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "portal.super-encrypt.com" OR sourcehostname CONTAINS "super-encrypt.com" OR sourcehostname CONTAINS "portal.intranet-rsnet.com" OR sourcehostname CONTAINS "intranet-rsnet.com" OR sourcehostname CONTAINS "p1.offline-microsoft.com" OR sourcehostname CONTAINS "offline-microsoft.com" OR sourcehostname CONTAINS "cdn.microsoft-official.com" OR sourcehostname CONTAINS "microsoft-official.com" OR sourcehostname CONTAINS "ramblercloud.com" OR sourcehostname CONTAINS "yandexpro.net")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "portal.super-encrypt.com" OR destinationntdomain CONTAINS "super-encrypt.com" OR destinationntdomain CONTAINS "portal.intranet-rsnet.com" OR destinationntdomain CONTAINS "intranet-rsnet.com" OR destinationntdomain CONTAINS "p1.offline-microsoft.com" OR destinationntdomain CONTAINS "offline-microsoft.com" OR destinationntdomain CONTAINS "cdn.microsoft-official.com" OR destinationntdomain CONTAINS "microsoft-official.com" OR destinationntdomain CONTAINS "ramblercloud.com" OR destinationntdomain CONTAINS "yandexpro.net")
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "portal.super-encrypt.com" OR destinationhostname CONTAINS "super-encrypt.com" OR destinationhostname CONTAINS "portal.intranet-rsnet.com" OR destinationhostname CONTAINS "intranet-rsnet.com" OR destinationhostname CONTAINS "p1.offline-microsoft.com" OR destinationhostname CONTAINS "offline-microsoft.com" OR destinationhostname CONTAINS "cdn.microsoft-official.com" OR destinationhostname CONTAINS "microsoft-official.com" OR destinationhostname CONTAINS "ramblercloud.com" OR destinationhostname CONTAINS "yandexpro.net")
index=activity AND rg_functionality="Unix / Linux / AIX" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "portal.super-encrypt.com" OR sourcentdomain CONTAINS "super-encrypt.com" OR sourcentdomain CONTAINS "portal.intranet-rsnet.com" OR sourcentdomain CONTAINS "intranet-rsnet.com" OR sourcentdomain CONTAINS "p1.offline-microsoft.com" OR sourcentdomain CONTAINS "offline-microsoft.com" OR sourcentdomain CONTAINS "cdn.microsoft-official.com" OR sourcentdomain CONTAINS "microsoft-official.com" OR sourcentdomain CONTAINS "ramblercloud.com" OR sourcentdomain CONTAINS "yandexpro.net")
index=activity AND rg_functionality="Unix / Linux / AIX" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "portal.super-encrypt.com" OR sourcehostname CONTAINS "super-encrypt.com" OR sourcehostname CONTAINS "portal.intranet-rsnet.com" OR sourcehostname CONTAINS "intranet-rsnet.com" OR sourcehostname CONTAINS "p1.offline-microsoft.com" OR sourcehostname CONTAINS "offline-microsoft.com" OR sourcehostname CONTAINS "cdn.microsoft-official.com" OR sourcehostname CONTAINS "microsoft-official.com" OR sourcehostname CONTAINS "ramblercloud.com" OR sourcehostname CONTAINS "yandexpro.net")
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "portal.super-encrypt.com" OR destinationntdomain CONTAINS "super-encrypt.com" OR destinationntdomain CONTAINS "portal.intranet-rsnet.com" OR destinationntdomain CONTAINS "intranet-rsnet.com" OR destinationntdomain CONTAINS "p1.offline-microsoft.com" OR destinationntdomain CONTAINS "offline-microsoft.com" OR destinationntdomain CONTAINS "cdn.microsoft-official.com" OR destinationntdomain CONTAINS "microsoft-official.com" OR destinationntdomain CONTAINS "ramblercloud.com" OR destinationntdomain CONTAINS "yandexpro.net")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "portal.super-encrypt.com" OR destinationhostname CONTAINS "super-encrypt.com" OR destinationhostname CONTAINS "portal.intranet-rsnet.com" OR destinationhostname CONTAINS "intranet-rsnet.com" OR destinationhostname CONTAINS "p1.offline-microsoft.com" OR destinationhostname CONTAINS "offline-microsoft.com" OR destinationhostname CONTAINS "cdn.microsoft-official.com" OR destinationhostname CONTAINS "microsoft-official.com" OR destinationhostname CONTAINS "ramblercloud.com" OR destinationhostname CONTAINS "yandexpro.net")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "portal.super-encrypt.com" OR sourcentdomain CONTAINS "super-encrypt.com" OR sourcentdomain CONTAINS "portal.intranet-rsnet.com" OR sourcentdomain CONTAINS "intranet-rsnet.com" OR sourcentdomain CONTAINS "p1.offline-microsoft.com" OR sourcentdomain CONTAINS "offline-microsoft.com" OR sourcentdomain CONTAINS "cdn.microsoft-official.com" OR sourcentdomain CONTAINS "microsoft-official.com" OR sourcentdomain CONTAINS "ramblercloud.com" OR sourcentdomain CONTAINS "yandexpro.net")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "portal.super-encrypt.com" OR sourcehostname CONTAINS "super-encrypt.com" OR sourcehostname CONTAINS "portal.intranet-rsnet.com" OR sourcehostname CONTAINS "intranet-rsnet.com" OR sourcehostname CONTAINS "p1.offline-microsoft.com" OR sourcehostname CONTAINS "offline-microsoft.com" OR sourcehostname CONTAINS "cdn.microsoft-official.com" OR sourcehostname CONTAINS "microsoft-official.com" OR sourcehostname CONTAINS "ramblercloud.com" OR sourcehostname CONTAINS "yandexpro.net")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "portal.super-encrypt.com" OR destinationntdomain CONTAINS "super-encrypt.com" OR destinationntdomain CONTAINS "portal.intranet-rsnet.com" OR destinationntdomain CONTAINS "intranet-rsnet.com" OR destinationntdomain CONTAINS "p1.offline-microsoft.com" OR destinationntdomain CONTAINS "offline-microsoft.com" OR destinationntdomain CONTAINS "cdn.microsoft-official.com" OR destinationntdomain CONTAINS "microsoft-official.com" OR destinationntdomain CONTAINS "ramblercloud.com" OR destinationntdomain CONTAINS "yandexpro.net")
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "portal.super-encrypt.com" OR destinationhostname CONTAINS "super-encrypt.com" OR destinationhostname CONTAINS "portal.intranet-rsnet.com" OR destinationhostname CONTAINS "intranet-rsnet.com" OR destinationhostname CONTAINS "p1.offline-microsoft.com" OR destinationhostname CONTAINS "offline-microsoft.com" OR destinationhostname CONTAINS "cdn.microsoft-official.com" OR destinationhostname CONTAINS "microsoft-official.com" OR destinationhostname CONTAINS "ramblercloud.com" OR destinationhostname CONTAINS "yandexpro.net")
index=activity AND rg_functionality="Cloud Application Security Broker" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "portal.super-encrypt.com" OR sourcentdomain CONTAINS "super-encrypt.com" OR sourcentdomain CONTAINS "portal.intranet-rsnet.com" OR sourcentdomain CONTAINS "intranet-rsnet.com" OR sourcentdomain CONTAINS "p1.offline-microsoft.com" OR sourcentdomain CONTAINS "offline-microsoft.com" OR sourcentdomain CONTAINS "cdn.microsoft-official.com" OR sourcentdomain CONTAINS "microsoft-official.com" OR sourcentdomain CONTAINS "ramblercloud.com" OR sourcentdomain CONTAINS "yandexpro.net")
index=activity AND rg_functionality="Cloud Application Security Broker" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "portal.super-encrypt.com" OR sourcehostname CONTAINS "super-encrypt.com" OR sourcehostname CONTAINS "portal.intranet-rsnet.com" OR sourcehostname CONTAINS "intranet-rsnet.com" OR sourcehostname CONTAINS "p1.offline-microsoft.com" OR sourcehostname CONTAINS "offline-microsoft.com" OR sourcehostname CONTAINS "cdn.microsoft-official.com" OR sourcehostname CONTAINS "microsoft-official.com" OR sourcehostname CONTAINS "ramblercloud.com" OR sourcehostname CONTAINS "yandexpro.net")
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "portal.super-encrypt.com" OR destinationntdomain CONTAINS "super-encrypt.com" OR destinationntdomain CONTAINS "portal.intranet-rsnet.com" OR destinationntdomain CONTAINS "intranet-rsnet.com" OR destinationntdomain CONTAINS "p1.offline-microsoft.com" OR destinationntdomain CONTAINS "offline-microsoft.com" OR destinationntdomain CONTAINS "cdn.microsoft-official.com" OR destinationntdomain CONTAINS "microsoft-official.com" OR destinationntdomain CONTAINS "ramblercloud.com" OR destinationntdomain CONTAINS "yandexpro.net")
index=activity AND rg_functionality="Source Code Repository" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "portal.super-encrypt.com" OR destinationhostname CONTAINS "super-encrypt.com" OR destinationhostname CONTAINS "portal.intranet-rsnet.com" OR destinationhostname CONTAINS "intranet-rsnet.com" OR destinationhostname CONTAINS "p1.offline-microsoft.com" OR destinationhostname CONTAINS "offline-microsoft.com" OR destinationhostname CONTAINS "cdn.microsoft-official.com" OR destinationhostname CONTAINS "microsoft-official.com" OR destinationhostname CONTAINS "ramblercloud.com" OR destinationhostname CONTAINS "yandexpro.net")
index=activity AND rg_functionality="Source Code Repository" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "portal.super-encrypt.com" OR sourcentdomain CONTAINS "super-encrypt.com" OR sourcentdomain CONTAINS "portal.intranet-rsnet.com" OR sourcentdomain CONTAINS "intranet-rsnet.com" OR sourcentdomain CONTAINS "p1.offline-microsoft.com" OR sourcentdomain CONTAINS "offline-microsoft.com" OR sourcentdomain CONTAINS "cdn.microsoft-official.com" OR sourcentdomain CONTAINS "microsoft-official.com" OR sourcentdomain CONTAINS "ramblercloud.com" OR sourcentdomain CONTAINS "yandexpro.net")
index=activity AND rg_functionality="Source Code Repository" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "portal.super-encrypt.com" OR sourcehostname CONTAINS "super-encrypt.com" OR sourcehostname CONTAINS "portal.intranet-rsnet.com" OR sourcehostname CONTAINS "intranet-rsnet.com" OR sourcehostname CONTAINS "p1.offline-microsoft.com" OR sourcehostname CONTAINS "offline-microsoft.com" OR sourcehostname CONTAINS "cdn.microsoft-official.com" OR sourcehostname CONTAINS "microsoft-official.com" OR sourcehostname CONTAINS "ramblercloud.com" OR sourcehostname CONTAINS "yandexpro.net")
index=activity AND rg_functionality="Source Code Repository" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "portal.super-encrypt.com" OR destinationntdomain CONTAINS "super-encrypt.com" OR destinationntdomain CONTAINS "portal.intranet-rsnet.com" OR destinationntdomain CONTAINS "intranet-rsnet.com" OR destinationntdomain CONTAINS "p1.offline-microsoft.com" OR destinationntdomain CONTAINS "offline-microsoft.com" OR destinationntdomain CONTAINS "cdn.microsoft-official.com" OR destinationntdomain CONTAINS "microsoft-official.com" OR destinationntdomain CONTAINS "ramblercloud.com" OR destinationntdomain CONTAINS "yandexpro.net")
