index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("9943bdf1b2a37434054b14a1a56a8e67aaa6a8b733ca785017d3ed8c1173ac59","ba5b485552ab775ce3116d9d5fa17f88452c1ae60118902e7f669fd6390eae97","6879a2b730e391964afe4dbbc29667844ba0c29239be5503b7c86e59e7052443","6b1420193a0ff96e3a19e887683535ab6654b2773a1899c2ab113739730924a1","231957a5b5b834f88925a1922dba8b4238cf13b0e92c17851a83f40931f264c1","a6aa76cf3f25c768cc6ddcf32a86e5fcf4d8dd95298240c232942ce5e08709ec","38b6b93a536cbab5c289fe542656d8817d7c1217ad75c7f367b15c65d96a21d4","05b468fc24c93885cad40ff9ecb50594faa6c2c590e75c88a5e5f54a8b696ac8","9a1adb50bb08f5a28160802c8f315749b15c9009f25aa6718c7752471db3bb4b")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("9943bdf1b2a37434054b14a1a56a8e67aaa6a8b733ca785017d3ed8c1173ac59","ba5b485552ab775ce3116d9d5fa17f88452c1ae60118902e7f669fd6390eae97","6879a2b730e391964afe4dbbc29667844ba0c29239be5503b7c86e59e7052443","6b1420193a0ff96e3a19e887683535ab6654b2773a1899c2ab113739730924a1","231957a5b5b834f88925a1922dba8b4238cf13b0e92c17851a83f40931f264c1","a6aa76cf3f25c768cc6ddcf32a86e5fcf4d8dd95298240c232942ce5e08709ec","38b6b93a536cbab5c289fe542656d8817d7c1217ad75c7f367b15c65d96a21d4","05b468fc24c93885cad40ff9ecb50594faa6c2c590e75c88a5e5f54a8b696ac8","9a1adb50bb08f5a28160802c8f315749b15c9009f25aa6718c7752471db3bb4b")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("9943bdf1b2a37434054b14a1a56a8e67aaa6a8b733ca785017d3ed8c1173ac59","ba5b485552ab775ce3116d9d5fa17f88452c1ae60118902e7f669fd6390eae97","6879a2b730e391964afe4dbbc29667844ba0c29239be5503b7c86e59e7052443","6b1420193a0ff96e3a19e887683535ab6654b2773a1899c2ab113739730924a1","231957a5b5b834f88925a1922dba8b4238cf13b0e92c17851a83f40931f264c1","a6aa76cf3f25c768cc6ddcf32a86e5fcf4d8dd95298240c232942ce5e08709ec","38b6b93a536cbab5c289fe542656d8817d7c1217ad75c7f367b15c65d96a21d4","05b468fc24c93885cad40ff9ecb50594faa6c2c590e75c88a5e5f54a8b696ac8","9a1adb50bb08f5a28160802c8f315749b15c9009f25aa6718c7752471db3bb4b")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring64 NOT NULL AND customstring64 IN ("9943bdf1b2a37434054b14a1a56a8e67aaa6a8b733ca785017d3ed8c1173ac59","ba5b485552ab775ce3116d9d5fa17f88452c1ae60118902e7f669fd6390eae97","6879a2b730e391964afe4dbbc29667844ba0c29239be5503b7c86e59e7052443","6b1420193a0ff96e3a19e887683535ab6654b2773a1899c2ab113739730924a1","231957a5b5b834f88925a1922dba8b4238cf13b0e92c17851a83f40931f264c1","a6aa76cf3f25c768cc6ddcf32a86e5fcf4d8dd95298240c232942ce5e08709ec","38b6b93a536cbab5c289fe542656d8817d7c1217ad75c7f367b15c65d96a21d4","05b468fc24c93885cad40ff9ecb50594faa6c2c590e75c88a5e5f54a8b696ac8","9a1adb50bb08f5a28160802c8f315749b15c9009f25aa6718c7752471db3bb4b")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("9943bdf1b2a37434054b14a1a56a8e67aaa6a8b733ca785017d3ed8c1173ac59","ba5b485552ab775ce3116d9d5fa17f88452c1ae60118902e7f669fd6390eae97","6879a2b730e391964afe4dbbc29667844ba0c29239be5503b7c86e59e7052443","6b1420193a0ff96e3a19e887683535ab6654b2773a1899c2ab113739730924a1","231957a5b5b834f88925a1922dba8b4238cf13b0e92c17851a83f40931f264c1","a6aa76cf3f25c768cc6ddcf32a86e5fcf4d8dd95298240c232942ce5e08709ec","38b6b93a536cbab5c289fe542656d8817d7c1217ad75c7f367b15c65d96a21d4","05b468fc24c93885cad40ff9ecb50594faa6c2c590e75c88a5e5f54a8b696ac8","9a1adb50bb08f5a28160802c8f315749b15c9009f25aa6718c7752471db3bb4b")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("9943bdf1b2a37434054b14a1a56a8e67aaa6a8b733ca785017d3ed8c1173ac59","ba5b485552ab775ce3116d9d5fa17f88452c1ae60118902e7f669fd6390eae97","6879a2b730e391964afe4dbbc29667844ba0c29239be5503b7c86e59e7052443","6b1420193a0ff96e3a19e887683535ab6654b2773a1899c2ab113739730924a1","231957a5b5b834f88925a1922dba8b4238cf13b0e92c17851a83f40931f264c1","a6aa76cf3f25c768cc6ddcf32a86e5fcf4d8dd95298240c232942ce5e08709ec","38b6b93a536cbab5c289fe542656d8817d7c1217ad75c7f367b15c65d96a21d4","05b468fc24c93885cad40ff9ecb50594faa6c2c590e75c88a5e5f54a8b696ac8","9a1adb50bb08f5a28160802c8f315749b15c9009f25aa6718c7752471db3bb4b")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("9943bdf1b2a37434054b14a1a56a8e67aaa6a8b733ca785017d3ed8c1173ac59","ba5b485552ab775ce3116d9d5fa17f88452c1ae60118902e7f669fd6390eae97","6879a2b730e391964afe4dbbc29667844ba0c29239be5503b7c86e59e7052443","6b1420193a0ff96e3a19e887683535ab6654b2773a1899c2ab113739730924a1","231957a5b5b834f88925a1922dba8b4238cf13b0e92c17851a83f40931f264c1","a6aa76cf3f25c768cc6ddcf32a86e5fcf4d8dd95298240c232942ce5e08709ec","38b6b93a536cbab5c289fe542656d8817d7c1217ad75c7f367b15c65d96a21d4","05b468fc24c93885cad40ff9ecb50594faa6c2c590e75c88a5e5f54a8b696ac8","9a1adb50bb08f5a28160802c8f315749b15c9009f25aa6718c7752471db3bb4b")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("9943bdf1b2a37434054b14a1a56a8e67aaa6a8b733ca785017d3ed8c1173ac59","ba5b485552ab775ce3116d9d5fa17f88452c1ae60118902e7f669fd6390eae97","6879a2b730e391964afe4dbbc29667844ba0c29239be5503b7c86e59e7052443","6b1420193a0ff96e3a19e887683535ab6654b2773a1899c2ab113739730924a1","231957a5b5b834f88925a1922dba8b4238cf13b0e92c17851a83f40931f264c1","a6aa76cf3f25c768cc6ddcf32a86e5fcf4d8dd95298240c232942ce5e08709ec","38b6b93a536cbab5c289fe542656d8817d7c1217ad75c7f367b15c65d96a21d4","05b468fc24c93885cad40ff9ecb50594faa6c2c590e75c88a5e5f54a8b696ac8","9a1adb50bb08f5a28160802c8f315749b15c9009f25aa6718c7752471db3bb4b")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("9943bdf1b2a37434054b14a1a56a8e67aaa6a8b733ca785017d3ed8c1173ac59","ba5b485552ab775ce3116d9d5fa17f88452c1ae60118902e7f669fd6390eae97","6879a2b730e391964afe4dbbc29667844ba0c29239be5503b7c86e59e7052443","6b1420193a0ff96e3a19e887683535ab6654b2773a1899c2ab113739730924a1","231957a5b5b834f88925a1922dba8b4238cf13b0e92c17851a83f40931f264c1","a6aa76cf3f25c768cc6ddcf32a86e5fcf4d8dd95298240c232942ce5e08709ec","38b6b93a536cbab5c289fe542656d8817d7c1217ad75c7f367b15c65d96a21d4","05b468fc24c93885cad40ff9ecb50594faa6c2c590e75c88a5e5f54a8b696ac8","9a1adb50bb08f5a28160802c8f315749b15c9009f25aa6718c7752471db3bb4b")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("9943bdf1b2a37434054b14a1a56a8e67aaa6a8b733ca785017d3ed8c1173ac59","ba5b485552ab775ce3116d9d5fa17f88452c1ae60118902e7f669fd6390eae97","6879a2b730e391964afe4dbbc29667844ba0c29239be5503b7c86e59e7052443","6b1420193a0ff96e3a19e887683535ab6654b2773a1899c2ab113739730924a1","231957a5b5b834f88925a1922dba8b4238cf13b0e92c17851a83f40931f264c1","a6aa76cf3f25c768cc6ddcf32a86e5fcf4d8dd95298240c232942ce5e08709ec","38b6b93a536cbab5c289fe542656d8817d7c1217ad75c7f367b15c65d96a21d4","05b468fc24c93885cad40ff9ecb50594faa6c2c590e75c88a5e5f54a8b696ac8","9a1adb50bb08f5a28160802c8f315749b15c9009f25aa6718c7752471db3bb4b")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("9943bdf1b2a37434054b14a1a56a8e67aaa6a8b733ca785017d3ed8c1173ac59","ba5b485552ab775ce3116d9d5fa17f88452c1ae60118902e7f669fd6390eae97","6879a2b730e391964afe4dbbc29667844ba0c29239be5503b7c86e59e7052443","6b1420193a0ff96e3a19e887683535ab6654b2773a1899c2ab113739730924a1","231957a5b5b834f88925a1922dba8b4238cf13b0e92c17851a83f40931f264c1","a6aa76cf3f25c768cc6ddcf32a86e5fcf4d8dd95298240c232942ce5e08709ec","38b6b93a536cbab5c289fe542656d8817d7c1217ad75c7f367b15c65d96a21d4","05b468fc24c93885cad40ff9ecb50594faa6c2c590e75c88a5e5f54a8b696ac8","9a1adb50bb08f5a28160802c8f315749b15c9009f25aa6718c7752471db3bb4b")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("9943bdf1b2a37434054b14a1a56a8e67aaa6a8b733ca785017d3ed8c1173ac59","ba5b485552ab775ce3116d9d5fa17f88452c1ae60118902e7f669fd6390eae97","6879a2b730e391964afe4dbbc29667844ba0c29239be5503b7c86e59e7052443","6b1420193a0ff96e3a19e887683535ab6654b2773a1899c2ab113739730924a1","231957a5b5b834f88925a1922dba8b4238cf13b0e92c17851a83f40931f264c1","a6aa76cf3f25c768cc6ddcf32a86e5fcf4d8dd95298240c232942ce5e08709ec","38b6b93a536cbab5c289fe542656d8817d7c1217ad75c7f367b15c65d96a21d4","05b468fc24c93885cad40ff9ecb50594faa6c2c590e75c88a5e5f54a8b696ac8","9a1adb50bb08f5a28160802c8f315749b15c9009f25aa6718c7752471db3bb4b")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("9943bdf1b2a37434054b14a1a56a8e67aaa6a8b733ca785017d3ed8c1173ac59","ba5b485552ab775ce3116d9d5fa17f88452c1ae60118902e7f669fd6390eae97","6879a2b730e391964afe4dbbc29667844ba0c29239be5503b7c86e59e7052443","6b1420193a0ff96e3a19e887683535ab6654b2773a1899c2ab113739730924a1","231957a5b5b834f88925a1922dba8b4238cf13b0e92c17851a83f40931f264c1","a6aa76cf3f25c768cc6ddcf32a86e5fcf4d8dd95298240c232942ce5e08709ec","38b6b93a536cbab5c289fe542656d8817d7c1217ad75c7f367b15c65d96a21d4","05b468fc24c93885cad40ff9ecb50594faa6c2c590e75c88a5e5f54a8b696ac8","9a1adb50bb08f5a28160802c8f315749b15c9009f25aa6718c7752471db3bb4b")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("9943bdf1b2a37434054b14a1a56a8e67aaa6a8b733ca785017d3ed8c1173ac59","ba5b485552ab775ce3116d9d5fa17f88452c1ae60118902e7f669fd6390eae97","6879a2b730e391964afe4dbbc29667844ba0c29239be5503b7c86e59e7052443","6b1420193a0ff96e3a19e887683535ab6654b2773a1899c2ab113739730924a1","231957a5b5b834f88925a1922dba8b4238cf13b0e92c17851a83f40931f264c1","a6aa76cf3f25c768cc6ddcf32a86e5fcf4d8dd95298240c232942ce5e08709ec","38b6b93a536cbab5c289fe542656d8817d7c1217ad75c7f367b15c65d96a21d4","05b468fc24c93885cad40ff9ecb50594faa6c2c590e75c88a5e5f54a8b696ac8","9a1adb50bb08f5a28160802c8f315749b15c9009f25aa6718c7752471db3bb4b")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("9943bdf1b2a37434054b14a1a56a8e67aaa6a8b733ca785017d3ed8c1173ac59","ba5b485552ab775ce3116d9d5fa17f88452c1ae60118902e7f669fd6390eae97","6879a2b730e391964afe4dbbc29667844ba0c29239be5503b7c86e59e7052443","6b1420193a0ff96e3a19e887683535ab6654b2773a1899c2ab113739730924a1","231957a5b5b834f88925a1922dba8b4238cf13b0e92c17851a83f40931f264c1","a6aa76cf3f25c768cc6ddcf32a86e5fcf4d8dd95298240c232942ce5e08709ec","38b6b93a536cbab5c289fe542656d8817d7c1217ad75c7f367b15c65d96a21d4","05b468fc24c93885cad40ff9ecb50594faa6c2c590e75c88a5e5f54a8b696ac8","9a1adb50bb08f5a28160802c8f315749b15c9009f25aa6718c7752471db3bb4b")
index=activity AND rg_functionality="Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("9943bdf1b2a37434054b14a1a56a8e67aaa6a8b733ca785017d3ed8c1173ac59","ba5b485552ab775ce3116d9d5fa17f88452c1ae60118902e7f669fd6390eae97","6879a2b730e391964afe4dbbc29667844ba0c29239be5503b7c86e59e7052443","6b1420193a0ff96e3a19e887683535ab6654b2773a1899c2ab113739730924a1","231957a5b5b834f88925a1922dba8b4238cf13b0e92c17851a83f40931f264c1","a6aa76cf3f25c768cc6ddcf32a86e5fcf4d8dd95298240c232942ce5e08709ec","38b6b93a536cbab5c289fe542656d8817d7c1217ad75c7f367b15c65d96a21d4","05b468fc24c93885cad40ff9ecb50594faa6c2c590e75c88a5e5f54a8b696ac8","9a1adb50bb08f5a28160802c8f315749b15c9009f25aa6718c7752471db3bb4b")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("9943bdf1b2a37434054b14a1a56a8e67aaa6a8b733ca785017d3ed8c1173ac59","ba5b485552ab775ce3116d9d5fa17f88452c1ae60118902e7f669fd6390eae97","6879a2b730e391964afe4dbbc29667844ba0c29239be5503b7c86e59e7052443","6b1420193a0ff96e3a19e887683535ab6654b2773a1899c2ab113739730924a1","231957a5b5b834f88925a1922dba8b4238cf13b0e92c17851a83f40931f264c1","a6aa76cf3f25c768cc6ddcf32a86e5fcf4d8dd95298240c232942ce5e08709ec","38b6b93a536cbab5c289fe542656d8817d7c1217ad75c7f367b15c65d96a21d4","05b468fc24c93885cad40ff9ecb50594faa6c2c590e75c88a5e5f54a8b696ac8","9a1adb50bb08f5a28160802c8f315749b15c9009f25aa6718c7752471db3bb4b")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("9943bdf1b2a37434054b14a1a56a8e67aaa6a8b733ca785017d3ed8c1173ac59","ba5b485552ab775ce3116d9d5fa17f88452c1ae60118902e7f669fd6390eae97","6879a2b730e391964afe4dbbc29667844ba0c29239be5503b7c86e59e7052443","6b1420193a0ff96e3a19e887683535ab6654b2773a1899c2ab113739730924a1","231957a5b5b834f88925a1922dba8b4238cf13b0e92c17851a83f40931f264c1","a6aa76cf3f25c768cc6ddcf32a86e5fcf4d8dd95298240c232942ce5e08709ec","38b6b93a536cbab5c289fe542656d8817d7c1217ad75c7f367b15c65d96a21d4","05b468fc24c93885cad40ff9ecb50594faa6c2c590e75c88a5e5f54a8b696ac8","9a1adb50bb08f5a28160802c8f315749b15c9009f25aa6718c7752471db3bb4b")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("9943bdf1b2a37434054b14a1a56a8e67aaa6a8b733ca785017d3ed8c1173ac59","ba5b485552ab775ce3116d9d5fa17f88452c1ae60118902e7f669fd6390eae97","6879a2b730e391964afe4dbbc29667844ba0c29239be5503b7c86e59e7052443","6b1420193a0ff96e3a19e887683535ab6654b2773a1899c2ab113739730924a1","231957a5b5b834f88925a1922dba8b4238cf13b0e92c17851a83f40931f264c1","a6aa76cf3f25c768cc6ddcf32a86e5fcf4d8dd95298240c232942ce5e08709ec","38b6b93a536cbab5c289fe542656d8817d7c1217ad75c7f367b15c65d96a21d4","05b468fc24c93885cad40ff9ecb50594faa6c2c590e75c88a5e5f54a8b696ac8","9a1adb50bb08f5a28160802c8f315749b15c9009f25aa6718c7752471db3bb4b")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("9943bdf1b2a37434054b14a1a56a8e67aaa6a8b733ca785017d3ed8c1173ac59","ba5b485552ab775ce3116d9d5fa17f88452c1ae60118902e7f669fd6390eae97","6879a2b730e391964afe4dbbc29667844ba0c29239be5503b7c86e59e7052443","6b1420193a0ff96e3a19e887683535ab6654b2773a1899c2ab113739730924a1","231957a5b5b834f88925a1922dba8b4238cf13b0e92c17851a83f40931f264c1","a6aa76cf3f25c768cc6ddcf32a86e5fcf4d8dd95298240c232942ce5e08709ec","38b6b93a536cbab5c289fe542656d8817d7c1217ad75c7f367b15c65d96a21d4","05b468fc24c93885cad40ff9ecb50594faa6c2c590e75c88a5e5f54a8b696ac8","9a1adb50bb08f5a28160802c8f315749b15c9009f25aa6718c7752471db3bb4b")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("9943bdf1b2a37434054b14a1a56a8e67aaa6a8b733ca785017d3ed8c1173ac59","ba5b485552ab775ce3116d9d5fa17f88452c1ae60118902e7f669fd6390eae97","6879a2b730e391964afe4dbbc29667844ba0c29239be5503b7c86e59e7052443","6b1420193a0ff96e3a19e887683535ab6654b2773a1899c2ab113739730924a1","231957a5b5b834f88925a1922dba8b4238cf13b0e92c17851a83f40931f264c1","a6aa76cf3f25c768cc6ddcf32a86e5fcf4d8dd95298240c232942ce5e08709ec","38b6b93a536cbab5c289fe542656d8817d7c1217ad75c7f367b15c65d96a21d4","05b468fc24c93885cad40ff9ecb50594faa6c2c590e75c88a5e5f54a8b696ac8","9a1adb50bb08f5a28160802c8f315749b15c9009f25aa6718c7752471db3bb4b")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("9943bdf1b2a37434054b14a1a56a8e67aaa6a8b733ca785017d3ed8c1173ac59","ba5b485552ab775ce3116d9d5fa17f88452c1ae60118902e7f669fd6390eae97","6879a2b730e391964afe4dbbc29667844ba0c29239be5503b7c86e59e7052443","6b1420193a0ff96e3a19e887683535ab6654b2773a1899c2ab113739730924a1","231957a5b5b834f88925a1922dba8b4238cf13b0e92c17851a83f40931f264c1","a6aa76cf3f25c768cc6ddcf32a86e5fcf4d8dd95298240c232942ce5e08709ec","38b6b93a536cbab5c289fe542656d8817d7c1217ad75c7f367b15c65d96a21d4","05b468fc24c93885cad40ff9ecb50594faa6c2c590e75c88a5e5f54a8b696ac8","9a1adb50bb08f5a28160802c8f315749b15c9009f25aa6718c7752471db3bb4b")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("9943bdf1b2a37434054b14a1a56a8e67aaa6a8b733ca785017d3ed8c1173ac59","ba5b485552ab775ce3116d9d5fa17f88452c1ae60118902e7f669fd6390eae97","6879a2b730e391964afe4dbbc29667844ba0c29239be5503b7c86e59e7052443","6b1420193a0ff96e3a19e887683535ab6654b2773a1899c2ab113739730924a1","231957a5b5b834f88925a1922dba8b4238cf13b0e92c17851a83f40931f264c1","a6aa76cf3f25c768cc6ddcf32a86e5fcf4d8dd95298240c232942ce5e08709ec","38b6b93a536cbab5c289fe542656d8817d7c1217ad75c7f367b15c65d96a21d4","05b468fc24c93885cad40ff9ecb50594faa6c2c590e75c88a5e5f54a8b696ac8","9a1adb50bb08f5a28160802c8f315749b15c9009f25aa6718c7752471db3bb4b")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring64 NOT NULL AND customstring64 IN ("9943bdf1b2a37434054b14a1a56a8e67aaa6a8b733ca785017d3ed8c1173ac59","ba5b485552ab775ce3116d9d5fa17f88452c1ae60118902e7f669fd6390eae97","6879a2b730e391964afe4dbbc29667844ba0c29239be5503b7c86e59e7052443","6b1420193a0ff96e3a19e887683535ab6654b2773a1899c2ab113739730924a1","231957a5b5b834f88925a1922dba8b4238cf13b0e92c17851a83f40931f264c1","a6aa76cf3f25c768cc6ddcf32a86e5fcf4d8dd95298240c232942ce5e08709ec","38b6b93a536cbab5c289fe542656d8817d7c1217ad75c7f367b15c65d96a21d4","05b468fc24c93885cad40ff9ecb50594faa6c2c590e75c88a5e5f54a8b696ac8","9a1adb50bb08f5a28160802c8f315749b15c9009f25aa6718c7752471db3bb4b")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("9943bdf1b2a37434054b14a1a56a8e67aaa6a8b733ca785017d3ed8c1173ac59","ba5b485552ab775ce3116d9d5fa17f88452c1ae60118902e7f669fd6390eae97","6879a2b730e391964afe4dbbc29667844ba0c29239be5503b7c86e59e7052443","6b1420193a0ff96e3a19e887683535ab6654b2773a1899c2ab113739730924a1","231957a5b5b834f88925a1922dba8b4238cf13b0e92c17851a83f40931f264c1","a6aa76cf3f25c768cc6ddcf32a86e5fcf4d8dd95298240c232942ce5e08709ec","38b6b93a536cbab5c289fe542656d8817d7c1217ad75c7f367b15c65d96a21d4","05b468fc24c93885cad40ff9ecb50594faa6c2c590e75c88a5e5f54a8b696ac8","9a1adb50bb08f5a28160802c8f315749b15c9009f25aa6718c7752471db3bb4b")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("9943bdf1b2a37434054b14a1a56a8e67aaa6a8b733ca785017d3ed8c1173ac59","ba5b485552ab775ce3116d9d5fa17f88452c1ae60118902e7f669fd6390eae97","6879a2b730e391964afe4dbbc29667844ba0c29239be5503b7c86e59e7052443","6b1420193a0ff96e3a19e887683535ab6654b2773a1899c2ab113739730924a1","231957a5b5b834f88925a1922dba8b4238cf13b0e92c17851a83f40931f264c1","a6aa76cf3f25c768cc6ddcf32a86e5fcf4d8dd95298240c232942ce5e08709ec","38b6b93a536cbab5c289fe542656d8817d7c1217ad75c7f367b15c65d96a21d4","05b468fc24c93885cad40ff9ecb50594faa6c2c590e75c88a5e5f54a8b696ac8","9a1adb50bb08f5a28160802c8f315749b15c9009f25aa6718c7752471db3bb4b")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("9943bdf1b2a37434054b14a1a56a8e67aaa6a8b733ca785017d3ed8c1173ac59","ba5b485552ab775ce3116d9d5fa17f88452c1ae60118902e7f669fd6390eae97","6879a2b730e391964afe4dbbc29667844ba0c29239be5503b7c86e59e7052443","6b1420193a0ff96e3a19e887683535ab6654b2773a1899c2ab113739730924a1","231957a5b5b834f88925a1922dba8b4238cf13b0e92c17851a83f40931f264c1","a6aa76cf3f25c768cc6ddcf32a86e5fcf4d8dd95298240c232942ce5e08709ec","38b6b93a536cbab5c289fe542656d8817d7c1217ad75c7f367b15c65d96a21d4","05b468fc24c93885cad40ff9ecb50594faa6c2c590e75c88a5e5f54a8b696ac8","9a1adb50bb08f5a28160802c8f315749b15c9009f25aa6718c7752471db3bb4b")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring64 NOT NULL AND customstring64 IN ("9943bdf1b2a37434054b14a1a56a8e67aaa6a8b733ca785017d3ed8c1173ac59","ba5b485552ab775ce3116d9d5fa17f88452c1ae60118902e7f669fd6390eae97","6879a2b730e391964afe4dbbc29667844ba0c29239be5503b7c86e59e7052443","6b1420193a0ff96e3a19e887683535ab6654b2773a1899c2ab113739730924a1","231957a5b5b834f88925a1922dba8b4238cf13b0e92c17851a83f40931f264c1","a6aa76cf3f25c768cc6ddcf32a86e5fcf4d8dd95298240c232942ce5e08709ec","38b6b93a536cbab5c289fe542656d8817d7c1217ad75c7f367b15c65d96a21d4","05b468fc24c93885cad40ff9ecb50594faa6c2c590e75c88a5e5f54a8b696ac8","9a1adb50bb08f5a28160802c8f315749b15c9009f25aa6718c7752471db3bb4b")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("9943bdf1b2a37434054b14a1a56a8e67aaa6a8b733ca785017d3ed8c1173ac59","ba5b485552ab775ce3116d9d5fa17f88452c1ae60118902e7f669fd6390eae97","6879a2b730e391964afe4dbbc29667844ba0c29239be5503b7c86e59e7052443","6b1420193a0ff96e3a19e887683535ab6654b2773a1899c2ab113739730924a1","231957a5b5b834f88925a1922dba8b4238cf13b0e92c17851a83f40931f264c1","a6aa76cf3f25c768cc6ddcf32a86e5fcf4d8dd95298240c232942ce5e08709ec","38b6b93a536cbab5c289fe542656d8817d7c1217ad75c7f367b15c65d96a21d4","05b468fc24c93885cad40ff9ecb50594faa6c2c590e75c88a5e5f54a8b696ac8","9a1adb50bb08f5a28160802c8f315749b15c9009f25aa6718c7752471db3bb4b")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("9943bdf1b2a37434054b14a1a56a8e67aaa6a8b733ca785017d3ed8c1173ac59","ba5b485552ab775ce3116d9d5fa17f88452c1ae60118902e7f669fd6390eae97","6879a2b730e391964afe4dbbc29667844ba0c29239be5503b7c86e59e7052443","6b1420193a0ff96e3a19e887683535ab6654b2773a1899c2ab113739730924a1","231957a5b5b834f88925a1922dba8b4238cf13b0e92c17851a83f40931f264c1","a6aa76cf3f25c768cc6ddcf32a86e5fcf4d8dd95298240c232942ce5e08709ec","38b6b93a536cbab5c289fe542656d8817d7c1217ad75c7f367b15c65d96a21d4","05b468fc24c93885cad40ff9ecb50594faa6c2c590e75c88a5e5f54a8b696ac8","9a1adb50bb08f5a28160802c8f315749b15c9009f25aa6718c7752471db3bb4b")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("9943bdf1b2a37434054b14a1a56a8e67aaa6a8b733ca785017d3ed8c1173ac59","ba5b485552ab775ce3116d9d5fa17f88452c1ae60118902e7f669fd6390eae97","6879a2b730e391964afe4dbbc29667844ba0c29239be5503b7c86e59e7052443","6b1420193a0ff96e3a19e887683535ab6654b2773a1899c2ab113739730924a1","231957a5b5b834f88925a1922dba8b4238cf13b0e92c17851a83f40931f264c1","a6aa76cf3f25c768cc6ddcf32a86e5fcf4d8dd95298240c232942ce5e08709ec","38b6b93a536cbab5c289fe542656d8817d7c1217ad75c7f367b15c65d96a21d4","05b468fc24c93885cad40ff9ecb50594faa6c2c590e75c88a5e5f54a8b696ac8","9a1adb50bb08f5a28160802c8f315749b15c9009f25aa6718c7752471db3bb4b")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring64 NOT NULL AND customstring64 IN ("9943bdf1b2a37434054b14a1a56a8e67aaa6a8b733ca785017d3ed8c1173ac59","ba5b485552ab775ce3116d9d5fa17f88452c1ae60118902e7f669fd6390eae97","6879a2b730e391964afe4dbbc29667844ba0c29239be5503b7c86e59e7052443","6b1420193a0ff96e3a19e887683535ab6654b2773a1899c2ab113739730924a1","231957a5b5b834f88925a1922dba8b4238cf13b0e92c17851a83f40931f264c1","a6aa76cf3f25c768cc6ddcf32a86e5fcf4d8dd95298240c232942ce5e08709ec","38b6b93a536cbab5c289fe542656d8817d7c1217ad75c7f367b15c65d96a21d4","05b468fc24c93885cad40ff9ecb50594faa6c2c590e75c88a5e5f54a8b696ac8","9a1adb50bb08f5a28160802c8f315749b15c9009f25aa6718c7752471db3bb4b")
index=activity AND rg_functionality="O365 General" AND filehash NOT NULL AND filehash IN ("9943bdf1b2a37434054b14a1a56a8e67aaa6a8b733ca785017d3ed8c1173ac59","ba5b485552ab775ce3116d9d5fa17f88452c1ae60118902e7f669fd6390eae97","6879a2b730e391964afe4dbbc29667844ba0c29239be5503b7c86e59e7052443","6b1420193a0ff96e3a19e887683535ab6654b2773a1899c2ab113739730924a1","231957a5b5b834f88925a1922dba8b4238cf13b0e92c17851a83f40931f264c1","a6aa76cf3f25c768cc6ddcf32a86e5fcf4d8dd95298240c232942ce5e08709ec","38b6b93a536cbab5c289fe542656d8817d7c1217ad75c7f367b15c65d96a21d4","05b468fc24c93885cad40ff9ecb50594faa6c2c590e75c88a5e5f54a8b696ac8","9a1adb50bb08f5a28160802c8f315749b15c9009f25aa6718c7752471db3bb4b")
index=activity AND rg_functionality="O365 General" AND oldfilehash NOT NULL AND oldfilehash IN ("9943bdf1b2a37434054b14a1a56a8e67aaa6a8b733ca785017d3ed8c1173ac59","ba5b485552ab775ce3116d9d5fa17f88452c1ae60118902e7f669fd6390eae97","6879a2b730e391964afe4dbbc29667844ba0c29239be5503b7c86e59e7052443","6b1420193a0ff96e3a19e887683535ab6654b2773a1899c2ab113739730924a1","231957a5b5b834f88925a1922dba8b4238cf13b0e92c17851a83f40931f264c1","a6aa76cf3f25c768cc6ddcf32a86e5fcf4d8dd95298240c232942ce5e08709ec","38b6b93a536cbab5c289fe542656d8817d7c1217ad75c7f367b15c65d96a21d4","05b468fc24c93885cad40ff9ecb50594faa6c2c590e75c88a5e5f54a8b696ac8","9a1adb50bb08f5a28160802c8f315749b15c9009f25aa6718c7752471db3bb4b")
index=activity AND rg_functionality="O365 General" AND customstring3 NOT NULL AND customstring3 IN ("9943bdf1b2a37434054b14a1a56a8e67aaa6a8b733ca785017d3ed8c1173ac59","ba5b485552ab775ce3116d9d5fa17f88452c1ae60118902e7f669fd6390eae97","6879a2b730e391964afe4dbbc29667844ba0c29239be5503b7c86e59e7052443","6b1420193a0ff96e3a19e887683535ab6654b2773a1899c2ab113739730924a1","231957a5b5b834f88925a1922dba8b4238cf13b0e92c17851a83f40931f264c1","a6aa76cf3f25c768cc6ddcf32a86e5fcf4d8dd95298240c232942ce5e08709ec","38b6b93a536cbab5c289fe542656d8817d7c1217ad75c7f367b15c65d96a21d4","05b468fc24c93885cad40ff9ecb50594faa6c2c590e75c88a5e5f54a8b696ac8","9a1adb50bb08f5a28160802c8f315749b15c9009f25aa6718c7752471db3bb4b")
index=activity AND rg_functionality="O365 General" AND customstring64 NOT NULL AND customstring64 IN ("9943bdf1b2a37434054b14a1a56a8e67aaa6a8b733ca785017d3ed8c1173ac59","ba5b485552ab775ce3116d9d5fa17f88452c1ae60118902e7f669fd6390eae97","6879a2b730e391964afe4dbbc29667844ba0c29239be5503b7c86e59e7052443","6b1420193a0ff96e3a19e887683535ab6654b2773a1899c2ab113739730924a1","231957a5b5b834f88925a1922dba8b4238cf13b0e92c17851a83f40931f264c1","a6aa76cf3f25c768cc6ddcf32a86e5fcf4d8dd95298240c232942ce5e08709ec","38b6b93a536cbab5c289fe542656d8817d7c1217ad75c7f367b15c65d96a21d4","05b468fc24c93885cad40ff9ecb50594faa6c2c590e75c88a5e5f54a8b696ac8","9a1adb50bb08f5a28160802c8f315749b15c9009f25aa6718c7752471db3bb4b")
