index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("d1a1eaefe6bd2e245bba369e966d7a8eab9ed6ad1fa827321e5889cc8d43f976","c967e60500dcadc9b010774616a90b7f4b77bee00c048998ad9faf04d523f14f","2ea4135f3c934c365008eb4db94d8ac6ac054fb36c89c1655dedcb7b345b8c4d","d29fe0f811fe4dbdfc6d449631597137758e087980fc6f9274660e1d316ffb3c","39aa01d7e37c2571eb76d74f0e250aa08dac8f531677e89a321b07d9fadc9690","62c99f27a6f962f3bf2e8844e6ae62cbc367fe8ef57469f1053bef64a1aa3573","9db74edf468202903cb97d4e2a87d67b88e374c8a15d0a46c04782e88679e51f","8adcfbfa5c750d2bc1ff80496c67f7cc6a9bd959a72d40025cb2e9499d6946c7","8b0ea6a9e427ac3288663e2f33bc3df5ea01bfdaead81d4b6595b00a6b7c4301","6fcbcdcafc5accf1b2b0453eccd93c203ab1dca9920521b107c9cff8ce236eb2","486b535c91e8609867bce918693dd24f0d93437a710281ea65f34a9c088211ef","1d56e3fd6e8b45cf01b36cc95e35eb3644018231e528f4ac115c39c7e01e30ba","c4fb60217e3d43eac92074c45228506a","172fff2634545cf59d59c179d139e0aa","7b08580a4f6995f645a5bf8addbefa68","1b71434e049fb8765d528ecabd722072","c4f591cad9d158e2fbb0ed6425ce3804","5f03629508f46e822cf08d7864f585d3","f5cd5f616a482645bbf8f4c51ee38958","fa2c39adbb0ca7aeab5bc5cd1ffb2f08","00cd306f7cdcfe187c561dd42ab40f33","ca27970308b2fdeaa3a8e8e53c86cd3e","d946e3e94fec670f9e47aca186ecaabe","e18c4172329c32d8394ba0658d5212c2","2fde001f4c17c8613480091fa48b55a0","c1f4c9f969f955dec2465317b526b600","026e8e7acb2f2a156f8afff64fd54066","fb64c22d37c502bde55b19688d40c803","70b8040730c62e4a52a904251fa74029","3efec6ffcbfe79f71f5410eb46f1c19e","b03211f6feccd3a62273368b52f6079d","d946e3e94fec670f9e47aca186ecaabe","5a9930c3eb4a6c624a67adb75584dfc2","6d0bf5684c233596a43bbb0ac23f2b79","bdf2096ac1c2cb24c49e02b887f2ca64","b570bfd958a2e23f777d2e0d748e208d","7741d27f60a52a8f6088c15aec783736","63b4205b99017588693d0e82d6de05cd","ebcc775409d48a956bef355ee41841c0","6eeae636ff43b60024b386c4f83aaab0","27bbffa557fc469f8798961bb55e7d84","7a1d2e76f55f477cf799fe9e1a779e07","9da31169bd9af344c1c3a90e7f89e6c8","ff267bcfd8b92eeda25b0dcc870ad0a7","bd1d76ba6d83df249b3b8d40edcfa8fa","230949c88cb5cac7743ccfe406447ea3")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("d1a1eaefe6bd2e245bba369e966d7a8eab9ed6ad1fa827321e5889cc8d43f976","c967e60500dcadc9b010774616a90b7f4b77bee00c048998ad9faf04d523f14f","2ea4135f3c934c365008eb4db94d8ac6ac054fb36c89c1655dedcb7b345b8c4d","d29fe0f811fe4dbdfc6d449631597137758e087980fc6f9274660e1d316ffb3c","39aa01d7e37c2571eb76d74f0e250aa08dac8f531677e89a321b07d9fadc9690","62c99f27a6f962f3bf2e8844e6ae62cbc367fe8ef57469f1053bef64a1aa3573","9db74edf468202903cb97d4e2a87d67b88e374c8a15d0a46c04782e88679e51f","8adcfbfa5c750d2bc1ff80496c67f7cc6a9bd959a72d40025cb2e9499d6946c7","8b0ea6a9e427ac3288663e2f33bc3df5ea01bfdaead81d4b6595b00a6b7c4301","6fcbcdcafc5accf1b2b0453eccd93c203ab1dca9920521b107c9cff8ce236eb2","486b535c91e8609867bce918693dd24f0d93437a710281ea65f34a9c088211ef","1d56e3fd6e8b45cf01b36cc95e35eb3644018231e528f4ac115c39c7e01e30ba","c4fb60217e3d43eac92074c45228506a","172fff2634545cf59d59c179d139e0aa","7b08580a4f6995f645a5bf8addbefa68","1b71434e049fb8765d528ecabd722072","c4f591cad9d158e2fbb0ed6425ce3804","5f03629508f46e822cf08d7864f585d3","f5cd5f616a482645bbf8f4c51ee38958","fa2c39adbb0ca7aeab5bc5cd1ffb2f08","00cd306f7cdcfe187c561dd42ab40f33","ca27970308b2fdeaa3a8e8e53c86cd3e","d946e3e94fec670f9e47aca186ecaabe","e18c4172329c32d8394ba0658d5212c2","2fde001f4c17c8613480091fa48b55a0","c1f4c9f969f955dec2465317b526b600","026e8e7acb2f2a156f8afff64fd54066","fb64c22d37c502bde55b19688d40c803","70b8040730c62e4a52a904251fa74029","3efec6ffcbfe79f71f5410eb46f1c19e","b03211f6feccd3a62273368b52f6079d","d946e3e94fec670f9e47aca186ecaabe","5a9930c3eb4a6c624a67adb75584dfc2","6d0bf5684c233596a43bbb0ac23f2b79","bdf2096ac1c2cb24c49e02b887f2ca64","b570bfd958a2e23f777d2e0d748e208d","7741d27f60a52a8f6088c15aec783736","63b4205b99017588693d0e82d6de05cd","ebcc775409d48a956bef355ee41841c0","6eeae636ff43b60024b386c4f83aaab0","27bbffa557fc469f8798961bb55e7d84","7a1d2e76f55f477cf799fe9e1a779e07","9da31169bd9af344c1c3a90e7f89e6c8","ff267bcfd8b92eeda25b0dcc870ad0a7","bd1d76ba6d83df249b3b8d40edcfa8fa","230949c88cb5cac7743ccfe406447ea3")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("d1a1eaefe6bd2e245bba369e966d7a8eab9ed6ad1fa827321e5889cc8d43f976","c967e60500dcadc9b010774616a90b7f4b77bee00c048998ad9faf04d523f14f","2ea4135f3c934c365008eb4db94d8ac6ac054fb36c89c1655dedcb7b345b8c4d","d29fe0f811fe4dbdfc6d449631597137758e087980fc6f9274660e1d316ffb3c","39aa01d7e37c2571eb76d74f0e250aa08dac8f531677e89a321b07d9fadc9690","62c99f27a6f962f3bf2e8844e6ae62cbc367fe8ef57469f1053bef64a1aa3573","9db74edf468202903cb97d4e2a87d67b88e374c8a15d0a46c04782e88679e51f","8adcfbfa5c750d2bc1ff80496c67f7cc6a9bd959a72d40025cb2e9499d6946c7","8b0ea6a9e427ac3288663e2f33bc3df5ea01bfdaead81d4b6595b00a6b7c4301","6fcbcdcafc5accf1b2b0453eccd93c203ab1dca9920521b107c9cff8ce236eb2","486b535c91e8609867bce918693dd24f0d93437a710281ea65f34a9c088211ef","1d56e3fd6e8b45cf01b36cc95e35eb3644018231e528f4ac115c39c7e01e30ba","c4fb60217e3d43eac92074c45228506a","172fff2634545cf59d59c179d139e0aa","7b08580a4f6995f645a5bf8addbefa68","1b71434e049fb8765d528ecabd722072","c4f591cad9d158e2fbb0ed6425ce3804","5f03629508f46e822cf08d7864f585d3","f5cd5f616a482645bbf8f4c51ee38958","fa2c39adbb0ca7aeab5bc5cd1ffb2f08","00cd306f7cdcfe187c561dd42ab40f33","ca27970308b2fdeaa3a8e8e53c86cd3e","d946e3e94fec670f9e47aca186ecaabe","e18c4172329c32d8394ba0658d5212c2","2fde001f4c17c8613480091fa48b55a0","c1f4c9f969f955dec2465317b526b600","026e8e7acb2f2a156f8afff64fd54066","fb64c22d37c502bde55b19688d40c803","70b8040730c62e4a52a904251fa74029","3efec6ffcbfe79f71f5410eb46f1c19e","b03211f6feccd3a62273368b52f6079d","d946e3e94fec670f9e47aca186ecaabe","5a9930c3eb4a6c624a67adb75584dfc2","6d0bf5684c233596a43bbb0ac23f2b79","bdf2096ac1c2cb24c49e02b887f2ca64","b570bfd958a2e23f777d2e0d748e208d","7741d27f60a52a8f6088c15aec783736","63b4205b99017588693d0e82d6de05cd","ebcc775409d48a956bef355ee41841c0","6eeae636ff43b60024b386c4f83aaab0","27bbffa557fc469f8798961bb55e7d84","7a1d2e76f55f477cf799fe9e1a779e07","9da31169bd9af344c1c3a90e7f89e6c8","ff267bcfd8b92eeda25b0dcc870ad0a7","bd1d76ba6d83df249b3b8d40edcfa8fa","230949c88cb5cac7743ccfe406447ea3")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring64 NOT NULL AND customstring64 IN ("d1a1eaefe6bd2e245bba369e966d7a8eab9ed6ad1fa827321e5889cc8d43f976","c967e60500dcadc9b010774616a90b7f4b77bee00c048998ad9faf04d523f14f","2ea4135f3c934c365008eb4db94d8ac6ac054fb36c89c1655dedcb7b345b8c4d","d29fe0f811fe4dbdfc6d449631597137758e087980fc6f9274660e1d316ffb3c","39aa01d7e37c2571eb76d74f0e250aa08dac8f531677e89a321b07d9fadc9690","62c99f27a6f962f3bf2e8844e6ae62cbc367fe8ef57469f1053bef64a1aa3573","9db74edf468202903cb97d4e2a87d67b88e374c8a15d0a46c04782e88679e51f","8adcfbfa5c750d2bc1ff80496c67f7cc6a9bd959a72d40025cb2e9499d6946c7","8b0ea6a9e427ac3288663e2f33bc3df5ea01bfdaead81d4b6595b00a6b7c4301","6fcbcdcafc5accf1b2b0453eccd93c203ab1dca9920521b107c9cff8ce236eb2","486b535c91e8609867bce918693dd24f0d93437a710281ea65f34a9c088211ef","1d56e3fd6e8b45cf01b36cc95e35eb3644018231e528f4ac115c39c7e01e30ba","c4fb60217e3d43eac92074c45228506a","172fff2634545cf59d59c179d139e0aa","7b08580a4f6995f645a5bf8addbefa68","1b71434e049fb8765d528ecabd722072","c4f591cad9d158e2fbb0ed6425ce3804","5f03629508f46e822cf08d7864f585d3","f5cd5f616a482645bbf8f4c51ee38958","fa2c39adbb0ca7aeab5bc5cd1ffb2f08","00cd306f7cdcfe187c561dd42ab40f33","ca27970308b2fdeaa3a8e8e53c86cd3e","d946e3e94fec670f9e47aca186ecaabe","e18c4172329c32d8394ba0658d5212c2","2fde001f4c17c8613480091fa48b55a0","c1f4c9f969f955dec2465317b526b600","026e8e7acb2f2a156f8afff64fd54066","fb64c22d37c502bde55b19688d40c803","70b8040730c62e4a52a904251fa74029","3efec6ffcbfe79f71f5410eb46f1c19e","b03211f6feccd3a62273368b52f6079d","d946e3e94fec670f9e47aca186ecaabe","5a9930c3eb4a6c624a67adb75584dfc2","6d0bf5684c233596a43bbb0ac23f2b79","bdf2096ac1c2cb24c49e02b887f2ca64","b570bfd958a2e23f777d2e0d748e208d","7741d27f60a52a8f6088c15aec783736","63b4205b99017588693d0e82d6de05cd","ebcc775409d48a956bef355ee41841c0","6eeae636ff43b60024b386c4f83aaab0","27bbffa557fc469f8798961bb55e7d84","7a1d2e76f55f477cf799fe9e1a779e07","9da31169bd9af344c1c3a90e7f89e6c8","ff267bcfd8b92eeda25b0dcc870ad0a7","bd1d76ba6d83df249b3b8d40edcfa8fa","230949c88cb5cac7743ccfe406447ea3")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("d1a1eaefe6bd2e245bba369e966d7a8eab9ed6ad1fa827321e5889cc8d43f976","c967e60500dcadc9b010774616a90b7f4b77bee00c048998ad9faf04d523f14f","2ea4135f3c934c365008eb4db94d8ac6ac054fb36c89c1655dedcb7b345b8c4d","d29fe0f811fe4dbdfc6d449631597137758e087980fc6f9274660e1d316ffb3c","39aa01d7e37c2571eb76d74f0e250aa08dac8f531677e89a321b07d9fadc9690","62c99f27a6f962f3bf2e8844e6ae62cbc367fe8ef57469f1053bef64a1aa3573","9db74edf468202903cb97d4e2a87d67b88e374c8a15d0a46c04782e88679e51f","8adcfbfa5c750d2bc1ff80496c67f7cc6a9bd959a72d40025cb2e9499d6946c7","8b0ea6a9e427ac3288663e2f33bc3df5ea01bfdaead81d4b6595b00a6b7c4301","6fcbcdcafc5accf1b2b0453eccd93c203ab1dca9920521b107c9cff8ce236eb2","486b535c91e8609867bce918693dd24f0d93437a710281ea65f34a9c088211ef","1d56e3fd6e8b45cf01b36cc95e35eb3644018231e528f4ac115c39c7e01e30ba","c4fb60217e3d43eac92074c45228506a","172fff2634545cf59d59c179d139e0aa","7b08580a4f6995f645a5bf8addbefa68","1b71434e049fb8765d528ecabd722072","c4f591cad9d158e2fbb0ed6425ce3804","5f03629508f46e822cf08d7864f585d3","f5cd5f616a482645bbf8f4c51ee38958","fa2c39adbb0ca7aeab5bc5cd1ffb2f08","00cd306f7cdcfe187c561dd42ab40f33","ca27970308b2fdeaa3a8e8e53c86cd3e","d946e3e94fec670f9e47aca186ecaabe","e18c4172329c32d8394ba0658d5212c2","2fde001f4c17c8613480091fa48b55a0","c1f4c9f969f955dec2465317b526b600","026e8e7acb2f2a156f8afff64fd54066","fb64c22d37c502bde55b19688d40c803","70b8040730c62e4a52a904251fa74029","3efec6ffcbfe79f71f5410eb46f1c19e","b03211f6feccd3a62273368b52f6079d","d946e3e94fec670f9e47aca186ecaabe","5a9930c3eb4a6c624a67adb75584dfc2","6d0bf5684c233596a43bbb0ac23f2b79","bdf2096ac1c2cb24c49e02b887f2ca64","b570bfd958a2e23f777d2e0d748e208d","7741d27f60a52a8f6088c15aec783736","63b4205b99017588693d0e82d6de05cd","ebcc775409d48a956bef355ee41841c0","6eeae636ff43b60024b386c4f83aaab0","27bbffa557fc469f8798961bb55e7d84","7a1d2e76f55f477cf799fe9e1a779e07","9da31169bd9af344c1c3a90e7f89e6c8","ff267bcfd8b92eeda25b0dcc870ad0a7","bd1d76ba6d83df249b3b8d40edcfa8fa","230949c88cb5cac7743ccfe406447ea3")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("d1a1eaefe6bd2e245bba369e966d7a8eab9ed6ad1fa827321e5889cc8d43f976","c967e60500dcadc9b010774616a90b7f4b77bee00c048998ad9faf04d523f14f","2ea4135f3c934c365008eb4db94d8ac6ac054fb36c89c1655dedcb7b345b8c4d","d29fe0f811fe4dbdfc6d449631597137758e087980fc6f9274660e1d316ffb3c","39aa01d7e37c2571eb76d74f0e250aa08dac8f531677e89a321b07d9fadc9690","62c99f27a6f962f3bf2e8844e6ae62cbc367fe8ef57469f1053bef64a1aa3573","9db74edf468202903cb97d4e2a87d67b88e374c8a15d0a46c04782e88679e51f","8adcfbfa5c750d2bc1ff80496c67f7cc6a9bd959a72d40025cb2e9499d6946c7","8b0ea6a9e427ac3288663e2f33bc3df5ea01bfdaead81d4b6595b00a6b7c4301","6fcbcdcafc5accf1b2b0453eccd93c203ab1dca9920521b107c9cff8ce236eb2","486b535c91e8609867bce918693dd24f0d93437a710281ea65f34a9c088211ef","1d56e3fd6e8b45cf01b36cc95e35eb3644018231e528f4ac115c39c7e01e30ba","c4fb60217e3d43eac92074c45228506a","172fff2634545cf59d59c179d139e0aa","7b08580a4f6995f645a5bf8addbefa68","1b71434e049fb8765d528ecabd722072","c4f591cad9d158e2fbb0ed6425ce3804","5f03629508f46e822cf08d7864f585d3","f5cd5f616a482645bbf8f4c51ee38958","fa2c39adbb0ca7aeab5bc5cd1ffb2f08","00cd306f7cdcfe187c561dd42ab40f33","ca27970308b2fdeaa3a8e8e53c86cd3e","d946e3e94fec670f9e47aca186ecaabe","e18c4172329c32d8394ba0658d5212c2","2fde001f4c17c8613480091fa48b55a0","c1f4c9f969f955dec2465317b526b600","026e8e7acb2f2a156f8afff64fd54066","fb64c22d37c502bde55b19688d40c803","70b8040730c62e4a52a904251fa74029","3efec6ffcbfe79f71f5410eb46f1c19e","b03211f6feccd3a62273368b52f6079d","d946e3e94fec670f9e47aca186ecaabe","5a9930c3eb4a6c624a67adb75584dfc2","6d0bf5684c233596a43bbb0ac23f2b79","bdf2096ac1c2cb24c49e02b887f2ca64","b570bfd958a2e23f777d2e0d748e208d","7741d27f60a52a8f6088c15aec783736","63b4205b99017588693d0e82d6de05cd","ebcc775409d48a956bef355ee41841c0","6eeae636ff43b60024b386c4f83aaab0","27bbffa557fc469f8798961bb55e7d84","7a1d2e76f55f477cf799fe9e1a779e07","9da31169bd9af344c1c3a90e7f89e6c8","ff267bcfd8b92eeda25b0dcc870ad0a7","bd1d76ba6d83df249b3b8d40edcfa8fa","230949c88cb5cac7743ccfe406447ea3")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("d1a1eaefe6bd2e245bba369e966d7a8eab9ed6ad1fa827321e5889cc8d43f976","c967e60500dcadc9b010774616a90b7f4b77bee00c048998ad9faf04d523f14f","2ea4135f3c934c365008eb4db94d8ac6ac054fb36c89c1655dedcb7b345b8c4d","d29fe0f811fe4dbdfc6d449631597137758e087980fc6f9274660e1d316ffb3c","39aa01d7e37c2571eb76d74f0e250aa08dac8f531677e89a321b07d9fadc9690","62c99f27a6f962f3bf2e8844e6ae62cbc367fe8ef57469f1053bef64a1aa3573","9db74edf468202903cb97d4e2a87d67b88e374c8a15d0a46c04782e88679e51f","8adcfbfa5c750d2bc1ff80496c67f7cc6a9bd959a72d40025cb2e9499d6946c7","8b0ea6a9e427ac3288663e2f33bc3df5ea01bfdaead81d4b6595b00a6b7c4301","6fcbcdcafc5accf1b2b0453eccd93c203ab1dca9920521b107c9cff8ce236eb2","486b535c91e8609867bce918693dd24f0d93437a710281ea65f34a9c088211ef","1d56e3fd6e8b45cf01b36cc95e35eb3644018231e528f4ac115c39c7e01e30ba","c4fb60217e3d43eac92074c45228506a","172fff2634545cf59d59c179d139e0aa","7b08580a4f6995f645a5bf8addbefa68","1b71434e049fb8765d528ecabd722072","c4f591cad9d158e2fbb0ed6425ce3804","5f03629508f46e822cf08d7864f585d3","f5cd5f616a482645bbf8f4c51ee38958","fa2c39adbb0ca7aeab5bc5cd1ffb2f08","00cd306f7cdcfe187c561dd42ab40f33","ca27970308b2fdeaa3a8e8e53c86cd3e","d946e3e94fec670f9e47aca186ecaabe","e18c4172329c32d8394ba0658d5212c2","2fde001f4c17c8613480091fa48b55a0","c1f4c9f969f955dec2465317b526b600","026e8e7acb2f2a156f8afff64fd54066","fb64c22d37c502bde55b19688d40c803","70b8040730c62e4a52a904251fa74029","3efec6ffcbfe79f71f5410eb46f1c19e","b03211f6feccd3a62273368b52f6079d","d946e3e94fec670f9e47aca186ecaabe","5a9930c3eb4a6c624a67adb75584dfc2","6d0bf5684c233596a43bbb0ac23f2b79","bdf2096ac1c2cb24c49e02b887f2ca64","b570bfd958a2e23f777d2e0d748e208d","7741d27f60a52a8f6088c15aec783736","63b4205b99017588693d0e82d6de05cd","ebcc775409d48a956bef355ee41841c0","6eeae636ff43b60024b386c4f83aaab0","27bbffa557fc469f8798961bb55e7d84","7a1d2e76f55f477cf799fe9e1a779e07","9da31169bd9af344c1c3a90e7f89e6c8","ff267bcfd8b92eeda25b0dcc870ad0a7","bd1d76ba6d83df249b3b8d40edcfa8fa","230949c88cb5cac7743ccfe406447ea3")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("d1a1eaefe6bd2e245bba369e966d7a8eab9ed6ad1fa827321e5889cc8d43f976","c967e60500dcadc9b010774616a90b7f4b77bee00c048998ad9faf04d523f14f","2ea4135f3c934c365008eb4db94d8ac6ac054fb36c89c1655dedcb7b345b8c4d","d29fe0f811fe4dbdfc6d449631597137758e087980fc6f9274660e1d316ffb3c","39aa01d7e37c2571eb76d74f0e250aa08dac8f531677e89a321b07d9fadc9690","62c99f27a6f962f3bf2e8844e6ae62cbc367fe8ef57469f1053bef64a1aa3573","9db74edf468202903cb97d4e2a87d67b88e374c8a15d0a46c04782e88679e51f","8adcfbfa5c750d2bc1ff80496c67f7cc6a9bd959a72d40025cb2e9499d6946c7","8b0ea6a9e427ac3288663e2f33bc3df5ea01bfdaead81d4b6595b00a6b7c4301","6fcbcdcafc5accf1b2b0453eccd93c203ab1dca9920521b107c9cff8ce236eb2","486b535c91e8609867bce918693dd24f0d93437a710281ea65f34a9c088211ef","1d56e3fd6e8b45cf01b36cc95e35eb3644018231e528f4ac115c39c7e01e30ba","c4fb60217e3d43eac92074c45228506a","172fff2634545cf59d59c179d139e0aa","7b08580a4f6995f645a5bf8addbefa68","1b71434e049fb8765d528ecabd722072","c4f591cad9d158e2fbb0ed6425ce3804","5f03629508f46e822cf08d7864f585d3","f5cd5f616a482645bbf8f4c51ee38958","fa2c39adbb0ca7aeab5bc5cd1ffb2f08","00cd306f7cdcfe187c561dd42ab40f33","ca27970308b2fdeaa3a8e8e53c86cd3e","d946e3e94fec670f9e47aca186ecaabe","e18c4172329c32d8394ba0658d5212c2","2fde001f4c17c8613480091fa48b55a0","c1f4c9f969f955dec2465317b526b600","026e8e7acb2f2a156f8afff64fd54066","fb64c22d37c502bde55b19688d40c803","70b8040730c62e4a52a904251fa74029","3efec6ffcbfe79f71f5410eb46f1c19e","b03211f6feccd3a62273368b52f6079d","d946e3e94fec670f9e47aca186ecaabe","5a9930c3eb4a6c624a67adb75584dfc2","6d0bf5684c233596a43bbb0ac23f2b79","bdf2096ac1c2cb24c49e02b887f2ca64","b570bfd958a2e23f777d2e0d748e208d","7741d27f60a52a8f6088c15aec783736","63b4205b99017588693d0e82d6de05cd","ebcc775409d48a956bef355ee41841c0","6eeae636ff43b60024b386c4f83aaab0","27bbffa557fc469f8798961bb55e7d84","7a1d2e76f55f477cf799fe9e1a779e07","9da31169bd9af344c1c3a90e7f89e6c8","ff267bcfd8b92eeda25b0dcc870ad0a7","bd1d76ba6d83df249b3b8d40edcfa8fa","230949c88cb5cac7743ccfe406447ea3")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("d1a1eaefe6bd2e245bba369e966d7a8eab9ed6ad1fa827321e5889cc8d43f976","c967e60500dcadc9b010774616a90b7f4b77bee00c048998ad9faf04d523f14f","2ea4135f3c934c365008eb4db94d8ac6ac054fb36c89c1655dedcb7b345b8c4d","d29fe0f811fe4dbdfc6d449631597137758e087980fc6f9274660e1d316ffb3c","39aa01d7e37c2571eb76d74f0e250aa08dac8f531677e89a321b07d9fadc9690","62c99f27a6f962f3bf2e8844e6ae62cbc367fe8ef57469f1053bef64a1aa3573","9db74edf468202903cb97d4e2a87d67b88e374c8a15d0a46c04782e88679e51f","8adcfbfa5c750d2bc1ff80496c67f7cc6a9bd959a72d40025cb2e9499d6946c7","8b0ea6a9e427ac3288663e2f33bc3df5ea01bfdaead81d4b6595b00a6b7c4301","6fcbcdcafc5accf1b2b0453eccd93c203ab1dca9920521b107c9cff8ce236eb2","486b535c91e8609867bce918693dd24f0d93437a710281ea65f34a9c088211ef","1d56e3fd6e8b45cf01b36cc95e35eb3644018231e528f4ac115c39c7e01e30ba","c4fb60217e3d43eac92074c45228506a","172fff2634545cf59d59c179d139e0aa","7b08580a4f6995f645a5bf8addbefa68","1b71434e049fb8765d528ecabd722072","c4f591cad9d158e2fbb0ed6425ce3804","5f03629508f46e822cf08d7864f585d3","f5cd5f616a482645bbf8f4c51ee38958","fa2c39adbb0ca7aeab5bc5cd1ffb2f08","00cd306f7cdcfe187c561dd42ab40f33","ca27970308b2fdeaa3a8e8e53c86cd3e","d946e3e94fec670f9e47aca186ecaabe","e18c4172329c32d8394ba0658d5212c2","2fde001f4c17c8613480091fa48b55a0","c1f4c9f969f955dec2465317b526b600","026e8e7acb2f2a156f8afff64fd54066","fb64c22d37c502bde55b19688d40c803","70b8040730c62e4a52a904251fa74029","3efec6ffcbfe79f71f5410eb46f1c19e","b03211f6feccd3a62273368b52f6079d","d946e3e94fec670f9e47aca186ecaabe","5a9930c3eb4a6c624a67adb75584dfc2","6d0bf5684c233596a43bbb0ac23f2b79","bdf2096ac1c2cb24c49e02b887f2ca64","b570bfd958a2e23f777d2e0d748e208d","7741d27f60a52a8f6088c15aec783736","63b4205b99017588693d0e82d6de05cd","ebcc775409d48a956bef355ee41841c0","6eeae636ff43b60024b386c4f83aaab0","27bbffa557fc469f8798961bb55e7d84","7a1d2e76f55f477cf799fe9e1a779e07","9da31169bd9af344c1c3a90e7f89e6c8","ff267bcfd8b92eeda25b0dcc870ad0a7","bd1d76ba6d83df249b3b8d40edcfa8fa","230949c88cb5cac7743ccfe406447ea3")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("d1a1eaefe6bd2e245bba369e966d7a8eab9ed6ad1fa827321e5889cc8d43f976","c967e60500dcadc9b010774616a90b7f4b77bee00c048998ad9faf04d523f14f","2ea4135f3c934c365008eb4db94d8ac6ac054fb36c89c1655dedcb7b345b8c4d","d29fe0f811fe4dbdfc6d449631597137758e087980fc6f9274660e1d316ffb3c","39aa01d7e37c2571eb76d74f0e250aa08dac8f531677e89a321b07d9fadc9690","62c99f27a6f962f3bf2e8844e6ae62cbc367fe8ef57469f1053bef64a1aa3573","9db74edf468202903cb97d4e2a87d67b88e374c8a15d0a46c04782e88679e51f","8adcfbfa5c750d2bc1ff80496c67f7cc6a9bd959a72d40025cb2e9499d6946c7","8b0ea6a9e427ac3288663e2f33bc3df5ea01bfdaead81d4b6595b00a6b7c4301","6fcbcdcafc5accf1b2b0453eccd93c203ab1dca9920521b107c9cff8ce236eb2","486b535c91e8609867bce918693dd24f0d93437a710281ea65f34a9c088211ef","1d56e3fd6e8b45cf01b36cc95e35eb3644018231e528f4ac115c39c7e01e30ba","c4fb60217e3d43eac92074c45228506a","172fff2634545cf59d59c179d139e0aa","7b08580a4f6995f645a5bf8addbefa68","1b71434e049fb8765d528ecabd722072","c4f591cad9d158e2fbb0ed6425ce3804","5f03629508f46e822cf08d7864f585d3","f5cd5f616a482645bbf8f4c51ee38958","fa2c39adbb0ca7aeab5bc5cd1ffb2f08","00cd306f7cdcfe187c561dd42ab40f33","ca27970308b2fdeaa3a8e8e53c86cd3e","d946e3e94fec670f9e47aca186ecaabe","e18c4172329c32d8394ba0658d5212c2","2fde001f4c17c8613480091fa48b55a0","c1f4c9f969f955dec2465317b526b600","026e8e7acb2f2a156f8afff64fd54066","fb64c22d37c502bde55b19688d40c803","70b8040730c62e4a52a904251fa74029","3efec6ffcbfe79f71f5410eb46f1c19e","b03211f6feccd3a62273368b52f6079d","d946e3e94fec670f9e47aca186ecaabe","5a9930c3eb4a6c624a67adb75584dfc2","6d0bf5684c233596a43bbb0ac23f2b79","bdf2096ac1c2cb24c49e02b887f2ca64","b570bfd958a2e23f777d2e0d748e208d","7741d27f60a52a8f6088c15aec783736","63b4205b99017588693d0e82d6de05cd","ebcc775409d48a956bef355ee41841c0","6eeae636ff43b60024b386c4f83aaab0","27bbffa557fc469f8798961bb55e7d84","7a1d2e76f55f477cf799fe9e1a779e07","9da31169bd9af344c1c3a90e7f89e6c8","ff267bcfd8b92eeda25b0dcc870ad0a7","bd1d76ba6d83df249b3b8d40edcfa8fa","230949c88cb5cac7743ccfe406447ea3")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("d1a1eaefe6bd2e245bba369e966d7a8eab9ed6ad1fa827321e5889cc8d43f976","c967e60500dcadc9b010774616a90b7f4b77bee00c048998ad9faf04d523f14f","2ea4135f3c934c365008eb4db94d8ac6ac054fb36c89c1655dedcb7b345b8c4d","d29fe0f811fe4dbdfc6d449631597137758e087980fc6f9274660e1d316ffb3c","39aa01d7e37c2571eb76d74f0e250aa08dac8f531677e89a321b07d9fadc9690","62c99f27a6f962f3bf2e8844e6ae62cbc367fe8ef57469f1053bef64a1aa3573","9db74edf468202903cb97d4e2a87d67b88e374c8a15d0a46c04782e88679e51f","8adcfbfa5c750d2bc1ff80496c67f7cc6a9bd959a72d40025cb2e9499d6946c7","8b0ea6a9e427ac3288663e2f33bc3df5ea01bfdaead81d4b6595b00a6b7c4301","6fcbcdcafc5accf1b2b0453eccd93c203ab1dca9920521b107c9cff8ce236eb2","486b535c91e8609867bce918693dd24f0d93437a710281ea65f34a9c088211ef","1d56e3fd6e8b45cf01b36cc95e35eb3644018231e528f4ac115c39c7e01e30ba","c4fb60217e3d43eac92074c45228506a","172fff2634545cf59d59c179d139e0aa","7b08580a4f6995f645a5bf8addbefa68","1b71434e049fb8765d528ecabd722072","c4f591cad9d158e2fbb0ed6425ce3804","5f03629508f46e822cf08d7864f585d3","f5cd5f616a482645bbf8f4c51ee38958","fa2c39adbb0ca7aeab5bc5cd1ffb2f08","00cd306f7cdcfe187c561dd42ab40f33","ca27970308b2fdeaa3a8e8e53c86cd3e","d946e3e94fec670f9e47aca186ecaabe","e18c4172329c32d8394ba0658d5212c2","2fde001f4c17c8613480091fa48b55a0","c1f4c9f969f955dec2465317b526b600","026e8e7acb2f2a156f8afff64fd54066","fb64c22d37c502bde55b19688d40c803","70b8040730c62e4a52a904251fa74029","3efec6ffcbfe79f71f5410eb46f1c19e","b03211f6feccd3a62273368b52f6079d","d946e3e94fec670f9e47aca186ecaabe","5a9930c3eb4a6c624a67adb75584dfc2","6d0bf5684c233596a43bbb0ac23f2b79","bdf2096ac1c2cb24c49e02b887f2ca64","b570bfd958a2e23f777d2e0d748e208d","7741d27f60a52a8f6088c15aec783736","63b4205b99017588693d0e82d6de05cd","ebcc775409d48a956bef355ee41841c0","6eeae636ff43b60024b386c4f83aaab0","27bbffa557fc469f8798961bb55e7d84","7a1d2e76f55f477cf799fe9e1a779e07","9da31169bd9af344c1c3a90e7f89e6c8","ff267bcfd8b92eeda25b0dcc870ad0a7","bd1d76ba6d83df249b3b8d40edcfa8fa","230949c88cb5cac7743ccfe406447ea3")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("d1a1eaefe6bd2e245bba369e966d7a8eab9ed6ad1fa827321e5889cc8d43f976","c967e60500dcadc9b010774616a90b7f4b77bee00c048998ad9faf04d523f14f","2ea4135f3c934c365008eb4db94d8ac6ac054fb36c89c1655dedcb7b345b8c4d","d29fe0f811fe4dbdfc6d449631597137758e087980fc6f9274660e1d316ffb3c","39aa01d7e37c2571eb76d74f0e250aa08dac8f531677e89a321b07d9fadc9690","62c99f27a6f962f3bf2e8844e6ae62cbc367fe8ef57469f1053bef64a1aa3573","9db74edf468202903cb97d4e2a87d67b88e374c8a15d0a46c04782e88679e51f","8adcfbfa5c750d2bc1ff80496c67f7cc6a9bd959a72d40025cb2e9499d6946c7","8b0ea6a9e427ac3288663e2f33bc3df5ea01bfdaead81d4b6595b00a6b7c4301","6fcbcdcafc5accf1b2b0453eccd93c203ab1dca9920521b107c9cff8ce236eb2","486b535c91e8609867bce918693dd24f0d93437a710281ea65f34a9c088211ef","1d56e3fd6e8b45cf01b36cc95e35eb3644018231e528f4ac115c39c7e01e30ba","c4fb60217e3d43eac92074c45228506a","172fff2634545cf59d59c179d139e0aa","7b08580a4f6995f645a5bf8addbefa68","1b71434e049fb8765d528ecabd722072","c4f591cad9d158e2fbb0ed6425ce3804","5f03629508f46e822cf08d7864f585d3","f5cd5f616a482645bbf8f4c51ee38958","fa2c39adbb0ca7aeab5bc5cd1ffb2f08","00cd306f7cdcfe187c561dd42ab40f33","ca27970308b2fdeaa3a8e8e53c86cd3e","d946e3e94fec670f9e47aca186ecaabe","e18c4172329c32d8394ba0658d5212c2","2fde001f4c17c8613480091fa48b55a0","c1f4c9f969f955dec2465317b526b600","026e8e7acb2f2a156f8afff64fd54066","fb64c22d37c502bde55b19688d40c803","70b8040730c62e4a52a904251fa74029","3efec6ffcbfe79f71f5410eb46f1c19e","b03211f6feccd3a62273368b52f6079d","d946e3e94fec670f9e47aca186ecaabe","5a9930c3eb4a6c624a67adb75584dfc2","6d0bf5684c233596a43bbb0ac23f2b79","bdf2096ac1c2cb24c49e02b887f2ca64","b570bfd958a2e23f777d2e0d748e208d","7741d27f60a52a8f6088c15aec783736","63b4205b99017588693d0e82d6de05cd","ebcc775409d48a956bef355ee41841c0","6eeae636ff43b60024b386c4f83aaab0","27bbffa557fc469f8798961bb55e7d84","7a1d2e76f55f477cf799fe9e1a779e07","9da31169bd9af344c1c3a90e7f89e6c8","ff267bcfd8b92eeda25b0dcc870ad0a7","bd1d76ba6d83df249b3b8d40edcfa8fa","230949c88cb5cac7743ccfe406447ea3")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("d1a1eaefe6bd2e245bba369e966d7a8eab9ed6ad1fa827321e5889cc8d43f976","c967e60500dcadc9b010774616a90b7f4b77bee00c048998ad9faf04d523f14f","2ea4135f3c934c365008eb4db94d8ac6ac054fb36c89c1655dedcb7b345b8c4d","d29fe0f811fe4dbdfc6d449631597137758e087980fc6f9274660e1d316ffb3c","39aa01d7e37c2571eb76d74f0e250aa08dac8f531677e89a321b07d9fadc9690","62c99f27a6f962f3bf2e8844e6ae62cbc367fe8ef57469f1053bef64a1aa3573","9db74edf468202903cb97d4e2a87d67b88e374c8a15d0a46c04782e88679e51f","8adcfbfa5c750d2bc1ff80496c67f7cc6a9bd959a72d40025cb2e9499d6946c7","8b0ea6a9e427ac3288663e2f33bc3df5ea01bfdaead81d4b6595b00a6b7c4301","6fcbcdcafc5accf1b2b0453eccd93c203ab1dca9920521b107c9cff8ce236eb2","486b535c91e8609867bce918693dd24f0d93437a710281ea65f34a9c088211ef","1d56e3fd6e8b45cf01b36cc95e35eb3644018231e528f4ac115c39c7e01e30ba","c4fb60217e3d43eac92074c45228506a","172fff2634545cf59d59c179d139e0aa","7b08580a4f6995f645a5bf8addbefa68","1b71434e049fb8765d528ecabd722072","c4f591cad9d158e2fbb0ed6425ce3804","5f03629508f46e822cf08d7864f585d3","f5cd5f616a482645bbf8f4c51ee38958","fa2c39adbb0ca7aeab5bc5cd1ffb2f08","00cd306f7cdcfe187c561dd42ab40f33","ca27970308b2fdeaa3a8e8e53c86cd3e","d946e3e94fec670f9e47aca186ecaabe","e18c4172329c32d8394ba0658d5212c2","2fde001f4c17c8613480091fa48b55a0","c1f4c9f969f955dec2465317b526b600","026e8e7acb2f2a156f8afff64fd54066","fb64c22d37c502bde55b19688d40c803","70b8040730c62e4a52a904251fa74029","3efec6ffcbfe79f71f5410eb46f1c19e","b03211f6feccd3a62273368b52f6079d","d946e3e94fec670f9e47aca186ecaabe","5a9930c3eb4a6c624a67adb75584dfc2","6d0bf5684c233596a43bbb0ac23f2b79","bdf2096ac1c2cb24c49e02b887f2ca64","b570bfd958a2e23f777d2e0d748e208d","7741d27f60a52a8f6088c15aec783736","63b4205b99017588693d0e82d6de05cd","ebcc775409d48a956bef355ee41841c0","6eeae636ff43b60024b386c4f83aaab0","27bbffa557fc469f8798961bb55e7d84","7a1d2e76f55f477cf799fe9e1a779e07","9da31169bd9af344c1c3a90e7f89e6c8","ff267bcfd8b92eeda25b0dcc870ad0a7","bd1d76ba6d83df249b3b8d40edcfa8fa","230949c88cb5cac7743ccfe406447ea3")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("d1a1eaefe6bd2e245bba369e966d7a8eab9ed6ad1fa827321e5889cc8d43f976","c967e60500dcadc9b010774616a90b7f4b77bee00c048998ad9faf04d523f14f","2ea4135f3c934c365008eb4db94d8ac6ac054fb36c89c1655dedcb7b345b8c4d","d29fe0f811fe4dbdfc6d449631597137758e087980fc6f9274660e1d316ffb3c","39aa01d7e37c2571eb76d74f0e250aa08dac8f531677e89a321b07d9fadc9690","62c99f27a6f962f3bf2e8844e6ae62cbc367fe8ef57469f1053bef64a1aa3573","9db74edf468202903cb97d4e2a87d67b88e374c8a15d0a46c04782e88679e51f","8adcfbfa5c750d2bc1ff80496c67f7cc6a9bd959a72d40025cb2e9499d6946c7","8b0ea6a9e427ac3288663e2f33bc3df5ea01bfdaead81d4b6595b00a6b7c4301","6fcbcdcafc5accf1b2b0453eccd93c203ab1dca9920521b107c9cff8ce236eb2","486b535c91e8609867bce918693dd24f0d93437a710281ea65f34a9c088211ef","1d56e3fd6e8b45cf01b36cc95e35eb3644018231e528f4ac115c39c7e01e30ba","c4fb60217e3d43eac92074c45228506a","172fff2634545cf59d59c179d139e0aa","7b08580a4f6995f645a5bf8addbefa68","1b71434e049fb8765d528ecabd722072","c4f591cad9d158e2fbb0ed6425ce3804","5f03629508f46e822cf08d7864f585d3","f5cd5f616a482645bbf8f4c51ee38958","fa2c39adbb0ca7aeab5bc5cd1ffb2f08","00cd306f7cdcfe187c561dd42ab40f33","ca27970308b2fdeaa3a8e8e53c86cd3e","d946e3e94fec670f9e47aca186ecaabe","e18c4172329c32d8394ba0658d5212c2","2fde001f4c17c8613480091fa48b55a0","c1f4c9f969f955dec2465317b526b600","026e8e7acb2f2a156f8afff64fd54066","fb64c22d37c502bde55b19688d40c803","70b8040730c62e4a52a904251fa74029","3efec6ffcbfe79f71f5410eb46f1c19e","b03211f6feccd3a62273368b52f6079d","d946e3e94fec670f9e47aca186ecaabe","5a9930c3eb4a6c624a67adb75584dfc2","6d0bf5684c233596a43bbb0ac23f2b79","bdf2096ac1c2cb24c49e02b887f2ca64","b570bfd958a2e23f777d2e0d748e208d","7741d27f60a52a8f6088c15aec783736","63b4205b99017588693d0e82d6de05cd","ebcc775409d48a956bef355ee41841c0","6eeae636ff43b60024b386c4f83aaab0","27bbffa557fc469f8798961bb55e7d84","7a1d2e76f55f477cf799fe9e1a779e07","9da31169bd9af344c1c3a90e7f89e6c8","ff267bcfd8b92eeda25b0dcc870ad0a7","bd1d76ba6d83df249b3b8d40edcfa8fa","230949c88cb5cac7743ccfe406447ea3")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("d1a1eaefe6bd2e245bba369e966d7a8eab9ed6ad1fa827321e5889cc8d43f976","c967e60500dcadc9b010774616a90b7f4b77bee00c048998ad9faf04d523f14f","2ea4135f3c934c365008eb4db94d8ac6ac054fb36c89c1655dedcb7b345b8c4d","d29fe0f811fe4dbdfc6d449631597137758e087980fc6f9274660e1d316ffb3c","39aa01d7e37c2571eb76d74f0e250aa08dac8f531677e89a321b07d9fadc9690","62c99f27a6f962f3bf2e8844e6ae62cbc367fe8ef57469f1053bef64a1aa3573","9db74edf468202903cb97d4e2a87d67b88e374c8a15d0a46c04782e88679e51f","8adcfbfa5c750d2bc1ff80496c67f7cc6a9bd959a72d40025cb2e9499d6946c7","8b0ea6a9e427ac3288663e2f33bc3df5ea01bfdaead81d4b6595b00a6b7c4301","6fcbcdcafc5accf1b2b0453eccd93c203ab1dca9920521b107c9cff8ce236eb2","486b535c91e8609867bce918693dd24f0d93437a710281ea65f34a9c088211ef","1d56e3fd6e8b45cf01b36cc95e35eb3644018231e528f4ac115c39c7e01e30ba","c4fb60217e3d43eac92074c45228506a","172fff2634545cf59d59c179d139e0aa","7b08580a4f6995f645a5bf8addbefa68","1b71434e049fb8765d528ecabd722072","c4f591cad9d158e2fbb0ed6425ce3804","5f03629508f46e822cf08d7864f585d3","f5cd5f616a482645bbf8f4c51ee38958","fa2c39adbb0ca7aeab5bc5cd1ffb2f08","00cd306f7cdcfe187c561dd42ab40f33","ca27970308b2fdeaa3a8e8e53c86cd3e","d946e3e94fec670f9e47aca186ecaabe","e18c4172329c32d8394ba0658d5212c2","2fde001f4c17c8613480091fa48b55a0","c1f4c9f969f955dec2465317b526b600","026e8e7acb2f2a156f8afff64fd54066","fb64c22d37c502bde55b19688d40c803","70b8040730c62e4a52a904251fa74029","3efec6ffcbfe79f71f5410eb46f1c19e","b03211f6feccd3a62273368b52f6079d","d946e3e94fec670f9e47aca186ecaabe","5a9930c3eb4a6c624a67adb75584dfc2","6d0bf5684c233596a43bbb0ac23f2b79","bdf2096ac1c2cb24c49e02b887f2ca64","b570bfd958a2e23f777d2e0d748e208d","7741d27f60a52a8f6088c15aec783736","63b4205b99017588693d0e82d6de05cd","ebcc775409d48a956bef355ee41841c0","6eeae636ff43b60024b386c4f83aaab0","27bbffa557fc469f8798961bb55e7d84","7a1d2e76f55f477cf799fe9e1a779e07","9da31169bd9af344c1c3a90e7f89e6c8","ff267bcfd8b92eeda25b0dcc870ad0a7","bd1d76ba6d83df249b3b8d40edcfa8fa","230949c88cb5cac7743ccfe406447ea3")
index=activity AND rg_functionality="Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("d1a1eaefe6bd2e245bba369e966d7a8eab9ed6ad1fa827321e5889cc8d43f976","c967e60500dcadc9b010774616a90b7f4b77bee00c048998ad9faf04d523f14f","2ea4135f3c934c365008eb4db94d8ac6ac054fb36c89c1655dedcb7b345b8c4d","d29fe0f811fe4dbdfc6d449631597137758e087980fc6f9274660e1d316ffb3c","39aa01d7e37c2571eb76d74f0e250aa08dac8f531677e89a321b07d9fadc9690","62c99f27a6f962f3bf2e8844e6ae62cbc367fe8ef57469f1053bef64a1aa3573","9db74edf468202903cb97d4e2a87d67b88e374c8a15d0a46c04782e88679e51f","8adcfbfa5c750d2bc1ff80496c67f7cc6a9bd959a72d40025cb2e9499d6946c7","8b0ea6a9e427ac3288663e2f33bc3df5ea01bfdaead81d4b6595b00a6b7c4301","6fcbcdcafc5accf1b2b0453eccd93c203ab1dca9920521b107c9cff8ce236eb2","486b535c91e8609867bce918693dd24f0d93437a710281ea65f34a9c088211ef","1d56e3fd6e8b45cf01b36cc95e35eb3644018231e528f4ac115c39c7e01e30ba","c4fb60217e3d43eac92074c45228506a","172fff2634545cf59d59c179d139e0aa","7b08580a4f6995f645a5bf8addbefa68","1b71434e049fb8765d528ecabd722072","c4f591cad9d158e2fbb0ed6425ce3804","5f03629508f46e822cf08d7864f585d3","f5cd5f616a482645bbf8f4c51ee38958","fa2c39adbb0ca7aeab5bc5cd1ffb2f08","00cd306f7cdcfe187c561dd42ab40f33","ca27970308b2fdeaa3a8e8e53c86cd3e","d946e3e94fec670f9e47aca186ecaabe","e18c4172329c32d8394ba0658d5212c2","2fde001f4c17c8613480091fa48b55a0","c1f4c9f969f955dec2465317b526b600","026e8e7acb2f2a156f8afff64fd54066","fb64c22d37c502bde55b19688d40c803","70b8040730c62e4a52a904251fa74029","3efec6ffcbfe79f71f5410eb46f1c19e","b03211f6feccd3a62273368b52f6079d","d946e3e94fec670f9e47aca186ecaabe","5a9930c3eb4a6c624a67adb75584dfc2","6d0bf5684c233596a43bbb0ac23f2b79","bdf2096ac1c2cb24c49e02b887f2ca64","b570bfd958a2e23f777d2e0d748e208d","7741d27f60a52a8f6088c15aec783736","63b4205b99017588693d0e82d6de05cd","ebcc775409d48a956bef355ee41841c0","6eeae636ff43b60024b386c4f83aaab0","27bbffa557fc469f8798961bb55e7d84","7a1d2e76f55f477cf799fe9e1a779e07","9da31169bd9af344c1c3a90e7f89e6c8","ff267bcfd8b92eeda25b0dcc870ad0a7","bd1d76ba6d83df249b3b8d40edcfa8fa","230949c88cb5cac7743ccfe406447ea3")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("d1a1eaefe6bd2e245bba369e966d7a8eab9ed6ad1fa827321e5889cc8d43f976","c967e60500dcadc9b010774616a90b7f4b77bee00c048998ad9faf04d523f14f","2ea4135f3c934c365008eb4db94d8ac6ac054fb36c89c1655dedcb7b345b8c4d","d29fe0f811fe4dbdfc6d449631597137758e087980fc6f9274660e1d316ffb3c","39aa01d7e37c2571eb76d74f0e250aa08dac8f531677e89a321b07d9fadc9690","62c99f27a6f962f3bf2e8844e6ae62cbc367fe8ef57469f1053bef64a1aa3573","9db74edf468202903cb97d4e2a87d67b88e374c8a15d0a46c04782e88679e51f","8adcfbfa5c750d2bc1ff80496c67f7cc6a9bd959a72d40025cb2e9499d6946c7","8b0ea6a9e427ac3288663e2f33bc3df5ea01bfdaead81d4b6595b00a6b7c4301","6fcbcdcafc5accf1b2b0453eccd93c203ab1dca9920521b107c9cff8ce236eb2","486b535c91e8609867bce918693dd24f0d93437a710281ea65f34a9c088211ef","1d56e3fd6e8b45cf01b36cc95e35eb3644018231e528f4ac115c39c7e01e30ba","c4fb60217e3d43eac92074c45228506a","172fff2634545cf59d59c179d139e0aa","7b08580a4f6995f645a5bf8addbefa68","1b71434e049fb8765d528ecabd722072","c4f591cad9d158e2fbb0ed6425ce3804","5f03629508f46e822cf08d7864f585d3","f5cd5f616a482645bbf8f4c51ee38958","fa2c39adbb0ca7aeab5bc5cd1ffb2f08","00cd306f7cdcfe187c561dd42ab40f33","ca27970308b2fdeaa3a8e8e53c86cd3e","d946e3e94fec670f9e47aca186ecaabe","e18c4172329c32d8394ba0658d5212c2","2fde001f4c17c8613480091fa48b55a0","c1f4c9f969f955dec2465317b526b600","026e8e7acb2f2a156f8afff64fd54066","fb64c22d37c502bde55b19688d40c803","70b8040730c62e4a52a904251fa74029","3efec6ffcbfe79f71f5410eb46f1c19e","b03211f6feccd3a62273368b52f6079d","d946e3e94fec670f9e47aca186ecaabe","5a9930c3eb4a6c624a67adb75584dfc2","6d0bf5684c233596a43bbb0ac23f2b79","bdf2096ac1c2cb24c49e02b887f2ca64","b570bfd958a2e23f777d2e0d748e208d","7741d27f60a52a8f6088c15aec783736","63b4205b99017588693d0e82d6de05cd","ebcc775409d48a956bef355ee41841c0","6eeae636ff43b60024b386c4f83aaab0","27bbffa557fc469f8798961bb55e7d84","7a1d2e76f55f477cf799fe9e1a779e07","9da31169bd9af344c1c3a90e7f89e6c8","ff267bcfd8b92eeda25b0dcc870ad0a7","bd1d76ba6d83df249b3b8d40edcfa8fa","230949c88cb5cac7743ccfe406447ea3")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("d1a1eaefe6bd2e245bba369e966d7a8eab9ed6ad1fa827321e5889cc8d43f976","c967e60500dcadc9b010774616a90b7f4b77bee00c048998ad9faf04d523f14f","2ea4135f3c934c365008eb4db94d8ac6ac054fb36c89c1655dedcb7b345b8c4d","d29fe0f811fe4dbdfc6d449631597137758e087980fc6f9274660e1d316ffb3c","39aa01d7e37c2571eb76d74f0e250aa08dac8f531677e89a321b07d9fadc9690","62c99f27a6f962f3bf2e8844e6ae62cbc367fe8ef57469f1053bef64a1aa3573","9db74edf468202903cb97d4e2a87d67b88e374c8a15d0a46c04782e88679e51f","8adcfbfa5c750d2bc1ff80496c67f7cc6a9bd959a72d40025cb2e9499d6946c7","8b0ea6a9e427ac3288663e2f33bc3df5ea01bfdaead81d4b6595b00a6b7c4301","6fcbcdcafc5accf1b2b0453eccd93c203ab1dca9920521b107c9cff8ce236eb2","486b535c91e8609867bce918693dd24f0d93437a710281ea65f34a9c088211ef","1d56e3fd6e8b45cf01b36cc95e35eb3644018231e528f4ac115c39c7e01e30ba","c4fb60217e3d43eac92074c45228506a","172fff2634545cf59d59c179d139e0aa","7b08580a4f6995f645a5bf8addbefa68","1b71434e049fb8765d528ecabd722072","c4f591cad9d158e2fbb0ed6425ce3804","5f03629508f46e822cf08d7864f585d3","f5cd5f616a482645bbf8f4c51ee38958","fa2c39adbb0ca7aeab5bc5cd1ffb2f08","00cd306f7cdcfe187c561dd42ab40f33","ca27970308b2fdeaa3a8e8e53c86cd3e","d946e3e94fec670f9e47aca186ecaabe","e18c4172329c32d8394ba0658d5212c2","2fde001f4c17c8613480091fa48b55a0","c1f4c9f969f955dec2465317b526b600","026e8e7acb2f2a156f8afff64fd54066","fb64c22d37c502bde55b19688d40c803","70b8040730c62e4a52a904251fa74029","3efec6ffcbfe79f71f5410eb46f1c19e","b03211f6feccd3a62273368b52f6079d","d946e3e94fec670f9e47aca186ecaabe","5a9930c3eb4a6c624a67adb75584dfc2","6d0bf5684c233596a43bbb0ac23f2b79","bdf2096ac1c2cb24c49e02b887f2ca64","b570bfd958a2e23f777d2e0d748e208d","7741d27f60a52a8f6088c15aec783736","63b4205b99017588693d0e82d6de05cd","ebcc775409d48a956bef355ee41841c0","6eeae636ff43b60024b386c4f83aaab0","27bbffa557fc469f8798961bb55e7d84","7a1d2e76f55f477cf799fe9e1a779e07","9da31169bd9af344c1c3a90e7f89e6c8","ff267bcfd8b92eeda25b0dcc870ad0a7","bd1d76ba6d83df249b3b8d40edcfa8fa","230949c88cb5cac7743ccfe406447ea3")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("d1a1eaefe6bd2e245bba369e966d7a8eab9ed6ad1fa827321e5889cc8d43f976","c967e60500dcadc9b010774616a90b7f4b77bee00c048998ad9faf04d523f14f","2ea4135f3c934c365008eb4db94d8ac6ac054fb36c89c1655dedcb7b345b8c4d","d29fe0f811fe4dbdfc6d449631597137758e087980fc6f9274660e1d316ffb3c","39aa01d7e37c2571eb76d74f0e250aa08dac8f531677e89a321b07d9fadc9690","62c99f27a6f962f3bf2e8844e6ae62cbc367fe8ef57469f1053bef64a1aa3573","9db74edf468202903cb97d4e2a87d67b88e374c8a15d0a46c04782e88679e51f","8adcfbfa5c750d2bc1ff80496c67f7cc6a9bd959a72d40025cb2e9499d6946c7","8b0ea6a9e427ac3288663e2f33bc3df5ea01bfdaead81d4b6595b00a6b7c4301","6fcbcdcafc5accf1b2b0453eccd93c203ab1dca9920521b107c9cff8ce236eb2","486b535c91e8609867bce918693dd24f0d93437a710281ea65f34a9c088211ef","1d56e3fd6e8b45cf01b36cc95e35eb3644018231e528f4ac115c39c7e01e30ba","c4fb60217e3d43eac92074c45228506a","172fff2634545cf59d59c179d139e0aa","7b08580a4f6995f645a5bf8addbefa68","1b71434e049fb8765d528ecabd722072","c4f591cad9d158e2fbb0ed6425ce3804","5f03629508f46e822cf08d7864f585d3","f5cd5f616a482645bbf8f4c51ee38958","fa2c39adbb0ca7aeab5bc5cd1ffb2f08","00cd306f7cdcfe187c561dd42ab40f33","ca27970308b2fdeaa3a8e8e53c86cd3e","d946e3e94fec670f9e47aca186ecaabe","e18c4172329c32d8394ba0658d5212c2","2fde001f4c17c8613480091fa48b55a0","c1f4c9f969f955dec2465317b526b600","026e8e7acb2f2a156f8afff64fd54066","fb64c22d37c502bde55b19688d40c803","70b8040730c62e4a52a904251fa74029","3efec6ffcbfe79f71f5410eb46f1c19e","b03211f6feccd3a62273368b52f6079d","d946e3e94fec670f9e47aca186ecaabe","5a9930c3eb4a6c624a67adb75584dfc2","6d0bf5684c233596a43bbb0ac23f2b79","bdf2096ac1c2cb24c49e02b887f2ca64","b570bfd958a2e23f777d2e0d748e208d","7741d27f60a52a8f6088c15aec783736","63b4205b99017588693d0e82d6de05cd","ebcc775409d48a956bef355ee41841c0","6eeae636ff43b60024b386c4f83aaab0","27bbffa557fc469f8798961bb55e7d84","7a1d2e76f55f477cf799fe9e1a779e07","9da31169bd9af344c1c3a90e7f89e6c8","ff267bcfd8b92eeda25b0dcc870ad0a7","bd1d76ba6d83df249b3b8d40edcfa8fa","230949c88cb5cac7743ccfe406447ea3")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("d1a1eaefe6bd2e245bba369e966d7a8eab9ed6ad1fa827321e5889cc8d43f976","c967e60500dcadc9b010774616a90b7f4b77bee00c048998ad9faf04d523f14f","2ea4135f3c934c365008eb4db94d8ac6ac054fb36c89c1655dedcb7b345b8c4d","d29fe0f811fe4dbdfc6d449631597137758e087980fc6f9274660e1d316ffb3c","39aa01d7e37c2571eb76d74f0e250aa08dac8f531677e89a321b07d9fadc9690","62c99f27a6f962f3bf2e8844e6ae62cbc367fe8ef57469f1053bef64a1aa3573","9db74edf468202903cb97d4e2a87d67b88e374c8a15d0a46c04782e88679e51f","8adcfbfa5c750d2bc1ff80496c67f7cc6a9bd959a72d40025cb2e9499d6946c7","8b0ea6a9e427ac3288663e2f33bc3df5ea01bfdaead81d4b6595b00a6b7c4301","6fcbcdcafc5accf1b2b0453eccd93c203ab1dca9920521b107c9cff8ce236eb2","486b535c91e8609867bce918693dd24f0d93437a710281ea65f34a9c088211ef","1d56e3fd6e8b45cf01b36cc95e35eb3644018231e528f4ac115c39c7e01e30ba","c4fb60217e3d43eac92074c45228506a","172fff2634545cf59d59c179d139e0aa","7b08580a4f6995f645a5bf8addbefa68","1b71434e049fb8765d528ecabd722072","c4f591cad9d158e2fbb0ed6425ce3804","5f03629508f46e822cf08d7864f585d3","f5cd5f616a482645bbf8f4c51ee38958","fa2c39adbb0ca7aeab5bc5cd1ffb2f08","00cd306f7cdcfe187c561dd42ab40f33","ca27970308b2fdeaa3a8e8e53c86cd3e","d946e3e94fec670f9e47aca186ecaabe","e18c4172329c32d8394ba0658d5212c2","2fde001f4c17c8613480091fa48b55a0","c1f4c9f969f955dec2465317b526b600","026e8e7acb2f2a156f8afff64fd54066","fb64c22d37c502bde55b19688d40c803","70b8040730c62e4a52a904251fa74029","3efec6ffcbfe79f71f5410eb46f1c19e","b03211f6feccd3a62273368b52f6079d","d946e3e94fec670f9e47aca186ecaabe","5a9930c3eb4a6c624a67adb75584dfc2","6d0bf5684c233596a43bbb0ac23f2b79","bdf2096ac1c2cb24c49e02b887f2ca64","b570bfd958a2e23f777d2e0d748e208d","7741d27f60a52a8f6088c15aec783736","63b4205b99017588693d0e82d6de05cd","ebcc775409d48a956bef355ee41841c0","6eeae636ff43b60024b386c4f83aaab0","27bbffa557fc469f8798961bb55e7d84","7a1d2e76f55f477cf799fe9e1a779e07","9da31169bd9af344c1c3a90e7f89e6c8","ff267bcfd8b92eeda25b0dcc870ad0a7","bd1d76ba6d83df249b3b8d40edcfa8fa","230949c88cb5cac7743ccfe406447ea3")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("d1a1eaefe6bd2e245bba369e966d7a8eab9ed6ad1fa827321e5889cc8d43f976","c967e60500dcadc9b010774616a90b7f4b77bee00c048998ad9faf04d523f14f","2ea4135f3c934c365008eb4db94d8ac6ac054fb36c89c1655dedcb7b345b8c4d","d29fe0f811fe4dbdfc6d449631597137758e087980fc6f9274660e1d316ffb3c","39aa01d7e37c2571eb76d74f0e250aa08dac8f531677e89a321b07d9fadc9690","62c99f27a6f962f3bf2e8844e6ae62cbc367fe8ef57469f1053bef64a1aa3573","9db74edf468202903cb97d4e2a87d67b88e374c8a15d0a46c04782e88679e51f","8adcfbfa5c750d2bc1ff80496c67f7cc6a9bd959a72d40025cb2e9499d6946c7","8b0ea6a9e427ac3288663e2f33bc3df5ea01bfdaead81d4b6595b00a6b7c4301","6fcbcdcafc5accf1b2b0453eccd93c203ab1dca9920521b107c9cff8ce236eb2","486b535c91e8609867bce918693dd24f0d93437a710281ea65f34a9c088211ef","1d56e3fd6e8b45cf01b36cc95e35eb3644018231e528f4ac115c39c7e01e30ba","c4fb60217e3d43eac92074c45228506a","172fff2634545cf59d59c179d139e0aa","7b08580a4f6995f645a5bf8addbefa68","1b71434e049fb8765d528ecabd722072","c4f591cad9d158e2fbb0ed6425ce3804","5f03629508f46e822cf08d7864f585d3","f5cd5f616a482645bbf8f4c51ee38958","fa2c39adbb0ca7aeab5bc5cd1ffb2f08","00cd306f7cdcfe187c561dd42ab40f33","ca27970308b2fdeaa3a8e8e53c86cd3e","d946e3e94fec670f9e47aca186ecaabe","e18c4172329c32d8394ba0658d5212c2","2fde001f4c17c8613480091fa48b55a0","c1f4c9f969f955dec2465317b526b600","026e8e7acb2f2a156f8afff64fd54066","fb64c22d37c502bde55b19688d40c803","70b8040730c62e4a52a904251fa74029","3efec6ffcbfe79f71f5410eb46f1c19e","b03211f6feccd3a62273368b52f6079d","d946e3e94fec670f9e47aca186ecaabe","5a9930c3eb4a6c624a67adb75584dfc2","6d0bf5684c233596a43bbb0ac23f2b79","bdf2096ac1c2cb24c49e02b887f2ca64","b570bfd958a2e23f777d2e0d748e208d","7741d27f60a52a8f6088c15aec783736","63b4205b99017588693d0e82d6de05cd","ebcc775409d48a956bef355ee41841c0","6eeae636ff43b60024b386c4f83aaab0","27bbffa557fc469f8798961bb55e7d84","7a1d2e76f55f477cf799fe9e1a779e07","9da31169bd9af344c1c3a90e7f89e6c8","ff267bcfd8b92eeda25b0dcc870ad0a7","bd1d76ba6d83df249b3b8d40edcfa8fa","230949c88cb5cac7743ccfe406447ea3")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("d1a1eaefe6bd2e245bba369e966d7a8eab9ed6ad1fa827321e5889cc8d43f976","c967e60500dcadc9b010774616a90b7f4b77bee00c048998ad9faf04d523f14f","2ea4135f3c934c365008eb4db94d8ac6ac054fb36c89c1655dedcb7b345b8c4d","d29fe0f811fe4dbdfc6d449631597137758e087980fc6f9274660e1d316ffb3c","39aa01d7e37c2571eb76d74f0e250aa08dac8f531677e89a321b07d9fadc9690","62c99f27a6f962f3bf2e8844e6ae62cbc367fe8ef57469f1053bef64a1aa3573","9db74edf468202903cb97d4e2a87d67b88e374c8a15d0a46c04782e88679e51f","8adcfbfa5c750d2bc1ff80496c67f7cc6a9bd959a72d40025cb2e9499d6946c7","8b0ea6a9e427ac3288663e2f33bc3df5ea01bfdaead81d4b6595b00a6b7c4301","6fcbcdcafc5accf1b2b0453eccd93c203ab1dca9920521b107c9cff8ce236eb2","486b535c91e8609867bce918693dd24f0d93437a710281ea65f34a9c088211ef","1d56e3fd6e8b45cf01b36cc95e35eb3644018231e528f4ac115c39c7e01e30ba","c4fb60217e3d43eac92074c45228506a","172fff2634545cf59d59c179d139e0aa","7b08580a4f6995f645a5bf8addbefa68","1b71434e049fb8765d528ecabd722072","c4f591cad9d158e2fbb0ed6425ce3804","5f03629508f46e822cf08d7864f585d3","f5cd5f616a482645bbf8f4c51ee38958","fa2c39adbb0ca7aeab5bc5cd1ffb2f08","00cd306f7cdcfe187c561dd42ab40f33","ca27970308b2fdeaa3a8e8e53c86cd3e","d946e3e94fec670f9e47aca186ecaabe","e18c4172329c32d8394ba0658d5212c2","2fde001f4c17c8613480091fa48b55a0","c1f4c9f969f955dec2465317b526b600","026e8e7acb2f2a156f8afff64fd54066","fb64c22d37c502bde55b19688d40c803","70b8040730c62e4a52a904251fa74029","3efec6ffcbfe79f71f5410eb46f1c19e","b03211f6feccd3a62273368b52f6079d","d946e3e94fec670f9e47aca186ecaabe","5a9930c3eb4a6c624a67adb75584dfc2","6d0bf5684c233596a43bbb0ac23f2b79","bdf2096ac1c2cb24c49e02b887f2ca64","b570bfd958a2e23f777d2e0d748e208d","7741d27f60a52a8f6088c15aec783736","63b4205b99017588693d0e82d6de05cd","ebcc775409d48a956bef355ee41841c0","6eeae636ff43b60024b386c4f83aaab0","27bbffa557fc469f8798961bb55e7d84","7a1d2e76f55f477cf799fe9e1a779e07","9da31169bd9af344c1c3a90e7f89e6c8","ff267bcfd8b92eeda25b0dcc870ad0a7","bd1d76ba6d83df249b3b8d40edcfa8fa","230949c88cb5cac7743ccfe406447ea3")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("d1a1eaefe6bd2e245bba369e966d7a8eab9ed6ad1fa827321e5889cc8d43f976","c967e60500dcadc9b010774616a90b7f4b77bee00c048998ad9faf04d523f14f","2ea4135f3c934c365008eb4db94d8ac6ac054fb36c89c1655dedcb7b345b8c4d","d29fe0f811fe4dbdfc6d449631597137758e087980fc6f9274660e1d316ffb3c","39aa01d7e37c2571eb76d74f0e250aa08dac8f531677e89a321b07d9fadc9690","62c99f27a6f962f3bf2e8844e6ae62cbc367fe8ef57469f1053bef64a1aa3573","9db74edf468202903cb97d4e2a87d67b88e374c8a15d0a46c04782e88679e51f","8adcfbfa5c750d2bc1ff80496c67f7cc6a9bd959a72d40025cb2e9499d6946c7","8b0ea6a9e427ac3288663e2f33bc3df5ea01bfdaead81d4b6595b00a6b7c4301","6fcbcdcafc5accf1b2b0453eccd93c203ab1dca9920521b107c9cff8ce236eb2","486b535c91e8609867bce918693dd24f0d93437a710281ea65f34a9c088211ef","1d56e3fd6e8b45cf01b36cc95e35eb3644018231e528f4ac115c39c7e01e30ba","c4fb60217e3d43eac92074c45228506a","172fff2634545cf59d59c179d139e0aa","7b08580a4f6995f645a5bf8addbefa68","1b71434e049fb8765d528ecabd722072","c4f591cad9d158e2fbb0ed6425ce3804","5f03629508f46e822cf08d7864f585d3","f5cd5f616a482645bbf8f4c51ee38958","fa2c39adbb0ca7aeab5bc5cd1ffb2f08","00cd306f7cdcfe187c561dd42ab40f33","ca27970308b2fdeaa3a8e8e53c86cd3e","d946e3e94fec670f9e47aca186ecaabe","e18c4172329c32d8394ba0658d5212c2","2fde001f4c17c8613480091fa48b55a0","c1f4c9f969f955dec2465317b526b600","026e8e7acb2f2a156f8afff64fd54066","fb64c22d37c502bde55b19688d40c803","70b8040730c62e4a52a904251fa74029","3efec6ffcbfe79f71f5410eb46f1c19e","b03211f6feccd3a62273368b52f6079d","d946e3e94fec670f9e47aca186ecaabe","5a9930c3eb4a6c624a67adb75584dfc2","6d0bf5684c233596a43bbb0ac23f2b79","bdf2096ac1c2cb24c49e02b887f2ca64","b570bfd958a2e23f777d2e0d748e208d","7741d27f60a52a8f6088c15aec783736","63b4205b99017588693d0e82d6de05cd","ebcc775409d48a956bef355ee41841c0","6eeae636ff43b60024b386c4f83aaab0","27bbffa557fc469f8798961bb55e7d84","7a1d2e76f55f477cf799fe9e1a779e07","9da31169bd9af344c1c3a90e7f89e6c8","ff267bcfd8b92eeda25b0dcc870ad0a7","bd1d76ba6d83df249b3b8d40edcfa8fa","230949c88cb5cac7743ccfe406447ea3")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring64 NOT NULL AND customstring64 IN ("d1a1eaefe6bd2e245bba369e966d7a8eab9ed6ad1fa827321e5889cc8d43f976","c967e60500dcadc9b010774616a90b7f4b77bee00c048998ad9faf04d523f14f","2ea4135f3c934c365008eb4db94d8ac6ac054fb36c89c1655dedcb7b345b8c4d","d29fe0f811fe4dbdfc6d449631597137758e087980fc6f9274660e1d316ffb3c","39aa01d7e37c2571eb76d74f0e250aa08dac8f531677e89a321b07d9fadc9690","62c99f27a6f962f3bf2e8844e6ae62cbc367fe8ef57469f1053bef64a1aa3573","9db74edf468202903cb97d4e2a87d67b88e374c8a15d0a46c04782e88679e51f","8adcfbfa5c750d2bc1ff80496c67f7cc6a9bd959a72d40025cb2e9499d6946c7","8b0ea6a9e427ac3288663e2f33bc3df5ea01bfdaead81d4b6595b00a6b7c4301","6fcbcdcafc5accf1b2b0453eccd93c203ab1dca9920521b107c9cff8ce236eb2","486b535c91e8609867bce918693dd24f0d93437a710281ea65f34a9c088211ef","1d56e3fd6e8b45cf01b36cc95e35eb3644018231e528f4ac115c39c7e01e30ba","c4fb60217e3d43eac92074c45228506a","172fff2634545cf59d59c179d139e0aa","7b08580a4f6995f645a5bf8addbefa68","1b71434e049fb8765d528ecabd722072","c4f591cad9d158e2fbb0ed6425ce3804","5f03629508f46e822cf08d7864f585d3","f5cd5f616a482645bbf8f4c51ee38958","fa2c39adbb0ca7aeab5bc5cd1ffb2f08","00cd306f7cdcfe187c561dd42ab40f33","ca27970308b2fdeaa3a8e8e53c86cd3e","d946e3e94fec670f9e47aca186ecaabe","e18c4172329c32d8394ba0658d5212c2","2fde001f4c17c8613480091fa48b55a0","c1f4c9f969f955dec2465317b526b600","026e8e7acb2f2a156f8afff64fd54066","fb64c22d37c502bde55b19688d40c803","70b8040730c62e4a52a904251fa74029","3efec6ffcbfe79f71f5410eb46f1c19e","b03211f6feccd3a62273368b52f6079d","d946e3e94fec670f9e47aca186ecaabe","5a9930c3eb4a6c624a67adb75584dfc2","6d0bf5684c233596a43bbb0ac23f2b79","bdf2096ac1c2cb24c49e02b887f2ca64","b570bfd958a2e23f777d2e0d748e208d","7741d27f60a52a8f6088c15aec783736","63b4205b99017588693d0e82d6de05cd","ebcc775409d48a956bef355ee41841c0","6eeae636ff43b60024b386c4f83aaab0","27bbffa557fc469f8798961bb55e7d84","7a1d2e76f55f477cf799fe9e1a779e07","9da31169bd9af344c1c3a90e7f89e6c8","ff267bcfd8b92eeda25b0dcc870ad0a7","bd1d76ba6d83df249b3b8d40edcfa8fa","230949c88cb5cac7743ccfe406447ea3")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("d1a1eaefe6bd2e245bba369e966d7a8eab9ed6ad1fa827321e5889cc8d43f976","c967e60500dcadc9b010774616a90b7f4b77bee00c048998ad9faf04d523f14f","2ea4135f3c934c365008eb4db94d8ac6ac054fb36c89c1655dedcb7b345b8c4d","d29fe0f811fe4dbdfc6d449631597137758e087980fc6f9274660e1d316ffb3c","39aa01d7e37c2571eb76d74f0e250aa08dac8f531677e89a321b07d9fadc9690","62c99f27a6f962f3bf2e8844e6ae62cbc367fe8ef57469f1053bef64a1aa3573","9db74edf468202903cb97d4e2a87d67b88e374c8a15d0a46c04782e88679e51f","8adcfbfa5c750d2bc1ff80496c67f7cc6a9bd959a72d40025cb2e9499d6946c7","8b0ea6a9e427ac3288663e2f33bc3df5ea01bfdaead81d4b6595b00a6b7c4301","6fcbcdcafc5accf1b2b0453eccd93c203ab1dca9920521b107c9cff8ce236eb2","486b535c91e8609867bce918693dd24f0d93437a710281ea65f34a9c088211ef","1d56e3fd6e8b45cf01b36cc95e35eb3644018231e528f4ac115c39c7e01e30ba","c4fb60217e3d43eac92074c45228506a","172fff2634545cf59d59c179d139e0aa","7b08580a4f6995f645a5bf8addbefa68","1b71434e049fb8765d528ecabd722072","c4f591cad9d158e2fbb0ed6425ce3804","5f03629508f46e822cf08d7864f585d3","f5cd5f616a482645bbf8f4c51ee38958","fa2c39adbb0ca7aeab5bc5cd1ffb2f08","00cd306f7cdcfe187c561dd42ab40f33","ca27970308b2fdeaa3a8e8e53c86cd3e","d946e3e94fec670f9e47aca186ecaabe","e18c4172329c32d8394ba0658d5212c2","2fde001f4c17c8613480091fa48b55a0","c1f4c9f969f955dec2465317b526b600","026e8e7acb2f2a156f8afff64fd54066","fb64c22d37c502bde55b19688d40c803","70b8040730c62e4a52a904251fa74029","3efec6ffcbfe79f71f5410eb46f1c19e","b03211f6feccd3a62273368b52f6079d","d946e3e94fec670f9e47aca186ecaabe","5a9930c3eb4a6c624a67adb75584dfc2","6d0bf5684c233596a43bbb0ac23f2b79","bdf2096ac1c2cb24c49e02b887f2ca64","b570bfd958a2e23f777d2e0d748e208d","7741d27f60a52a8f6088c15aec783736","63b4205b99017588693d0e82d6de05cd","ebcc775409d48a956bef355ee41841c0","6eeae636ff43b60024b386c4f83aaab0","27bbffa557fc469f8798961bb55e7d84","7a1d2e76f55f477cf799fe9e1a779e07","9da31169bd9af344c1c3a90e7f89e6c8","ff267bcfd8b92eeda25b0dcc870ad0a7","bd1d76ba6d83df249b3b8d40edcfa8fa","230949c88cb5cac7743ccfe406447ea3")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("d1a1eaefe6bd2e245bba369e966d7a8eab9ed6ad1fa827321e5889cc8d43f976","c967e60500dcadc9b010774616a90b7f4b77bee00c048998ad9faf04d523f14f","2ea4135f3c934c365008eb4db94d8ac6ac054fb36c89c1655dedcb7b345b8c4d","d29fe0f811fe4dbdfc6d449631597137758e087980fc6f9274660e1d316ffb3c","39aa01d7e37c2571eb76d74f0e250aa08dac8f531677e89a321b07d9fadc9690","62c99f27a6f962f3bf2e8844e6ae62cbc367fe8ef57469f1053bef64a1aa3573","9db74edf468202903cb97d4e2a87d67b88e374c8a15d0a46c04782e88679e51f","8adcfbfa5c750d2bc1ff80496c67f7cc6a9bd959a72d40025cb2e9499d6946c7","8b0ea6a9e427ac3288663e2f33bc3df5ea01bfdaead81d4b6595b00a6b7c4301","6fcbcdcafc5accf1b2b0453eccd93c203ab1dca9920521b107c9cff8ce236eb2","486b535c91e8609867bce918693dd24f0d93437a710281ea65f34a9c088211ef","1d56e3fd6e8b45cf01b36cc95e35eb3644018231e528f4ac115c39c7e01e30ba","c4fb60217e3d43eac92074c45228506a","172fff2634545cf59d59c179d139e0aa","7b08580a4f6995f645a5bf8addbefa68","1b71434e049fb8765d528ecabd722072","c4f591cad9d158e2fbb0ed6425ce3804","5f03629508f46e822cf08d7864f585d3","f5cd5f616a482645bbf8f4c51ee38958","fa2c39adbb0ca7aeab5bc5cd1ffb2f08","00cd306f7cdcfe187c561dd42ab40f33","ca27970308b2fdeaa3a8e8e53c86cd3e","d946e3e94fec670f9e47aca186ecaabe","e18c4172329c32d8394ba0658d5212c2","2fde001f4c17c8613480091fa48b55a0","c1f4c9f969f955dec2465317b526b600","026e8e7acb2f2a156f8afff64fd54066","fb64c22d37c502bde55b19688d40c803","70b8040730c62e4a52a904251fa74029","3efec6ffcbfe79f71f5410eb46f1c19e","b03211f6feccd3a62273368b52f6079d","d946e3e94fec670f9e47aca186ecaabe","5a9930c3eb4a6c624a67adb75584dfc2","6d0bf5684c233596a43bbb0ac23f2b79","bdf2096ac1c2cb24c49e02b887f2ca64","b570bfd958a2e23f777d2e0d748e208d","7741d27f60a52a8f6088c15aec783736","63b4205b99017588693d0e82d6de05cd","ebcc775409d48a956bef355ee41841c0","6eeae636ff43b60024b386c4f83aaab0","27bbffa557fc469f8798961bb55e7d84","7a1d2e76f55f477cf799fe9e1a779e07","9da31169bd9af344c1c3a90e7f89e6c8","ff267bcfd8b92eeda25b0dcc870ad0a7","bd1d76ba6d83df249b3b8d40edcfa8fa","230949c88cb5cac7743ccfe406447ea3")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("d1a1eaefe6bd2e245bba369e966d7a8eab9ed6ad1fa827321e5889cc8d43f976","c967e60500dcadc9b010774616a90b7f4b77bee00c048998ad9faf04d523f14f","2ea4135f3c934c365008eb4db94d8ac6ac054fb36c89c1655dedcb7b345b8c4d","d29fe0f811fe4dbdfc6d449631597137758e087980fc6f9274660e1d316ffb3c","39aa01d7e37c2571eb76d74f0e250aa08dac8f531677e89a321b07d9fadc9690","62c99f27a6f962f3bf2e8844e6ae62cbc367fe8ef57469f1053bef64a1aa3573","9db74edf468202903cb97d4e2a87d67b88e374c8a15d0a46c04782e88679e51f","8adcfbfa5c750d2bc1ff80496c67f7cc6a9bd959a72d40025cb2e9499d6946c7","8b0ea6a9e427ac3288663e2f33bc3df5ea01bfdaead81d4b6595b00a6b7c4301","6fcbcdcafc5accf1b2b0453eccd93c203ab1dca9920521b107c9cff8ce236eb2","486b535c91e8609867bce918693dd24f0d93437a710281ea65f34a9c088211ef","1d56e3fd6e8b45cf01b36cc95e35eb3644018231e528f4ac115c39c7e01e30ba","c4fb60217e3d43eac92074c45228506a","172fff2634545cf59d59c179d139e0aa","7b08580a4f6995f645a5bf8addbefa68","1b71434e049fb8765d528ecabd722072","c4f591cad9d158e2fbb0ed6425ce3804","5f03629508f46e822cf08d7864f585d3","f5cd5f616a482645bbf8f4c51ee38958","fa2c39adbb0ca7aeab5bc5cd1ffb2f08","00cd306f7cdcfe187c561dd42ab40f33","ca27970308b2fdeaa3a8e8e53c86cd3e","d946e3e94fec670f9e47aca186ecaabe","e18c4172329c32d8394ba0658d5212c2","2fde001f4c17c8613480091fa48b55a0","c1f4c9f969f955dec2465317b526b600","026e8e7acb2f2a156f8afff64fd54066","fb64c22d37c502bde55b19688d40c803","70b8040730c62e4a52a904251fa74029","3efec6ffcbfe79f71f5410eb46f1c19e","b03211f6feccd3a62273368b52f6079d","d946e3e94fec670f9e47aca186ecaabe","5a9930c3eb4a6c624a67adb75584dfc2","6d0bf5684c233596a43bbb0ac23f2b79","bdf2096ac1c2cb24c49e02b887f2ca64","b570bfd958a2e23f777d2e0d748e208d","7741d27f60a52a8f6088c15aec783736","63b4205b99017588693d0e82d6de05cd","ebcc775409d48a956bef355ee41841c0","6eeae636ff43b60024b386c4f83aaab0","27bbffa557fc469f8798961bb55e7d84","7a1d2e76f55f477cf799fe9e1a779e07","9da31169bd9af344c1c3a90e7f89e6c8","ff267bcfd8b92eeda25b0dcc870ad0a7","bd1d76ba6d83df249b3b8d40edcfa8fa","230949c88cb5cac7743ccfe406447ea3")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring64 NOT NULL AND customstring64 IN ("d1a1eaefe6bd2e245bba369e966d7a8eab9ed6ad1fa827321e5889cc8d43f976","c967e60500dcadc9b010774616a90b7f4b77bee00c048998ad9faf04d523f14f","2ea4135f3c934c365008eb4db94d8ac6ac054fb36c89c1655dedcb7b345b8c4d","d29fe0f811fe4dbdfc6d449631597137758e087980fc6f9274660e1d316ffb3c","39aa01d7e37c2571eb76d74f0e250aa08dac8f531677e89a321b07d9fadc9690","62c99f27a6f962f3bf2e8844e6ae62cbc367fe8ef57469f1053bef64a1aa3573","9db74edf468202903cb97d4e2a87d67b88e374c8a15d0a46c04782e88679e51f","8adcfbfa5c750d2bc1ff80496c67f7cc6a9bd959a72d40025cb2e9499d6946c7","8b0ea6a9e427ac3288663e2f33bc3df5ea01bfdaead81d4b6595b00a6b7c4301","6fcbcdcafc5accf1b2b0453eccd93c203ab1dca9920521b107c9cff8ce236eb2","486b535c91e8609867bce918693dd24f0d93437a710281ea65f34a9c088211ef","1d56e3fd6e8b45cf01b36cc95e35eb3644018231e528f4ac115c39c7e01e30ba","c4fb60217e3d43eac92074c45228506a","172fff2634545cf59d59c179d139e0aa","7b08580a4f6995f645a5bf8addbefa68","1b71434e049fb8765d528ecabd722072","c4f591cad9d158e2fbb0ed6425ce3804","5f03629508f46e822cf08d7864f585d3","f5cd5f616a482645bbf8f4c51ee38958","fa2c39adbb0ca7aeab5bc5cd1ffb2f08","00cd306f7cdcfe187c561dd42ab40f33","ca27970308b2fdeaa3a8e8e53c86cd3e","d946e3e94fec670f9e47aca186ecaabe","e18c4172329c32d8394ba0658d5212c2","2fde001f4c17c8613480091fa48b55a0","c1f4c9f969f955dec2465317b526b600","026e8e7acb2f2a156f8afff64fd54066","fb64c22d37c502bde55b19688d40c803","70b8040730c62e4a52a904251fa74029","3efec6ffcbfe79f71f5410eb46f1c19e","b03211f6feccd3a62273368b52f6079d","d946e3e94fec670f9e47aca186ecaabe","5a9930c3eb4a6c624a67adb75584dfc2","6d0bf5684c233596a43bbb0ac23f2b79","bdf2096ac1c2cb24c49e02b887f2ca64","b570bfd958a2e23f777d2e0d748e208d","7741d27f60a52a8f6088c15aec783736","63b4205b99017588693d0e82d6de05cd","ebcc775409d48a956bef355ee41841c0","6eeae636ff43b60024b386c4f83aaab0","27bbffa557fc469f8798961bb55e7d84","7a1d2e76f55f477cf799fe9e1a779e07","9da31169bd9af344c1c3a90e7f89e6c8","ff267bcfd8b92eeda25b0dcc870ad0a7","bd1d76ba6d83df249b3b8d40edcfa8fa","230949c88cb5cac7743ccfe406447ea3")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("d1a1eaefe6bd2e245bba369e966d7a8eab9ed6ad1fa827321e5889cc8d43f976","c967e60500dcadc9b010774616a90b7f4b77bee00c048998ad9faf04d523f14f","2ea4135f3c934c365008eb4db94d8ac6ac054fb36c89c1655dedcb7b345b8c4d","d29fe0f811fe4dbdfc6d449631597137758e087980fc6f9274660e1d316ffb3c","39aa01d7e37c2571eb76d74f0e250aa08dac8f531677e89a321b07d9fadc9690","62c99f27a6f962f3bf2e8844e6ae62cbc367fe8ef57469f1053bef64a1aa3573","9db74edf468202903cb97d4e2a87d67b88e374c8a15d0a46c04782e88679e51f","8adcfbfa5c750d2bc1ff80496c67f7cc6a9bd959a72d40025cb2e9499d6946c7","8b0ea6a9e427ac3288663e2f33bc3df5ea01bfdaead81d4b6595b00a6b7c4301","6fcbcdcafc5accf1b2b0453eccd93c203ab1dca9920521b107c9cff8ce236eb2","486b535c91e8609867bce918693dd24f0d93437a710281ea65f34a9c088211ef","1d56e3fd6e8b45cf01b36cc95e35eb3644018231e528f4ac115c39c7e01e30ba","c4fb60217e3d43eac92074c45228506a","172fff2634545cf59d59c179d139e0aa","7b08580a4f6995f645a5bf8addbefa68","1b71434e049fb8765d528ecabd722072","c4f591cad9d158e2fbb0ed6425ce3804","5f03629508f46e822cf08d7864f585d3","f5cd5f616a482645bbf8f4c51ee38958","fa2c39adbb0ca7aeab5bc5cd1ffb2f08","00cd306f7cdcfe187c561dd42ab40f33","ca27970308b2fdeaa3a8e8e53c86cd3e","d946e3e94fec670f9e47aca186ecaabe","e18c4172329c32d8394ba0658d5212c2","2fde001f4c17c8613480091fa48b55a0","c1f4c9f969f955dec2465317b526b600","026e8e7acb2f2a156f8afff64fd54066","fb64c22d37c502bde55b19688d40c803","70b8040730c62e4a52a904251fa74029","3efec6ffcbfe79f71f5410eb46f1c19e","b03211f6feccd3a62273368b52f6079d","d946e3e94fec670f9e47aca186ecaabe","5a9930c3eb4a6c624a67adb75584dfc2","6d0bf5684c233596a43bbb0ac23f2b79","bdf2096ac1c2cb24c49e02b887f2ca64","b570bfd958a2e23f777d2e0d748e208d","7741d27f60a52a8f6088c15aec783736","63b4205b99017588693d0e82d6de05cd","ebcc775409d48a956bef355ee41841c0","6eeae636ff43b60024b386c4f83aaab0","27bbffa557fc469f8798961bb55e7d84","7a1d2e76f55f477cf799fe9e1a779e07","9da31169bd9af344c1c3a90e7f89e6c8","ff267bcfd8b92eeda25b0dcc870ad0a7","bd1d76ba6d83df249b3b8d40edcfa8fa","230949c88cb5cac7743ccfe406447ea3")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("d1a1eaefe6bd2e245bba369e966d7a8eab9ed6ad1fa827321e5889cc8d43f976","c967e60500dcadc9b010774616a90b7f4b77bee00c048998ad9faf04d523f14f","2ea4135f3c934c365008eb4db94d8ac6ac054fb36c89c1655dedcb7b345b8c4d","d29fe0f811fe4dbdfc6d449631597137758e087980fc6f9274660e1d316ffb3c","39aa01d7e37c2571eb76d74f0e250aa08dac8f531677e89a321b07d9fadc9690","62c99f27a6f962f3bf2e8844e6ae62cbc367fe8ef57469f1053bef64a1aa3573","9db74edf468202903cb97d4e2a87d67b88e374c8a15d0a46c04782e88679e51f","8adcfbfa5c750d2bc1ff80496c67f7cc6a9bd959a72d40025cb2e9499d6946c7","8b0ea6a9e427ac3288663e2f33bc3df5ea01bfdaead81d4b6595b00a6b7c4301","6fcbcdcafc5accf1b2b0453eccd93c203ab1dca9920521b107c9cff8ce236eb2","486b535c91e8609867bce918693dd24f0d93437a710281ea65f34a9c088211ef","1d56e3fd6e8b45cf01b36cc95e35eb3644018231e528f4ac115c39c7e01e30ba","c4fb60217e3d43eac92074c45228506a","172fff2634545cf59d59c179d139e0aa","7b08580a4f6995f645a5bf8addbefa68","1b71434e049fb8765d528ecabd722072","c4f591cad9d158e2fbb0ed6425ce3804","5f03629508f46e822cf08d7864f585d3","f5cd5f616a482645bbf8f4c51ee38958","fa2c39adbb0ca7aeab5bc5cd1ffb2f08","00cd306f7cdcfe187c561dd42ab40f33","ca27970308b2fdeaa3a8e8e53c86cd3e","d946e3e94fec670f9e47aca186ecaabe","e18c4172329c32d8394ba0658d5212c2","2fde001f4c17c8613480091fa48b55a0","c1f4c9f969f955dec2465317b526b600","026e8e7acb2f2a156f8afff64fd54066","fb64c22d37c502bde55b19688d40c803","70b8040730c62e4a52a904251fa74029","3efec6ffcbfe79f71f5410eb46f1c19e","b03211f6feccd3a62273368b52f6079d","d946e3e94fec670f9e47aca186ecaabe","5a9930c3eb4a6c624a67adb75584dfc2","6d0bf5684c233596a43bbb0ac23f2b79","bdf2096ac1c2cb24c49e02b887f2ca64","b570bfd958a2e23f777d2e0d748e208d","7741d27f60a52a8f6088c15aec783736","63b4205b99017588693d0e82d6de05cd","ebcc775409d48a956bef355ee41841c0","6eeae636ff43b60024b386c4f83aaab0","27bbffa557fc469f8798961bb55e7d84","7a1d2e76f55f477cf799fe9e1a779e07","9da31169bd9af344c1c3a90e7f89e6c8","ff267bcfd8b92eeda25b0dcc870ad0a7","bd1d76ba6d83df249b3b8d40edcfa8fa","230949c88cb5cac7743ccfe406447ea3")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("d1a1eaefe6bd2e245bba369e966d7a8eab9ed6ad1fa827321e5889cc8d43f976","c967e60500dcadc9b010774616a90b7f4b77bee00c048998ad9faf04d523f14f","2ea4135f3c934c365008eb4db94d8ac6ac054fb36c89c1655dedcb7b345b8c4d","d29fe0f811fe4dbdfc6d449631597137758e087980fc6f9274660e1d316ffb3c","39aa01d7e37c2571eb76d74f0e250aa08dac8f531677e89a321b07d9fadc9690","62c99f27a6f962f3bf2e8844e6ae62cbc367fe8ef57469f1053bef64a1aa3573","9db74edf468202903cb97d4e2a87d67b88e374c8a15d0a46c04782e88679e51f","8adcfbfa5c750d2bc1ff80496c67f7cc6a9bd959a72d40025cb2e9499d6946c7","8b0ea6a9e427ac3288663e2f33bc3df5ea01bfdaead81d4b6595b00a6b7c4301","6fcbcdcafc5accf1b2b0453eccd93c203ab1dca9920521b107c9cff8ce236eb2","486b535c91e8609867bce918693dd24f0d93437a710281ea65f34a9c088211ef","1d56e3fd6e8b45cf01b36cc95e35eb3644018231e528f4ac115c39c7e01e30ba","c4fb60217e3d43eac92074c45228506a","172fff2634545cf59d59c179d139e0aa","7b08580a4f6995f645a5bf8addbefa68","1b71434e049fb8765d528ecabd722072","c4f591cad9d158e2fbb0ed6425ce3804","5f03629508f46e822cf08d7864f585d3","f5cd5f616a482645bbf8f4c51ee38958","fa2c39adbb0ca7aeab5bc5cd1ffb2f08","00cd306f7cdcfe187c561dd42ab40f33","ca27970308b2fdeaa3a8e8e53c86cd3e","d946e3e94fec670f9e47aca186ecaabe","e18c4172329c32d8394ba0658d5212c2","2fde001f4c17c8613480091fa48b55a0","c1f4c9f969f955dec2465317b526b600","026e8e7acb2f2a156f8afff64fd54066","fb64c22d37c502bde55b19688d40c803","70b8040730c62e4a52a904251fa74029","3efec6ffcbfe79f71f5410eb46f1c19e","b03211f6feccd3a62273368b52f6079d","d946e3e94fec670f9e47aca186ecaabe","5a9930c3eb4a6c624a67adb75584dfc2","6d0bf5684c233596a43bbb0ac23f2b79","bdf2096ac1c2cb24c49e02b887f2ca64","b570bfd958a2e23f777d2e0d748e208d","7741d27f60a52a8f6088c15aec783736","63b4205b99017588693d0e82d6de05cd","ebcc775409d48a956bef355ee41841c0","6eeae636ff43b60024b386c4f83aaab0","27bbffa557fc469f8798961bb55e7d84","7a1d2e76f55f477cf799fe9e1a779e07","9da31169bd9af344c1c3a90e7f89e6c8","ff267bcfd8b92eeda25b0dcc870ad0a7","bd1d76ba6d83df249b3b8d40edcfa8fa","230949c88cb5cac7743ccfe406447ea3")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring64 NOT NULL AND customstring64 IN ("d1a1eaefe6bd2e245bba369e966d7a8eab9ed6ad1fa827321e5889cc8d43f976","c967e60500dcadc9b010774616a90b7f4b77bee00c048998ad9faf04d523f14f","2ea4135f3c934c365008eb4db94d8ac6ac054fb36c89c1655dedcb7b345b8c4d","d29fe0f811fe4dbdfc6d449631597137758e087980fc6f9274660e1d316ffb3c","39aa01d7e37c2571eb76d74f0e250aa08dac8f531677e89a321b07d9fadc9690","62c99f27a6f962f3bf2e8844e6ae62cbc367fe8ef57469f1053bef64a1aa3573","9db74edf468202903cb97d4e2a87d67b88e374c8a15d0a46c04782e88679e51f","8adcfbfa5c750d2bc1ff80496c67f7cc6a9bd959a72d40025cb2e9499d6946c7","8b0ea6a9e427ac3288663e2f33bc3df5ea01bfdaead81d4b6595b00a6b7c4301","6fcbcdcafc5accf1b2b0453eccd93c203ab1dca9920521b107c9cff8ce236eb2","486b535c91e8609867bce918693dd24f0d93437a710281ea65f34a9c088211ef","1d56e3fd6e8b45cf01b36cc95e35eb3644018231e528f4ac115c39c7e01e30ba","c4fb60217e3d43eac92074c45228506a","172fff2634545cf59d59c179d139e0aa","7b08580a4f6995f645a5bf8addbefa68","1b71434e049fb8765d528ecabd722072","c4f591cad9d158e2fbb0ed6425ce3804","5f03629508f46e822cf08d7864f585d3","f5cd5f616a482645bbf8f4c51ee38958","fa2c39adbb0ca7aeab5bc5cd1ffb2f08","00cd306f7cdcfe187c561dd42ab40f33","ca27970308b2fdeaa3a8e8e53c86cd3e","d946e3e94fec670f9e47aca186ecaabe","e18c4172329c32d8394ba0658d5212c2","2fde001f4c17c8613480091fa48b55a0","c1f4c9f969f955dec2465317b526b600","026e8e7acb2f2a156f8afff64fd54066","fb64c22d37c502bde55b19688d40c803","70b8040730c62e4a52a904251fa74029","3efec6ffcbfe79f71f5410eb46f1c19e","b03211f6feccd3a62273368b52f6079d","d946e3e94fec670f9e47aca186ecaabe","5a9930c3eb4a6c624a67adb75584dfc2","6d0bf5684c233596a43bbb0ac23f2b79","bdf2096ac1c2cb24c49e02b887f2ca64","b570bfd958a2e23f777d2e0d748e208d","7741d27f60a52a8f6088c15aec783736","63b4205b99017588693d0e82d6de05cd","ebcc775409d48a956bef355ee41841c0","6eeae636ff43b60024b386c4f83aaab0","27bbffa557fc469f8798961bb55e7d84","7a1d2e76f55f477cf799fe9e1a779e07","9da31169bd9af344c1c3a90e7f89e6c8","ff267bcfd8b92eeda25b0dcc870ad0a7","bd1d76ba6d83df249b3b8d40edcfa8fa","230949c88cb5cac7743ccfe406447ea3")
index=activity AND rg_functionality="O365 General" AND filehash NOT NULL AND filehash IN ("d1a1eaefe6bd2e245bba369e966d7a8eab9ed6ad1fa827321e5889cc8d43f976","c967e60500dcadc9b010774616a90b7f4b77bee00c048998ad9faf04d523f14f","2ea4135f3c934c365008eb4db94d8ac6ac054fb36c89c1655dedcb7b345b8c4d","d29fe0f811fe4dbdfc6d449631597137758e087980fc6f9274660e1d316ffb3c","39aa01d7e37c2571eb76d74f0e250aa08dac8f531677e89a321b07d9fadc9690","62c99f27a6f962f3bf2e8844e6ae62cbc367fe8ef57469f1053bef64a1aa3573","9db74edf468202903cb97d4e2a87d67b88e374c8a15d0a46c04782e88679e51f","8adcfbfa5c750d2bc1ff80496c67f7cc6a9bd959a72d40025cb2e9499d6946c7","8b0ea6a9e427ac3288663e2f33bc3df5ea01bfdaead81d4b6595b00a6b7c4301","6fcbcdcafc5accf1b2b0453eccd93c203ab1dca9920521b107c9cff8ce236eb2","486b535c91e8609867bce918693dd24f0d93437a710281ea65f34a9c088211ef","1d56e3fd6e8b45cf01b36cc95e35eb3644018231e528f4ac115c39c7e01e30ba","c4fb60217e3d43eac92074c45228506a","172fff2634545cf59d59c179d139e0aa","7b08580a4f6995f645a5bf8addbefa68","1b71434e049fb8765d528ecabd722072","c4f591cad9d158e2fbb0ed6425ce3804","5f03629508f46e822cf08d7864f585d3","f5cd5f616a482645bbf8f4c51ee38958","fa2c39adbb0ca7aeab5bc5cd1ffb2f08","00cd306f7cdcfe187c561dd42ab40f33","ca27970308b2fdeaa3a8e8e53c86cd3e","d946e3e94fec670f9e47aca186ecaabe","e18c4172329c32d8394ba0658d5212c2","2fde001f4c17c8613480091fa48b55a0","c1f4c9f969f955dec2465317b526b600","026e8e7acb2f2a156f8afff64fd54066","fb64c22d37c502bde55b19688d40c803","70b8040730c62e4a52a904251fa74029","3efec6ffcbfe79f71f5410eb46f1c19e","b03211f6feccd3a62273368b52f6079d","d946e3e94fec670f9e47aca186ecaabe","5a9930c3eb4a6c624a67adb75584dfc2","6d0bf5684c233596a43bbb0ac23f2b79","bdf2096ac1c2cb24c49e02b887f2ca64","b570bfd958a2e23f777d2e0d748e208d","7741d27f60a52a8f6088c15aec783736","63b4205b99017588693d0e82d6de05cd","ebcc775409d48a956bef355ee41841c0","6eeae636ff43b60024b386c4f83aaab0","27bbffa557fc469f8798961bb55e7d84","7a1d2e76f55f477cf799fe9e1a779e07","9da31169bd9af344c1c3a90e7f89e6c8","ff267bcfd8b92eeda25b0dcc870ad0a7","bd1d76ba6d83df249b3b8d40edcfa8fa","230949c88cb5cac7743ccfe406447ea3")
index=activity AND rg_functionality="O365 General" AND oldfilehash NOT NULL AND oldfilehash IN ("d1a1eaefe6bd2e245bba369e966d7a8eab9ed6ad1fa827321e5889cc8d43f976","c967e60500dcadc9b010774616a90b7f4b77bee00c048998ad9faf04d523f14f","2ea4135f3c934c365008eb4db94d8ac6ac054fb36c89c1655dedcb7b345b8c4d","d29fe0f811fe4dbdfc6d449631597137758e087980fc6f9274660e1d316ffb3c","39aa01d7e37c2571eb76d74f0e250aa08dac8f531677e89a321b07d9fadc9690","62c99f27a6f962f3bf2e8844e6ae62cbc367fe8ef57469f1053bef64a1aa3573","9db74edf468202903cb97d4e2a87d67b88e374c8a15d0a46c04782e88679e51f","8adcfbfa5c750d2bc1ff80496c67f7cc6a9bd959a72d40025cb2e9499d6946c7","8b0ea6a9e427ac3288663e2f33bc3df5ea01bfdaead81d4b6595b00a6b7c4301","6fcbcdcafc5accf1b2b0453eccd93c203ab1dca9920521b107c9cff8ce236eb2","486b535c91e8609867bce918693dd24f0d93437a710281ea65f34a9c088211ef","1d56e3fd6e8b45cf01b36cc95e35eb3644018231e528f4ac115c39c7e01e30ba","c4fb60217e3d43eac92074c45228506a","172fff2634545cf59d59c179d139e0aa","7b08580a4f6995f645a5bf8addbefa68","1b71434e049fb8765d528ecabd722072","c4f591cad9d158e2fbb0ed6425ce3804","5f03629508f46e822cf08d7864f585d3","f5cd5f616a482645bbf8f4c51ee38958","fa2c39adbb0ca7aeab5bc5cd1ffb2f08","00cd306f7cdcfe187c561dd42ab40f33","ca27970308b2fdeaa3a8e8e53c86cd3e","d946e3e94fec670f9e47aca186ecaabe","e18c4172329c32d8394ba0658d5212c2","2fde001f4c17c8613480091fa48b55a0","c1f4c9f969f955dec2465317b526b600","026e8e7acb2f2a156f8afff64fd54066","fb64c22d37c502bde55b19688d40c803","70b8040730c62e4a52a904251fa74029","3efec6ffcbfe79f71f5410eb46f1c19e","b03211f6feccd3a62273368b52f6079d","d946e3e94fec670f9e47aca186ecaabe","5a9930c3eb4a6c624a67adb75584dfc2","6d0bf5684c233596a43bbb0ac23f2b79","bdf2096ac1c2cb24c49e02b887f2ca64","b570bfd958a2e23f777d2e0d748e208d","7741d27f60a52a8f6088c15aec783736","63b4205b99017588693d0e82d6de05cd","ebcc775409d48a956bef355ee41841c0","6eeae636ff43b60024b386c4f83aaab0","27bbffa557fc469f8798961bb55e7d84","7a1d2e76f55f477cf799fe9e1a779e07","9da31169bd9af344c1c3a90e7f89e6c8","ff267bcfd8b92eeda25b0dcc870ad0a7","bd1d76ba6d83df249b3b8d40edcfa8fa","230949c88cb5cac7743ccfe406447ea3")
index=activity AND rg_functionality="O365 General" AND customstring3 NOT NULL AND customstring3 IN ("d1a1eaefe6bd2e245bba369e966d7a8eab9ed6ad1fa827321e5889cc8d43f976","c967e60500dcadc9b010774616a90b7f4b77bee00c048998ad9faf04d523f14f","2ea4135f3c934c365008eb4db94d8ac6ac054fb36c89c1655dedcb7b345b8c4d","d29fe0f811fe4dbdfc6d449631597137758e087980fc6f9274660e1d316ffb3c","39aa01d7e37c2571eb76d74f0e250aa08dac8f531677e89a321b07d9fadc9690","62c99f27a6f962f3bf2e8844e6ae62cbc367fe8ef57469f1053bef64a1aa3573","9db74edf468202903cb97d4e2a87d67b88e374c8a15d0a46c04782e88679e51f","8adcfbfa5c750d2bc1ff80496c67f7cc6a9bd959a72d40025cb2e9499d6946c7","8b0ea6a9e427ac3288663e2f33bc3df5ea01bfdaead81d4b6595b00a6b7c4301","6fcbcdcafc5accf1b2b0453eccd93c203ab1dca9920521b107c9cff8ce236eb2","486b535c91e8609867bce918693dd24f0d93437a710281ea65f34a9c088211ef","1d56e3fd6e8b45cf01b36cc95e35eb3644018231e528f4ac115c39c7e01e30ba","c4fb60217e3d43eac92074c45228506a","172fff2634545cf59d59c179d139e0aa","7b08580a4f6995f645a5bf8addbefa68","1b71434e049fb8765d528ecabd722072","c4f591cad9d158e2fbb0ed6425ce3804","5f03629508f46e822cf08d7864f585d3","f5cd5f616a482645bbf8f4c51ee38958","fa2c39adbb0ca7aeab5bc5cd1ffb2f08","00cd306f7cdcfe187c561dd42ab40f33","ca27970308b2fdeaa3a8e8e53c86cd3e","d946e3e94fec670f9e47aca186ecaabe","e18c4172329c32d8394ba0658d5212c2","2fde001f4c17c8613480091fa48b55a0","c1f4c9f969f955dec2465317b526b600","026e8e7acb2f2a156f8afff64fd54066","fb64c22d37c502bde55b19688d40c803","70b8040730c62e4a52a904251fa74029","3efec6ffcbfe79f71f5410eb46f1c19e","b03211f6feccd3a62273368b52f6079d","d946e3e94fec670f9e47aca186ecaabe","5a9930c3eb4a6c624a67adb75584dfc2","6d0bf5684c233596a43bbb0ac23f2b79","bdf2096ac1c2cb24c49e02b887f2ca64","b570bfd958a2e23f777d2e0d748e208d","7741d27f60a52a8f6088c15aec783736","63b4205b99017588693d0e82d6de05cd","ebcc775409d48a956bef355ee41841c0","6eeae636ff43b60024b386c4f83aaab0","27bbffa557fc469f8798961bb55e7d84","7a1d2e76f55f477cf799fe9e1a779e07","9da31169bd9af344c1c3a90e7f89e6c8","ff267bcfd8b92eeda25b0dcc870ad0a7","bd1d76ba6d83df249b3b8d40edcfa8fa","230949c88cb5cac7743ccfe406447ea3")
index=activity AND rg_functionality="O365 General" AND customstring64 NOT NULL AND customstring64 IN ("d1a1eaefe6bd2e245bba369e966d7a8eab9ed6ad1fa827321e5889cc8d43f976","c967e60500dcadc9b010774616a90b7f4b77bee00c048998ad9faf04d523f14f","2ea4135f3c934c365008eb4db94d8ac6ac054fb36c89c1655dedcb7b345b8c4d","d29fe0f811fe4dbdfc6d449631597137758e087980fc6f9274660e1d316ffb3c","39aa01d7e37c2571eb76d74f0e250aa08dac8f531677e89a321b07d9fadc9690","62c99f27a6f962f3bf2e8844e6ae62cbc367fe8ef57469f1053bef64a1aa3573","9db74edf468202903cb97d4e2a87d67b88e374c8a15d0a46c04782e88679e51f","8adcfbfa5c750d2bc1ff80496c67f7cc6a9bd959a72d40025cb2e9499d6946c7","8b0ea6a9e427ac3288663e2f33bc3df5ea01bfdaead81d4b6595b00a6b7c4301","6fcbcdcafc5accf1b2b0453eccd93c203ab1dca9920521b107c9cff8ce236eb2","486b535c91e8609867bce918693dd24f0d93437a710281ea65f34a9c088211ef","1d56e3fd6e8b45cf01b36cc95e35eb3644018231e528f4ac115c39c7e01e30ba","c4fb60217e3d43eac92074c45228506a","172fff2634545cf59d59c179d139e0aa","7b08580a4f6995f645a5bf8addbefa68","1b71434e049fb8765d528ecabd722072","c4f591cad9d158e2fbb0ed6425ce3804","5f03629508f46e822cf08d7864f585d3","f5cd5f616a482645bbf8f4c51ee38958","fa2c39adbb0ca7aeab5bc5cd1ffb2f08","00cd306f7cdcfe187c561dd42ab40f33","ca27970308b2fdeaa3a8e8e53c86cd3e","d946e3e94fec670f9e47aca186ecaabe","e18c4172329c32d8394ba0658d5212c2","2fde001f4c17c8613480091fa48b55a0","c1f4c9f969f955dec2465317b526b600","026e8e7acb2f2a156f8afff64fd54066","fb64c22d37c502bde55b19688d40c803","70b8040730c62e4a52a904251fa74029","3efec6ffcbfe79f71f5410eb46f1c19e","b03211f6feccd3a62273368b52f6079d","d946e3e94fec670f9e47aca186ecaabe","5a9930c3eb4a6c624a67adb75584dfc2","6d0bf5684c233596a43bbb0ac23f2b79","bdf2096ac1c2cb24c49e02b887f2ca64","b570bfd958a2e23f777d2e0d748e208d","7741d27f60a52a8f6088c15aec783736","63b4205b99017588693d0e82d6de05cd","ebcc775409d48a956bef355ee41841c0","6eeae636ff43b60024b386c4f83aaab0","27bbffa557fc469f8798961bb55e7d84","7a1d2e76f55f477cf799fe9e1a779e07","9da31169bd9af344c1c3a90e7f89e6c8","ff267bcfd8b92eeda25b0dcc870ad0a7","bd1d76ba6d83df249b3b8d40edcfa8fa","230949c88cb5cac7743ccfe406447ea3")
