index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("1aec7b1227060a987d5cb6f17782e76e","591b2aaf1732c8a656b5c602875cbdd9","d035135e190fb6121faa7630e4a45eed","cc1522fb2121cf4ae57278921a5965da","2dc20d55d248e8a99afbe5edaae5d2fc","f34fa3d0329642615c17061e252c6afe","051517b5b685116c2f4f1e6b535eb4cb","da05d6ab72290ca064916324cbc86bab","443a00feeb3beaea02b2fbcd4302a3c9","f6d72abf9ca654a20bbaf23ea1c10a55")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("1aec7b1227060a987d5cb6f17782e76e","591b2aaf1732c8a656b5c602875cbdd9","d035135e190fb6121faa7630e4a45eed","cc1522fb2121cf4ae57278921a5965da","2dc20d55d248e8a99afbe5edaae5d2fc","f34fa3d0329642615c17061e252c6afe","051517b5b685116c2f4f1e6b535eb4cb","da05d6ab72290ca064916324cbc86bab","443a00feeb3beaea02b2fbcd4302a3c9","f6d72abf9ca654a20bbaf23ea1c10a55")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("1aec7b1227060a987d5cb6f17782e76e","591b2aaf1732c8a656b5c602875cbdd9","d035135e190fb6121faa7630e4a45eed","cc1522fb2121cf4ae57278921a5965da","2dc20d55d248e8a99afbe5edaae5d2fc","f34fa3d0329642615c17061e252c6afe","051517b5b685116c2f4f1e6b535eb4cb","da05d6ab72290ca064916324cbc86bab","443a00feeb3beaea02b2fbcd4302a3c9","f6d72abf9ca654a20bbaf23ea1c10a55")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring64 NOT NULL AND customstring64 IN ("1aec7b1227060a987d5cb6f17782e76e","591b2aaf1732c8a656b5c602875cbdd9","d035135e190fb6121faa7630e4a45eed","cc1522fb2121cf4ae57278921a5965da","2dc20d55d248e8a99afbe5edaae5d2fc","f34fa3d0329642615c17061e252c6afe","051517b5b685116c2f4f1e6b535eb4cb","da05d6ab72290ca064916324cbc86bab","443a00feeb3beaea02b2fbcd4302a3c9","f6d72abf9ca654a20bbaf23ea1c10a55")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("1aec7b1227060a987d5cb6f17782e76e","591b2aaf1732c8a656b5c602875cbdd9","d035135e190fb6121faa7630e4a45eed","cc1522fb2121cf4ae57278921a5965da","2dc20d55d248e8a99afbe5edaae5d2fc","f34fa3d0329642615c17061e252c6afe","051517b5b685116c2f4f1e6b535eb4cb","da05d6ab72290ca064916324cbc86bab","443a00feeb3beaea02b2fbcd4302a3c9","f6d72abf9ca654a20bbaf23ea1c10a55")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("1aec7b1227060a987d5cb6f17782e76e","591b2aaf1732c8a656b5c602875cbdd9","d035135e190fb6121faa7630e4a45eed","cc1522fb2121cf4ae57278921a5965da","2dc20d55d248e8a99afbe5edaae5d2fc","f34fa3d0329642615c17061e252c6afe","051517b5b685116c2f4f1e6b535eb4cb","da05d6ab72290ca064916324cbc86bab","443a00feeb3beaea02b2fbcd4302a3c9","f6d72abf9ca654a20bbaf23ea1c10a55")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("1aec7b1227060a987d5cb6f17782e76e","591b2aaf1732c8a656b5c602875cbdd9","d035135e190fb6121faa7630e4a45eed","cc1522fb2121cf4ae57278921a5965da","2dc20d55d248e8a99afbe5edaae5d2fc","f34fa3d0329642615c17061e252c6afe","051517b5b685116c2f4f1e6b535eb4cb","da05d6ab72290ca064916324cbc86bab","443a00feeb3beaea02b2fbcd4302a3c9","f6d72abf9ca654a20bbaf23ea1c10a55")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("1aec7b1227060a987d5cb6f17782e76e","591b2aaf1732c8a656b5c602875cbdd9","d035135e190fb6121faa7630e4a45eed","cc1522fb2121cf4ae57278921a5965da","2dc20d55d248e8a99afbe5edaae5d2fc","f34fa3d0329642615c17061e252c6afe","051517b5b685116c2f4f1e6b535eb4cb","da05d6ab72290ca064916324cbc86bab","443a00feeb3beaea02b2fbcd4302a3c9","f6d72abf9ca654a20bbaf23ea1c10a55")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("1aec7b1227060a987d5cb6f17782e76e","591b2aaf1732c8a656b5c602875cbdd9","d035135e190fb6121faa7630e4a45eed","cc1522fb2121cf4ae57278921a5965da","2dc20d55d248e8a99afbe5edaae5d2fc","f34fa3d0329642615c17061e252c6afe","051517b5b685116c2f4f1e6b535eb4cb","da05d6ab72290ca064916324cbc86bab","443a00feeb3beaea02b2fbcd4302a3c9","f6d72abf9ca654a20bbaf23ea1c10a55")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("1aec7b1227060a987d5cb6f17782e76e","591b2aaf1732c8a656b5c602875cbdd9","d035135e190fb6121faa7630e4a45eed","cc1522fb2121cf4ae57278921a5965da","2dc20d55d248e8a99afbe5edaae5d2fc","f34fa3d0329642615c17061e252c6afe","051517b5b685116c2f4f1e6b535eb4cb","da05d6ab72290ca064916324cbc86bab","443a00feeb3beaea02b2fbcd4302a3c9","f6d72abf9ca654a20bbaf23ea1c10a55")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("1aec7b1227060a987d5cb6f17782e76e","591b2aaf1732c8a656b5c602875cbdd9","d035135e190fb6121faa7630e4a45eed","cc1522fb2121cf4ae57278921a5965da","2dc20d55d248e8a99afbe5edaae5d2fc","f34fa3d0329642615c17061e252c6afe","051517b5b685116c2f4f1e6b535eb4cb","da05d6ab72290ca064916324cbc86bab","443a00feeb3beaea02b2fbcd4302a3c9","f6d72abf9ca654a20bbaf23ea1c10a55")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("1aec7b1227060a987d5cb6f17782e76e","591b2aaf1732c8a656b5c602875cbdd9","d035135e190fb6121faa7630e4a45eed","cc1522fb2121cf4ae57278921a5965da","2dc20d55d248e8a99afbe5edaae5d2fc","f34fa3d0329642615c17061e252c6afe","051517b5b685116c2f4f1e6b535eb4cb","da05d6ab72290ca064916324cbc86bab","443a00feeb3beaea02b2fbcd4302a3c9","f6d72abf9ca654a20bbaf23ea1c10a55")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("1aec7b1227060a987d5cb6f17782e76e","591b2aaf1732c8a656b5c602875cbdd9","d035135e190fb6121faa7630e4a45eed","cc1522fb2121cf4ae57278921a5965da","2dc20d55d248e8a99afbe5edaae5d2fc","f34fa3d0329642615c17061e252c6afe","051517b5b685116c2f4f1e6b535eb4cb","da05d6ab72290ca064916324cbc86bab","443a00feeb3beaea02b2fbcd4302a3c9","f6d72abf9ca654a20bbaf23ea1c10a55")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("1aec7b1227060a987d5cb6f17782e76e","591b2aaf1732c8a656b5c602875cbdd9","d035135e190fb6121faa7630e4a45eed","cc1522fb2121cf4ae57278921a5965da","2dc20d55d248e8a99afbe5edaae5d2fc","f34fa3d0329642615c17061e252c6afe","051517b5b685116c2f4f1e6b535eb4cb","da05d6ab72290ca064916324cbc86bab","443a00feeb3beaea02b2fbcd4302a3c9","f6d72abf9ca654a20bbaf23ea1c10a55")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("1aec7b1227060a987d5cb6f17782e76e","591b2aaf1732c8a656b5c602875cbdd9","d035135e190fb6121faa7630e4a45eed","cc1522fb2121cf4ae57278921a5965da","2dc20d55d248e8a99afbe5edaae5d2fc","f34fa3d0329642615c17061e252c6afe","051517b5b685116c2f4f1e6b535eb4cb","da05d6ab72290ca064916324cbc86bab","443a00feeb3beaea02b2fbcd4302a3c9","f6d72abf9ca654a20bbaf23ea1c10a55")
index=activity AND rg_functionality="Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("1aec7b1227060a987d5cb6f17782e76e","591b2aaf1732c8a656b5c602875cbdd9","d035135e190fb6121faa7630e4a45eed","cc1522fb2121cf4ae57278921a5965da","2dc20d55d248e8a99afbe5edaae5d2fc","f34fa3d0329642615c17061e252c6afe","051517b5b685116c2f4f1e6b535eb4cb","da05d6ab72290ca064916324cbc86bab","443a00feeb3beaea02b2fbcd4302a3c9","f6d72abf9ca654a20bbaf23ea1c10a55")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("1aec7b1227060a987d5cb6f17782e76e","591b2aaf1732c8a656b5c602875cbdd9","d035135e190fb6121faa7630e4a45eed","cc1522fb2121cf4ae57278921a5965da","2dc20d55d248e8a99afbe5edaae5d2fc","f34fa3d0329642615c17061e252c6afe","051517b5b685116c2f4f1e6b535eb4cb","da05d6ab72290ca064916324cbc86bab","443a00feeb3beaea02b2fbcd4302a3c9","f6d72abf9ca654a20bbaf23ea1c10a55")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("1aec7b1227060a987d5cb6f17782e76e","591b2aaf1732c8a656b5c602875cbdd9","d035135e190fb6121faa7630e4a45eed","cc1522fb2121cf4ae57278921a5965da","2dc20d55d248e8a99afbe5edaae5d2fc","f34fa3d0329642615c17061e252c6afe","051517b5b685116c2f4f1e6b535eb4cb","da05d6ab72290ca064916324cbc86bab","443a00feeb3beaea02b2fbcd4302a3c9","f6d72abf9ca654a20bbaf23ea1c10a55")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("1aec7b1227060a987d5cb6f17782e76e","591b2aaf1732c8a656b5c602875cbdd9","d035135e190fb6121faa7630e4a45eed","cc1522fb2121cf4ae57278921a5965da","2dc20d55d248e8a99afbe5edaae5d2fc","f34fa3d0329642615c17061e252c6afe","051517b5b685116c2f4f1e6b535eb4cb","da05d6ab72290ca064916324cbc86bab","443a00feeb3beaea02b2fbcd4302a3c9","f6d72abf9ca654a20bbaf23ea1c10a55")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("1aec7b1227060a987d5cb6f17782e76e","591b2aaf1732c8a656b5c602875cbdd9","d035135e190fb6121faa7630e4a45eed","cc1522fb2121cf4ae57278921a5965da","2dc20d55d248e8a99afbe5edaae5d2fc","f34fa3d0329642615c17061e252c6afe","051517b5b685116c2f4f1e6b535eb4cb","da05d6ab72290ca064916324cbc86bab","443a00feeb3beaea02b2fbcd4302a3c9","f6d72abf9ca654a20bbaf23ea1c10a55")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("1aec7b1227060a987d5cb6f17782e76e","591b2aaf1732c8a656b5c602875cbdd9","d035135e190fb6121faa7630e4a45eed","cc1522fb2121cf4ae57278921a5965da","2dc20d55d248e8a99afbe5edaae5d2fc","f34fa3d0329642615c17061e252c6afe","051517b5b685116c2f4f1e6b535eb4cb","da05d6ab72290ca064916324cbc86bab","443a00feeb3beaea02b2fbcd4302a3c9","f6d72abf9ca654a20bbaf23ea1c10a55")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("1aec7b1227060a987d5cb6f17782e76e","591b2aaf1732c8a656b5c602875cbdd9","d035135e190fb6121faa7630e4a45eed","cc1522fb2121cf4ae57278921a5965da","2dc20d55d248e8a99afbe5edaae5d2fc","f34fa3d0329642615c17061e252c6afe","051517b5b685116c2f4f1e6b535eb4cb","da05d6ab72290ca064916324cbc86bab","443a00feeb3beaea02b2fbcd4302a3c9","f6d72abf9ca654a20bbaf23ea1c10a55")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("1aec7b1227060a987d5cb6f17782e76e","591b2aaf1732c8a656b5c602875cbdd9","d035135e190fb6121faa7630e4a45eed","cc1522fb2121cf4ae57278921a5965da","2dc20d55d248e8a99afbe5edaae5d2fc","f34fa3d0329642615c17061e252c6afe","051517b5b685116c2f4f1e6b535eb4cb","da05d6ab72290ca064916324cbc86bab","443a00feeb3beaea02b2fbcd4302a3c9","f6d72abf9ca654a20bbaf23ea1c10a55")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring64 NOT NULL AND customstring64 IN ("1aec7b1227060a987d5cb6f17782e76e","591b2aaf1732c8a656b5c602875cbdd9","d035135e190fb6121faa7630e4a45eed","cc1522fb2121cf4ae57278921a5965da","2dc20d55d248e8a99afbe5edaae5d2fc","f34fa3d0329642615c17061e252c6afe","051517b5b685116c2f4f1e6b535eb4cb","da05d6ab72290ca064916324cbc86bab","443a00feeb3beaea02b2fbcd4302a3c9","f6d72abf9ca654a20bbaf23ea1c10a55")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("1aec7b1227060a987d5cb6f17782e76e","591b2aaf1732c8a656b5c602875cbdd9","d035135e190fb6121faa7630e4a45eed","cc1522fb2121cf4ae57278921a5965da","2dc20d55d248e8a99afbe5edaae5d2fc","f34fa3d0329642615c17061e252c6afe","051517b5b685116c2f4f1e6b535eb4cb","da05d6ab72290ca064916324cbc86bab","443a00feeb3beaea02b2fbcd4302a3c9","f6d72abf9ca654a20bbaf23ea1c10a55")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("1aec7b1227060a987d5cb6f17782e76e","591b2aaf1732c8a656b5c602875cbdd9","d035135e190fb6121faa7630e4a45eed","cc1522fb2121cf4ae57278921a5965da","2dc20d55d248e8a99afbe5edaae5d2fc","f34fa3d0329642615c17061e252c6afe","051517b5b685116c2f4f1e6b535eb4cb","da05d6ab72290ca064916324cbc86bab","443a00feeb3beaea02b2fbcd4302a3c9","f6d72abf9ca654a20bbaf23ea1c10a55")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("1aec7b1227060a987d5cb6f17782e76e","591b2aaf1732c8a656b5c602875cbdd9","d035135e190fb6121faa7630e4a45eed","cc1522fb2121cf4ae57278921a5965da","2dc20d55d248e8a99afbe5edaae5d2fc","f34fa3d0329642615c17061e252c6afe","051517b5b685116c2f4f1e6b535eb4cb","da05d6ab72290ca064916324cbc86bab","443a00feeb3beaea02b2fbcd4302a3c9","f6d72abf9ca654a20bbaf23ea1c10a55")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring64 NOT NULL AND customstring64 IN ("1aec7b1227060a987d5cb6f17782e76e","591b2aaf1732c8a656b5c602875cbdd9","d035135e190fb6121faa7630e4a45eed","cc1522fb2121cf4ae57278921a5965da","2dc20d55d248e8a99afbe5edaae5d2fc","f34fa3d0329642615c17061e252c6afe","051517b5b685116c2f4f1e6b535eb4cb","da05d6ab72290ca064916324cbc86bab","443a00feeb3beaea02b2fbcd4302a3c9","f6d72abf9ca654a20bbaf23ea1c10a55")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("1aec7b1227060a987d5cb6f17782e76e","591b2aaf1732c8a656b5c602875cbdd9","d035135e190fb6121faa7630e4a45eed","cc1522fb2121cf4ae57278921a5965da","2dc20d55d248e8a99afbe5edaae5d2fc","f34fa3d0329642615c17061e252c6afe","051517b5b685116c2f4f1e6b535eb4cb","da05d6ab72290ca064916324cbc86bab","443a00feeb3beaea02b2fbcd4302a3c9","f6d72abf9ca654a20bbaf23ea1c10a55")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("1aec7b1227060a987d5cb6f17782e76e","591b2aaf1732c8a656b5c602875cbdd9","d035135e190fb6121faa7630e4a45eed","cc1522fb2121cf4ae57278921a5965da","2dc20d55d248e8a99afbe5edaae5d2fc","f34fa3d0329642615c17061e252c6afe","051517b5b685116c2f4f1e6b535eb4cb","da05d6ab72290ca064916324cbc86bab","443a00feeb3beaea02b2fbcd4302a3c9","f6d72abf9ca654a20bbaf23ea1c10a55")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("1aec7b1227060a987d5cb6f17782e76e","591b2aaf1732c8a656b5c602875cbdd9","d035135e190fb6121faa7630e4a45eed","cc1522fb2121cf4ae57278921a5965da","2dc20d55d248e8a99afbe5edaae5d2fc","f34fa3d0329642615c17061e252c6afe","051517b5b685116c2f4f1e6b535eb4cb","da05d6ab72290ca064916324cbc86bab","443a00feeb3beaea02b2fbcd4302a3c9","f6d72abf9ca654a20bbaf23ea1c10a55")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring64 NOT NULL AND customstring64 IN ("1aec7b1227060a987d5cb6f17782e76e","591b2aaf1732c8a656b5c602875cbdd9","d035135e190fb6121faa7630e4a45eed","cc1522fb2121cf4ae57278921a5965da","2dc20d55d248e8a99afbe5edaae5d2fc","f34fa3d0329642615c17061e252c6afe","051517b5b685116c2f4f1e6b535eb4cb","da05d6ab72290ca064916324cbc86bab","443a00feeb3beaea02b2fbcd4302a3c9","f6d72abf9ca654a20bbaf23ea1c10a55")
index=activity AND rg_functionality="O365 General" AND filehash NOT NULL AND filehash IN ("1aec7b1227060a987d5cb6f17782e76e","591b2aaf1732c8a656b5c602875cbdd9","d035135e190fb6121faa7630e4a45eed","cc1522fb2121cf4ae57278921a5965da","2dc20d55d248e8a99afbe5edaae5d2fc","f34fa3d0329642615c17061e252c6afe","051517b5b685116c2f4f1e6b535eb4cb","da05d6ab72290ca064916324cbc86bab","443a00feeb3beaea02b2fbcd4302a3c9","f6d72abf9ca654a20bbaf23ea1c10a55")
index=activity AND rg_functionality="O365 General" AND oldfilehash NOT NULL AND oldfilehash IN ("1aec7b1227060a987d5cb6f17782e76e","591b2aaf1732c8a656b5c602875cbdd9","d035135e190fb6121faa7630e4a45eed","cc1522fb2121cf4ae57278921a5965da","2dc20d55d248e8a99afbe5edaae5d2fc","f34fa3d0329642615c17061e252c6afe","051517b5b685116c2f4f1e6b535eb4cb","da05d6ab72290ca064916324cbc86bab","443a00feeb3beaea02b2fbcd4302a3c9","f6d72abf9ca654a20bbaf23ea1c10a55")
index=activity AND rg_functionality="O365 General" AND customstring3 NOT NULL AND customstring3 IN ("1aec7b1227060a987d5cb6f17782e76e","591b2aaf1732c8a656b5c602875cbdd9","d035135e190fb6121faa7630e4a45eed","cc1522fb2121cf4ae57278921a5965da","2dc20d55d248e8a99afbe5edaae5d2fc","f34fa3d0329642615c17061e252c6afe","051517b5b685116c2f4f1e6b535eb4cb","da05d6ab72290ca064916324cbc86bab","443a00feeb3beaea02b2fbcd4302a3c9","f6d72abf9ca654a20bbaf23ea1c10a55")
index=activity AND rg_functionality="O365 General" AND customstring64 NOT NULL AND customstring64 IN ("1aec7b1227060a987d5cb6f17782e76e","591b2aaf1732c8a656b5c602875cbdd9","d035135e190fb6121faa7630e4a45eed","cc1522fb2121cf4ae57278921a5965da","2dc20d55d248e8a99afbe5edaae5d2fc","f34fa3d0329642615c17061e252c6afe","051517b5b685116c2f4f1e6b535eb4cb","da05d6ab72290ca064916324cbc86bab","443a00feeb3beaea02b2fbcd4302a3c9","f6d72abf9ca654a20bbaf23ea1c10a55")
