index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("3bcde12b9388e30df1dee8925999e6101718fde3040d2708adbbc93b400e4a17","dba195e6ccc386f9d260f09e2c5d84c1a5f8b28c707e1a353f72dba9ffa2b850","1be9fcca5fd587accd9dbfa1b6a67a2e6bb58465dd78f775c40f6eb6480bfb5f","64fd11a9befea1310503336a6a8194fca7ab7af291562787c4985d1a1f06b4e1","0d32a67ee4193520116d2435d1d579811c5ab71c7550d433948eb82e027cc601","7f8737e14ca51c1724c0f65a568cefa4d9e1536416ddf89569eab2cce8ae2e01")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("3bcde12b9388e30df1dee8925999e6101718fde3040d2708adbbc93b400e4a17","dba195e6ccc386f9d260f09e2c5d84c1a5f8b28c707e1a353f72dba9ffa2b850","1be9fcca5fd587accd9dbfa1b6a67a2e6bb58465dd78f775c40f6eb6480bfb5f","64fd11a9befea1310503336a6a8194fca7ab7af291562787c4985d1a1f06b4e1","0d32a67ee4193520116d2435d1d579811c5ab71c7550d433948eb82e027cc601","7f8737e14ca51c1724c0f65a568cefa4d9e1536416ddf89569eab2cce8ae2e01")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("3bcde12b9388e30df1dee8925999e6101718fde3040d2708adbbc93b400e4a17","dba195e6ccc386f9d260f09e2c5d84c1a5f8b28c707e1a353f72dba9ffa2b850","1be9fcca5fd587accd9dbfa1b6a67a2e6bb58465dd78f775c40f6eb6480bfb5f","64fd11a9befea1310503336a6a8194fca7ab7af291562787c4985d1a1f06b4e1","0d32a67ee4193520116d2435d1d579811c5ab71c7550d433948eb82e027cc601","7f8737e14ca51c1724c0f65a568cefa4d9e1536416ddf89569eab2cce8ae2e01")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring64 NOT NULL AND customstring64 IN ("3bcde12b9388e30df1dee8925999e6101718fde3040d2708adbbc93b400e4a17","dba195e6ccc386f9d260f09e2c5d84c1a5f8b28c707e1a353f72dba9ffa2b850","1be9fcca5fd587accd9dbfa1b6a67a2e6bb58465dd78f775c40f6eb6480bfb5f","64fd11a9befea1310503336a6a8194fca7ab7af291562787c4985d1a1f06b4e1","0d32a67ee4193520116d2435d1d579811c5ab71c7550d433948eb82e027cc601","7f8737e14ca51c1724c0f65a568cefa4d9e1536416ddf89569eab2cce8ae2e01")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("3bcde12b9388e30df1dee8925999e6101718fde3040d2708adbbc93b400e4a17","dba195e6ccc386f9d260f09e2c5d84c1a5f8b28c707e1a353f72dba9ffa2b850","1be9fcca5fd587accd9dbfa1b6a67a2e6bb58465dd78f775c40f6eb6480bfb5f","64fd11a9befea1310503336a6a8194fca7ab7af291562787c4985d1a1f06b4e1","0d32a67ee4193520116d2435d1d579811c5ab71c7550d433948eb82e027cc601","7f8737e14ca51c1724c0f65a568cefa4d9e1536416ddf89569eab2cce8ae2e01")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("3bcde12b9388e30df1dee8925999e6101718fde3040d2708adbbc93b400e4a17","dba195e6ccc386f9d260f09e2c5d84c1a5f8b28c707e1a353f72dba9ffa2b850","1be9fcca5fd587accd9dbfa1b6a67a2e6bb58465dd78f775c40f6eb6480bfb5f","64fd11a9befea1310503336a6a8194fca7ab7af291562787c4985d1a1f06b4e1","0d32a67ee4193520116d2435d1d579811c5ab71c7550d433948eb82e027cc601","7f8737e14ca51c1724c0f65a568cefa4d9e1536416ddf89569eab2cce8ae2e01")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("3bcde12b9388e30df1dee8925999e6101718fde3040d2708adbbc93b400e4a17","dba195e6ccc386f9d260f09e2c5d84c1a5f8b28c707e1a353f72dba9ffa2b850","1be9fcca5fd587accd9dbfa1b6a67a2e6bb58465dd78f775c40f6eb6480bfb5f","64fd11a9befea1310503336a6a8194fca7ab7af291562787c4985d1a1f06b4e1","0d32a67ee4193520116d2435d1d579811c5ab71c7550d433948eb82e027cc601","7f8737e14ca51c1724c0f65a568cefa4d9e1536416ddf89569eab2cce8ae2e01")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("3bcde12b9388e30df1dee8925999e6101718fde3040d2708adbbc93b400e4a17","dba195e6ccc386f9d260f09e2c5d84c1a5f8b28c707e1a353f72dba9ffa2b850","1be9fcca5fd587accd9dbfa1b6a67a2e6bb58465dd78f775c40f6eb6480bfb5f","64fd11a9befea1310503336a6a8194fca7ab7af291562787c4985d1a1f06b4e1","0d32a67ee4193520116d2435d1d579811c5ab71c7550d433948eb82e027cc601","7f8737e14ca51c1724c0f65a568cefa4d9e1536416ddf89569eab2cce8ae2e01")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("3bcde12b9388e30df1dee8925999e6101718fde3040d2708adbbc93b400e4a17","dba195e6ccc386f9d260f09e2c5d84c1a5f8b28c707e1a353f72dba9ffa2b850","1be9fcca5fd587accd9dbfa1b6a67a2e6bb58465dd78f775c40f6eb6480bfb5f","64fd11a9befea1310503336a6a8194fca7ab7af291562787c4985d1a1f06b4e1","0d32a67ee4193520116d2435d1d579811c5ab71c7550d433948eb82e027cc601","7f8737e14ca51c1724c0f65a568cefa4d9e1536416ddf89569eab2cce8ae2e01")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("3bcde12b9388e30df1dee8925999e6101718fde3040d2708adbbc93b400e4a17","dba195e6ccc386f9d260f09e2c5d84c1a5f8b28c707e1a353f72dba9ffa2b850","1be9fcca5fd587accd9dbfa1b6a67a2e6bb58465dd78f775c40f6eb6480bfb5f","64fd11a9befea1310503336a6a8194fca7ab7af291562787c4985d1a1f06b4e1","0d32a67ee4193520116d2435d1d579811c5ab71c7550d433948eb82e027cc601","7f8737e14ca51c1724c0f65a568cefa4d9e1536416ddf89569eab2cce8ae2e01")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("3bcde12b9388e30df1dee8925999e6101718fde3040d2708adbbc93b400e4a17","dba195e6ccc386f9d260f09e2c5d84c1a5f8b28c707e1a353f72dba9ffa2b850","1be9fcca5fd587accd9dbfa1b6a67a2e6bb58465dd78f775c40f6eb6480bfb5f","64fd11a9befea1310503336a6a8194fca7ab7af291562787c4985d1a1f06b4e1","0d32a67ee4193520116d2435d1d579811c5ab71c7550d433948eb82e027cc601","7f8737e14ca51c1724c0f65a568cefa4d9e1536416ddf89569eab2cce8ae2e01")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("3bcde12b9388e30df1dee8925999e6101718fde3040d2708adbbc93b400e4a17","dba195e6ccc386f9d260f09e2c5d84c1a5f8b28c707e1a353f72dba9ffa2b850","1be9fcca5fd587accd9dbfa1b6a67a2e6bb58465dd78f775c40f6eb6480bfb5f","64fd11a9befea1310503336a6a8194fca7ab7af291562787c4985d1a1f06b4e1","0d32a67ee4193520116d2435d1d579811c5ab71c7550d433948eb82e027cc601","7f8737e14ca51c1724c0f65a568cefa4d9e1536416ddf89569eab2cce8ae2e01")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("3bcde12b9388e30df1dee8925999e6101718fde3040d2708adbbc93b400e4a17","dba195e6ccc386f9d260f09e2c5d84c1a5f8b28c707e1a353f72dba9ffa2b850","1be9fcca5fd587accd9dbfa1b6a67a2e6bb58465dd78f775c40f6eb6480bfb5f","64fd11a9befea1310503336a6a8194fca7ab7af291562787c4985d1a1f06b4e1","0d32a67ee4193520116d2435d1d579811c5ab71c7550d433948eb82e027cc601","7f8737e14ca51c1724c0f65a568cefa4d9e1536416ddf89569eab2cce8ae2e01")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("3bcde12b9388e30df1dee8925999e6101718fde3040d2708adbbc93b400e4a17","dba195e6ccc386f9d260f09e2c5d84c1a5f8b28c707e1a353f72dba9ffa2b850","1be9fcca5fd587accd9dbfa1b6a67a2e6bb58465dd78f775c40f6eb6480bfb5f","64fd11a9befea1310503336a6a8194fca7ab7af291562787c4985d1a1f06b4e1","0d32a67ee4193520116d2435d1d579811c5ab71c7550d433948eb82e027cc601","7f8737e14ca51c1724c0f65a568cefa4d9e1536416ddf89569eab2cce8ae2e01")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("3bcde12b9388e30df1dee8925999e6101718fde3040d2708adbbc93b400e4a17","dba195e6ccc386f9d260f09e2c5d84c1a5f8b28c707e1a353f72dba9ffa2b850","1be9fcca5fd587accd9dbfa1b6a67a2e6bb58465dd78f775c40f6eb6480bfb5f","64fd11a9befea1310503336a6a8194fca7ab7af291562787c4985d1a1f06b4e1","0d32a67ee4193520116d2435d1d579811c5ab71c7550d433948eb82e027cc601","7f8737e14ca51c1724c0f65a568cefa4d9e1536416ddf89569eab2cce8ae2e01")
index=activity AND rg_functionality="Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("3bcde12b9388e30df1dee8925999e6101718fde3040d2708adbbc93b400e4a17","dba195e6ccc386f9d260f09e2c5d84c1a5f8b28c707e1a353f72dba9ffa2b850","1be9fcca5fd587accd9dbfa1b6a67a2e6bb58465dd78f775c40f6eb6480bfb5f","64fd11a9befea1310503336a6a8194fca7ab7af291562787c4985d1a1f06b4e1","0d32a67ee4193520116d2435d1d579811c5ab71c7550d433948eb82e027cc601","7f8737e14ca51c1724c0f65a568cefa4d9e1536416ddf89569eab2cce8ae2e01")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("3bcde12b9388e30df1dee8925999e6101718fde3040d2708adbbc93b400e4a17","dba195e6ccc386f9d260f09e2c5d84c1a5f8b28c707e1a353f72dba9ffa2b850","1be9fcca5fd587accd9dbfa1b6a67a2e6bb58465dd78f775c40f6eb6480bfb5f","64fd11a9befea1310503336a6a8194fca7ab7af291562787c4985d1a1f06b4e1","0d32a67ee4193520116d2435d1d579811c5ab71c7550d433948eb82e027cc601","7f8737e14ca51c1724c0f65a568cefa4d9e1536416ddf89569eab2cce8ae2e01")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("3bcde12b9388e30df1dee8925999e6101718fde3040d2708adbbc93b400e4a17","dba195e6ccc386f9d260f09e2c5d84c1a5f8b28c707e1a353f72dba9ffa2b850","1be9fcca5fd587accd9dbfa1b6a67a2e6bb58465dd78f775c40f6eb6480bfb5f","64fd11a9befea1310503336a6a8194fca7ab7af291562787c4985d1a1f06b4e1","0d32a67ee4193520116d2435d1d579811c5ab71c7550d433948eb82e027cc601","7f8737e14ca51c1724c0f65a568cefa4d9e1536416ddf89569eab2cce8ae2e01")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("3bcde12b9388e30df1dee8925999e6101718fde3040d2708adbbc93b400e4a17","dba195e6ccc386f9d260f09e2c5d84c1a5f8b28c707e1a353f72dba9ffa2b850","1be9fcca5fd587accd9dbfa1b6a67a2e6bb58465dd78f775c40f6eb6480bfb5f","64fd11a9befea1310503336a6a8194fca7ab7af291562787c4985d1a1f06b4e1","0d32a67ee4193520116d2435d1d579811c5ab71c7550d433948eb82e027cc601","7f8737e14ca51c1724c0f65a568cefa4d9e1536416ddf89569eab2cce8ae2e01")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("3bcde12b9388e30df1dee8925999e6101718fde3040d2708adbbc93b400e4a17","dba195e6ccc386f9d260f09e2c5d84c1a5f8b28c707e1a353f72dba9ffa2b850","1be9fcca5fd587accd9dbfa1b6a67a2e6bb58465dd78f775c40f6eb6480bfb5f","64fd11a9befea1310503336a6a8194fca7ab7af291562787c4985d1a1f06b4e1","0d32a67ee4193520116d2435d1d579811c5ab71c7550d433948eb82e027cc601","7f8737e14ca51c1724c0f65a568cefa4d9e1536416ddf89569eab2cce8ae2e01")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("3bcde12b9388e30df1dee8925999e6101718fde3040d2708adbbc93b400e4a17","dba195e6ccc386f9d260f09e2c5d84c1a5f8b28c707e1a353f72dba9ffa2b850","1be9fcca5fd587accd9dbfa1b6a67a2e6bb58465dd78f775c40f6eb6480bfb5f","64fd11a9befea1310503336a6a8194fca7ab7af291562787c4985d1a1f06b4e1","0d32a67ee4193520116d2435d1d579811c5ab71c7550d433948eb82e027cc601","7f8737e14ca51c1724c0f65a568cefa4d9e1536416ddf89569eab2cce8ae2e01")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("3bcde12b9388e30df1dee8925999e6101718fde3040d2708adbbc93b400e4a17","dba195e6ccc386f9d260f09e2c5d84c1a5f8b28c707e1a353f72dba9ffa2b850","1be9fcca5fd587accd9dbfa1b6a67a2e6bb58465dd78f775c40f6eb6480bfb5f","64fd11a9befea1310503336a6a8194fca7ab7af291562787c4985d1a1f06b4e1","0d32a67ee4193520116d2435d1d579811c5ab71c7550d433948eb82e027cc601","7f8737e14ca51c1724c0f65a568cefa4d9e1536416ddf89569eab2cce8ae2e01")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("3bcde12b9388e30df1dee8925999e6101718fde3040d2708adbbc93b400e4a17","dba195e6ccc386f9d260f09e2c5d84c1a5f8b28c707e1a353f72dba9ffa2b850","1be9fcca5fd587accd9dbfa1b6a67a2e6bb58465dd78f775c40f6eb6480bfb5f","64fd11a9befea1310503336a6a8194fca7ab7af291562787c4985d1a1f06b4e1","0d32a67ee4193520116d2435d1d579811c5ab71c7550d433948eb82e027cc601","7f8737e14ca51c1724c0f65a568cefa4d9e1536416ddf89569eab2cce8ae2e01")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring64 NOT NULL AND customstring64 IN ("3bcde12b9388e30df1dee8925999e6101718fde3040d2708adbbc93b400e4a17","dba195e6ccc386f9d260f09e2c5d84c1a5f8b28c707e1a353f72dba9ffa2b850","1be9fcca5fd587accd9dbfa1b6a67a2e6bb58465dd78f775c40f6eb6480bfb5f","64fd11a9befea1310503336a6a8194fca7ab7af291562787c4985d1a1f06b4e1","0d32a67ee4193520116d2435d1d579811c5ab71c7550d433948eb82e027cc601","7f8737e14ca51c1724c0f65a568cefa4d9e1536416ddf89569eab2cce8ae2e01")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("3bcde12b9388e30df1dee8925999e6101718fde3040d2708adbbc93b400e4a17","dba195e6ccc386f9d260f09e2c5d84c1a5f8b28c707e1a353f72dba9ffa2b850","1be9fcca5fd587accd9dbfa1b6a67a2e6bb58465dd78f775c40f6eb6480bfb5f","64fd11a9befea1310503336a6a8194fca7ab7af291562787c4985d1a1f06b4e1","0d32a67ee4193520116d2435d1d579811c5ab71c7550d433948eb82e027cc601","7f8737e14ca51c1724c0f65a568cefa4d9e1536416ddf89569eab2cce8ae2e01")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("3bcde12b9388e30df1dee8925999e6101718fde3040d2708adbbc93b400e4a17","dba195e6ccc386f9d260f09e2c5d84c1a5f8b28c707e1a353f72dba9ffa2b850","1be9fcca5fd587accd9dbfa1b6a67a2e6bb58465dd78f775c40f6eb6480bfb5f","64fd11a9befea1310503336a6a8194fca7ab7af291562787c4985d1a1f06b4e1","0d32a67ee4193520116d2435d1d579811c5ab71c7550d433948eb82e027cc601","7f8737e14ca51c1724c0f65a568cefa4d9e1536416ddf89569eab2cce8ae2e01")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("3bcde12b9388e30df1dee8925999e6101718fde3040d2708adbbc93b400e4a17","dba195e6ccc386f9d260f09e2c5d84c1a5f8b28c707e1a353f72dba9ffa2b850","1be9fcca5fd587accd9dbfa1b6a67a2e6bb58465dd78f775c40f6eb6480bfb5f","64fd11a9befea1310503336a6a8194fca7ab7af291562787c4985d1a1f06b4e1","0d32a67ee4193520116d2435d1d579811c5ab71c7550d433948eb82e027cc601","7f8737e14ca51c1724c0f65a568cefa4d9e1536416ddf89569eab2cce8ae2e01")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring64 NOT NULL AND customstring64 IN ("3bcde12b9388e30df1dee8925999e6101718fde3040d2708adbbc93b400e4a17","dba195e6ccc386f9d260f09e2c5d84c1a5f8b28c707e1a353f72dba9ffa2b850","1be9fcca5fd587accd9dbfa1b6a67a2e6bb58465dd78f775c40f6eb6480bfb5f","64fd11a9befea1310503336a6a8194fca7ab7af291562787c4985d1a1f06b4e1","0d32a67ee4193520116d2435d1d579811c5ab71c7550d433948eb82e027cc601","7f8737e14ca51c1724c0f65a568cefa4d9e1536416ddf89569eab2cce8ae2e01")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("3bcde12b9388e30df1dee8925999e6101718fde3040d2708adbbc93b400e4a17","dba195e6ccc386f9d260f09e2c5d84c1a5f8b28c707e1a353f72dba9ffa2b850","1be9fcca5fd587accd9dbfa1b6a67a2e6bb58465dd78f775c40f6eb6480bfb5f","64fd11a9befea1310503336a6a8194fca7ab7af291562787c4985d1a1f06b4e1","0d32a67ee4193520116d2435d1d579811c5ab71c7550d433948eb82e027cc601","7f8737e14ca51c1724c0f65a568cefa4d9e1536416ddf89569eab2cce8ae2e01")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("3bcde12b9388e30df1dee8925999e6101718fde3040d2708adbbc93b400e4a17","dba195e6ccc386f9d260f09e2c5d84c1a5f8b28c707e1a353f72dba9ffa2b850","1be9fcca5fd587accd9dbfa1b6a67a2e6bb58465dd78f775c40f6eb6480bfb5f","64fd11a9befea1310503336a6a8194fca7ab7af291562787c4985d1a1f06b4e1","0d32a67ee4193520116d2435d1d579811c5ab71c7550d433948eb82e027cc601","7f8737e14ca51c1724c0f65a568cefa4d9e1536416ddf89569eab2cce8ae2e01")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("3bcde12b9388e30df1dee8925999e6101718fde3040d2708adbbc93b400e4a17","dba195e6ccc386f9d260f09e2c5d84c1a5f8b28c707e1a353f72dba9ffa2b850","1be9fcca5fd587accd9dbfa1b6a67a2e6bb58465dd78f775c40f6eb6480bfb5f","64fd11a9befea1310503336a6a8194fca7ab7af291562787c4985d1a1f06b4e1","0d32a67ee4193520116d2435d1d579811c5ab71c7550d433948eb82e027cc601","7f8737e14ca51c1724c0f65a568cefa4d9e1536416ddf89569eab2cce8ae2e01")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring64 NOT NULL AND customstring64 IN ("3bcde12b9388e30df1dee8925999e6101718fde3040d2708adbbc93b400e4a17","dba195e6ccc386f9d260f09e2c5d84c1a5f8b28c707e1a353f72dba9ffa2b850","1be9fcca5fd587accd9dbfa1b6a67a2e6bb58465dd78f775c40f6eb6480bfb5f","64fd11a9befea1310503336a6a8194fca7ab7af291562787c4985d1a1f06b4e1","0d32a67ee4193520116d2435d1d579811c5ab71c7550d433948eb82e027cc601","7f8737e14ca51c1724c0f65a568cefa4d9e1536416ddf89569eab2cce8ae2e01")
