index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("01906c1b73ecffd72f98e729d8ededd8a716b7e3","0be8f44f5351a6cbef1a54a6de7674e1219d65b6","0be56a8c0d0de11e0e97b563cae6d1ee164f3317","1e3d4230655411cb5f7c6885d7f947072b8f9f0f","2fdd49a3f7d06fffd32b40d35abd69dec851eb77","3ac205be62806a90072524c193b731a1423d5dfd","6abf731b90c11ffbd3406aa6b89261cc9596fefd","8e99a5ec8c173033941f5e00a3fc38b7dea9dcb3","15adffda49c07946d4bd41ab44846eb673c22b2b","47db52ab94b9a303e85ed1aa1dd949605157417e","70bc8c2dc62cf894e765950de60ec5bd2128d55b","88b125dda928462fdb00c459131b232a3cd21887","90a443787b464877ad9eb57536f51556b5ba8117","249bed77c1349be7ec1fc182afccb1234adfacdf","3101b17d73031384f555ae3acd7139bbbab3f525","8946e40255b57e95bab041687a2f0f0e15f5ffce","946082f225c76f2ffbe92235f0faf9fb9e33b784","a8acf307ea747b24d7c405deef70b50b2b3f2186","f8039d04ff310cef9ca47ac03025bd38a3587d10")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("01906c1b73ecffd72f98e729d8ededd8a716b7e3","0be8f44f5351a6cbef1a54a6de7674e1219d65b6","0be56a8c0d0de11e0e97b563cae6d1ee164f3317","1e3d4230655411cb5f7c6885d7f947072b8f9f0f","2fdd49a3f7d06fffd32b40d35abd69dec851eb77","3ac205be62806a90072524c193b731a1423d5dfd","6abf731b90c11ffbd3406aa6b89261cc9596fefd","8e99a5ec8c173033941f5e00a3fc38b7dea9dcb3","15adffda49c07946d4bd41ab44846eb673c22b2b","47db52ab94b9a303e85ed1aa1dd949605157417e","70bc8c2dc62cf894e765950de60ec5bd2128d55b","88b125dda928462fdb00c459131b232a3cd21887","90a443787b464877ad9eb57536f51556b5ba8117","249bed77c1349be7ec1fc182afccb1234adfacdf","3101b17d73031384f555ae3acd7139bbbab3f525","8946e40255b57e95bab041687a2f0f0e15f5ffce","946082f225c76f2ffbe92235f0faf9fb9e33b784","a8acf307ea747b24d7c405deef70b50b2b3f2186","f8039d04ff310cef9ca47ac03025bd38a3587d10")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("01906c1b73ecffd72f98e729d8ededd8a716b7e3","0be8f44f5351a6cbef1a54a6de7674e1219d65b6","0be56a8c0d0de11e0e97b563cae6d1ee164f3317","1e3d4230655411cb5f7c6885d7f947072b8f9f0f","2fdd49a3f7d06fffd32b40d35abd69dec851eb77","3ac205be62806a90072524c193b731a1423d5dfd","6abf731b90c11ffbd3406aa6b89261cc9596fefd","8e99a5ec8c173033941f5e00a3fc38b7dea9dcb3","15adffda49c07946d4bd41ab44846eb673c22b2b","47db52ab94b9a303e85ed1aa1dd949605157417e","70bc8c2dc62cf894e765950de60ec5bd2128d55b","88b125dda928462fdb00c459131b232a3cd21887","90a443787b464877ad9eb57536f51556b5ba8117","249bed77c1349be7ec1fc182afccb1234adfacdf","3101b17d73031384f555ae3acd7139bbbab3f525","8946e40255b57e95bab041687a2f0f0e15f5ffce","946082f225c76f2ffbe92235f0faf9fb9e33b784","a8acf307ea747b24d7c405deef70b50b2b3f2186","f8039d04ff310cef9ca47ac03025bd38a3587d10")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring64 NOT NULL AND customstring64 IN ("01906c1b73ecffd72f98e729d8ededd8a716b7e3","0be8f44f5351a6cbef1a54a6de7674e1219d65b6","0be56a8c0d0de11e0e97b563cae6d1ee164f3317","1e3d4230655411cb5f7c6885d7f947072b8f9f0f","2fdd49a3f7d06fffd32b40d35abd69dec851eb77","3ac205be62806a90072524c193b731a1423d5dfd","6abf731b90c11ffbd3406aa6b89261cc9596fefd","8e99a5ec8c173033941f5e00a3fc38b7dea9dcb3","15adffda49c07946d4bd41ab44846eb673c22b2b","47db52ab94b9a303e85ed1aa1dd949605157417e","70bc8c2dc62cf894e765950de60ec5bd2128d55b","88b125dda928462fdb00c459131b232a3cd21887","90a443787b464877ad9eb57536f51556b5ba8117","249bed77c1349be7ec1fc182afccb1234adfacdf","3101b17d73031384f555ae3acd7139bbbab3f525","8946e40255b57e95bab041687a2f0f0e15f5ffce","946082f225c76f2ffbe92235f0faf9fb9e33b784","a8acf307ea747b24d7c405deef70b50b2b3f2186","f8039d04ff310cef9ca47ac03025bd38a3587d10")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("01906c1b73ecffd72f98e729d8ededd8a716b7e3","0be8f44f5351a6cbef1a54a6de7674e1219d65b6","0be56a8c0d0de11e0e97b563cae6d1ee164f3317","1e3d4230655411cb5f7c6885d7f947072b8f9f0f","2fdd49a3f7d06fffd32b40d35abd69dec851eb77","3ac205be62806a90072524c193b731a1423d5dfd","6abf731b90c11ffbd3406aa6b89261cc9596fefd","8e99a5ec8c173033941f5e00a3fc38b7dea9dcb3","15adffda49c07946d4bd41ab44846eb673c22b2b","47db52ab94b9a303e85ed1aa1dd949605157417e","70bc8c2dc62cf894e765950de60ec5bd2128d55b","88b125dda928462fdb00c459131b232a3cd21887","90a443787b464877ad9eb57536f51556b5ba8117","249bed77c1349be7ec1fc182afccb1234adfacdf","3101b17d73031384f555ae3acd7139bbbab3f525","8946e40255b57e95bab041687a2f0f0e15f5ffce","946082f225c76f2ffbe92235f0faf9fb9e33b784","a8acf307ea747b24d7c405deef70b50b2b3f2186","f8039d04ff310cef9ca47ac03025bd38a3587d10")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("01906c1b73ecffd72f98e729d8ededd8a716b7e3","0be8f44f5351a6cbef1a54a6de7674e1219d65b6","0be56a8c0d0de11e0e97b563cae6d1ee164f3317","1e3d4230655411cb5f7c6885d7f947072b8f9f0f","2fdd49a3f7d06fffd32b40d35abd69dec851eb77","3ac205be62806a90072524c193b731a1423d5dfd","6abf731b90c11ffbd3406aa6b89261cc9596fefd","8e99a5ec8c173033941f5e00a3fc38b7dea9dcb3","15adffda49c07946d4bd41ab44846eb673c22b2b","47db52ab94b9a303e85ed1aa1dd949605157417e","70bc8c2dc62cf894e765950de60ec5bd2128d55b","88b125dda928462fdb00c459131b232a3cd21887","90a443787b464877ad9eb57536f51556b5ba8117","249bed77c1349be7ec1fc182afccb1234adfacdf","3101b17d73031384f555ae3acd7139bbbab3f525","8946e40255b57e95bab041687a2f0f0e15f5ffce","946082f225c76f2ffbe92235f0faf9fb9e33b784","a8acf307ea747b24d7c405deef70b50b2b3f2186","f8039d04ff310cef9ca47ac03025bd38a3587d10")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("01906c1b73ecffd72f98e729d8ededd8a716b7e3","0be8f44f5351a6cbef1a54a6de7674e1219d65b6","0be56a8c0d0de11e0e97b563cae6d1ee164f3317","1e3d4230655411cb5f7c6885d7f947072b8f9f0f","2fdd49a3f7d06fffd32b40d35abd69dec851eb77","3ac205be62806a90072524c193b731a1423d5dfd","6abf731b90c11ffbd3406aa6b89261cc9596fefd","8e99a5ec8c173033941f5e00a3fc38b7dea9dcb3","15adffda49c07946d4bd41ab44846eb673c22b2b","47db52ab94b9a303e85ed1aa1dd949605157417e","70bc8c2dc62cf894e765950de60ec5bd2128d55b","88b125dda928462fdb00c459131b232a3cd21887","90a443787b464877ad9eb57536f51556b5ba8117","249bed77c1349be7ec1fc182afccb1234adfacdf","3101b17d73031384f555ae3acd7139bbbab3f525","8946e40255b57e95bab041687a2f0f0e15f5ffce","946082f225c76f2ffbe92235f0faf9fb9e33b784","a8acf307ea747b24d7c405deef70b50b2b3f2186","f8039d04ff310cef9ca47ac03025bd38a3587d10")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("01906c1b73ecffd72f98e729d8ededd8a716b7e3","0be8f44f5351a6cbef1a54a6de7674e1219d65b6","0be56a8c0d0de11e0e97b563cae6d1ee164f3317","1e3d4230655411cb5f7c6885d7f947072b8f9f0f","2fdd49a3f7d06fffd32b40d35abd69dec851eb77","3ac205be62806a90072524c193b731a1423d5dfd","6abf731b90c11ffbd3406aa6b89261cc9596fefd","8e99a5ec8c173033941f5e00a3fc38b7dea9dcb3","15adffda49c07946d4bd41ab44846eb673c22b2b","47db52ab94b9a303e85ed1aa1dd949605157417e","70bc8c2dc62cf894e765950de60ec5bd2128d55b","88b125dda928462fdb00c459131b232a3cd21887","90a443787b464877ad9eb57536f51556b5ba8117","249bed77c1349be7ec1fc182afccb1234adfacdf","3101b17d73031384f555ae3acd7139bbbab3f525","8946e40255b57e95bab041687a2f0f0e15f5ffce","946082f225c76f2ffbe92235f0faf9fb9e33b784","a8acf307ea747b24d7c405deef70b50b2b3f2186","f8039d04ff310cef9ca47ac03025bd38a3587d10")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("01906c1b73ecffd72f98e729d8ededd8a716b7e3","0be8f44f5351a6cbef1a54a6de7674e1219d65b6","0be56a8c0d0de11e0e97b563cae6d1ee164f3317","1e3d4230655411cb5f7c6885d7f947072b8f9f0f","2fdd49a3f7d06fffd32b40d35abd69dec851eb77","3ac205be62806a90072524c193b731a1423d5dfd","6abf731b90c11ffbd3406aa6b89261cc9596fefd","8e99a5ec8c173033941f5e00a3fc38b7dea9dcb3","15adffda49c07946d4bd41ab44846eb673c22b2b","47db52ab94b9a303e85ed1aa1dd949605157417e","70bc8c2dc62cf894e765950de60ec5bd2128d55b","88b125dda928462fdb00c459131b232a3cd21887","90a443787b464877ad9eb57536f51556b5ba8117","249bed77c1349be7ec1fc182afccb1234adfacdf","3101b17d73031384f555ae3acd7139bbbab3f525","8946e40255b57e95bab041687a2f0f0e15f5ffce","946082f225c76f2ffbe92235f0faf9fb9e33b784","a8acf307ea747b24d7c405deef70b50b2b3f2186","f8039d04ff310cef9ca47ac03025bd38a3587d10")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("01906c1b73ecffd72f98e729d8ededd8a716b7e3","0be8f44f5351a6cbef1a54a6de7674e1219d65b6","0be56a8c0d0de11e0e97b563cae6d1ee164f3317","1e3d4230655411cb5f7c6885d7f947072b8f9f0f","2fdd49a3f7d06fffd32b40d35abd69dec851eb77","3ac205be62806a90072524c193b731a1423d5dfd","6abf731b90c11ffbd3406aa6b89261cc9596fefd","8e99a5ec8c173033941f5e00a3fc38b7dea9dcb3","15adffda49c07946d4bd41ab44846eb673c22b2b","47db52ab94b9a303e85ed1aa1dd949605157417e","70bc8c2dc62cf894e765950de60ec5bd2128d55b","88b125dda928462fdb00c459131b232a3cd21887","90a443787b464877ad9eb57536f51556b5ba8117","249bed77c1349be7ec1fc182afccb1234adfacdf","3101b17d73031384f555ae3acd7139bbbab3f525","8946e40255b57e95bab041687a2f0f0e15f5ffce","946082f225c76f2ffbe92235f0faf9fb9e33b784","a8acf307ea747b24d7c405deef70b50b2b3f2186","f8039d04ff310cef9ca47ac03025bd38a3587d10")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("01906c1b73ecffd72f98e729d8ededd8a716b7e3","0be8f44f5351a6cbef1a54a6de7674e1219d65b6","0be56a8c0d0de11e0e97b563cae6d1ee164f3317","1e3d4230655411cb5f7c6885d7f947072b8f9f0f","2fdd49a3f7d06fffd32b40d35abd69dec851eb77","3ac205be62806a90072524c193b731a1423d5dfd","6abf731b90c11ffbd3406aa6b89261cc9596fefd","8e99a5ec8c173033941f5e00a3fc38b7dea9dcb3","15adffda49c07946d4bd41ab44846eb673c22b2b","47db52ab94b9a303e85ed1aa1dd949605157417e","70bc8c2dc62cf894e765950de60ec5bd2128d55b","88b125dda928462fdb00c459131b232a3cd21887","90a443787b464877ad9eb57536f51556b5ba8117","249bed77c1349be7ec1fc182afccb1234adfacdf","3101b17d73031384f555ae3acd7139bbbab3f525","8946e40255b57e95bab041687a2f0f0e15f5ffce","946082f225c76f2ffbe92235f0faf9fb9e33b784","a8acf307ea747b24d7c405deef70b50b2b3f2186","f8039d04ff310cef9ca47ac03025bd38a3587d10")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("01906c1b73ecffd72f98e729d8ededd8a716b7e3","0be8f44f5351a6cbef1a54a6de7674e1219d65b6","0be56a8c0d0de11e0e97b563cae6d1ee164f3317","1e3d4230655411cb5f7c6885d7f947072b8f9f0f","2fdd49a3f7d06fffd32b40d35abd69dec851eb77","3ac205be62806a90072524c193b731a1423d5dfd","6abf731b90c11ffbd3406aa6b89261cc9596fefd","8e99a5ec8c173033941f5e00a3fc38b7dea9dcb3","15adffda49c07946d4bd41ab44846eb673c22b2b","47db52ab94b9a303e85ed1aa1dd949605157417e","70bc8c2dc62cf894e765950de60ec5bd2128d55b","88b125dda928462fdb00c459131b232a3cd21887","90a443787b464877ad9eb57536f51556b5ba8117","249bed77c1349be7ec1fc182afccb1234adfacdf","3101b17d73031384f555ae3acd7139bbbab3f525","8946e40255b57e95bab041687a2f0f0e15f5ffce","946082f225c76f2ffbe92235f0faf9fb9e33b784","a8acf307ea747b24d7c405deef70b50b2b3f2186","f8039d04ff310cef9ca47ac03025bd38a3587d10")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("01906c1b73ecffd72f98e729d8ededd8a716b7e3","0be8f44f5351a6cbef1a54a6de7674e1219d65b6","0be56a8c0d0de11e0e97b563cae6d1ee164f3317","1e3d4230655411cb5f7c6885d7f947072b8f9f0f","2fdd49a3f7d06fffd32b40d35abd69dec851eb77","3ac205be62806a90072524c193b731a1423d5dfd","6abf731b90c11ffbd3406aa6b89261cc9596fefd","8e99a5ec8c173033941f5e00a3fc38b7dea9dcb3","15adffda49c07946d4bd41ab44846eb673c22b2b","47db52ab94b9a303e85ed1aa1dd949605157417e","70bc8c2dc62cf894e765950de60ec5bd2128d55b","88b125dda928462fdb00c459131b232a3cd21887","90a443787b464877ad9eb57536f51556b5ba8117","249bed77c1349be7ec1fc182afccb1234adfacdf","3101b17d73031384f555ae3acd7139bbbab3f525","8946e40255b57e95bab041687a2f0f0e15f5ffce","946082f225c76f2ffbe92235f0faf9fb9e33b784","a8acf307ea747b24d7c405deef70b50b2b3f2186","f8039d04ff310cef9ca47ac03025bd38a3587d10")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("01906c1b73ecffd72f98e729d8ededd8a716b7e3","0be8f44f5351a6cbef1a54a6de7674e1219d65b6","0be56a8c0d0de11e0e97b563cae6d1ee164f3317","1e3d4230655411cb5f7c6885d7f947072b8f9f0f","2fdd49a3f7d06fffd32b40d35abd69dec851eb77","3ac205be62806a90072524c193b731a1423d5dfd","6abf731b90c11ffbd3406aa6b89261cc9596fefd","8e99a5ec8c173033941f5e00a3fc38b7dea9dcb3","15adffda49c07946d4bd41ab44846eb673c22b2b","47db52ab94b9a303e85ed1aa1dd949605157417e","70bc8c2dc62cf894e765950de60ec5bd2128d55b","88b125dda928462fdb00c459131b232a3cd21887","90a443787b464877ad9eb57536f51556b5ba8117","249bed77c1349be7ec1fc182afccb1234adfacdf","3101b17d73031384f555ae3acd7139bbbab3f525","8946e40255b57e95bab041687a2f0f0e15f5ffce","946082f225c76f2ffbe92235f0faf9fb9e33b784","a8acf307ea747b24d7c405deef70b50b2b3f2186","f8039d04ff310cef9ca47ac03025bd38a3587d10")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("01906c1b73ecffd72f98e729d8ededd8a716b7e3","0be8f44f5351a6cbef1a54a6de7674e1219d65b6","0be56a8c0d0de11e0e97b563cae6d1ee164f3317","1e3d4230655411cb5f7c6885d7f947072b8f9f0f","2fdd49a3f7d06fffd32b40d35abd69dec851eb77","3ac205be62806a90072524c193b731a1423d5dfd","6abf731b90c11ffbd3406aa6b89261cc9596fefd","8e99a5ec8c173033941f5e00a3fc38b7dea9dcb3","15adffda49c07946d4bd41ab44846eb673c22b2b","47db52ab94b9a303e85ed1aa1dd949605157417e","70bc8c2dc62cf894e765950de60ec5bd2128d55b","88b125dda928462fdb00c459131b232a3cd21887","90a443787b464877ad9eb57536f51556b5ba8117","249bed77c1349be7ec1fc182afccb1234adfacdf","3101b17d73031384f555ae3acd7139bbbab3f525","8946e40255b57e95bab041687a2f0f0e15f5ffce","946082f225c76f2ffbe92235f0faf9fb9e33b784","a8acf307ea747b24d7c405deef70b50b2b3f2186","f8039d04ff310cef9ca47ac03025bd38a3587d10")
index=activity AND rg_functionality="Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("01906c1b73ecffd72f98e729d8ededd8a716b7e3","0be8f44f5351a6cbef1a54a6de7674e1219d65b6","0be56a8c0d0de11e0e97b563cae6d1ee164f3317","1e3d4230655411cb5f7c6885d7f947072b8f9f0f","2fdd49a3f7d06fffd32b40d35abd69dec851eb77","3ac205be62806a90072524c193b731a1423d5dfd","6abf731b90c11ffbd3406aa6b89261cc9596fefd","8e99a5ec8c173033941f5e00a3fc38b7dea9dcb3","15adffda49c07946d4bd41ab44846eb673c22b2b","47db52ab94b9a303e85ed1aa1dd949605157417e","70bc8c2dc62cf894e765950de60ec5bd2128d55b","88b125dda928462fdb00c459131b232a3cd21887","90a443787b464877ad9eb57536f51556b5ba8117","249bed77c1349be7ec1fc182afccb1234adfacdf","3101b17d73031384f555ae3acd7139bbbab3f525","8946e40255b57e95bab041687a2f0f0e15f5ffce","946082f225c76f2ffbe92235f0faf9fb9e33b784","a8acf307ea747b24d7c405deef70b50b2b3f2186","f8039d04ff310cef9ca47ac03025bd38a3587d10")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("01906c1b73ecffd72f98e729d8ededd8a716b7e3","0be8f44f5351a6cbef1a54a6de7674e1219d65b6","0be56a8c0d0de11e0e97b563cae6d1ee164f3317","1e3d4230655411cb5f7c6885d7f947072b8f9f0f","2fdd49a3f7d06fffd32b40d35abd69dec851eb77","3ac205be62806a90072524c193b731a1423d5dfd","6abf731b90c11ffbd3406aa6b89261cc9596fefd","8e99a5ec8c173033941f5e00a3fc38b7dea9dcb3","15adffda49c07946d4bd41ab44846eb673c22b2b","47db52ab94b9a303e85ed1aa1dd949605157417e","70bc8c2dc62cf894e765950de60ec5bd2128d55b","88b125dda928462fdb00c459131b232a3cd21887","90a443787b464877ad9eb57536f51556b5ba8117","249bed77c1349be7ec1fc182afccb1234adfacdf","3101b17d73031384f555ae3acd7139bbbab3f525","8946e40255b57e95bab041687a2f0f0e15f5ffce","946082f225c76f2ffbe92235f0faf9fb9e33b784","a8acf307ea747b24d7c405deef70b50b2b3f2186","f8039d04ff310cef9ca47ac03025bd38a3587d10")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("01906c1b73ecffd72f98e729d8ededd8a716b7e3","0be8f44f5351a6cbef1a54a6de7674e1219d65b6","0be56a8c0d0de11e0e97b563cae6d1ee164f3317","1e3d4230655411cb5f7c6885d7f947072b8f9f0f","2fdd49a3f7d06fffd32b40d35abd69dec851eb77","3ac205be62806a90072524c193b731a1423d5dfd","6abf731b90c11ffbd3406aa6b89261cc9596fefd","8e99a5ec8c173033941f5e00a3fc38b7dea9dcb3","15adffda49c07946d4bd41ab44846eb673c22b2b","47db52ab94b9a303e85ed1aa1dd949605157417e","70bc8c2dc62cf894e765950de60ec5bd2128d55b","88b125dda928462fdb00c459131b232a3cd21887","90a443787b464877ad9eb57536f51556b5ba8117","249bed77c1349be7ec1fc182afccb1234adfacdf","3101b17d73031384f555ae3acd7139bbbab3f525","8946e40255b57e95bab041687a2f0f0e15f5ffce","946082f225c76f2ffbe92235f0faf9fb9e33b784","a8acf307ea747b24d7c405deef70b50b2b3f2186","f8039d04ff310cef9ca47ac03025bd38a3587d10")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("01906c1b73ecffd72f98e729d8ededd8a716b7e3","0be8f44f5351a6cbef1a54a6de7674e1219d65b6","0be56a8c0d0de11e0e97b563cae6d1ee164f3317","1e3d4230655411cb5f7c6885d7f947072b8f9f0f","2fdd49a3f7d06fffd32b40d35abd69dec851eb77","3ac205be62806a90072524c193b731a1423d5dfd","6abf731b90c11ffbd3406aa6b89261cc9596fefd","8e99a5ec8c173033941f5e00a3fc38b7dea9dcb3","15adffda49c07946d4bd41ab44846eb673c22b2b","47db52ab94b9a303e85ed1aa1dd949605157417e","70bc8c2dc62cf894e765950de60ec5bd2128d55b","88b125dda928462fdb00c459131b232a3cd21887","90a443787b464877ad9eb57536f51556b5ba8117","249bed77c1349be7ec1fc182afccb1234adfacdf","3101b17d73031384f555ae3acd7139bbbab3f525","8946e40255b57e95bab041687a2f0f0e15f5ffce","946082f225c76f2ffbe92235f0faf9fb9e33b784","a8acf307ea747b24d7c405deef70b50b2b3f2186","f8039d04ff310cef9ca47ac03025bd38a3587d10")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("01906c1b73ecffd72f98e729d8ededd8a716b7e3","0be8f44f5351a6cbef1a54a6de7674e1219d65b6","0be56a8c0d0de11e0e97b563cae6d1ee164f3317","1e3d4230655411cb5f7c6885d7f947072b8f9f0f","2fdd49a3f7d06fffd32b40d35abd69dec851eb77","3ac205be62806a90072524c193b731a1423d5dfd","6abf731b90c11ffbd3406aa6b89261cc9596fefd","8e99a5ec8c173033941f5e00a3fc38b7dea9dcb3","15adffda49c07946d4bd41ab44846eb673c22b2b","47db52ab94b9a303e85ed1aa1dd949605157417e","70bc8c2dc62cf894e765950de60ec5bd2128d55b","88b125dda928462fdb00c459131b232a3cd21887","90a443787b464877ad9eb57536f51556b5ba8117","249bed77c1349be7ec1fc182afccb1234adfacdf","3101b17d73031384f555ae3acd7139bbbab3f525","8946e40255b57e95bab041687a2f0f0e15f5ffce","946082f225c76f2ffbe92235f0faf9fb9e33b784","a8acf307ea747b24d7c405deef70b50b2b3f2186","f8039d04ff310cef9ca47ac03025bd38a3587d10")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("01906c1b73ecffd72f98e729d8ededd8a716b7e3","0be8f44f5351a6cbef1a54a6de7674e1219d65b6","0be56a8c0d0de11e0e97b563cae6d1ee164f3317","1e3d4230655411cb5f7c6885d7f947072b8f9f0f","2fdd49a3f7d06fffd32b40d35abd69dec851eb77","3ac205be62806a90072524c193b731a1423d5dfd","6abf731b90c11ffbd3406aa6b89261cc9596fefd","8e99a5ec8c173033941f5e00a3fc38b7dea9dcb3","15adffda49c07946d4bd41ab44846eb673c22b2b","47db52ab94b9a303e85ed1aa1dd949605157417e","70bc8c2dc62cf894e765950de60ec5bd2128d55b","88b125dda928462fdb00c459131b232a3cd21887","90a443787b464877ad9eb57536f51556b5ba8117","249bed77c1349be7ec1fc182afccb1234adfacdf","3101b17d73031384f555ae3acd7139bbbab3f525","8946e40255b57e95bab041687a2f0f0e15f5ffce","946082f225c76f2ffbe92235f0faf9fb9e33b784","a8acf307ea747b24d7c405deef70b50b2b3f2186","f8039d04ff310cef9ca47ac03025bd38a3587d10")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("01906c1b73ecffd72f98e729d8ededd8a716b7e3","0be8f44f5351a6cbef1a54a6de7674e1219d65b6","0be56a8c0d0de11e0e97b563cae6d1ee164f3317","1e3d4230655411cb5f7c6885d7f947072b8f9f0f","2fdd49a3f7d06fffd32b40d35abd69dec851eb77","3ac205be62806a90072524c193b731a1423d5dfd","6abf731b90c11ffbd3406aa6b89261cc9596fefd","8e99a5ec8c173033941f5e00a3fc38b7dea9dcb3","15adffda49c07946d4bd41ab44846eb673c22b2b","47db52ab94b9a303e85ed1aa1dd949605157417e","70bc8c2dc62cf894e765950de60ec5bd2128d55b","88b125dda928462fdb00c459131b232a3cd21887","90a443787b464877ad9eb57536f51556b5ba8117","249bed77c1349be7ec1fc182afccb1234adfacdf","3101b17d73031384f555ae3acd7139bbbab3f525","8946e40255b57e95bab041687a2f0f0e15f5ffce","946082f225c76f2ffbe92235f0faf9fb9e33b784","a8acf307ea747b24d7c405deef70b50b2b3f2186","f8039d04ff310cef9ca47ac03025bd38a3587d10")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("01906c1b73ecffd72f98e729d8ededd8a716b7e3","0be8f44f5351a6cbef1a54a6de7674e1219d65b6","0be56a8c0d0de11e0e97b563cae6d1ee164f3317","1e3d4230655411cb5f7c6885d7f947072b8f9f0f","2fdd49a3f7d06fffd32b40d35abd69dec851eb77","3ac205be62806a90072524c193b731a1423d5dfd","6abf731b90c11ffbd3406aa6b89261cc9596fefd","8e99a5ec8c173033941f5e00a3fc38b7dea9dcb3","15adffda49c07946d4bd41ab44846eb673c22b2b","47db52ab94b9a303e85ed1aa1dd949605157417e","70bc8c2dc62cf894e765950de60ec5bd2128d55b","88b125dda928462fdb00c459131b232a3cd21887","90a443787b464877ad9eb57536f51556b5ba8117","249bed77c1349be7ec1fc182afccb1234adfacdf","3101b17d73031384f555ae3acd7139bbbab3f525","8946e40255b57e95bab041687a2f0f0e15f5ffce","946082f225c76f2ffbe92235f0faf9fb9e33b784","a8acf307ea747b24d7c405deef70b50b2b3f2186","f8039d04ff310cef9ca47ac03025bd38a3587d10")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring64 NOT NULL AND customstring64 IN ("01906c1b73ecffd72f98e729d8ededd8a716b7e3","0be8f44f5351a6cbef1a54a6de7674e1219d65b6","0be56a8c0d0de11e0e97b563cae6d1ee164f3317","1e3d4230655411cb5f7c6885d7f947072b8f9f0f","2fdd49a3f7d06fffd32b40d35abd69dec851eb77","3ac205be62806a90072524c193b731a1423d5dfd","6abf731b90c11ffbd3406aa6b89261cc9596fefd","8e99a5ec8c173033941f5e00a3fc38b7dea9dcb3","15adffda49c07946d4bd41ab44846eb673c22b2b","47db52ab94b9a303e85ed1aa1dd949605157417e","70bc8c2dc62cf894e765950de60ec5bd2128d55b","88b125dda928462fdb00c459131b232a3cd21887","90a443787b464877ad9eb57536f51556b5ba8117","249bed77c1349be7ec1fc182afccb1234adfacdf","3101b17d73031384f555ae3acd7139bbbab3f525","8946e40255b57e95bab041687a2f0f0e15f5ffce","946082f225c76f2ffbe92235f0faf9fb9e33b784","a8acf307ea747b24d7c405deef70b50b2b3f2186","f8039d04ff310cef9ca47ac03025bd38a3587d10")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("01906c1b73ecffd72f98e729d8ededd8a716b7e3","0be8f44f5351a6cbef1a54a6de7674e1219d65b6","0be56a8c0d0de11e0e97b563cae6d1ee164f3317","1e3d4230655411cb5f7c6885d7f947072b8f9f0f","2fdd49a3f7d06fffd32b40d35abd69dec851eb77","3ac205be62806a90072524c193b731a1423d5dfd","6abf731b90c11ffbd3406aa6b89261cc9596fefd","8e99a5ec8c173033941f5e00a3fc38b7dea9dcb3","15adffda49c07946d4bd41ab44846eb673c22b2b","47db52ab94b9a303e85ed1aa1dd949605157417e","70bc8c2dc62cf894e765950de60ec5bd2128d55b","88b125dda928462fdb00c459131b232a3cd21887","90a443787b464877ad9eb57536f51556b5ba8117","249bed77c1349be7ec1fc182afccb1234adfacdf","3101b17d73031384f555ae3acd7139bbbab3f525","8946e40255b57e95bab041687a2f0f0e15f5ffce","946082f225c76f2ffbe92235f0faf9fb9e33b784","a8acf307ea747b24d7c405deef70b50b2b3f2186","f8039d04ff310cef9ca47ac03025bd38a3587d10")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("01906c1b73ecffd72f98e729d8ededd8a716b7e3","0be8f44f5351a6cbef1a54a6de7674e1219d65b6","0be56a8c0d0de11e0e97b563cae6d1ee164f3317","1e3d4230655411cb5f7c6885d7f947072b8f9f0f","2fdd49a3f7d06fffd32b40d35abd69dec851eb77","3ac205be62806a90072524c193b731a1423d5dfd","6abf731b90c11ffbd3406aa6b89261cc9596fefd","8e99a5ec8c173033941f5e00a3fc38b7dea9dcb3","15adffda49c07946d4bd41ab44846eb673c22b2b","47db52ab94b9a303e85ed1aa1dd949605157417e","70bc8c2dc62cf894e765950de60ec5bd2128d55b","88b125dda928462fdb00c459131b232a3cd21887","90a443787b464877ad9eb57536f51556b5ba8117","249bed77c1349be7ec1fc182afccb1234adfacdf","3101b17d73031384f555ae3acd7139bbbab3f525","8946e40255b57e95bab041687a2f0f0e15f5ffce","946082f225c76f2ffbe92235f0faf9fb9e33b784","a8acf307ea747b24d7c405deef70b50b2b3f2186","f8039d04ff310cef9ca47ac03025bd38a3587d10")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("01906c1b73ecffd72f98e729d8ededd8a716b7e3","0be8f44f5351a6cbef1a54a6de7674e1219d65b6","0be56a8c0d0de11e0e97b563cae6d1ee164f3317","1e3d4230655411cb5f7c6885d7f947072b8f9f0f","2fdd49a3f7d06fffd32b40d35abd69dec851eb77","3ac205be62806a90072524c193b731a1423d5dfd","6abf731b90c11ffbd3406aa6b89261cc9596fefd","8e99a5ec8c173033941f5e00a3fc38b7dea9dcb3","15adffda49c07946d4bd41ab44846eb673c22b2b","47db52ab94b9a303e85ed1aa1dd949605157417e","70bc8c2dc62cf894e765950de60ec5bd2128d55b","88b125dda928462fdb00c459131b232a3cd21887","90a443787b464877ad9eb57536f51556b5ba8117","249bed77c1349be7ec1fc182afccb1234adfacdf","3101b17d73031384f555ae3acd7139bbbab3f525","8946e40255b57e95bab041687a2f0f0e15f5ffce","946082f225c76f2ffbe92235f0faf9fb9e33b784","a8acf307ea747b24d7c405deef70b50b2b3f2186","f8039d04ff310cef9ca47ac03025bd38a3587d10")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring64 NOT NULL AND customstring64 IN ("01906c1b73ecffd72f98e729d8ededd8a716b7e3","0be8f44f5351a6cbef1a54a6de7674e1219d65b6","0be56a8c0d0de11e0e97b563cae6d1ee164f3317","1e3d4230655411cb5f7c6885d7f947072b8f9f0f","2fdd49a3f7d06fffd32b40d35abd69dec851eb77","3ac205be62806a90072524c193b731a1423d5dfd","6abf731b90c11ffbd3406aa6b89261cc9596fefd","8e99a5ec8c173033941f5e00a3fc38b7dea9dcb3","15adffda49c07946d4bd41ab44846eb673c22b2b","47db52ab94b9a303e85ed1aa1dd949605157417e","70bc8c2dc62cf894e765950de60ec5bd2128d55b","88b125dda928462fdb00c459131b232a3cd21887","90a443787b464877ad9eb57536f51556b5ba8117","249bed77c1349be7ec1fc182afccb1234adfacdf","3101b17d73031384f555ae3acd7139bbbab3f525","8946e40255b57e95bab041687a2f0f0e15f5ffce","946082f225c76f2ffbe92235f0faf9fb9e33b784","a8acf307ea747b24d7c405deef70b50b2b3f2186","f8039d04ff310cef9ca47ac03025bd38a3587d10")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("01906c1b73ecffd72f98e729d8ededd8a716b7e3","0be8f44f5351a6cbef1a54a6de7674e1219d65b6","0be56a8c0d0de11e0e97b563cae6d1ee164f3317","1e3d4230655411cb5f7c6885d7f947072b8f9f0f","2fdd49a3f7d06fffd32b40d35abd69dec851eb77","3ac205be62806a90072524c193b731a1423d5dfd","6abf731b90c11ffbd3406aa6b89261cc9596fefd","8e99a5ec8c173033941f5e00a3fc38b7dea9dcb3","15adffda49c07946d4bd41ab44846eb673c22b2b","47db52ab94b9a303e85ed1aa1dd949605157417e","70bc8c2dc62cf894e765950de60ec5bd2128d55b","88b125dda928462fdb00c459131b232a3cd21887","90a443787b464877ad9eb57536f51556b5ba8117","249bed77c1349be7ec1fc182afccb1234adfacdf","3101b17d73031384f555ae3acd7139bbbab3f525","8946e40255b57e95bab041687a2f0f0e15f5ffce","946082f225c76f2ffbe92235f0faf9fb9e33b784","a8acf307ea747b24d7c405deef70b50b2b3f2186","f8039d04ff310cef9ca47ac03025bd38a3587d10")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("01906c1b73ecffd72f98e729d8ededd8a716b7e3","0be8f44f5351a6cbef1a54a6de7674e1219d65b6","0be56a8c0d0de11e0e97b563cae6d1ee164f3317","1e3d4230655411cb5f7c6885d7f947072b8f9f0f","2fdd49a3f7d06fffd32b40d35abd69dec851eb77","3ac205be62806a90072524c193b731a1423d5dfd","6abf731b90c11ffbd3406aa6b89261cc9596fefd","8e99a5ec8c173033941f5e00a3fc38b7dea9dcb3","15adffda49c07946d4bd41ab44846eb673c22b2b","47db52ab94b9a303e85ed1aa1dd949605157417e","70bc8c2dc62cf894e765950de60ec5bd2128d55b","88b125dda928462fdb00c459131b232a3cd21887","90a443787b464877ad9eb57536f51556b5ba8117","249bed77c1349be7ec1fc182afccb1234adfacdf","3101b17d73031384f555ae3acd7139bbbab3f525","8946e40255b57e95bab041687a2f0f0e15f5ffce","946082f225c76f2ffbe92235f0faf9fb9e33b784","a8acf307ea747b24d7c405deef70b50b2b3f2186","f8039d04ff310cef9ca47ac03025bd38a3587d10")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("01906c1b73ecffd72f98e729d8ededd8a716b7e3","0be8f44f5351a6cbef1a54a6de7674e1219d65b6","0be56a8c0d0de11e0e97b563cae6d1ee164f3317","1e3d4230655411cb5f7c6885d7f947072b8f9f0f","2fdd49a3f7d06fffd32b40d35abd69dec851eb77","3ac205be62806a90072524c193b731a1423d5dfd","6abf731b90c11ffbd3406aa6b89261cc9596fefd","8e99a5ec8c173033941f5e00a3fc38b7dea9dcb3","15adffda49c07946d4bd41ab44846eb673c22b2b","47db52ab94b9a303e85ed1aa1dd949605157417e","70bc8c2dc62cf894e765950de60ec5bd2128d55b","88b125dda928462fdb00c459131b232a3cd21887","90a443787b464877ad9eb57536f51556b5ba8117","249bed77c1349be7ec1fc182afccb1234adfacdf","3101b17d73031384f555ae3acd7139bbbab3f525","8946e40255b57e95bab041687a2f0f0e15f5ffce","946082f225c76f2ffbe92235f0faf9fb9e33b784","a8acf307ea747b24d7c405deef70b50b2b3f2186","f8039d04ff310cef9ca47ac03025bd38a3587d10")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring64 NOT NULL AND customstring64 IN ("01906c1b73ecffd72f98e729d8ededd8a716b7e3","0be8f44f5351a6cbef1a54a6de7674e1219d65b6","0be56a8c0d0de11e0e97b563cae6d1ee164f3317","1e3d4230655411cb5f7c6885d7f947072b8f9f0f","2fdd49a3f7d06fffd32b40d35abd69dec851eb77","3ac205be62806a90072524c193b731a1423d5dfd","6abf731b90c11ffbd3406aa6b89261cc9596fefd","8e99a5ec8c173033941f5e00a3fc38b7dea9dcb3","15adffda49c07946d4bd41ab44846eb673c22b2b","47db52ab94b9a303e85ed1aa1dd949605157417e","70bc8c2dc62cf894e765950de60ec5bd2128d55b","88b125dda928462fdb00c459131b232a3cd21887","90a443787b464877ad9eb57536f51556b5ba8117","249bed77c1349be7ec1fc182afccb1234adfacdf","3101b17d73031384f555ae3acd7139bbbab3f525","8946e40255b57e95bab041687a2f0f0e15f5ffce","946082f225c76f2ffbe92235f0faf9fb9e33b784","a8acf307ea747b24d7c405deef70b50b2b3f2186","f8039d04ff310cef9ca47ac03025bd38a3587d10")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("F8039D04FF310CEF9CA47AC03025BD38A3587D10","8E99A5EC8C173033941F5E00A3FC38B7DEA9DCB3","1E3D4230655411CB5F7C6885D7F947072B8F9F0F","3AC205BE62806A90072524C193B731A1423D5DFD","70BC8C2DC62CF894E765950DE60EC5BD2128D55B","8946E40255B57E95BAB041687A2F0F0E15F5FFCE","47DB52AB94B9A303E85ED1AA1DD949605157417E","0BE8F44F5351A6CBEF1A54A6DE7674E1219D65B6","3101B17D73031384F555AE3ACD7139BBBAB3F525","0BE56A8C0D0DE11E0E97B563CAE6D1EE164F3317","15ADFFDA49C07946D4BD41AB44846EB673C22B2B","249BED77C1349BE7EC1FC182AFCCB1234ADFACDF","90A443787B464877AD9EB57536F51556B5BA8117","946082F225C76F2FFBE92235F0FAF9FB9E33B784","2FDD49A3F7D06FFFD32B40D35ABD69DEC851EB77","88B125DDA928462FDB00C459131B232A3CD21887","01906C1B73ECFFD72F98E729D8EDEDD8A716B7E3","A8ACF307EA747B24D7C405DEEF70B50B2B3F2186","6ABF731B90C11FFBD3406AA6B89261CC9596FEFD")
index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("F8039D04FF310CEF9CA47AC03025BD38A3587D10","8E99A5EC8C173033941F5E00A3FC38B7DEA9DCB3","1E3D4230655411CB5F7C6885D7F947072B8F9F0F","3AC205BE62806A90072524C193B731A1423D5DFD","70BC8C2DC62CF894E765950DE60EC5BD2128D55B","8946E40255B57E95BAB041687A2F0F0E15F5FFCE","47DB52AB94B9A303E85ED1AA1DD949605157417E","0BE8F44F5351A6CBEF1A54A6DE7674E1219D65B6","3101B17D73031384F555AE3ACD7139BBBAB3F525","0BE56A8C0D0DE11E0E97B563CAE6D1EE164F3317","15ADFFDA49C07946D4BD41AB44846EB673C22B2B","249BED77C1349BE7EC1FC182AFCCB1234ADFACDF","90A443787B464877AD9EB57536F51556B5BA8117","946082F225C76F2FFBE92235F0FAF9FB9E33B784","2FDD49A3F7D06FFFD32B40D35ABD69DEC851EB77","88B125DDA928462FDB00C459131B232A3CD21887","01906C1B73ECFFD72F98E729D8EDEDD8A716B7E3","A8ACF307EA747B24D7C405DEEF70B50B2B3F2186","6ABF731B90C11FFBD3406AA6B89261CC9596FEFD")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("F8039D04FF310CEF9CA47AC03025BD38A3587D10","8E99A5EC8C173033941F5E00A3FC38B7DEA9DCB3","1E3D4230655411CB5F7C6885D7F947072B8F9F0F","3AC205BE62806A90072524C193B731A1423D5DFD","70BC8C2DC62CF894E765950DE60EC5BD2128D55B","8946E40255B57E95BAB041687A2F0F0E15F5FFCE","47DB52AB94B9A303E85ED1AA1DD949605157417E","0BE8F44F5351A6CBEF1A54A6DE7674E1219D65B6","3101B17D73031384F555AE3ACD7139BBBAB3F525","0BE56A8C0D0DE11E0E97B563CAE6D1EE164F3317","15ADFFDA49C07946D4BD41AB44846EB673C22B2B","249BED77C1349BE7EC1FC182AFCCB1234ADFACDF","90A443787B464877AD9EB57536F51556B5BA8117","946082F225C76F2FFBE92235F0FAF9FB9E33B784","2FDD49A3F7D06FFFD32B40D35ABD69DEC851EB77","88B125DDA928462FDB00C459131B232A3CD21887","01906C1B73ECFFD72F98E729D8EDEDD8A716B7E3","A8ACF307EA747B24D7C405DEEF70B50B2B3F2186","6ABF731B90C11FFBD3406AA6B89261CC9596FEFD")
