index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("99109eb335db668094278d1953aff94f","957031f0e075b8adb355aeeb11aa9839","b6dd1bc3b9ff8522d97945e2c19d0a2ea9651cf7","c2a3fd6a4f6d424729215f3740d9a3577f0fe0b0","0ec61a80e61f56f460fc42e5d4f0accec2b04c8db98c28ed4534946214076f2a","a35c3274a726b27cbcef5abe3f28d8f9675a30883490d37f23b4d730d72eca42")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("99109eb335db668094278d1953aff94f","957031f0e075b8adb355aeeb11aa9839","b6dd1bc3b9ff8522d97945e2c19d0a2ea9651cf7","c2a3fd6a4f6d424729215f3740d9a3577f0fe0b0","0ec61a80e61f56f460fc42e5d4f0accec2b04c8db98c28ed4534946214076f2a","a35c3274a726b27cbcef5abe3f28d8f9675a30883490d37f23b4d730d72eca42")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("99109eb335db668094278d1953aff94f","957031f0e075b8adb355aeeb11aa9839","b6dd1bc3b9ff8522d97945e2c19d0a2ea9651cf7","c2a3fd6a4f6d424729215f3740d9a3577f0fe0b0","0ec61a80e61f56f460fc42e5d4f0accec2b04c8db98c28ed4534946214076f2a","a35c3274a726b27cbcef5abe3f28d8f9675a30883490d37f23b4d730d72eca42")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring64 NOT NULL AND customstring64 IN ("99109eb335db668094278d1953aff94f","957031f0e075b8adb355aeeb11aa9839","b6dd1bc3b9ff8522d97945e2c19d0a2ea9651cf7","c2a3fd6a4f6d424729215f3740d9a3577f0fe0b0","0ec61a80e61f56f460fc42e5d4f0accec2b04c8db98c28ed4534946214076f2a","a35c3274a726b27cbcef5abe3f28d8f9675a30883490d37f23b4d730d72eca42")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("99109eb335db668094278d1953aff94f","957031f0e075b8adb355aeeb11aa9839","b6dd1bc3b9ff8522d97945e2c19d0a2ea9651cf7","c2a3fd6a4f6d424729215f3740d9a3577f0fe0b0","0ec61a80e61f56f460fc42e5d4f0accec2b04c8db98c28ed4534946214076f2a","a35c3274a726b27cbcef5abe3f28d8f9675a30883490d37f23b4d730d72eca42")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("99109eb335db668094278d1953aff94f","957031f0e075b8adb355aeeb11aa9839","b6dd1bc3b9ff8522d97945e2c19d0a2ea9651cf7","c2a3fd6a4f6d424729215f3740d9a3577f0fe0b0","0ec61a80e61f56f460fc42e5d4f0accec2b04c8db98c28ed4534946214076f2a","a35c3274a726b27cbcef5abe3f28d8f9675a30883490d37f23b4d730d72eca42")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("99109eb335db668094278d1953aff94f","957031f0e075b8adb355aeeb11aa9839","b6dd1bc3b9ff8522d97945e2c19d0a2ea9651cf7","c2a3fd6a4f6d424729215f3740d9a3577f0fe0b0","0ec61a80e61f56f460fc42e5d4f0accec2b04c8db98c28ed4534946214076f2a","a35c3274a726b27cbcef5abe3f28d8f9675a30883490d37f23b4d730d72eca42")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("99109eb335db668094278d1953aff94f","957031f0e075b8adb355aeeb11aa9839","b6dd1bc3b9ff8522d97945e2c19d0a2ea9651cf7","c2a3fd6a4f6d424729215f3740d9a3577f0fe0b0","0ec61a80e61f56f460fc42e5d4f0accec2b04c8db98c28ed4534946214076f2a","a35c3274a726b27cbcef5abe3f28d8f9675a30883490d37f23b4d730d72eca42")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("99109eb335db668094278d1953aff94f","957031f0e075b8adb355aeeb11aa9839","b6dd1bc3b9ff8522d97945e2c19d0a2ea9651cf7","c2a3fd6a4f6d424729215f3740d9a3577f0fe0b0","0ec61a80e61f56f460fc42e5d4f0accec2b04c8db98c28ed4534946214076f2a","a35c3274a726b27cbcef5abe3f28d8f9675a30883490d37f23b4d730d72eca42")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("99109eb335db668094278d1953aff94f","957031f0e075b8adb355aeeb11aa9839","b6dd1bc3b9ff8522d97945e2c19d0a2ea9651cf7","c2a3fd6a4f6d424729215f3740d9a3577f0fe0b0","0ec61a80e61f56f460fc42e5d4f0accec2b04c8db98c28ed4534946214076f2a","a35c3274a726b27cbcef5abe3f28d8f9675a30883490d37f23b4d730d72eca42")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("99109eb335db668094278d1953aff94f","957031f0e075b8adb355aeeb11aa9839","b6dd1bc3b9ff8522d97945e2c19d0a2ea9651cf7","c2a3fd6a4f6d424729215f3740d9a3577f0fe0b0","0ec61a80e61f56f460fc42e5d4f0accec2b04c8db98c28ed4534946214076f2a","a35c3274a726b27cbcef5abe3f28d8f9675a30883490d37f23b4d730d72eca42")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("99109eb335db668094278d1953aff94f","957031f0e075b8adb355aeeb11aa9839","b6dd1bc3b9ff8522d97945e2c19d0a2ea9651cf7","c2a3fd6a4f6d424729215f3740d9a3577f0fe0b0","0ec61a80e61f56f460fc42e5d4f0accec2b04c8db98c28ed4534946214076f2a","a35c3274a726b27cbcef5abe3f28d8f9675a30883490d37f23b4d730d72eca42")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("99109eb335db668094278d1953aff94f","957031f0e075b8adb355aeeb11aa9839","b6dd1bc3b9ff8522d97945e2c19d0a2ea9651cf7","c2a3fd6a4f6d424729215f3740d9a3577f0fe0b0","0ec61a80e61f56f460fc42e5d4f0accec2b04c8db98c28ed4534946214076f2a","a35c3274a726b27cbcef5abe3f28d8f9675a30883490d37f23b4d730d72eca42")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("99109eb335db668094278d1953aff94f","957031f0e075b8adb355aeeb11aa9839","b6dd1bc3b9ff8522d97945e2c19d0a2ea9651cf7","c2a3fd6a4f6d424729215f3740d9a3577f0fe0b0","0ec61a80e61f56f460fc42e5d4f0accec2b04c8db98c28ed4534946214076f2a","a35c3274a726b27cbcef5abe3f28d8f9675a30883490d37f23b4d730d72eca42")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("99109eb335db668094278d1953aff94f","957031f0e075b8adb355aeeb11aa9839","b6dd1bc3b9ff8522d97945e2c19d0a2ea9651cf7","c2a3fd6a4f6d424729215f3740d9a3577f0fe0b0","0ec61a80e61f56f460fc42e5d4f0accec2b04c8db98c28ed4534946214076f2a","a35c3274a726b27cbcef5abe3f28d8f9675a30883490d37f23b4d730d72eca42")
index=activity AND rg_functionality="Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("99109eb335db668094278d1953aff94f","957031f0e075b8adb355aeeb11aa9839","b6dd1bc3b9ff8522d97945e2c19d0a2ea9651cf7","c2a3fd6a4f6d424729215f3740d9a3577f0fe0b0","0ec61a80e61f56f460fc42e5d4f0accec2b04c8db98c28ed4534946214076f2a","a35c3274a726b27cbcef5abe3f28d8f9675a30883490d37f23b4d730d72eca42")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("99109eb335db668094278d1953aff94f","957031f0e075b8adb355aeeb11aa9839","b6dd1bc3b9ff8522d97945e2c19d0a2ea9651cf7","c2a3fd6a4f6d424729215f3740d9a3577f0fe0b0","0ec61a80e61f56f460fc42e5d4f0accec2b04c8db98c28ed4534946214076f2a","a35c3274a726b27cbcef5abe3f28d8f9675a30883490d37f23b4d730d72eca42")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("99109eb335db668094278d1953aff94f","957031f0e075b8adb355aeeb11aa9839","b6dd1bc3b9ff8522d97945e2c19d0a2ea9651cf7","c2a3fd6a4f6d424729215f3740d9a3577f0fe0b0","0ec61a80e61f56f460fc42e5d4f0accec2b04c8db98c28ed4534946214076f2a","a35c3274a726b27cbcef5abe3f28d8f9675a30883490d37f23b4d730d72eca42")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("99109eb335db668094278d1953aff94f","957031f0e075b8adb355aeeb11aa9839","b6dd1bc3b9ff8522d97945e2c19d0a2ea9651cf7","c2a3fd6a4f6d424729215f3740d9a3577f0fe0b0","0ec61a80e61f56f460fc42e5d4f0accec2b04c8db98c28ed4534946214076f2a","a35c3274a726b27cbcef5abe3f28d8f9675a30883490d37f23b4d730d72eca42")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("99109eb335db668094278d1953aff94f","957031f0e075b8adb355aeeb11aa9839","b6dd1bc3b9ff8522d97945e2c19d0a2ea9651cf7","c2a3fd6a4f6d424729215f3740d9a3577f0fe0b0","0ec61a80e61f56f460fc42e5d4f0accec2b04c8db98c28ed4534946214076f2a","a35c3274a726b27cbcef5abe3f28d8f9675a30883490d37f23b4d730d72eca42")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("99109eb335db668094278d1953aff94f","957031f0e075b8adb355aeeb11aa9839","b6dd1bc3b9ff8522d97945e2c19d0a2ea9651cf7","c2a3fd6a4f6d424729215f3740d9a3577f0fe0b0","0ec61a80e61f56f460fc42e5d4f0accec2b04c8db98c28ed4534946214076f2a","a35c3274a726b27cbcef5abe3f28d8f9675a30883490d37f23b4d730d72eca42")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("99109eb335db668094278d1953aff94f","957031f0e075b8adb355aeeb11aa9839","b6dd1bc3b9ff8522d97945e2c19d0a2ea9651cf7","c2a3fd6a4f6d424729215f3740d9a3577f0fe0b0","0ec61a80e61f56f460fc42e5d4f0accec2b04c8db98c28ed4534946214076f2a","a35c3274a726b27cbcef5abe3f28d8f9675a30883490d37f23b4d730d72eca42")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("99109eb335db668094278d1953aff94f","957031f0e075b8adb355aeeb11aa9839","b6dd1bc3b9ff8522d97945e2c19d0a2ea9651cf7","c2a3fd6a4f6d424729215f3740d9a3577f0fe0b0","0ec61a80e61f56f460fc42e5d4f0accec2b04c8db98c28ed4534946214076f2a","a35c3274a726b27cbcef5abe3f28d8f9675a30883490d37f23b4d730d72eca42")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring64 NOT NULL AND customstring64 IN ("99109eb335db668094278d1953aff94f","957031f0e075b8adb355aeeb11aa9839","b6dd1bc3b9ff8522d97945e2c19d0a2ea9651cf7","c2a3fd6a4f6d424729215f3740d9a3577f0fe0b0","0ec61a80e61f56f460fc42e5d4f0accec2b04c8db98c28ed4534946214076f2a","a35c3274a726b27cbcef5abe3f28d8f9675a30883490d37f23b4d730d72eca42")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("99109eb335db668094278d1953aff94f","957031f0e075b8adb355aeeb11aa9839","b6dd1bc3b9ff8522d97945e2c19d0a2ea9651cf7","c2a3fd6a4f6d424729215f3740d9a3577f0fe0b0","0ec61a80e61f56f460fc42e5d4f0accec2b04c8db98c28ed4534946214076f2a","a35c3274a726b27cbcef5abe3f28d8f9675a30883490d37f23b4d730d72eca42")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("99109eb335db668094278d1953aff94f","957031f0e075b8adb355aeeb11aa9839","b6dd1bc3b9ff8522d97945e2c19d0a2ea9651cf7","c2a3fd6a4f6d424729215f3740d9a3577f0fe0b0","0ec61a80e61f56f460fc42e5d4f0accec2b04c8db98c28ed4534946214076f2a","a35c3274a726b27cbcef5abe3f28d8f9675a30883490d37f23b4d730d72eca42")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("99109eb335db668094278d1953aff94f","957031f0e075b8adb355aeeb11aa9839","b6dd1bc3b9ff8522d97945e2c19d0a2ea9651cf7","c2a3fd6a4f6d424729215f3740d9a3577f0fe0b0","0ec61a80e61f56f460fc42e5d4f0accec2b04c8db98c28ed4534946214076f2a","a35c3274a726b27cbcef5abe3f28d8f9675a30883490d37f23b4d730d72eca42")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring64 NOT NULL AND customstring64 IN ("99109eb335db668094278d1953aff94f","957031f0e075b8adb355aeeb11aa9839","b6dd1bc3b9ff8522d97945e2c19d0a2ea9651cf7","c2a3fd6a4f6d424729215f3740d9a3577f0fe0b0","0ec61a80e61f56f460fc42e5d4f0accec2b04c8db98c28ed4534946214076f2a","a35c3274a726b27cbcef5abe3f28d8f9675a30883490d37f23b4d730d72eca42")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("99109eb335db668094278d1953aff94f","957031f0e075b8adb355aeeb11aa9839","b6dd1bc3b9ff8522d97945e2c19d0a2ea9651cf7","c2a3fd6a4f6d424729215f3740d9a3577f0fe0b0","0ec61a80e61f56f460fc42e5d4f0accec2b04c8db98c28ed4534946214076f2a","a35c3274a726b27cbcef5abe3f28d8f9675a30883490d37f23b4d730d72eca42")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("99109eb335db668094278d1953aff94f","957031f0e075b8adb355aeeb11aa9839","b6dd1bc3b9ff8522d97945e2c19d0a2ea9651cf7","c2a3fd6a4f6d424729215f3740d9a3577f0fe0b0","0ec61a80e61f56f460fc42e5d4f0accec2b04c8db98c28ed4534946214076f2a","a35c3274a726b27cbcef5abe3f28d8f9675a30883490d37f23b4d730d72eca42")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("99109eb335db668094278d1953aff94f","957031f0e075b8adb355aeeb11aa9839","b6dd1bc3b9ff8522d97945e2c19d0a2ea9651cf7","c2a3fd6a4f6d424729215f3740d9a3577f0fe0b0","0ec61a80e61f56f460fc42e5d4f0accec2b04c8db98c28ed4534946214076f2a","a35c3274a726b27cbcef5abe3f28d8f9675a30883490d37f23b4d730d72eca42")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring64 NOT NULL AND customstring64 IN ("99109eb335db668094278d1953aff94f","957031f0e075b8adb355aeeb11aa9839","b6dd1bc3b9ff8522d97945e2c19d0a2ea9651cf7","c2a3fd6a4f6d424729215f3740d9a3577f0fe0b0","0ec61a80e61f56f460fc42e5d4f0accec2b04c8db98c28ed4534946214076f2a","a35c3274a726b27cbcef5abe3f28d8f9675a30883490d37f23b4d730d72eca42")
