index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("e8a5392f6773a3cfda23fc0b9ea09749","14214f7904102bb6747d0e31a50c08d3","f25a3e2bbaa9bed0210adf5bff0bc5d76fbf44e09ae4bc22e40473814a6ebad1","2dcaca208625860f4eb114af4c4158368284eb99c994793d5ac66d3af654bf5f","791fa78b31f640830d37ec92bae5dac67b15db9a","a89974390c9c03495e631f6dca4ae54d044d0941")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("e8a5392f6773a3cfda23fc0b9ea09749","14214f7904102bb6747d0e31a50c08d3","f25a3e2bbaa9bed0210adf5bff0bc5d76fbf44e09ae4bc22e40473814a6ebad1","2dcaca208625860f4eb114af4c4158368284eb99c994793d5ac66d3af654bf5f","791fa78b31f640830d37ec92bae5dac67b15db9a","a89974390c9c03495e631f6dca4ae54d044d0941")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("e8a5392f6773a3cfda23fc0b9ea09749","14214f7904102bb6747d0e31a50c08d3","f25a3e2bbaa9bed0210adf5bff0bc5d76fbf44e09ae4bc22e40473814a6ebad1","2dcaca208625860f4eb114af4c4158368284eb99c994793d5ac66d3af654bf5f","791fa78b31f640830d37ec92bae5dac67b15db9a","a89974390c9c03495e631f6dca4ae54d044d0941")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring64 NOT NULL AND customstring64 IN ("e8a5392f6773a3cfda23fc0b9ea09749","14214f7904102bb6747d0e31a50c08d3","f25a3e2bbaa9bed0210adf5bff0bc5d76fbf44e09ae4bc22e40473814a6ebad1","2dcaca208625860f4eb114af4c4158368284eb99c994793d5ac66d3af654bf5f","791fa78b31f640830d37ec92bae5dac67b15db9a","a89974390c9c03495e631f6dca4ae54d044d0941")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("e8a5392f6773a3cfda23fc0b9ea09749","14214f7904102bb6747d0e31a50c08d3","f25a3e2bbaa9bed0210adf5bff0bc5d76fbf44e09ae4bc22e40473814a6ebad1","2dcaca208625860f4eb114af4c4158368284eb99c994793d5ac66d3af654bf5f","791fa78b31f640830d37ec92bae5dac67b15db9a","a89974390c9c03495e631f6dca4ae54d044d0941")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("e8a5392f6773a3cfda23fc0b9ea09749","14214f7904102bb6747d0e31a50c08d3","f25a3e2bbaa9bed0210adf5bff0bc5d76fbf44e09ae4bc22e40473814a6ebad1","2dcaca208625860f4eb114af4c4158368284eb99c994793d5ac66d3af654bf5f","791fa78b31f640830d37ec92bae5dac67b15db9a","a89974390c9c03495e631f6dca4ae54d044d0941")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("e8a5392f6773a3cfda23fc0b9ea09749","14214f7904102bb6747d0e31a50c08d3","f25a3e2bbaa9bed0210adf5bff0bc5d76fbf44e09ae4bc22e40473814a6ebad1","2dcaca208625860f4eb114af4c4158368284eb99c994793d5ac66d3af654bf5f","791fa78b31f640830d37ec92bae5dac67b15db9a","a89974390c9c03495e631f6dca4ae54d044d0941")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("e8a5392f6773a3cfda23fc0b9ea09749","14214f7904102bb6747d0e31a50c08d3","f25a3e2bbaa9bed0210adf5bff0bc5d76fbf44e09ae4bc22e40473814a6ebad1","2dcaca208625860f4eb114af4c4158368284eb99c994793d5ac66d3af654bf5f","791fa78b31f640830d37ec92bae5dac67b15db9a","a89974390c9c03495e631f6dca4ae54d044d0941")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("e8a5392f6773a3cfda23fc0b9ea09749","14214f7904102bb6747d0e31a50c08d3","f25a3e2bbaa9bed0210adf5bff0bc5d76fbf44e09ae4bc22e40473814a6ebad1","2dcaca208625860f4eb114af4c4158368284eb99c994793d5ac66d3af654bf5f","791fa78b31f640830d37ec92bae5dac67b15db9a","a89974390c9c03495e631f6dca4ae54d044d0941")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("e8a5392f6773a3cfda23fc0b9ea09749","14214f7904102bb6747d0e31a50c08d3","f25a3e2bbaa9bed0210adf5bff0bc5d76fbf44e09ae4bc22e40473814a6ebad1","2dcaca208625860f4eb114af4c4158368284eb99c994793d5ac66d3af654bf5f","791fa78b31f640830d37ec92bae5dac67b15db9a","a89974390c9c03495e631f6dca4ae54d044d0941")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("e8a5392f6773a3cfda23fc0b9ea09749","14214f7904102bb6747d0e31a50c08d3","f25a3e2bbaa9bed0210adf5bff0bc5d76fbf44e09ae4bc22e40473814a6ebad1","2dcaca208625860f4eb114af4c4158368284eb99c994793d5ac66d3af654bf5f","791fa78b31f640830d37ec92bae5dac67b15db9a","a89974390c9c03495e631f6dca4ae54d044d0941")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("e8a5392f6773a3cfda23fc0b9ea09749","14214f7904102bb6747d0e31a50c08d3","f25a3e2bbaa9bed0210adf5bff0bc5d76fbf44e09ae4bc22e40473814a6ebad1","2dcaca208625860f4eb114af4c4158368284eb99c994793d5ac66d3af654bf5f","791fa78b31f640830d37ec92bae5dac67b15db9a","a89974390c9c03495e631f6dca4ae54d044d0941")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("e8a5392f6773a3cfda23fc0b9ea09749","14214f7904102bb6747d0e31a50c08d3","f25a3e2bbaa9bed0210adf5bff0bc5d76fbf44e09ae4bc22e40473814a6ebad1","2dcaca208625860f4eb114af4c4158368284eb99c994793d5ac66d3af654bf5f","791fa78b31f640830d37ec92bae5dac67b15db9a","a89974390c9c03495e631f6dca4ae54d044d0941")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("e8a5392f6773a3cfda23fc0b9ea09749","14214f7904102bb6747d0e31a50c08d3","f25a3e2bbaa9bed0210adf5bff0bc5d76fbf44e09ae4bc22e40473814a6ebad1","2dcaca208625860f4eb114af4c4158368284eb99c994793d5ac66d3af654bf5f","791fa78b31f640830d37ec92bae5dac67b15db9a","a89974390c9c03495e631f6dca4ae54d044d0941")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("e8a5392f6773a3cfda23fc0b9ea09749","14214f7904102bb6747d0e31a50c08d3","f25a3e2bbaa9bed0210adf5bff0bc5d76fbf44e09ae4bc22e40473814a6ebad1","2dcaca208625860f4eb114af4c4158368284eb99c994793d5ac66d3af654bf5f","791fa78b31f640830d37ec92bae5dac67b15db9a","a89974390c9c03495e631f6dca4ae54d044d0941")
index=activity AND rg_functionality="Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("e8a5392f6773a3cfda23fc0b9ea09749","14214f7904102bb6747d0e31a50c08d3","f25a3e2bbaa9bed0210adf5bff0bc5d76fbf44e09ae4bc22e40473814a6ebad1","2dcaca208625860f4eb114af4c4158368284eb99c994793d5ac66d3af654bf5f","791fa78b31f640830d37ec92bae5dac67b15db9a","a89974390c9c03495e631f6dca4ae54d044d0941")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("e8a5392f6773a3cfda23fc0b9ea09749","14214f7904102bb6747d0e31a50c08d3","f25a3e2bbaa9bed0210adf5bff0bc5d76fbf44e09ae4bc22e40473814a6ebad1","2dcaca208625860f4eb114af4c4158368284eb99c994793d5ac66d3af654bf5f","791fa78b31f640830d37ec92bae5dac67b15db9a","a89974390c9c03495e631f6dca4ae54d044d0941")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("e8a5392f6773a3cfda23fc0b9ea09749","14214f7904102bb6747d0e31a50c08d3","f25a3e2bbaa9bed0210adf5bff0bc5d76fbf44e09ae4bc22e40473814a6ebad1","2dcaca208625860f4eb114af4c4158368284eb99c994793d5ac66d3af654bf5f","791fa78b31f640830d37ec92bae5dac67b15db9a","a89974390c9c03495e631f6dca4ae54d044d0941")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("e8a5392f6773a3cfda23fc0b9ea09749","14214f7904102bb6747d0e31a50c08d3","f25a3e2bbaa9bed0210adf5bff0bc5d76fbf44e09ae4bc22e40473814a6ebad1","2dcaca208625860f4eb114af4c4158368284eb99c994793d5ac66d3af654bf5f","791fa78b31f640830d37ec92bae5dac67b15db9a","a89974390c9c03495e631f6dca4ae54d044d0941")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("e8a5392f6773a3cfda23fc0b9ea09749","14214f7904102bb6747d0e31a50c08d3","f25a3e2bbaa9bed0210adf5bff0bc5d76fbf44e09ae4bc22e40473814a6ebad1","2dcaca208625860f4eb114af4c4158368284eb99c994793d5ac66d3af654bf5f","791fa78b31f640830d37ec92bae5dac67b15db9a","a89974390c9c03495e631f6dca4ae54d044d0941")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("e8a5392f6773a3cfda23fc0b9ea09749","14214f7904102bb6747d0e31a50c08d3","f25a3e2bbaa9bed0210adf5bff0bc5d76fbf44e09ae4bc22e40473814a6ebad1","2dcaca208625860f4eb114af4c4158368284eb99c994793d5ac66d3af654bf5f","791fa78b31f640830d37ec92bae5dac67b15db9a","a89974390c9c03495e631f6dca4ae54d044d0941")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("e8a5392f6773a3cfda23fc0b9ea09749","14214f7904102bb6747d0e31a50c08d3","f25a3e2bbaa9bed0210adf5bff0bc5d76fbf44e09ae4bc22e40473814a6ebad1","2dcaca208625860f4eb114af4c4158368284eb99c994793d5ac66d3af654bf5f","791fa78b31f640830d37ec92bae5dac67b15db9a","a89974390c9c03495e631f6dca4ae54d044d0941")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("e8a5392f6773a3cfda23fc0b9ea09749","14214f7904102bb6747d0e31a50c08d3","f25a3e2bbaa9bed0210adf5bff0bc5d76fbf44e09ae4bc22e40473814a6ebad1","2dcaca208625860f4eb114af4c4158368284eb99c994793d5ac66d3af654bf5f","791fa78b31f640830d37ec92bae5dac67b15db9a","a89974390c9c03495e631f6dca4ae54d044d0941")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring64 NOT NULL AND customstring64 IN ("e8a5392f6773a3cfda23fc0b9ea09749","14214f7904102bb6747d0e31a50c08d3","f25a3e2bbaa9bed0210adf5bff0bc5d76fbf44e09ae4bc22e40473814a6ebad1","2dcaca208625860f4eb114af4c4158368284eb99c994793d5ac66d3af654bf5f","791fa78b31f640830d37ec92bae5dac67b15db9a","a89974390c9c03495e631f6dca4ae54d044d0941")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("e8a5392f6773a3cfda23fc0b9ea09749","14214f7904102bb6747d0e31a50c08d3","f25a3e2bbaa9bed0210adf5bff0bc5d76fbf44e09ae4bc22e40473814a6ebad1","2dcaca208625860f4eb114af4c4158368284eb99c994793d5ac66d3af654bf5f","791fa78b31f640830d37ec92bae5dac67b15db9a","a89974390c9c03495e631f6dca4ae54d044d0941")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("e8a5392f6773a3cfda23fc0b9ea09749","14214f7904102bb6747d0e31a50c08d3","f25a3e2bbaa9bed0210adf5bff0bc5d76fbf44e09ae4bc22e40473814a6ebad1","2dcaca208625860f4eb114af4c4158368284eb99c994793d5ac66d3af654bf5f","791fa78b31f640830d37ec92bae5dac67b15db9a","a89974390c9c03495e631f6dca4ae54d044d0941")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("e8a5392f6773a3cfda23fc0b9ea09749","14214f7904102bb6747d0e31a50c08d3","f25a3e2bbaa9bed0210adf5bff0bc5d76fbf44e09ae4bc22e40473814a6ebad1","2dcaca208625860f4eb114af4c4158368284eb99c994793d5ac66d3af654bf5f","791fa78b31f640830d37ec92bae5dac67b15db9a","a89974390c9c03495e631f6dca4ae54d044d0941")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring64 NOT NULL AND customstring64 IN ("e8a5392f6773a3cfda23fc0b9ea09749","14214f7904102bb6747d0e31a50c08d3","f25a3e2bbaa9bed0210adf5bff0bc5d76fbf44e09ae4bc22e40473814a6ebad1","2dcaca208625860f4eb114af4c4158368284eb99c994793d5ac66d3af654bf5f","791fa78b31f640830d37ec92bae5dac67b15db9a","a89974390c9c03495e631f6dca4ae54d044d0941")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("e8a5392f6773a3cfda23fc0b9ea09749","14214f7904102bb6747d0e31a50c08d3","f25a3e2bbaa9bed0210adf5bff0bc5d76fbf44e09ae4bc22e40473814a6ebad1","2dcaca208625860f4eb114af4c4158368284eb99c994793d5ac66d3af654bf5f","791fa78b31f640830d37ec92bae5dac67b15db9a","a89974390c9c03495e631f6dca4ae54d044d0941")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("e8a5392f6773a3cfda23fc0b9ea09749","14214f7904102bb6747d0e31a50c08d3","f25a3e2bbaa9bed0210adf5bff0bc5d76fbf44e09ae4bc22e40473814a6ebad1","2dcaca208625860f4eb114af4c4158368284eb99c994793d5ac66d3af654bf5f","791fa78b31f640830d37ec92bae5dac67b15db9a","a89974390c9c03495e631f6dca4ae54d044d0941")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("e8a5392f6773a3cfda23fc0b9ea09749","14214f7904102bb6747d0e31a50c08d3","f25a3e2bbaa9bed0210adf5bff0bc5d76fbf44e09ae4bc22e40473814a6ebad1","2dcaca208625860f4eb114af4c4158368284eb99c994793d5ac66d3af654bf5f","791fa78b31f640830d37ec92bae5dac67b15db9a","a89974390c9c03495e631f6dca4ae54d044d0941")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring64 NOT NULL AND customstring64 IN ("e8a5392f6773a3cfda23fc0b9ea09749","14214f7904102bb6747d0e31a50c08d3","f25a3e2bbaa9bed0210adf5bff0bc5d76fbf44e09ae4bc22e40473814a6ebad1","2dcaca208625860f4eb114af4c4158368284eb99c994793d5ac66d3af654bf5f","791fa78b31f640830d37ec92bae5dac67b15db9a","a89974390c9c03495e631f6dca4ae54d044d0941")
