index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("f5b60a8ead96703080e73a1f79c3e70ff44df271","fe3a3042890c1f11361368aeb2cc12647a6fdae1","76746b48a78a3828b64924f4aedca2e4c49b6735","4a02a72aedc3356d8cb38f01f0e0b9f26ddc5ccb7c0f04a561337cf24aa84030","b39c14becb62aeb55df7fd55c814afbb0d659687d947d917512fe67973100b70","fa3a74a6c015c801f5341c02be2cbdfb301c6ed60633d49fc0bc723617741af7","390665bdd93a656f48c463bb6c11a4d45b7d5444bdd1d1f7a5879b0f6f9aac7e","66af332ce5f93ce21d2fe408dffd49d4ae31e364d6802fff97d95ed593ff3082","7baf220eb89f2a216fcb2d0e9aa021b2a10324f0641caf8b7a9088e4e45bec95")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("f5b60a8ead96703080e73a1f79c3e70ff44df271","fe3a3042890c1f11361368aeb2cc12647a6fdae1","76746b48a78a3828b64924f4aedca2e4c49b6735","4a02a72aedc3356d8cb38f01f0e0b9f26ddc5ccb7c0f04a561337cf24aa84030","b39c14becb62aeb55df7fd55c814afbb0d659687d947d917512fe67973100b70","fa3a74a6c015c801f5341c02be2cbdfb301c6ed60633d49fc0bc723617741af7","390665bdd93a656f48c463bb6c11a4d45b7d5444bdd1d1f7a5879b0f6f9aac7e","66af332ce5f93ce21d2fe408dffd49d4ae31e364d6802fff97d95ed593ff3082","7baf220eb89f2a216fcb2d0e9aa021b2a10324f0641caf8b7a9088e4e45bec95")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("f5b60a8ead96703080e73a1f79c3e70ff44df271","fe3a3042890c1f11361368aeb2cc12647a6fdae1","76746b48a78a3828b64924f4aedca2e4c49b6735","4a02a72aedc3356d8cb38f01f0e0b9f26ddc5ccb7c0f04a561337cf24aa84030","b39c14becb62aeb55df7fd55c814afbb0d659687d947d917512fe67973100b70","fa3a74a6c015c801f5341c02be2cbdfb301c6ed60633d49fc0bc723617741af7","390665bdd93a656f48c463bb6c11a4d45b7d5444bdd1d1f7a5879b0f6f9aac7e","66af332ce5f93ce21d2fe408dffd49d4ae31e364d6802fff97d95ed593ff3082","7baf220eb89f2a216fcb2d0e9aa021b2a10324f0641caf8b7a9088e4e45bec95")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring64 NOT NULL AND customstring64 IN ("f5b60a8ead96703080e73a1f79c3e70ff44df271","fe3a3042890c1f11361368aeb2cc12647a6fdae1","76746b48a78a3828b64924f4aedca2e4c49b6735","4a02a72aedc3356d8cb38f01f0e0b9f26ddc5ccb7c0f04a561337cf24aa84030","b39c14becb62aeb55df7fd55c814afbb0d659687d947d917512fe67973100b70","fa3a74a6c015c801f5341c02be2cbdfb301c6ed60633d49fc0bc723617741af7","390665bdd93a656f48c463bb6c11a4d45b7d5444bdd1d1f7a5879b0f6f9aac7e","66af332ce5f93ce21d2fe408dffd49d4ae31e364d6802fff97d95ed593ff3082","7baf220eb89f2a216fcb2d0e9aa021b2a10324f0641caf8b7a9088e4e45bec95")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("f5b60a8ead96703080e73a1f79c3e70ff44df271","fe3a3042890c1f11361368aeb2cc12647a6fdae1","76746b48a78a3828b64924f4aedca2e4c49b6735","4a02a72aedc3356d8cb38f01f0e0b9f26ddc5ccb7c0f04a561337cf24aa84030","b39c14becb62aeb55df7fd55c814afbb0d659687d947d917512fe67973100b70","fa3a74a6c015c801f5341c02be2cbdfb301c6ed60633d49fc0bc723617741af7","390665bdd93a656f48c463bb6c11a4d45b7d5444bdd1d1f7a5879b0f6f9aac7e","66af332ce5f93ce21d2fe408dffd49d4ae31e364d6802fff97d95ed593ff3082","7baf220eb89f2a216fcb2d0e9aa021b2a10324f0641caf8b7a9088e4e45bec95")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("f5b60a8ead96703080e73a1f79c3e70ff44df271","fe3a3042890c1f11361368aeb2cc12647a6fdae1","76746b48a78a3828b64924f4aedca2e4c49b6735","4a02a72aedc3356d8cb38f01f0e0b9f26ddc5ccb7c0f04a561337cf24aa84030","b39c14becb62aeb55df7fd55c814afbb0d659687d947d917512fe67973100b70","fa3a74a6c015c801f5341c02be2cbdfb301c6ed60633d49fc0bc723617741af7","390665bdd93a656f48c463bb6c11a4d45b7d5444bdd1d1f7a5879b0f6f9aac7e","66af332ce5f93ce21d2fe408dffd49d4ae31e364d6802fff97d95ed593ff3082","7baf220eb89f2a216fcb2d0e9aa021b2a10324f0641caf8b7a9088e4e45bec95")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("f5b60a8ead96703080e73a1f79c3e70ff44df271","fe3a3042890c1f11361368aeb2cc12647a6fdae1","76746b48a78a3828b64924f4aedca2e4c49b6735","4a02a72aedc3356d8cb38f01f0e0b9f26ddc5ccb7c0f04a561337cf24aa84030","b39c14becb62aeb55df7fd55c814afbb0d659687d947d917512fe67973100b70","fa3a74a6c015c801f5341c02be2cbdfb301c6ed60633d49fc0bc723617741af7","390665bdd93a656f48c463bb6c11a4d45b7d5444bdd1d1f7a5879b0f6f9aac7e","66af332ce5f93ce21d2fe408dffd49d4ae31e364d6802fff97d95ed593ff3082","7baf220eb89f2a216fcb2d0e9aa021b2a10324f0641caf8b7a9088e4e45bec95")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("f5b60a8ead96703080e73a1f79c3e70ff44df271","fe3a3042890c1f11361368aeb2cc12647a6fdae1","76746b48a78a3828b64924f4aedca2e4c49b6735","4a02a72aedc3356d8cb38f01f0e0b9f26ddc5ccb7c0f04a561337cf24aa84030","b39c14becb62aeb55df7fd55c814afbb0d659687d947d917512fe67973100b70","fa3a74a6c015c801f5341c02be2cbdfb301c6ed60633d49fc0bc723617741af7","390665bdd93a656f48c463bb6c11a4d45b7d5444bdd1d1f7a5879b0f6f9aac7e","66af332ce5f93ce21d2fe408dffd49d4ae31e364d6802fff97d95ed593ff3082","7baf220eb89f2a216fcb2d0e9aa021b2a10324f0641caf8b7a9088e4e45bec95")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("f5b60a8ead96703080e73a1f79c3e70ff44df271","fe3a3042890c1f11361368aeb2cc12647a6fdae1","76746b48a78a3828b64924f4aedca2e4c49b6735","4a02a72aedc3356d8cb38f01f0e0b9f26ddc5ccb7c0f04a561337cf24aa84030","b39c14becb62aeb55df7fd55c814afbb0d659687d947d917512fe67973100b70","fa3a74a6c015c801f5341c02be2cbdfb301c6ed60633d49fc0bc723617741af7","390665bdd93a656f48c463bb6c11a4d45b7d5444bdd1d1f7a5879b0f6f9aac7e","66af332ce5f93ce21d2fe408dffd49d4ae31e364d6802fff97d95ed593ff3082","7baf220eb89f2a216fcb2d0e9aa021b2a10324f0641caf8b7a9088e4e45bec95")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("f5b60a8ead96703080e73a1f79c3e70ff44df271","fe3a3042890c1f11361368aeb2cc12647a6fdae1","76746b48a78a3828b64924f4aedca2e4c49b6735","4a02a72aedc3356d8cb38f01f0e0b9f26ddc5ccb7c0f04a561337cf24aa84030","b39c14becb62aeb55df7fd55c814afbb0d659687d947d917512fe67973100b70","fa3a74a6c015c801f5341c02be2cbdfb301c6ed60633d49fc0bc723617741af7","390665bdd93a656f48c463bb6c11a4d45b7d5444bdd1d1f7a5879b0f6f9aac7e","66af332ce5f93ce21d2fe408dffd49d4ae31e364d6802fff97d95ed593ff3082","7baf220eb89f2a216fcb2d0e9aa021b2a10324f0641caf8b7a9088e4e45bec95")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("f5b60a8ead96703080e73a1f79c3e70ff44df271","fe3a3042890c1f11361368aeb2cc12647a6fdae1","76746b48a78a3828b64924f4aedca2e4c49b6735","4a02a72aedc3356d8cb38f01f0e0b9f26ddc5ccb7c0f04a561337cf24aa84030","b39c14becb62aeb55df7fd55c814afbb0d659687d947d917512fe67973100b70","fa3a74a6c015c801f5341c02be2cbdfb301c6ed60633d49fc0bc723617741af7","390665bdd93a656f48c463bb6c11a4d45b7d5444bdd1d1f7a5879b0f6f9aac7e","66af332ce5f93ce21d2fe408dffd49d4ae31e364d6802fff97d95ed593ff3082","7baf220eb89f2a216fcb2d0e9aa021b2a10324f0641caf8b7a9088e4e45bec95")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("f5b60a8ead96703080e73a1f79c3e70ff44df271","fe3a3042890c1f11361368aeb2cc12647a6fdae1","76746b48a78a3828b64924f4aedca2e4c49b6735","4a02a72aedc3356d8cb38f01f0e0b9f26ddc5ccb7c0f04a561337cf24aa84030","b39c14becb62aeb55df7fd55c814afbb0d659687d947d917512fe67973100b70","fa3a74a6c015c801f5341c02be2cbdfb301c6ed60633d49fc0bc723617741af7","390665bdd93a656f48c463bb6c11a4d45b7d5444bdd1d1f7a5879b0f6f9aac7e","66af332ce5f93ce21d2fe408dffd49d4ae31e364d6802fff97d95ed593ff3082","7baf220eb89f2a216fcb2d0e9aa021b2a10324f0641caf8b7a9088e4e45bec95")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("f5b60a8ead96703080e73a1f79c3e70ff44df271","fe3a3042890c1f11361368aeb2cc12647a6fdae1","76746b48a78a3828b64924f4aedca2e4c49b6735","4a02a72aedc3356d8cb38f01f0e0b9f26ddc5ccb7c0f04a561337cf24aa84030","b39c14becb62aeb55df7fd55c814afbb0d659687d947d917512fe67973100b70","fa3a74a6c015c801f5341c02be2cbdfb301c6ed60633d49fc0bc723617741af7","390665bdd93a656f48c463bb6c11a4d45b7d5444bdd1d1f7a5879b0f6f9aac7e","66af332ce5f93ce21d2fe408dffd49d4ae31e364d6802fff97d95ed593ff3082","7baf220eb89f2a216fcb2d0e9aa021b2a10324f0641caf8b7a9088e4e45bec95")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("f5b60a8ead96703080e73a1f79c3e70ff44df271","fe3a3042890c1f11361368aeb2cc12647a6fdae1","76746b48a78a3828b64924f4aedca2e4c49b6735","4a02a72aedc3356d8cb38f01f0e0b9f26ddc5ccb7c0f04a561337cf24aa84030","b39c14becb62aeb55df7fd55c814afbb0d659687d947d917512fe67973100b70","fa3a74a6c015c801f5341c02be2cbdfb301c6ed60633d49fc0bc723617741af7","390665bdd93a656f48c463bb6c11a4d45b7d5444bdd1d1f7a5879b0f6f9aac7e","66af332ce5f93ce21d2fe408dffd49d4ae31e364d6802fff97d95ed593ff3082","7baf220eb89f2a216fcb2d0e9aa021b2a10324f0641caf8b7a9088e4e45bec95")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("f5b60a8ead96703080e73a1f79c3e70ff44df271","fe3a3042890c1f11361368aeb2cc12647a6fdae1","76746b48a78a3828b64924f4aedca2e4c49b6735","4a02a72aedc3356d8cb38f01f0e0b9f26ddc5ccb7c0f04a561337cf24aa84030","b39c14becb62aeb55df7fd55c814afbb0d659687d947d917512fe67973100b70","fa3a74a6c015c801f5341c02be2cbdfb301c6ed60633d49fc0bc723617741af7","390665bdd93a656f48c463bb6c11a4d45b7d5444bdd1d1f7a5879b0f6f9aac7e","66af332ce5f93ce21d2fe408dffd49d4ae31e364d6802fff97d95ed593ff3082","7baf220eb89f2a216fcb2d0e9aa021b2a10324f0641caf8b7a9088e4e45bec95")
index=activity AND rg_functionality="Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("f5b60a8ead96703080e73a1f79c3e70ff44df271","fe3a3042890c1f11361368aeb2cc12647a6fdae1","76746b48a78a3828b64924f4aedca2e4c49b6735","4a02a72aedc3356d8cb38f01f0e0b9f26ddc5ccb7c0f04a561337cf24aa84030","b39c14becb62aeb55df7fd55c814afbb0d659687d947d917512fe67973100b70","fa3a74a6c015c801f5341c02be2cbdfb301c6ed60633d49fc0bc723617741af7","390665bdd93a656f48c463bb6c11a4d45b7d5444bdd1d1f7a5879b0f6f9aac7e","66af332ce5f93ce21d2fe408dffd49d4ae31e364d6802fff97d95ed593ff3082","7baf220eb89f2a216fcb2d0e9aa021b2a10324f0641caf8b7a9088e4e45bec95")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("f5b60a8ead96703080e73a1f79c3e70ff44df271","fe3a3042890c1f11361368aeb2cc12647a6fdae1","76746b48a78a3828b64924f4aedca2e4c49b6735","4a02a72aedc3356d8cb38f01f0e0b9f26ddc5ccb7c0f04a561337cf24aa84030","b39c14becb62aeb55df7fd55c814afbb0d659687d947d917512fe67973100b70","fa3a74a6c015c801f5341c02be2cbdfb301c6ed60633d49fc0bc723617741af7","390665bdd93a656f48c463bb6c11a4d45b7d5444bdd1d1f7a5879b0f6f9aac7e","66af332ce5f93ce21d2fe408dffd49d4ae31e364d6802fff97d95ed593ff3082","7baf220eb89f2a216fcb2d0e9aa021b2a10324f0641caf8b7a9088e4e45bec95")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("f5b60a8ead96703080e73a1f79c3e70ff44df271","fe3a3042890c1f11361368aeb2cc12647a6fdae1","76746b48a78a3828b64924f4aedca2e4c49b6735","4a02a72aedc3356d8cb38f01f0e0b9f26ddc5ccb7c0f04a561337cf24aa84030","b39c14becb62aeb55df7fd55c814afbb0d659687d947d917512fe67973100b70","fa3a74a6c015c801f5341c02be2cbdfb301c6ed60633d49fc0bc723617741af7","390665bdd93a656f48c463bb6c11a4d45b7d5444bdd1d1f7a5879b0f6f9aac7e","66af332ce5f93ce21d2fe408dffd49d4ae31e364d6802fff97d95ed593ff3082","7baf220eb89f2a216fcb2d0e9aa021b2a10324f0641caf8b7a9088e4e45bec95")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("f5b60a8ead96703080e73a1f79c3e70ff44df271","fe3a3042890c1f11361368aeb2cc12647a6fdae1","76746b48a78a3828b64924f4aedca2e4c49b6735","4a02a72aedc3356d8cb38f01f0e0b9f26ddc5ccb7c0f04a561337cf24aa84030","b39c14becb62aeb55df7fd55c814afbb0d659687d947d917512fe67973100b70","fa3a74a6c015c801f5341c02be2cbdfb301c6ed60633d49fc0bc723617741af7","390665bdd93a656f48c463bb6c11a4d45b7d5444bdd1d1f7a5879b0f6f9aac7e","66af332ce5f93ce21d2fe408dffd49d4ae31e364d6802fff97d95ed593ff3082","7baf220eb89f2a216fcb2d0e9aa021b2a10324f0641caf8b7a9088e4e45bec95")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("f5b60a8ead96703080e73a1f79c3e70ff44df271","fe3a3042890c1f11361368aeb2cc12647a6fdae1","76746b48a78a3828b64924f4aedca2e4c49b6735","4a02a72aedc3356d8cb38f01f0e0b9f26ddc5ccb7c0f04a561337cf24aa84030","b39c14becb62aeb55df7fd55c814afbb0d659687d947d917512fe67973100b70","fa3a74a6c015c801f5341c02be2cbdfb301c6ed60633d49fc0bc723617741af7","390665bdd93a656f48c463bb6c11a4d45b7d5444bdd1d1f7a5879b0f6f9aac7e","66af332ce5f93ce21d2fe408dffd49d4ae31e364d6802fff97d95ed593ff3082","7baf220eb89f2a216fcb2d0e9aa021b2a10324f0641caf8b7a9088e4e45bec95")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("f5b60a8ead96703080e73a1f79c3e70ff44df271","fe3a3042890c1f11361368aeb2cc12647a6fdae1","76746b48a78a3828b64924f4aedca2e4c49b6735","4a02a72aedc3356d8cb38f01f0e0b9f26ddc5ccb7c0f04a561337cf24aa84030","b39c14becb62aeb55df7fd55c814afbb0d659687d947d917512fe67973100b70","fa3a74a6c015c801f5341c02be2cbdfb301c6ed60633d49fc0bc723617741af7","390665bdd93a656f48c463bb6c11a4d45b7d5444bdd1d1f7a5879b0f6f9aac7e","66af332ce5f93ce21d2fe408dffd49d4ae31e364d6802fff97d95ed593ff3082","7baf220eb89f2a216fcb2d0e9aa021b2a10324f0641caf8b7a9088e4e45bec95")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("f5b60a8ead96703080e73a1f79c3e70ff44df271","fe3a3042890c1f11361368aeb2cc12647a6fdae1","76746b48a78a3828b64924f4aedca2e4c49b6735","4a02a72aedc3356d8cb38f01f0e0b9f26ddc5ccb7c0f04a561337cf24aa84030","b39c14becb62aeb55df7fd55c814afbb0d659687d947d917512fe67973100b70","fa3a74a6c015c801f5341c02be2cbdfb301c6ed60633d49fc0bc723617741af7","390665bdd93a656f48c463bb6c11a4d45b7d5444bdd1d1f7a5879b0f6f9aac7e","66af332ce5f93ce21d2fe408dffd49d4ae31e364d6802fff97d95ed593ff3082","7baf220eb89f2a216fcb2d0e9aa021b2a10324f0641caf8b7a9088e4e45bec95")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("f5b60a8ead96703080e73a1f79c3e70ff44df271","fe3a3042890c1f11361368aeb2cc12647a6fdae1","76746b48a78a3828b64924f4aedca2e4c49b6735","4a02a72aedc3356d8cb38f01f0e0b9f26ddc5ccb7c0f04a561337cf24aa84030","b39c14becb62aeb55df7fd55c814afbb0d659687d947d917512fe67973100b70","fa3a74a6c015c801f5341c02be2cbdfb301c6ed60633d49fc0bc723617741af7","390665bdd93a656f48c463bb6c11a4d45b7d5444bdd1d1f7a5879b0f6f9aac7e","66af332ce5f93ce21d2fe408dffd49d4ae31e364d6802fff97d95ed593ff3082","7baf220eb89f2a216fcb2d0e9aa021b2a10324f0641caf8b7a9088e4e45bec95")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring64 NOT NULL AND customstring64 IN ("f5b60a8ead96703080e73a1f79c3e70ff44df271","fe3a3042890c1f11361368aeb2cc12647a6fdae1","76746b48a78a3828b64924f4aedca2e4c49b6735","4a02a72aedc3356d8cb38f01f0e0b9f26ddc5ccb7c0f04a561337cf24aa84030","b39c14becb62aeb55df7fd55c814afbb0d659687d947d917512fe67973100b70","fa3a74a6c015c801f5341c02be2cbdfb301c6ed60633d49fc0bc723617741af7","390665bdd93a656f48c463bb6c11a4d45b7d5444bdd1d1f7a5879b0f6f9aac7e","66af332ce5f93ce21d2fe408dffd49d4ae31e364d6802fff97d95ed593ff3082","7baf220eb89f2a216fcb2d0e9aa021b2a10324f0641caf8b7a9088e4e45bec95")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("f5b60a8ead96703080e73a1f79c3e70ff44df271","fe3a3042890c1f11361368aeb2cc12647a6fdae1","76746b48a78a3828b64924f4aedca2e4c49b6735","4a02a72aedc3356d8cb38f01f0e0b9f26ddc5ccb7c0f04a561337cf24aa84030","b39c14becb62aeb55df7fd55c814afbb0d659687d947d917512fe67973100b70","fa3a74a6c015c801f5341c02be2cbdfb301c6ed60633d49fc0bc723617741af7","390665bdd93a656f48c463bb6c11a4d45b7d5444bdd1d1f7a5879b0f6f9aac7e","66af332ce5f93ce21d2fe408dffd49d4ae31e364d6802fff97d95ed593ff3082","7baf220eb89f2a216fcb2d0e9aa021b2a10324f0641caf8b7a9088e4e45bec95")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("f5b60a8ead96703080e73a1f79c3e70ff44df271","fe3a3042890c1f11361368aeb2cc12647a6fdae1","76746b48a78a3828b64924f4aedca2e4c49b6735","4a02a72aedc3356d8cb38f01f0e0b9f26ddc5ccb7c0f04a561337cf24aa84030","b39c14becb62aeb55df7fd55c814afbb0d659687d947d917512fe67973100b70","fa3a74a6c015c801f5341c02be2cbdfb301c6ed60633d49fc0bc723617741af7","390665bdd93a656f48c463bb6c11a4d45b7d5444bdd1d1f7a5879b0f6f9aac7e","66af332ce5f93ce21d2fe408dffd49d4ae31e364d6802fff97d95ed593ff3082","7baf220eb89f2a216fcb2d0e9aa021b2a10324f0641caf8b7a9088e4e45bec95")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("f5b60a8ead96703080e73a1f79c3e70ff44df271","fe3a3042890c1f11361368aeb2cc12647a6fdae1","76746b48a78a3828b64924f4aedca2e4c49b6735","4a02a72aedc3356d8cb38f01f0e0b9f26ddc5ccb7c0f04a561337cf24aa84030","b39c14becb62aeb55df7fd55c814afbb0d659687d947d917512fe67973100b70","fa3a74a6c015c801f5341c02be2cbdfb301c6ed60633d49fc0bc723617741af7","390665bdd93a656f48c463bb6c11a4d45b7d5444bdd1d1f7a5879b0f6f9aac7e","66af332ce5f93ce21d2fe408dffd49d4ae31e364d6802fff97d95ed593ff3082","7baf220eb89f2a216fcb2d0e9aa021b2a10324f0641caf8b7a9088e4e45bec95")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring64 NOT NULL AND customstring64 IN ("f5b60a8ead96703080e73a1f79c3e70ff44df271","fe3a3042890c1f11361368aeb2cc12647a6fdae1","76746b48a78a3828b64924f4aedca2e4c49b6735","4a02a72aedc3356d8cb38f01f0e0b9f26ddc5ccb7c0f04a561337cf24aa84030","b39c14becb62aeb55df7fd55c814afbb0d659687d947d917512fe67973100b70","fa3a74a6c015c801f5341c02be2cbdfb301c6ed60633d49fc0bc723617741af7","390665bdd93a656f48c463bb6c11a4d45b7d5444bdd1d1f7a5879b0f6f9aac7e","66af332ce5f93ce21d2fe408dffd49d4ae31e364d6802fff97d95ed593ff3082","7baf220eb89f2a216fcb2d0e9aa021b2a10324f0641caf8b7a9088e4e45bec95")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("f5b60a8ead96703080e73a1f79c3e70ff44df271","fe3a3042890c1f11361368aeb2cc12647a6fdae1","76746b48a78a3828b64924f4aedca2e4c49b6735","4a02a72aedc3356d8cb38f01f0e0b9f26ddc5ccb7c0f04a561337cf24aa84030","b39c14becb62aeb55df7fd55c814afbb0d659687d947d917512fe67973100b70","fa3a74a6c015c801f5341c02be2cbdfb301c6ed60633d49fc0bc723617741af7","390665bdd93a656f48c463bb6c11a4d45b7d5444bdd1d1f7a5879b0f6f9aac7e","66af332ce5f93ce21d2fe408dffd49d4ae31e364d6802fff97d95ed593ff3082","7baf220eb89f2a216fcb2d0e9aa021b2a10324f0641caf8b7a9088e4e45bec95")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("f5b60a8ead96703080e73a1f79c3e70ff44df271","fe3a3042890c1f11361368aeb2cc12647a6fdae1","76746b48a78a3828b64924f4aedca2e4c49b6735","4a02a72aedc3356d8cb38f01f0e0b9f26ddc5ccb7c0f04a561337cf24aa84030","b39c14becb62aeb55df7fd55c814afbb0d659687d947d917512fe67973100b70","fa3a74a6c015c801f5341c02be2cbdfb301c6ed60633d49fc0bc723617741af7","390665bdd93a656f48c463bb6c11a4d45b7d5444bdd1d1f7a5879b0f6f9aac7e","66af332ce5f93ce21d2fe408dffd49d4ae31e364d6802fff97d95ed593ff3082","7baf220eb89f2a216fcb2d0e9aa021b2a10324f0641caf8b7a9088e4e45bec95")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("f5b60a8ead96703080e73a1f79c3e70ff44df271","fe3a3042890c1f11361368aeb2cc12647a6fdae1","76746b48a78a3828b64924f4aedca2e4c49b6735","4a02a72aedc3356d8cb38f01f0e0b9f26ddc5ccb7c0f04a561337cf24aa84030","b39c14becb62aeb55df7fd55c814afbb0d659687d947d917512fe67973100b70","fa3a74a6c015c801f5341c02be2cbdfb301c6ed60633d49fc0bc723617741af7","390665bdd93a656f48c463bb6c11a4d45b7d5444bdd1d1f7a5879b0f6f9aac7e","66af332ce5f93ce21d2fe408dffd49d4ae31e364d6802fff97d95ed593ff3082","7baf220eb89f2a216fcb2d0e9aa021b2a10324f0641caf8b7a9088e4e45bec95")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring64 NOT NULL AND customstring64 IN ("f5b60a8ead96703080e73a1f79c3e70ff44df271","fe3a3042890c1f11361368aeb2cc12647a6fdae1","76746b48a78a3828b64924f4aedca2e4c49b6735","4a02a72aedc3356d8cb38f01f0e0b9f26ddc5ccb7c0f04a561337cf24aa84030","b39c14becb62aeb55df7fd55c814afbb0d659687d947d917512fe67973100b70","fa3a74a6c015c801f5341c02be2cbdfb301c6ed60633d49fc0bc723617741af7","390665bdd93a656f48c463bb6c11a4d45b7d5444bdd1d1f7a5879b0f6f9aac7e","66af332ce5f93ce21d2fe408dffd49d4ae31e364d6802fff97d95ed593ff3082","7baf220eb89f2a216fcb2d0e9aa021b2a10324f0641caf8b7a9088e4e45bec95")
index=activity AND rg_functionality="O365 General" AND filehash NOT NULL AND filehash IN ("f5b60a8ead96703080e73a1f79c3e70ff44df271","fe3a3042890c1f11361368aeb2cc12647a6fdae1","76746b48a78a3828b64924f4aedca2e4c49b6735","4a02a72aedc3356d8cb38f01f0e0b9f26ddc5ccb7c0f04a561337cf24aa84030","b39c14becb62aeb55df7fd55c814afbb0d659687d947d917512fe67973100b70","fa3a74a6c015c801f5341c02be2cbdfb301c6ed60633d49fc0bc723617741af7","390665bdd93a656f48c463bb6c11a4d45b7d5444bdd1d1f7a5879b0f6f9aac7e","66af332ce5f93ce21d2fe408dffd49d4ae31e364d6802fff97d95ed593ff3082","7baf220eb89f2a216fcb2d0e9aa021b2a10324f0641caf8b7a9088e4e45bec95")
index=activity AND rg_functionality="O365 General" AND oldfilehash NOT NULL AND oldfilehash IN ("f5b60a8ead96703080e73a1f79c3e70ff44df271","fe3a3042890c1f11361368aeb2cc12647a6fdae1","76746b48a78a3828b64924f4aedca2e4c49b6735","4a02a72aedc3356d8cb38f01f0e0b9f26ddc5ccb7c0f04a561337cf24aa84030","b39c14becb62aeb55df7fd55c814afbb0d659687d947d917512fe67973100b70","fa3a74a6c015c801f5341c02be2cbdfb301c6ed60633d49fc0bc723617741af7","390665bdd93a656f48c463bb6c11a4d45b7d5444bdd1d1f7a5879b0f6f9aac7e","66af332ce5f93ce21d2fe408dffd49d4ae31e364d6802fff97d95ed593ff3082","7baf220eb89f2a216fcb2d0e9aa021b2a10324f0641caf8b7a9088e4e45bec95")
index=activity AND rg_functionality="O365 General" AND customstring3 NOT NULL AND customstring3 IN ("f5b60a8ead96703080e73a1f79c3e70ff44df271","fe3a3042890c1f11361368aeb2cc12647a6fdae1","76746b48a78a3828b64924f4aedca2e4c49b6735","4a02a72aedc3356d8cb38f01f0e0b9f26ddc5ccb7c0f04a561337cf24aa84030","b39c14becb62aeb55df7fd55c814afbb0d659687d947d917512fe67973100b70","fa3a74a6c015c801f5341c02be2cbdfb301c6ed60633d49fc0bc723617741af7","390665bdd93a656f48c463bb6c11a4d45b7d5444bdd1d1f7a5879b0f6f9aac7e","66af332ce5f93ce21d2fe408dffd49d4ae31e364d6802fff97d95ed593ff3082","7baf220eb89f2a216fcb2d0e9aa021b2a10324f0641caf8b7a9088e4e45bec95")
index=activity AND rg_functionality="O365 General" AND customstring64 NOT NULL AND customstring64 IN ("f5b60a8ead96703080e73a1f79c3e70ff44df271","fe3a3042890c1f11361368aeb2cc12647a6fdae1","76746b48a78a3828b64924f4aedca2e4c49b6735","4a02a72aedc3356d8cb38f01f0e0b9f26ddc5ccb7c0f04a561337cf24aa84030","b39c14becb62aeb55df7fd55c814afbb0d659687d947d917512fe67973100b70","fa3a74a6c015c801f5341c02be2cbdfb301c6ed60633d49fc0bc723617741af7","390665bdd93a656f48c463bb6c11a4d45b7d5444bdd1d1f7a5879b0f6f9aac7e","66af332ce5f93ce21d2fe408dffd49d4ae31e364d6802fff97d95ed593ff3082","7baf220eb89f2a216fcb2d0e9aa021b2a10324f0641caf8b7a9088e4e45bec95")
