index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("e4cc9a566e92fd87c00dfe2398f93b7badd2110cb712145e344e20aa0ddc6457","a2c2a58995a8d79c4af92a7117d9c3ba5eb2e3b0600a5871b81558fcd7aeb97b","818675ba09b4883e57790aff9a79669275dfe088d02dc5f5cf459b16375d17db","595a0565461528e335b8a4c3e93f305bec04089c04a641c233e28a26ffca40d6","7aae334219ed0d7af2eaff729050ae2fc1bdf2c286fdc8a00be39c8f4907ff19")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("e4cc9a566e92fd87c00dfe2398f93b7badd2110cb712145e344e20aa0ddc6457","a2c2a58995a8d79c4af92a7117d9c3ba5eb2e3b0600a5871b81558fcd7aeb97b","818675ba09b4883e57790aff9a79669275dfe088d02dc5f5cf459b16375d17db","595a0565461528e335b8a4c3e93f305bec04089c04a641c233e28a26ffca40d6","7aae334219ed0d7af2eaff729050ae2fc1bdf2c286fdc8a00be39c8f4907ff19")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("e4cc9a566e92fd87c00dfe2398f93b7badd2110cb712145e344e20aa0ddc6457","a2c2a58995a8d79c4af92a7117d9c3ba5eb2e3b0600a5871b81558fcd7aeb97b","818675ba09b4883e57790aff9a79669275dfe088d02dc5f5cf459b16375d17db","595a0565461528e335b8a4c3e93f305bec04089c04a641c233e28a26ffca40d6","7aae334219ed0d7af2eaff729050ae2fc1bdf2c286fdc8a00be39c8f4907ff19")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring64 NOT NULL AND customstring64 IN ("e4cc9a566e92fd87c00dfe2398f93b7badd2110cb712145e344e20aa0ddc6457","a2c2a58995a8d79c4af92a7117d9c3ba5eb2e3b0600a5871b81558fcd7aeb97b","818675ba09b4883e57790aff9a79669275dfe088d02dc5f5cf459b16375d17db","595a0565461528e335b8a4c3e93f305bec04089c04a641c233e28a26ffca40d6","7aae334219ed0d7af2eaff729050ae2fc1bdf2c286fdc8a00be39c8f4907ff19")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("e4cc9a566e92fd87c00dfe2398f93b7badd2110cb712145e344e20aa0ddc6457","a2c2a58995a8d79c4af92a7117d9c3ba5eb2e3b0600a5871b81558fcd7aeb97b","818675ba09b4883e57790aff9a79669275dfe088d02dc5f5cf459b16375d17db","595a0565461528e335b8a4c3e93f305bec04089c04a641c233e28a26ffca40d6","7aae334219ed0d7af2eaff729050ae2fc1bdf2c286fdc8a00be39c8f4907ff19")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("e4cc9a566e92fd87c00dfe2398f93b7badd2110cb712145e344e20aa0ddc6457","a2c2a58995a8d79c4af92a7117d9c3ba5eb2e3b0600a5871b81558fcd7aeb97b","818675ba09b4883e57790aff9a79669275dfe088d02dc5f5cf459b16375d17db","595a0565461528e335b8a4c3e93f305bec04089c04a641c233e28a26ffca40d6","7aae334219ed0d7af2eaff729050ae2fc1bdf2c286fdc8a00be39c8f4907ff19")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("e4cc9a566e92fd87c00dfe2398f93b7badd2110cb712145e344e20aa0ddc6457","a2c2a58995a8d79c4af92a7117d9c3ba5eb2e3b0600a5871b81558fcd7aeb97b","818675ba09b4883e57790aff9a79669275dfe088d02dc5f5cf459b16375d17db","595a0565461528e335b8a4c3e93f305bec04089c04a641c233e28a26ffca40d6","7aae334219ed0d7af2eaff729050ae2fc1bdf2c286fdc8a00be39c8f4907ff19")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("e4cc9a566e92fd87c00dfe2398f93b7badd2110cb712145e344e20aa0ddc6457","a2c2a58995a8d79c4af92a7117d9c3ba5eb2e3b0600a5871b81558fcd7aeb97b","818675ba09b4883e57790aff9a79669275dfe088d02dc5f5cf459b16375d17db","595a0565461528e335b8a4c3e93f305bec04089c04a641c233e28a26ffca40d6","7aae334219ed0d7af2eaff729050ae2fc1bdf2c286fdc8a00be39c8f4907ff19")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("e4cc9a566e92fd87c00dfe2398f93b7badd2110cb712145e344e20aa0ddc6457","a2c2a58995a8d79c4af92a7117d9c3ba5eb2e3b0600a5871b81558fcd7aeb97b","818675ba09b4883e57790aff9a79669275dfe088d02dc5f5cf459b16375d17db","595a0565461528e335b8a4c3e93f305bec04089c04a641c233e28a26ffca40d6","7aae334219ed0d7af2eaff729050ae2fc1bdf2c286fdc8a00be39c8f4907ff19")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("e4cc9a566e92fd87c00dfe2398f93b7badd2110cb712145e344e20aa0ddc6457","a2c2a58995a8d79c4af92a7117d9c3ba5eb2e3b0600a5871b81558fcd7aeb97b","818675ba09b4883e57790aff9a79669275dfe088d02dc5f5cf459b16375d17db","595a0565461528e335b8a4c3e93f305bec04089c04a641c233e28a26ffca40d6","7aae334219ed0d7af2eaff729050ae2fc1bdf2c286fdc8a00be39c8f4907ff19")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("e4cc9a566e92fd87c00dfe2398f93b7badd2110cb712145e344e20aa0ddc6457","a2c2a58995a8d79c4af92a7117d9c3ba5eb2e3b0600a5871b81558fcd7aeb97b","818675ba09b4883e57790aff9a79669275dfe088d02dc5f5cf459b16375d17db","595a0565461528e335b8a4c3e93f305bec04089c04a641c233e28a26ffca40d6","7aae334219ed0d7af2eaff729050ae2fc1bdf2c286fdc8a00be39c8f4907ff19")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("e4cc9a566e92fd87c00dfe2398f93b7badd2110cb712145e344e20aa0ddc6457","a2c2a58995a8d79c4af92a7117d9c3ba5eb2e3b0600a5871b81558fcd7aeb97b","818675ba09b4883e57790aff9a79669275dfe088d02dc5f5cf459b16375d17db","595a0565461528e335b8a4c3e93f305bec04089c04a641c233e28a26ffca40d6","7aae334219ed0d7af2eaff729050ae2fc1bdf2c286fdc8a00be39c8f4907ff19")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("e4cc9a566e92fd87c00dfe2398f93b7badd2110cb712145e344e20aa0ddc6457","a2c2a58995a8d79c4af92a7117d9c3ba5eb2e3b0600a5871b81558fcd7aeb97b","818675ba09b4883e57790aff9a79669275dfe088d02dc5f5cf459b16375d17db","595a0565461528e335b8a4c3e93f305bec04089c04a641c233e28a26ffca40d6","7aae334219ed0d7af2eaff729050ae2fc1bdf2c286fdc8a00be39c8f4907ff19")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("e4cc9a566e92fd87c00dfe2398f93b7badd2110cb712145e344e20aa0ddc6457","a2c2a58995a8d79c4af92a7117d9c3ba5eb2e3b0600a5871b81558fcd7aeb97b","818675ba09b4883e57790aff9a79669275dfe088d02dc5f5cf459b16375d17db","595a0565461528e335b8a4c3e93f305bec04089c04a641c233e28a26ffca40d6","7aae334219ed0d7af2eaff729050ae2fc1bdf2c286fdc8a00be39c8f4907ff19")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("e4cc9a566e92fd87c00dfe2398f93b7badd2110cb712145e344e20aa0ddc6457","a2c2a58995a8d79c4af92a7117d9c3ba5eb2e3b0600a5871b81558fcd7aeb97b","818675ba09b4883e57790aff9a79669275dfe088d02dc5f5cf459b16375d17db","595a0565461528e335b8a4c3e93f305bec04089c04a641c233e28a26ffca40d6","7aae334219ed0d7af2eaff729050ae2fc1bdf2c286fdc8a00be39c8f4907ff19")
index=activity AND rg_functionality="Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("e4cc9a566e92fd87c00dfe2398f93b7badd2110cb712145e344e20aa0ddc6457","a2c2a58995a8d79c4af92a7117d9c3ba5eb2e3b0600a5871b81558fcd7aeb97b","818675ba09b4883e57790aff9a79669275dfe088d02dc5f5cf459b16375d17db","595a0565461528e335b8a4c3e93f305bec04089c04a641c233e28a26ffca40d6","7aae334219ed0d7af2eaff729050ae2fc1bdf2c286fdc8a00be39c8f4907ff19")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("e4cc9a566e92fd87c00dfe2398f93b7badd2110cb712145e344e20aa0ddc6457","a2c2a58995a8d79c4af92a7117d9c3ba5eb2e3b0600a5871b81558fcd7aeb97b","818675ba09b4883e57790aff9a79669275dfe088d02dc5f5cf459b16375d17db","595a0565461528e335b8a4c3e93f305bec04089c04a641c233e28a26ffca40d6","7aae334219ed0d7af2eaff729050ae2fc1bdf2c286fdc8a00be39c8f4907ff19")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("e4cc9a566e92fd87c00dfe2398f93b7badd2110cb712145e344e20aa0ddc6457","a2c2a58995a8d79c4af92a7117d9c3ba5eb2e3b0600a5871b81558fcd7aeb97b","818675ba09b4883e57790aff9a79669275dfe088d02dc5f5cf459b16375d17db","595a0565461528e335b8a4c3e93f305bec04089c04a641c233e28a26ffca40d6","7aae334219ed0d7af2eaff729050ae2fc1bdf2c286fdc8a00be39c8f4907ff19")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("e4cc9a566e92fd87c00dfe2398f93b7badd2110cb712145e344e20aa0ddc6457","a2c2a58995a8d79c4af92a7117d9c3ba5eb2e3b0600a5871b81558fcd7aeb97b","818675ba09b4883e57790aff9a79669275dfe088d02dc5f5cf459b16375d17db","595a0565461528e335b8a4c3e93f305bec04089c04a641c233e28a26ffca40d6","7aae334219ed0d7af2eaff729050ae2fc1bdf2c286fdc8a00be39c8f4907ff19")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("e4cc9a566e92fd87c00dfe2398f93b7badd2110cb712145e344e20aa0ddc6457","a2c2a58995a8d79c4af92a7117d9c3ba5eb2e3b0600a5871b81558fcd7aeb97b","818675ba09b4883e57790aff9a79669275dfe088d02dc5f5cf459b16375d17db","595a0565461528e335b8a4c3e93f305bec04089c04a641c233e28a26ffca40d6","7aae334219ed0d7af2eaff729050ae2fc1bdf2c286fdc8a00be39c8f4907ff19")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("e4cc9a566e92fd87c00dfe2398f93b7badd2110cb712145e344e20aa0ddc6457","a2c2a58995a8d79c4af92a7117d9c3ba5eb2e3b0600a5871b81558fcd7aeb97b","818675ba09b4883e57790aff9a79669275dfe088d02dc5f5cf459b16375d17db","595a0565461528e335b8a4c3e93f305bec04089c04a641c233e28a26ffca40d6","7aae334219ed0d7af2eaff729050ae2fc1bdf2c286fdc8a00be39c8f4907ff19")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("e4cc9a566e92fd87c00dfe2398f93b7badd2110cb712145e344e20aa0ddc6457","a2c2a58995a8d79c4af92a7117d9c3ba5eb2e3b0600a5871b81558fcd7aeb97b","818675ba09b4883e57790aff9a79669275dfe088d02dc5f5cf459b16375d17db","595a0565461528e335b8a4c3e93f305bec04089c04a641c233e28a26ffca40d6","7aae334219ed0d7af2eaff729050ae2fc1bdf2c286fdc8a00be39c8f4907ff19")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("e4cc9a566e92fd87c00dfe2398f93b7badd2110cb712145e344e20aa0ddc6457","a2c2a58995a8d79c4af92a7117d9c3ba5eb2e3b0600a5871b81558fcd7aeb97b","818675ba09b4883e57790aff9a79669275dfe088d02dc5f5cf459b16375d17db","595a0565461528e335b8a4c3e93f305bec04089c04a641c233e28a26ffca40d6","7aae334219ed0d7af2eaff729050ae2fc1bdf2c286fdc8a00be39c8f4907ff19")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring64 NOT NULL AND customstring64 IN ("e4cc9a566e92fd87c00dfe2398f93b7badd2110cb712145e344e20aa0ddc6457","a2c2a58995a8d79c4af92a7117d9c3ba5eb2e3b0600a5871b81558fcd7aeb97b","818675ba09b4883e57790aff9a79669275dfe088d02dc5f5cf459b16375d17db","595a0565461528e335b8a4c3e93f305bec04089c04a641c233e28a26ffca40d6","7aae334219ed0d7af2eaff729050ae2fc1bdf2c286fdc8a00be39c8f4907ff19")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("e4cc9a566e92fd87c00dfe2398f93b7badd2110cb712145e344e20aa0ddc6457","a2c2a58995a8d79c4af92a7117d9c3ba5eb2e3b0600a5871b81558fcd7aeb97b","818675ba09b4883e57790aff9a79669275dfe088d02dc5f5cf459b16375d17db","595a0565461528e335b8a4c3e93f305bec04089c04a641c233e28a26ffca40d6","7aae334219ed0d7af2eaff729050ae2fc1bdf2c286fdc8a00be39c8f4907ff19")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("e4cc9a566e92fd87c00dfe2398f93b7badd2110cb712145e344e20aa0ddc6457","a2c2a58995a8d79c4af92a7117d9c3ba5eb2e3b0600a5871b81558fcd7aeb97b","818675ba09b4883e57790aff9a79669275dfe088d02dc5f5cf459b16375d17db","595a0565461528e335b8a4c3e93f305bec04089c04a641c233e28a26ffca40d6","7aae334219ed0d7af2eaff729050ae2fc1bdf2c286fdc8a00be39c8f4907ff19")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("e4cc9a566e92fd87c00dfe2398f93b7badd2110cb712145e344e20aa0ddc6457","a2c2a58995a8d79c4af92a7117d9c3ba5eb2e3b0600a5871b81558fcd7aeb97b","818675ba09b4883e57790aff9a79669275dfe088d02dc5f5cf459b16375d17db","595a0565461528e335b8a4c3e93f305bec04089c04a641c233e28a26ffca40d6","7aae334219ed0d7af2eaff729050ae2fc1bdf2c286fdc8a00be39c8f4907ff19")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring64 NOT NULL AND customstring64 IN ("e4cc9a566e92fd87c00dfe2398f93b7badd2110cb712145e344e20aa0ddc6457","a2c2a58995a8d79c4af92a7117d9c3ba5eb2e3b0600a5871b81558fcd7aeb97b","818675ba09b4883e57790aff9a79669275dfe088d02dc5f5cf459b16375d17db","595a0565461528e335b8a4c3e93f305bec04089c04a641c233e28a26ffca40d6","7aae334219ed0d7af2eaff729050ae2fc1bdf2c286fdc8a00be39c8f4907ff19")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("e4cc9a566e92fd87c00dfe2398f93b7badd2110cb712145e344e20aa0ddc6457","a2c2a58995a8d79c4af92a7117d9c3ba5eb2e3b0600a5871b81558fcd7aeb97b","818675ba09b4883e57790aff9a79669275dfe088d02dc5f5cf459b16375d17db","595a0565461528e335b8a4c3e93f305bec04089c04a641c233e28a26ffca40d6","7aae334219ed0d7af2eaff729050ae2fc1bdf2c286fdc8a00be39c8f4907ff19")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("e4cc9a566e92fd87c00dfe2398f93b7badd2110cb712145e344e20aa0ddc6457","a2c2a58995a8d79c4af92a7117d9c3ba5eb2e3b0600a5871b81558fcd7aeb97b","818675ba09b4883e57790aff9a79669275dfe088d02dc5f5cf459b16375d17db","595a0565461528e335b8a4c3e93f305bec04089c04a641c233e28a26ffca40d6","7aae334219ed0d7af2eaff729050ae2fc1bdf2c286fdc8a00be39c8f4907ff19")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("e4cc9a566e92fd87c00dfe2398f93b7badd2110cb712145e344e20aa0ddc6457","a2c2a58995a8d79c4af92a7117d9c3ba5eb2e3b0600a5871b81558fcd7aeb97b","818675ba09b4883e57790aff9a79669275dfe088d02dc5f5cf459b16375d17db","595a0565461528e335b8a4c3e93f305bec04089c04a641c233e28a26ffca40d6","7aae334219ed0d7af2eaff729050ae2fc1bdf2c286fdc8a00be39c8f4907ff19")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring64 NOT NULL AND customstring64 IN ("e4cc9a566e92fd87c00dfe2398f93b7badd2110cb712145e344e20aa0ddc6457","a2c2a58995a8d79c4af92a7117d9c3ba5eb2e3b0600a5871b81558fcd7aeb97b","818675ba09b4883e57790aff9a79669275dfe088d02dc5f5cf459b16375d17db","595a0565461528e335b8a4c3e93f305bec04089c04a641c233e28a26ffca40d6","7aae334219ed0d7af2eaff729050ae2fc1bdf2c286fdc8a00be39c8f4907ff19")
