index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("58bd748483b75a3a6470075e2e57d679","726f7bfb18899b67629dc0a7981e6a21fb5ddf38","4d38d7c7161ccb08998f90079a565f32a296f1bf404001b9e6bbc4d4558d53fd","8e4eba1f01a94b77563ede99bcfdf464","c14517ff49f31e419f0b1a4463ba5ff083ae5a4b","e04dbe0de745fc8026710034af6a00fc8dc38569440ce8ebebe74cd4dc0a6dc5")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("58bd748483b75a3a6470075e2e57d679","726f7bfb18899b67629dc0a7981e6a21fb5ddf38","4d38d7c7161ccb08998f90079a565f32a296f1bf404001b9e6bbc4d4558d53fd","8e4eba1f01a94b77563ede99bcfdf464","c14517ff49f31e419f0b1a4463ba5ff083ae5a4b","e04dbe0de745fc8026710034af6a00fc8dc38569440ce8ebebe74cd4dc0a6dc5")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("58bd748483b75a3a6470075e2e57d679","726f7bfb18899b67629dc0a7981e6a21fb5ddf38","4d38d7c7161ccb08998f90079a565f32a296f1bf404001b9e6bbc4d4558d53fd","8e4eba1f01a94b77563ede99bcfdf464","c14517ff49f31e419f0b1a4463ba5ff083ae5a4b","e04dbe0de745fc8026710034af6a00fc8dc38569440ce8ebebe74cd4dc0a6dc5")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring64 NOT NULL AND customstring64 IN ("58bd748483b75a3a6470075e2e57d679","726f7bfb18899b67629dc0a7981e6a21fb5ddf38","4d38d7c7161ccb08998f90079a565f32a296f1bf404001b9e6bbc4d4558d53fd","8e4eba1f01a94b77563ede99bcfdf464","c14517ff49f31e419f0b1a4463ba5ff083ae5a4b","e04dbe0de745fc8026710034af6a00fc8dc38569440ce8ebebe74cd4dc0a6dc5")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("58bd748483b75a3a6470075e2e57d679","726f7bfb18899b67629dc0a7981e6a21fb5ddf38","4d38d7c7161ccb08998f90079a565f32a296f1bf404001b9e6bbc4d4558d53fd","8e4eba1f01a94b77563ede99bcfdf464","c14517ff49f31e419f0b1a4463ba5ff083ae5a4b","e04dbe0de745fc8026710034af6a00fc8dc38569440ce8ebebe74cd4dc0a6dc5")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("58bd748483b75a3a6470075e2e57d679","726f7bfb18899b67629dc0a7981e6a21fb5ddf38","4d38d7c7161ccb08998f90079a565f32a296f1bf404001b9e6bbc4d4558d53fd","8e4eba1f01a94b77563ede99bcfdf464","c14517ff49f31e419f0b1a4463ba5ff083ae5a4b","e04dbe0de745fc8026710034af6a00fc8dc38569440ce8ebebe74cd4dc0a6dc5")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("58bd748483b75a3a6470075e2e57d679","726f7bfb18899b67629dc0a7981e6a21fb5ddf38","4d38d7c7161ccb08998f90079a565f32a296f1bf404001b9e6bbc4d4558d53fd","8e4eba1f01a94b77563ede99bcfdf464","c14517ff49f31e419f0b1a4463ba5ff083ae5a4b","e04dbe0de745fc8026710034af6a00fc8dc38569440ce8ebebe74cd4dc0a6dc5")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("58bd748483b75a3a6470075e2e57d679","726f7bfb18899b67629dc0a7981e6a21fb5ddf38","4d38d7c7161ccb08998f90079a565f32a296f1bf404001b9e6bbc4d4558d53fd","8e4eba1f01a94b77563ede99bcfdf464","c14517ff49f31e419f0b1a4463ba5ff083ae5a4b","e04dbe0de745fc8026710034af6a00fc8dc38569440ce8ebebe74cd4dc0a6dc5")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("58bd748483b75a3a6470075e2e57d679","726f7bfb18899b67629dc0a7981e6a21fb5ddf38","4d38d7c7161ccb08998f90079a565f32a296f1bf404001b9e6bbc4d4558d53fd","8e4eba1f01a94b77563ede99bcfdf464","c14517ff49f31e419f0b1a4463ba5ff083ae5a4b","e04dbe0de745fc8026710034af6a00fc8dc38569440ce8ebebe74cd4dc0a6dc5")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("58bd748483b75a3a6470075e2e57d679","726f7bfb18899b67629dc0a7981e6a21fb5ddf38","4d38d7c7161ccb08998f90079a565f32a296f1bf404001b9e6bbc4d4558d53fd","8e4eba1f01a94b77563ede99bcfdf464","c14517ff49f31e419f0b1a4463ba5ff083ae5a4b","e04dbe0de745fc8026710034af6a00fc8dc38569440ce8ebebe74cd4dc0a6dc5")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("58bd748483b75a3a6470075e2e57d679","726f7bfb18899b67629dc0a7981e6a21fb5ddf38","4d38d7c7161ccb08998f90079a565f32a296f1bf404001b9e6bbc4d4558d53fd","8e4eba1f01a94b77563ede99bcfdf464","c14517ff49f31e419f0b1a4463ba5ff083ae5a4b","e04dbe0de745fc8026710034af6a00fc8dc38569440ce8ebebe74cd4dc0a6dc5")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("58bd748483b75a3a6470075e2e57d679","726f7bfb18899b67629dc0a7981e6a21fb5ddf38","4d38d7c7161ccb08998f90079a565f32a296f1bf404001b9e6bbc4d4558d53fd","8e4eba1f01a94b77563ede99bcfdf464","c14517ff49f31e419f0b1a4463ba5ff083ae5a4b","e04dbe0de745fc8026710034af6a00fc8dc38569440ce8ebebe74cd4dc0a6dc5")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("58bd748483b75a3a6470075e2e57d679","726f7bfb18899b67629dc0a7981e6a21fb5ddf38","4d38d7c7161ccb08998f90079a565f32a296f1bf404001b9e6bbc4d4558d53fd","8e4eba1f01a94b77563ede99bcfdf464","c14517ff49f31e419f0b1a4463ba5ff083ae5a4b","e04dbe0de745fc8026710034af6a00fc8dc38569440ce8ebebe74cd4dc0a6dc5")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("58bd748483b75a3a6470075e2e57d679","726f7bfb18899b67629dc0a7981e6a21fb5ddf38","4d38d7c7161ccb08998f90079a565f32a296f1bf404001b9e6bbc4d4558d53fd","8e4eba1f01a94b77563ede99bcfdf464","c14517ff49f31e419f0b1a4463ba5ff083ae5a4b","e04dbe0de745fc8026710034af6a00fc8dc38569440ce8ebebe74cd4dc0a6dc5")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("58bd748483b75a3a6470075e2e57d679","726f7bfb18899b67629dc0a7981e6a21fb5ddf38","4d38d7c7161ccb08998f90079a565f32a296f1bf404001b9e6bbc4d4558d53fd","8e4eba1f01a94b77563ede99bcfdf464","c14517ff49f31e419f0b1a4463ba5ff083ae5a4b","e04dbe0de745fc8026710034af6a00fc8dc38569440ce8ebebe74cd4dc0a6dc5")
index=activity AND rg_functionality="Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("58bd748483b75a3a6470075e2e57d679","726f7bfb18899b67629dc0a7981e6a21fb5ddf38","4d38d7c7161ccb08998f90079a565f32a296f1bf404001b9e6bbc4d4558d53fd","8e4eba1f01a94b77563ede99bcfdf464","c14517ff49f31e419f0b1a4463ba5ff083ae5a4b","e04dbe0de745fc8026710034af6a00fc8dc38569440ce8ebebe74cd4dc0a6dc5")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("58bd748483b75a3a6470075e2e57d679","726f7bfb18899b67629dc0a7981e6a21fb5ddf38","4d38d7c7161ccb08998f90079a565f32a296f1bf404001b9e6bbc4d4558d53fd","8e4eba1f01a94b77563ede99bcfdf464","c14517ff49f31e419f0b1a4463ba5ff083ae5a4b","e04dbe0de745fc8026710034af6a00fc8dc38569440ce8ebebe74cd4dc0a6dc5")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("58bd748483b75a3a6470075e2e57d679","726f7bfb18899b67629dc0a7981e6a21fb5ddf38","4d38d7c7161ccb08998f90079a565f32a296f1bf404001b9e6bbc4d4558d53fd","8e4eba1f01a94b77563ede99bcfdf464","c14517ff49f31e419f0b1a4463ba5ff083ae5a4b","e04dbe0de745fc8026710034af6a00fc8dc38569440ce8ebebe74cd4dc0a6dc5")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("58bd748483b75a3a6470075e2e57d679","726f7bfb18899b67629dc0a7981e6a21fb5ddf38","4d38d7c7161ccb08998f90079a565f32a296f1bf404001b9e6bbc4d4558d53fd","8e4eba1f01a94b77563ede99bcfdf464","c14517ff49f31e419f0b1a4463ba5ff083ae5a4b","e04dbe0de745fc8026710034af6a00fc8dc38569440ce8ebebe74cd4dc0a6dc5")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("58bd748483b75a3a6470075e2e57d679","726f7bfb18899b67629dc0a7981e6a21fb5ddf38","4d38d7c7161ccb08998f90079a565f32a296f1bf404001b9e6bbc4d4558d53fd","8e4eba1f01a94b77563ede99bcfdf464","c14517ff49f31e419f0b1a4463ba5ff083ae5a4b","e04dbe0de745fc8026710034af6a00fc8dc38569440ce8ebebe74cd4dc0a6dc5")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("58bd748483b75a3a6470075e2e57d679","726f7bfb18899b67629dc0a7981e6a21fb5ddf38","4d38d7c7161ccb08998f90079a565f32a296f1bf404001b9e6bbc4d4558d53fd","8e4eba1f01a94b77563ede99bcfdf464","c14517ff49f31e419f0b1a4463ba5ff083ae5a4b","e04dbe0de745fc8026710034af6a00fc8dc38569440ce8ebebe74cd4dc0a6dc5")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("58bd748483b75a3a6470075e2e57d679","726f7bfb18899b67629dc0a7981e6a21fb5ddf38","4d38d7c7161ccb08998f90079a565f32a296f1bf404001b9e6bbc4d4558d53fd","8e4eba1f01a94b77563ede99bcfdf464","c14517ff49f31e419f0b1a4463ba5ff083ae5a4b","e04dbe0de745fc8026710034af6a00fc8dc38569440ce8ebebe74cd4dc0a6dc5")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("58bd748483b75a3a6470075e2e57d679","726f7bfb18899b67629dc0a7981e6a21fb5ddf38","4d38d7c7161ccb08998f90079a565f32a296f1bf404001b9e6bbc4d4558d53fd","8e4eba1f01a94b77563ede99bcfdf464","c14517ff49f31e419f0b1a4463ba5ff083ae5a4b","e04dbe0de745fc8026710034af6a00fc8dc38569440ce8ebebe74cd4dc0a6dc5")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring64 NOT NULL AND customstring64 IN ("58bd748483b75a3a6470075e2e57d679","726f7bfb18899b67629dc0a7981e6a21fb5ddf38","4d38d7c7161ccb08998f90079a565f32a296f1bf404001b9e6bbc4d4558d53fd","8e4eba1f01a94b77563ede99bcfdf464","c14517ff49f31e419f0b1a4463ba5ff083ae5a4b","e04dbe0de745fc8026710034af6a00fc8dc38569440ce8ebebe74cd4dc0a6dc5")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("58bd748483b75a3a6470075e2e57d679","726f7bfb18899b67629dc0a7981e6a21fb5ddf38","4d38d7c7161ccb08998f90079a565f32a296f1bf404001b9e6bbc4d4558d53fd","8e4eba1f01a94b77563ede99bcfdf464","c14517ff49f31e419f0b1a4463ba5ff083ae5a4b","e04dbe0de745fc8026710034af6a00fc8dc38569440ce8ebebe74cd4dc0a6dc5")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("58bd748483b75a3a6470075e2e57d679","726f7bfb18899b67629dc0a7981e6a21fb5ddf38","4d38d7c7161ccb08998f90079a565f32a296f1bf404001b9e6bbc4d4558d53fd","8e4eba1f01a94b77563ede99bcfdf464","c14517ff49f31e419f0b1a4463ba5ff083ae5a4b","e04dbe0de745fc8026710034af6a00fc8dc38569440ce8ebebe74cd4dc0a6dc5")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("58bd748483b75a3a6470075e2e57d679","726f7bfb18899b67629dc0a7981e6a21fb5ddf38","4d38d7c7161ccb08998f90079a565f32a296f1bf404001b9e6bbc4d4558d53fd","8e4eba1f01a94b77563ede99bcfdf464","c14517ff49f31e419f0b1a4463ba5ff083ae5a4b","e04dbe0de745fc8026710034af6a00fc8dc38569440ce8ebebe74cd4dc0a6dc5")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring64 NOT NULL AND customstring64 IN ("58bd748483b75a3a6470075e2e57d679","726f7bfb18899b67629dc0a7981e6a21fb5ddf38","4d38d7c7161ccb08998f90079a565f32a296f1bf404001b9e6bbc4d4558d53fd","8e4eba1f01a94b77563ede99bcfdf464","c14517ff49f31e419f0b1a4463ba5ff083ae5a4b","e04dbe0de745fc8026710034af6a00fc8dc38569440ce8ebebe74cd4dc0a6dc5")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("58bd748483b75a3a6470075e2e57d679","726f7bfb18899b67629dc0a7981e6a21fb5ddf38","4d38d7c7161ccb08998f90079a565f32a296f1bf404001b9e6bbc4d4558d53fd","8e4eba1f01a94b77563ede99bcfdf464","c14517ff49f31e419f0b1a4463ba5ff083ae5a4b","e04dbe0de745fc8026710034af6a00fc8dc38569440ce8ebebe74cd4dc0a6dc5")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("58bd748483b75a3a6470075e2e57d679","726f7bfb18899b67629dc0a7981e6a21fb5ddf38","4d38d7c7161ccb08998f90079a565f32a296f1bf404001b9e6bbc4d4558d53fd","8e4eba1f01a94b77563ede99bcfdf464","c14517ff49f31e419f0b1a4463ba5ff083ae5a4b","e04dbe0de745fc8026710034af6a00fc8dc38569440ce8ebebe74cd4dc0a6dc5")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("58bd748483b75a3a6470075e2e57d679","726f7bfb18899b67629dc0a7981e6a21fb5ddf38","4d38d7c7161ccb08998f90079a565f32a296f1bf404001b9e6bbc4d4558d53fd","8e4eba1f01a94b77563ede99bcfdf464","c14517ff49f31e419f0b1a4463ba5ff083ae5a4b","e04dbe0de745fc8026710034af6a00fc8dc38569440ce8ebebe74cd4dc0a6dc5")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring64 NOT NULL AND customstring64 IN ("58bd748483b75a3a6470075e2e57d679","726f7bfb18899b67629dc0a7981e6a21fb5ddf38","4d38d7c7161ccb08998f90079a565f32a296f1bf404001b9e6bbc4d4558d53fd","8e4eba1f01a94b77563ede99bcfdf464","c14517ff49f31e419f0b1a4463ba5ff083ae5a4b","e04dbe0de745fc8026710034af6a00fc8dc38569440ce8ebebe74cd4dc0a6dc5")
