index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("426284b7dedb929129687303f1bf7e4def607f404c93f7736d17241e43f0ab33","50e2cb600471fc38c4245d596f92f5444e7e17cd21dd794ba7d547e0f2d9a9d5","a0a59d83fa8631d0b9de2f477350faa89499e96fd5ec07069e30992aaabe913a","ebe77c060f8155e01703cfc898685f548b6da12379e6aefb996dbcaac201587c","c10dc2f6694414b68c10139195d7db2bb655f3afdcc1ac6885ef41ef1f0078df")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("426284b7dedb929129687303f1bf7e4def607f404c93f7736d17241e43f0ab33","50e2cb600471fc38c4245d596f92f5444e7e17cd21dd794ba7d547e0f2d9a9d5","a0a59d83fa8631d0b9de2f477350faa89499e96fd5ec07069e30992aaabe913a","ebe77c060f8155e01703cfc898685f548b6da12379e6aefb996dbcaac201587c","c10dc2f6694414b68c10139195d7db2bb655f3afdcc1ac6885ef41ef1f0078df")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("426284b7dedb929129687303f1bf7e4def607f404c93f7736d17241e43f0ab33","50e2cb600471fc38c4245d596f92f5444e7e17cd21dd794ba7d547e0f2d9a9d5","a0a59d83fa8631d0b9de2f477350faa89499e96fd5ec07069e30992aaabe913a","ebe77c060f8155e01703cfc898685f548b6da12379e6aefb996dbcaac201587c","c10dc2f6694414b68c10139195d7db2bb655f3afdcc1ac6885ef41ef1f0078df")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring64 NOT NULL AND customstring64 IN ("426284b7dedb929129687303f1bf7e4def607f404c93f7736d17241e43f0ab33","50e2cb600471fc38c4245d596f92f5444e7e17cd21dd794ba7d547e0f2d9a9d5","a0a59d83fa8631d0b9de2f477350faa89499e96fd5ec07069e30992aaabe913a","ebe77c060f8155e01703cfc898685f548b6da12379e6aefb996dbcaac201587c","c10dc2f6694414b68c10139195d7db2bb655f3afdcc1ac6885ef41ef1f0078df")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("426284b7dedb929129687303f1bf7e4def607f404c93f7736d17241e43f0ab33","50e2cb600471fc38c4245d596f92f5444e7e17cd21dd794ba7d547e0f2d9a9d5","a0a59d83fa8631d0b9de2f477350faa89499e96fd5ec07069e30992aaabe913a","ebe77c060f8155e01703cfc898685f548b6da12379e6aefb996dbcaac201587c","c10dc2f6694414b68c10139195d7db2bb655f3afdcc1ac6885ef41ef1f0078df")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("426284b7dedb929129687303f1bf7e4def607f404c93f7736d17241e43f0ab33","50e2cb600471fc38c4245d596f92f5444e7e17cd21dd794ba7d547e0f2d9a9d5","a0a59d83fa8631d0b9de2f477350faa89499e96fd5ec07069e30992aaabe913a","ebe77c060f8155e01703cfc898685f548b6da12379e6aefb996dbcaac201587c","c10dc2f6694414b68c10139195d7db2bb655f3afdcc1ac6885ef41ef1f0078df")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("426284b7dedb929129687303f1bf7e4def607f404c93f7736d17241e43f0ab33","50e2cb600471fc38c4245d596f92f5444e7e17cd21dd794ba7d547e0f2d9a9d5","a0a59d83fa8631d0b9de2f477350faa89499e96fd5ec07069e30992aaabe913a","ebe77c060f8155e01703cfc898685f548b6da12379e6aefb996dbcaac201587c","c10dc2f6694414b68c10139195d7db2bb655f3afdcc1ac6885ef41ef1f0078df")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("426284b7dedb929129687303f1bf7e4def607f404c93f7736d17241e43f0ab33","50e2cb600471fc38c4245d596f92f5444e7e17cd21dd794ba7d547e0f2d9a9d5","a0a59d83fa8631d0b9de2f477350faa89499e96fd5ec07069e30992aaabe913a","ebe77c060f8155e01703cfc898685f548b6da12379e6aefb996dbcaac201587c","c10dc2f6694414b68c10139195d7db2bb655f3afdcc1ac6885ef41ef1f0078df")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("426284b7dedb929129687303f1bf7e4def607f404c93f7736d17241e43f0ab33","50e2cb600471fc38c4245d596f92f5444e7e17cd21dd794ba7d547e0f2d9a9d5","a0a59d83fa8631d0b9de2f477350faa89499e96fd5ec07069e30992aaabe913a","ebe77c060f8155e01703cfc898685f548b6da12379e6aefb996dbcaac201587c","c10dc2f6694414b68c10139195d7db2bb655f3afdcc1ac6885ef41ef1f0078df")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("426284b7dedb929129687303f1bf7e4def607f404c93f7736d17241e43f0ab33","50e2cb600471fc38c4245d596f92f5444e7e17cd21dd794ba7d547e0f2d9a9d5","a0a59d83fa8631d0b9de2f477350faa89499e96fd5ec07069e30992aaabe913a","ebe77c060f8155e01703cfc898685f548b6da12379e6aefb996dbcaac201587c","c10dc2f6694414b68c10139195d7db2bb655f3afdcc1ac6885ef41ef1f0078df")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("426284b7dedb929129687303f1bf7e4def607f404c93f7736d17241e43f0ab33","50e2cb600471fc38c4245d596f92f5444e7e17cd21dd794ba7d547e0f2d9a9d5","a0a59d83fa8631d0b9de2f477350faa89499e96fd5ec07069e30992aaabe913a","ebe77c060f8155e01703cfc898685f548b6da12379e6aefb996dbcaac201587c","c10dc2f6694414b68c10139195d7db2bb655f3afdcc1ac6885ef41ef1f0078df")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("426284b7dedb929129687303f1bf7e4def607f404c93f7736d17241e43f0ab33","50e2cb600471fc38c4245d596f92f5444e7e17cd21dd794ba7d547e0f2d9a9d5","a0a59d83fa8631d0b9de2f477350faa89499e96fd5ec07069e30992aaabe913a","ebe77c060f8155e01703cfc898685f548b6da12379e6aefb996dbcaac201587c","c10dc2f6694414b68c10139195d7db2bb655f3afdcc1ac6885ef41ef1f0078df")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("426284b7dedb929129687303f1bf7e4def607f404c93f7736d17241e43f0ab33","50e2cb600471fc38c4245d596f92f5444e7e17cd21dd794ba7d547e0f2d9a9d5","a0a59d83fa8631d0b9de2f477350faa89499e96fd5ec07069e30992aaabe913a","ebe77c060f8155e01703cfc898685f548b6da12379e6aefb996dbcaac201587c","c10dc2f6694414b68c10139195d7db2bb655f3afdcc1ac6885ef41ef1f0078df")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("426284b7dedb929129687303f1bf7e4def607f404c93f7736d17241e43f0ab33","50e2cb600471fc38c4245d596f92f5444e7e17cd21dd794ba7d547e0f2d9a9d5","a0a59d83fa8631d0b9de2f477350faa89499e96fd5ec07069e30992aaabe913a","ebe77c060f8155e01703cfc898685f548b6da12379e6aefb996dbcaac201587c","c10dc2f6694414b68c10139195d7db2bb655f3afdcc1ac6885ef41ef1f0078df")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("426284b7dedb929129687303f1bf7e4def607f404c93f7736d17241e43f0ab33","50e2cb600471fc38c4245d596f92f5444e7e17cd21dd794ba7d547e0f2d9a9d5","a0a59d83fa8631d0b9de2f477350faa89499e96fd5ec07069e30992aaabe913a","ebe77c060f8155e01703cfc898685f548b6da12379e6aefb996dbcaac201587c","c10dc2f6694414b68c10139195d7db2bb655f3afdcc1ac6885ef41ef1f0078df")
index=activity AND rg_functionality="Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("426284b7dedb929129687303f1bf7e4def607f404c93f7736d17241e43f0ab33","50e2cb600471fc38c4245d596f92f5444e7e17cd21dd794ba7d547e0f2d9a9d5","a0a59d83fa8631d0b9de2f477350faa89499e96fd5ec07069e30992aaabe913a","ebe77c060f8155e01703cfc898685f548b6da12379e6aefb996dbcaac201587c","c10dc2f6694414b68c10139195d7db2bb655f3afdcc1ac6885ef41ef1f0078df")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("426284b7dedb929129687303f1bf7e4def607f404c93f7736d17241e43f0ab33","50e2cb600471fc38c4245d596f92f5444e7e17cd21dd794ba7d547e0f2d9a9d5","a0a59d83fa8631d0b9de2f477350faa89499e96fd5ec07069e30992aaabe913a","ebe77c060f8155e01703cfc898685f548b6da12379e6aefb996dbcaac201587c","c10dc2f6694414b68c10139195d7db2bb655f3afdcc1ac6885ef41ef1f0078df")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("426284b7dedb929129687303f1bf7e4def607f404c93f7736d17241e43f0ab33","50e2cb600471fc38c4245d596f92f5444e7e17cd21dd794ba7d547e0f2d9a9d5","a0a59d83fa8631d0b9de2f477350faa89499e96fd5ec07069e30992aaabe913a","ebe77c060f8155e01703cfc898685f548b6da12379e6aefb996dbcaac201587c","c10dc2f6694414b68c10139195d7db2bb655f3afdcc1ac6885ef41ef1f0078df")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("426284b7dedb929129687303f1bf7e4def607f404c93f7736d17241e43f0ab33","50e2cb600471fc38c4245d596f92f5444e7e17cd21dd794ba7d547e0f2d9a9d5","a0a59d83fa8631d0b9de2f477350faa89499e96fd5ec07069e30992aaabe913a","ebe77c060f8155e01703cfc898685f548b6da12379e6aefb996dbcaac201587c","c10dc2f6694414b68c10139195d7db2bb655f3afdcc1ac6885ef41ef1f0078df")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("426284b7dedb929129687303f1bf7e4def607f404c93f7736d17241e43f0ab33","50e2cb600471fc38c4245d596f92f5444e7e17cd21dd794ba7d547e0f2d9a9d5","a0a59d83fa8631d0b9de2f477350faa89499e96fd5ec07069e30992aaabe913a","ebe77c060f8155e01703cfc898685f548b6da12379e6aefb996dbcaac201587c","c10dc2f6694414b68c10139195d7db2bb655f3afdcc1ac6885ef41ef1f0078df")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("426284b7dedb929129687303f1bf7e4def607f404c93f7736d17241e43f0ab33","50e2cb600471fc38c4245d596f92f5444e7e17cd21dd794ba7d547e0f2d9a9d5","a0a59d83fa8631d0b9de2f477350faa89499e96fd5ec07069e30992aaabe913a","ebe77c060f8155e01703cfc898685f548b6da12379e6aefb996dbcaac201587c","c10dc2f6694414b68c10139195d7db2bb655f3afdcc1ac6885ef41ef1f0078df")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("426284b7dedb929129687303f1bf7e4def607f404c93f7736d17241e43f0ab33","50e2cb600471fc38c4245d596f92f5444e7e17cd21dd794ba7d547e0f2d9a9d5","a0a59d83fa8631d0b9de2f477350faa89499e96fd5ec07069e30992aaabe913a","ebe77c060f8155e01703cfc898685f548b6da12379e6aefb996dbcaac201587c","c10dc2f6694414b68c10139195d7db2bb655f3afdcc1ac6885ef41ef1f0078df")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("426284b7dedb929129687303f1bf7e4def607f404c93f7736d17241e43f0ab33","50e2cb600471fc38c4245d596f92f5444e7e17cd21dd794ba7d547e0f2d9a9d5","a0a59d83fa8631d0b9de2f477350faa89499e96fd5ec07069e30992aaabe913a","ebe77c060f8155e01703cfc898685f548b6da12379e6aefb996dbcaac201587c","c10dc2f6694414b68c10139195d7db2bb655f3afdcc1ac6885ef41ef1f0078df")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring64 NOT NULL AND customstring64 IN ("426284b7dedb929129687303f1bf7e4def607f404c93f7736d17241e43f0ab33","50e2cb600471fc38c4245d596f92f5444e7e17cd21dd794ba7d547e0f2d9a9d5","a0a59d83fa8631d0b9de2f477350faa89499e96fd5ec07069e30992aaabe913a","ebe77c060f8155e01703cfc898685f548b6da12379e6aefb996dbcaac201587c","c10dc2f6694414b68c10139195d7db2bb655f3afdcc1ac6885ef41ef1f0078df")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("426284b7dedb929129687303f1bf7e4def607f404c93f7736d17241e43f0ab33","50e2cb600471fc38c4245d596f92f5444e7e17cd21dd794ba7d547e0f2d9a9d5","a0a59d83fa8631d0b9de2f477350faa89499e96fd5ec07069e30992aaabe913a","ebe77c060f8155e01703cfc898685f548b6da12379e6aefb996dbcaac201587c","c10dc2f6694414b68c10139195d7db2bb655f3afdcc1ac6885ef41ef1f0078df")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("426284b7dedb929129687303f1bf7e4def607f404c93f7736d17241e43f0ab33","50e2cb600471fc38c4245d596f92f5444e7e17cd21dd794ba7d547e0f2d9a9d5","a0a59d83fa8631d0b9de2f477350faa89499e96fd5ec07069e30992aaabe913a","ebe77c060f8155e01703cfc898685f548b6da12379e6aefb996dbcaac201587c","c10dc2f6694414b68c10139195d7db2bb655f3afdcc1ac6885ef41ef1f0078df")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("426284b7dedb929129687303f1bf7e4def607f404c93f7736d17241e43f0ab33","50e2cb600471fc38c4245d596f92f5444e7e17cd21dd794ba7d547e0f2d9a9d5","a0a59d83fa8631d0b9de2f477350faa89499e96fd5ec07069e30992aaabe913a","ebe77c060f8155e01703cfc898685f548b6da12379e6aefb996dbcaac201587c","c10dc2f6694414b68c10139195d7db2bb655f3afdcc1ac6885ef41ef1f0078df")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring64 NOT NULL AND customstring64 IN ("426284b7dedb929129687303f1bf7e4def607f404c93f7736d17241e43f0ab33","50e2cb600471fc38c4245d596f92f5444e7e17cd21dd794ba7d547e0f2d9a9d5","a0a59d83fa8631d0b9de2f477350faa89499e96fd5ec07069e30992aaabe913a","ebe77c060f8155e01703cfc898685f548b6da12379e6aefb996dbcaac201587c","c10dc2f6694414b68c10139195d7db2bb655f3afdcc1ac6885ef41ef1f0078df")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("426284b7dedb929129687303f1bf7e4def607f404c93f7736d17241e43f0ab33","50e2cb600471fc38c4245d596f92f5444e7e17cd21dd794ba7d547e0f2d9a9d5","a0a59d83fa8631d0b9de2f477350faa89499e96fd5ec07069e30992aaabe913a","ebe77c060f8155e01703cfc898685f548b6da12379e6aefb996dbcaac201587c","c10dc2f6694414b68c10139195d7db2bb655f3afdcc1ac6885ef41ef1f0078df")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("426284b7dedb929129687303f1bf7e4def607f404c93f7736d17241e43f0ab33","50e2cb600471fc38c4245d596f92f5444e7e17cd21dd794ba7d547e0f2d9a9d5","a0a59d83fa8631d0b9de2f477350faa89499e96fd5ec07069e30992aaabe913a","ebe77c060f8155e01703cfc898685f548b6da12379e6aefb996dbcaac201587c","c10dc2f6694414b68c10139195d7db2bb655f3afdcc1ac6885ef41ef1f0078df")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("426284b7dedb929129687303f1bf7e4def607f404c93f7736d17241e43f0ab33","50e2cb600471fc38c4245d596f92f5444e7e17cd21dd794ba7d547e0f2d9a9d5","a0a59d83fa8631d0b9de2f477350faa89499e96fd5ec07069e30992aaabe913a","ebe77c060f8155e01703cfc898685f548b6da12379e6aefb996dbcaac201587c","c10dc2f6694414b68c10139195d7db2bb655f3afdcc1ac6885ef41ef1f0078df")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring64 NOT NULL AND customstring64 IN ("426284b7dedb929129687303f1bf7e4def607f404c93f7736d17241e43f0ab33","50e2cb600471fc38c4245d596f92f5444e7e17cd21dd794ba7d547e0f2d9a9d5","a0a59d83fa8631d0b9de2f477350faa89499e96fd5ec07069e30992aaabe913a","ebe77c060f8155e01703cfc898685f548b6da12379e6aefb996dbcaac201587c","c10dc2f6694414b68c10139195d7db2bb655f3afdcc1ac6885ef41ef1f0078df")
