index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("48220a3a4c72317ae0fbb08e255b8350","4cba27111c5fca7a1ae78566de2df5b3","a7704fbccaeb78678a5f94714993567c","aa579d5f062f02d9ff76910560bb312c","f8c06e955718639ba9ffdd4265965593")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("48220a3a4c72317ae0fbb08e255b8350","4cba27111c5fca7a1ae78566de2df5b3","a7704fbccaeb78678a5f94714993567c","aa579d5f062f02d9ff76910560bb312c","f8c06e955718639ba9ffdd4265965593")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("48220a3a4c72317ae0fbb08e255b8350","4cba27111c5fca7a1ae78566de2df5b3","a7704fbccaeb78678a5f94714993567c","aa579d5f062f02d9ff76910560bb312c","f8c06e955718639ba9ffdd4265965593")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring64 NOT NULL AND customstring64 IN ("48220a3a4c72317ae0fbb08e255b8350","4cba27111c5fca7a1ae78566de2df5b3","a7704fbccaeb78678a5f94714993567c","aa579d5f062f02d9ff76910560bb312c","f8c06e955718639ba9ffdd4265965593")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("48220a3a4c72317ae0fbb08e255b8350","4cba27111c5fca7a1ae78566de2df5b3","a7704fbccaeb78678a5f94714993567c","aa579d5f062f02d9ff76910560bb312c","f8c06e955718639ba9ffdd4265965593")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("48220a3a4c72317ae0fbb08e255b8350","4cba27111c5fca7a1ae78566de2df5b3","a7704fbccaeb78678a5f94714993567c","aa579d5f062f02d9ff76910560bb312c","f8c06e955718639ba9ffdd4265965593")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("48220a3a4c72317ae0fbb08e255b8350","4cba27111c5fca7a1ae78566de2df5b3","a7704fbccaeb78678a5f94714993567c","aa579d5f062f02d9ff76910560bb312c","f8c06e955718639ba9ffdd4265965593")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("48220a3a4c72317ae0fbb08e255b8350","4cba27111c5fca7a1ae78566de2df5b3","a7704fbccaeb78678a5f94714993567c","aa579d5f062f02d9ff76910560bb312c","f8c06e955718639ba9ffdd4265965593")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("48220a3a4c72317ae0fbb08e255b8350","4cba27111c5fca7a1ae78566de2df5b3","a7704fbccaeb78678a5f94714993567c","aa579d5f062f02d9ff76910560bb312c","f8c06e955718639ba9ffdd4265965593")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("48220a3a4c72317ae0fbb08e255b8350","4cba27111c5fca7a1ae78566de2df5b3","a7704fbccaeb78678a5f94714993567c","aa579d5f062f02d9ff76910560bb312c","f8c06e955718639ba9ffdd4265965593")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("48220a3a4c72317ae0fbb08e255b8350","4cba27111c5fca7a1ae78566de2df5b3","a7704fbccaeb78678a5f94714993567c","aa579d5f062f02d9ff76910560bb312c","f8c06e955718639ba9ffdd4265965593")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("48220a3a4c72317ae0fbb08e255b8350","4cba27111c5fca7a1ae78566de2df5b3","a7704fbccaeb78678a5f94714993567c","aa579d5f062f02d9ff76910560bb312c","f8c06e955718639ba9ffdd4265965593")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("48220a3a4c72317ae0fbb08e255b8350","4cba27111c5fca7a1ae78566de2df5b3","a7704fbccaeb78678a5f94714993567c","aa579d5f062f02d9ff76910560bb312c","f8c06e955718639ba9ffdd4265965593")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("48220a3a4c72317ae0fbb08e255b8350","4cba27111c5fca7a1ae78566de2df5b3","a7704fbccaeb78678a5f94714993567c","aa579d5f062f02d9ff76910560bb312c","f8c06e955718639ba9ffdd4265965593")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("48220a3a4c72317ae0fbb08e255b8350","4cba27111c5fca7a1ae78566de2df5b3","a7704fbccaeb78678a5f94714993567c","aa579d5f062f02d9ff76910560bb312c","f8c06e955718639ba9ffdd4265965593")
index=activity AND rg_functionality="Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("48220a3a4c72317ae0fbb08e255b8350","4cba27111c5fca7a1ae78566de2df5b3","a7704fbccaeb78678a5f94714993567c","aa579d5f062f02d9ff76910560bb312c","f8c06e955718639ba9ffdd4265965593")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("48220a3a4c72317ae0fbb08e255b8350","4cba27111c5fca7a1ae78566de2df5b3","a7704fbccaeb78678a5f94714993567c","aa579d5f062f02d9ff76910560bb312c","f8c06e955718639ba9ffdd4265965593")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("48220a3a4c72317ae0fbb08e255b8350","4cba27111c5fca7a1ae78566de2df5b3","a7704fbccaeb78678a5f94714993567c","aa579d5f062f02d9ff76910560bb312c","f8c06e955718639ba9ffdd4265965593")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("48220a3a4c72317ae0fbb08e255b8350","4cba27111c5fca7a1ae78566de2df5b3","a7704fbccaeb78678a5f94714993567c","aa579d5f062f02d9ff76910560bb312c","f8c06e955718639ba9ffdd4265965593")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("48220a3a4c72317ae0fbb08e255b8350","4cba27111c5fca7a1ae78566de2df5b3","a7704fbccaeb78678a5f94714993567c","aa579d5f062f02d9ff76910560bb312c","f8c06e955718639ba9ffdd4265965593")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("48220a3a4c72317ae0fbb08e255b8350","4cba27111c5fca7a1ae78566de2df5b3","a7704fbccaeb78678a5f94714993567c","aa579d5f062f02d9ff76910560bb312c","f8c06e955718639ba9ffdd4265965593")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("48220a3a4c72317ae0fbb08e255b8350","4cba27111c5fca7a1ae78566de2df5b3","a7704fbccaeb78678a5f94714993567c","aa579d5f062f02d9ff76910560bb312c","f8c06e955718639ba9ffdd4265965593")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("48220a3a4c72317ae0fbb08e255b8350","4cba27111c5fca7a1ae78566de2df5b3","a7704fbccaeb78678a5f94714993567c","aa579d5f062f02d9ff76910560bb312c","f8c06e955718639ba9ffdd4265965593")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring64 NOT NULL AND customstring64 IN ("48220a3a4c72317ae0fbb08e255b8350","4cba27111c5fca7a1ae78566de2df5b3","a7704fbccaeb78678a5f94714993567c","aa579d5f062f02d9ff76910560bb312c","f8c06e955718639ba9ffdd4265965593")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("48220a3a4c72317ae0fbb08e255b8350","4cba27111c5fca7a1ae78566de2df5b3","a7704fbccaeb78678a5f94714993567c","aa579d5f062f02d9ff76910560bb312c","f8c06e955718639ba9ffdd4265965593")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("48220a3a4c72317ae0fbb08e255b8350","4cba27111c5fca7a1ae78566de2df5b3","a7704fbccaeb78678a5f94714993567c","aa579d5f062f02d9ff76910560bb312c","f8c06e955718639ba9ffdd4265965593")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("48220a3a4c72317ae0fbb08e255b8350","4cba27111c5fca7a1ae78566de2df5b3","a7704fbccaeb78678a5f94714993567c","aa579d5f062f02d9ff76910560bb312c","f8c06e955718639ba9ffdd4265965593")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring64 NOT NULL AND customstring64 IN ("48220a3a4c72317ae0fbb08e255b8350","4cba27111c5fca7a1ae78566de2df5b3","a7704fbccaeb78678a5f94714993567c","aa579d5f062f02d9ff76910560bb312c","f8c06e955718639ba9ffdd4265965593")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("48220a3a4c72317ae0fbb08e255b8350","4cba27111c5fca7a1ae78566de2df5b3","a7704fbccaeb78678a5f94714993567c","aa579d5f062f02d9ff76910560bb312c","f8c06e955718639ba9ffdd4265965593")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("48220a3a4c72317ae0fbb08e255b8350","4cba27111c5fca7a1ae78566de2df5b3","a7704fbccaeb78678a5f94714993567c","aa579d5f062f02d9ff76910560bb312c","f8c06e955718639ba9ffdd4265965593")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("48220a3a4c72317ae0fbb08e255b8350","4cba27111c5fca7a1ae78566de2df5b3","a7704fbccaeb78678a5f94714993567c","aa579d5f062f02d9ff76910560bb312c","f8c06e955718639ba9ffdd4265965593")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring64 NOT NULL AND customstring64 IN ("48220a3a4c72317ae0fbb08e255b8350","4cba27111c5fca7a1ae78566de2df5b3","a7704fbccaeb78678a5f94714993567c","aa579d5f062f02d9ff76910560bb312c","f8c06e955718639ba9ffdd4265965593")
