index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("a32b7e40fc353fd2f13307d8bfe1c7c634c8c897b80e72a9872baa9a1da08c46","3339ba53e1f05f91dbe907d187489dbaba6c801f7af6fd06521f3ba8c484ec6c","7095beafff5837070a89407c1bf3c6acf8221ed786e0697f6c578d4c3de0efd6","855f411bd0667b650c4f2fd3c9fbb4fa9209cf40b0d655fa9304dcdd956e0808")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("a32b7e40fc353fd2f13307d8bfe1c7c634c8c897b80e72a9872baa9a1da08c46","3339ba53e1f05f91dbe907d187489dbaba6c801f7af6fd06521f3ba8c484ec6c","7095beafff5837070a89407c1bf3c6acf8221ed786e0697f6c578d4c3de0efd6","855f411bd0667b650c4f2fd3c9fbb4fa9209cf40b0d655fa9304dcdd956e0808")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("a32b7e40fc353fd2f13307d8bfe1c7c634c8c897b80e72a9872baa9a1da08c46","3339ba53e1f05f91dbe907d187489dbaba6c801f7af6fd06521f3ba8c484ec6c","7095beafff5837070a89407c1bf3c6acf8221ed786e0697f6c578d4c3de0efd6","855f411bd0667b650c4f2fd3c9fbb4fa9209cf40b0d655fa9304dcdd956e0808")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring64 NOT NULL AND customstring64 IN ("a32b7e40fc353fd2f13307d8bfe1c7c634c8c897b80e72a9872baa9a1da08c46","3339ba53e1f05f91dbe907d187489dbaba6c801f7af6fd06521f3ba8c484ec6c","7095beafff5837070a89407c1bf3c6acf8221ed786e0697f6c578d4c3de0efd6","855f411bd0667b650c4f2fd3c9fbb4fa9209cf40b0d655fa9304dcdd956e0808")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("a32b7e40fc353fd2f13307d8bfe1c7c634c8c897b80e72a9872baa9a1da08c46","3339ba53e1f05f91dbe907d187489dbaba6c801f7af6fd06521f3ba8c484ec6c","7095beafff5837070a89407c1bf3c6acf8221ed786e0697f6c578d4c3de0efd6","855f411bd0667b650c4f2fd3c9fbb4fa9209cf40b0d655fa9304dcdd956e0808")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("a32b7e40fc353fd2f13307d8bfe1c7c634c8c897b80e72a9872baa9a1da08c46","3339ba53e1f05f91dbe907d187489dbaba6c801f7af6fd06521f3ba8c484ec6c","7095beafff5837070a89407c1bf3c6acf8221ed786e0697f6c578d4c3de0efd6","855f411bd0667b650c4f2fd3c9fbb4fa9209cf40b0d655fa9304dcdd956e0808")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("a32b7e40fc353fd2f13307d8bfe1c7c634c8c897b80e72a9872baa9a1da08c46","3339ba53e1f05f91dbe907d187489dbaba6c801f7af6fd06521f3ba8c484ec6c","7095beafff5837070a89407c1bf3c6acf8221ed786e0697f6c578d4c3de0efd6","855f411bd0667b650c4f2fd3c9fbb4fa9209cf40b0d655fa9304dcdd956e0808")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("a32b7e40fc353fd2f13307d8bfe1c7c634c8c897b80e72a9872baa9a1da08c46","3339ba53e1f05f91dbe907d187489dbaba6c801f7af6fd06521f3ba8c484ec6c","7095beafff5837070a89407c1bf3c6acf8221ed786e0697f6c578d4c3de0efd6","855f411bd0667b650c4f2fd3c9fbb4fa9209cf40b0d655fa9304dcdd956e0808")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("a32b7e40fc353fd2f13307d8bfe1c7c634c8c897b80e72a9872baa9a1da08c46","3339ba53e1f05f91dbe907d187489dbaba6c801f7af6fd06521f3ba8c484ec6c","7095beafff5837070a89407c1bf3c6acf8221ed786e0697f6c578d4c3de0efd6","855f411bd0667b650c4f2fd3c9fbb4fa9209cf40b0d655fa9304dcdd956e0808")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("a32b7e40fc353fd2f13307d8bfe1c7c634c8c897b80e72a9872baa9a1da08c46","3339ba53e1f05f91dbe907d187489dbaba6c801f7af6fd06521f3ba8c484ec6c","7095beafff5837070a89407c1bf3c6acf8221ed786e0697f6c578d4c3de0efd6","855f411bd0667b650c4f2fd3c9fbb4fa9209cf40b0d655fa9304dcdd956e0808")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("a32b7e40fc353fd2f13307d8bfe1c7c634c8c897b80e72a9872baa9a1da08c46","3339ba53e1f05f91dbe907d187489dbaba6c801f7af6fd06521f3ba8c484ec6c","7095beafff5837070a89407c1bf3c6acf8221ed786e0697f6c578d4c3de0efd6","855f411bd0667b650c4f2fd3c9fbb4fa9209cf40b0d655fa9304dcdd956e0808")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("a32b7e40fc353fd2f13307d8bfe1c7c634c8c897b80e72a9872baa9a1da08c46","3339ba53e1f05f91dbe907d187489dbaba6c801f7af6fd06521f3ba8c484ec6c","7095beafff5837070a89407c1bf3c6acf8221ed786e0697f6c578d4c3de0efd6","855f411bd0667b650c4f2fd3c9fbb4fa9209cf40b0d655fa9304dcdd956e0808")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("a32b7e40fc353fd2f13307d8bfe1c7c634c8c897b80e72a9872baa9a1da08c46","3339ba53e1f05f91dbe907d187489dbaba6c801f7af6fd06521f3ba8c484ec6c","7095beafff5837070a89407c1bf3c6acf8221ed786e0697f6c578d4c3de0efd6","855f411bd0667b650c4f2fd3c9fbb4fa9209cf40b0d655fa9304dcdd956e0808")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("a32b7e40fc353fd2f13307d8bfe1c7c634c8c897b80e72a9872baa9a1da08c46","3339ba53e1f05f91dbe907d187489dbaba6c801f7af6fd06521f3ba8c484ec6c","7095beafff5837070a89407c1bf3c6acf8221ed786e0697f6c578d4c3de0efd6","855f411bd0667b650c4f2fd3c9fbb4fa9209cf40b0d655fa9304dcdd956e0808")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("a32b7e40fc353fd2f13307d8bfe1c7c634c8c897b80e72a9872baa9a1da08c46","3339ba53e1f05f91dbe907d187489dbaba6c801f7af6fd06521f3ba8c484ec6c","7095beafff5837070a89407c1bf3c6acf8221ed786e0697f6c578d4c3de0efd6","855f411bd0667b650c4f2fd3c9fbb4fa9209cf40b0d655fa9304dcdd956e0808")
index=activity AND rg_functionality="Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("a32b7e40fc353fd2f13307d8bfe1c7c634c8c897b80e72a9872baa9a1da08c46","3339ba53e1f05f91dbe907d187489dbaba6c801f7af6fd06521f3ba8c484ec6c","7095beafff5837070a89407c1bf3c6acf8221ed786e0697f6c578d4c3de0efd6","855f411bd0667b650c4f2fd3c9fbb4fa9209cf40b0d655fa9304dcdd956e0808")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("a32b7e40fc353fd2f13307d8bfe1c7c634c8c897b80e72a9872baa9a1da08c46","3339ba53e1f05f91dbe907d187489dbaba6c801f7af6fd06521f3ba8c484ec6c","7095beafff5837070a89407c1bf3c6acf8221ed786e0697f6c578d4c3de0efd6","855f411bd0667b650c4f2fd3c9fbb4fa9209cf40b0d655fa9304dcdd956e0808")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("a32b7e40fc353fd2f13307d8bfe1c7c634c8c897b80e72a9872baa9a1da08c46","3339ba53e1f05f91dbe907d187489dbaba6c801f7af6fd06521f3ba8c484ec6c","7095beafff5837070a89407c1bf3c6acf8221ed786e0697f6c578d4c3de0efd6","855f411bd0667b650c4f2fd3c9fbb4fa9209cf40b0d655fa9304dcdd956e0808")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("a32b7e40fc353fd2f13307d8bfe1c7c634c8c897b80e72a9872baa9a1da08c46","3339ba53e1f05f91dbe907d187489dbaba6c801f7af6fd06521f3ba8c484ec6c","7095beafff5837070a89407c1bf3c6acf8221ed786e0697f6c578d4c3de0efd6","855f411bd0667b650c4f2fd3c9fbb4fa9209cf40b0d655fa9304dcdd956e0808")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("a32b7e40fc353fd2f13307d8bfe1c7c634c8c897b80e72a9872baa9a1da08c46","3339ba53e1f05f91dbe907d187489dbaba6c801f7af6fd06521f3ba8c484ec6c","7095beafff5837070a89407c1bf3c6acf8221ed786e0697f6c578d4c3de0efd6","855f411bd0667b650c4f2fd3c9fbb4fa9209cf40b0d655fa9304dcdd956e0808")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("a32b7e40fc353fd2f13307d8bfe1c7c634c8c897b80e72a9872baa9a1da08c46","3339ba53e1f05f91dbe907d187489dbaba6c801f7af6fd06521f3ba8c484ec6c","7095beafff5837070a89407c1bf3c6acf8221ed786e0697f6c578d4c3de0efd6","855f411bd0667b650c4f2fd3c9fbb4fa9209cf40b0d655fa9304dcdd956e0808")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("a32b7e40fc353fd2f13307d8bfe1c7c634c8c897b80e72a9872baa9a1da08c46","3339ba53e1f05f91dbe907d187489dbaba6c801f7af6fd06521f3ba8c484ec6c","7095beafff5837070a89407c1bf3c6acf8221ed786e0697f6c578d4c3de0efd6","855f411bd0667b650c4f2fd3c9fbb4fa9209cf40b0d655fa9304dcdd956e0808")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("a32b7e40fc353fd2f13307d8bfe1c7c634c8c897b80e72a9872baa9a1da08c46","3339ba53e1f05f91dbe907d187489dbaba6c801f7af6fd06521f3ba8c484ec6c","7095beafff5837070a89407c1bf3c6acf8221ed786e0697f6c578d4c3de0efd6","855f411bd0667b650c4f2fd3c9fbb4fa9209cf40b0d655fa9304dcdd956e0808")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring64 NOT NULL AND customstring64 IN ("a32b7e40fc353fd2f13307d8bfe1c7c634c8c897b80e72a9872baa9a1da08c46","3339ba53e1f05f91dbe907d187489dbaba6c801f7af6fd06521f3ba8c484ec6c","7095beafff5837070a89407c1bf3c6acf8221ed786e0697f6c578d4c3de0efd6","855f411bd0667b650c4f2fd3c9fbb4fa9209cf40b0d655fa9304dcdd956e0808")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("a32b7e40fc353fd2f13307d8bfe1c7c634c8c897b80e72a9872baa9a1da08c46","3339ba53e1f05f91dbe907d187489dbaba6c801f7af6fd06521f3ba8c484ec6c","7095beafff5837070a89407c1bf3c6acf8221ed786e0697f6c578d4c3de0efd6","855f411bd0667b650c4f2fd3c9fbb4fa9209cf40b0d655fa9304dcdd956e0808")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("a32b7e40fc353fd2f13307d8bfe1c7c634c8c897b80e72a9872baa9a1da08c46","3339ba53e1f05f91dbe907d187489dbaba6c801f7af6fd06521f3ba8c484ec6c","7095beafff5837070a89407c1bf3c6acf8221ed786e0697f6c578d4c3de0efd6","855f411bd0667b650c4f2fd3c9fbb4fa9209cf40b0d655fa9304dcdd956e0808")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("a32b7e40fc353fd2f13307d8bfe1c7c634c8c897b80e72a9872baa9a1da08c46","3339ba53e1f05f91dbe907d187489dbaba6c801f7af6fd06521f3ba8c484ec6c","7095beafff5837070a89407c1bf3c6acf8221ed786e0697f6c578d4c3de0efd6","855f411bd0667b650c4f2fd3c9fbb4fa9209cf40b0d655fa9304dcdd956e0808")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring64 NOT NULL AND customstring64 IN ("a32b7e40fc353fd2f13307d8bfe1c7c634c8c897b80e72a9872baa9a1da08c46","3339ba53e1f05f91dbe907d187489dbaba6c801f7af6fd06521f3ba8c484ec6c","7095beafff5837070a89407c1bf3c6acf8221ed786e0697f6c578d4c3de0efd6","855f411bd0667b650c4f2fd3c9fbb4fa9209cf40b0d655fa9304dcdd956e0808")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("a32b7e40fc353fd2f13307d8bfe1c7c634c8c897b80e72a9872baa9a1da08c46","3339ba53e1f05f91dbe907d187489dbaba6c801f7af6fd06521f3ba8c484ec6c","7095beafff5837070a89407c1bf3c6acf8221ed786e0697f6c578d4c3de0efd6","855f411bd0667b650c4f2fd3c9fbb4fa9209cf40b0d655fa9304dcdd956e0808")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("a32b7e40fc353fd2f13307d8bfe1c7c634c8c897b80e72a9872baa9a1da08c46","3339ba53e1f05f91dbe907d187489dbaba6c801f7af6fd06521f3ba8c484ec6c","7095beafff5837070a89407c1bf3c6acf8221ed786e0697f6c578d4c3de0efd6","855f411bd0667b650c4f2fd3c9fbb4fa9209cf40b0d655fa9304dcdd956e0808")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("a32b7e40fc353fd2f13307d8bfe1c7c634c8c897b80e72a9872baa9a1da08c46","3339ba53e1f05f91dbe907d187489dbaba6c801f7af6fd06521f3ba8c484ec6c","7095beafff5837070a89407c1bf3c6acf8221ed786e0697f6c578d4c3de0efd6","855f411bd0667b650c4f2fd3c9fbb4fa9209cf40b0d655fa9304dcdd956e0808")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring64 NOT NULL AND customstring64 IN ("a32b7e40fc353fd2f13307d8bfe1c7c634c8c897b80e72a9872baa9a1da08c46","3339ba53e1f05f91dbe907d187489dbaba6c801f7af6fd06521f3ba8c484ec6c","7095beafff5837070a89407c1bf3c6acf8221ed786e0697f6c578d4c3de0efd6","855f411bd0667b650c4f2fd3c9fbb4fa9209cf40b0d655fa9304dcdd956e0808")
