index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("8a5c7fff7a7a52dca5b48afc77810142b003b9dae1c0d6b522984319d44d135a","dfd6fa5eea999907c49f6be122fd9a078412eeb84f1696418903f2b369bec4e0","5ed4ffbd9a1a1acd44f4859c39a49639babe515434ca34bec603598b50211bab","62051ec55c990d2ff21f36a90115986e4ac0eada18306f39687e209f49f2c6ec","911153af684ef3460bdf568d18a4356b84efdb638e3e581609eb5cd5223f0010","85ea71c910ebb00ba8cae266bf18400a15b08bd341e37e12083ab9a79ff6c943","c96b098cab47c0a33d0b6d8f14b24e7c9ba897b0c59a2ac1f3dc608ca7a2ed7e")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("8a5c7fff7a7a52dca5b48afc77810142b003b9dae1c0d6b522984319d44d135a","dfd6fa5eea999907c49f6be122fd9a078412eeb84f1696418903f2b369bec4e0","5ed4ffbd9a1a1acd44f4859c39a49639babe515434ca34bec603598b50211bab","62051ec55c990d2ff21f36a90115986e4ac0eada18306f39687e209f49f2c6ec","911153af684ef3460bdf568d18a4356b84efdb638e3e581609eb5cd5223f0010","85ea71c910ebb00ba8cae266bf18400a15b08bd341e37e12083ab9a79ff6c943","c96b098cab47c0a33d0b6d8f14b24e7c9ba897b0c59a2ac1f3dc608ca7a2ed7e")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("8a5c7fff7a7a52dca5b48afc77810142b003b9dae1c0d6b522984319d44d135a","dfd6fa5eea999907c49f6be122fd9a078412eeb84f1696418903f2b369bec4e0","5ed4ffbd9a1a1acd44f4859c39a49639babe515434ca34bec603598b50211bab","62051ec55c990d2ff21f36a90115986e4ac0eada18306f39687e209f49f2c6ec","911153af684ef3460bdf568d18a4356b84efdb638e3e581609eb5cd5223f0010","85ea71c910ebb00ba8cae266bf18400a15b08bd341e37e12083ab9a79ff6c943","c96b098cab47c0a33d0b6d8f14b24e7c9ba897b0c59a2ac1f3dc608ca7a2ed7e")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("8a5c7fff7a7a52dca5b48afc77810142b003b9dae1c0d6b522984319d44d135a","dfd6fa5eea999907c49f6be122fd9a078412eeb84f1696418903f2b369bec4e0","5ed4ffbd9a1a1acd44f4859c39a49639babe515434ca34bec603598b50211bab","62051ec55c990d2ff21f36a90115986e4ac0eada18306f39687e209f49f2c6ec","911153af684ef3460bdf568d18a4356b84efdb638e3e581609eb5cd5223f0010","85ea71c910ebb00ba8cae266bf18400a15b08bd341e37e12083ab9a79ff6c943","c96b098cab47c0a33d0b6d8f14b24e7c9ba897b0c59a2ac1f3dc608ca7a2ed7e")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("8a5c7fff7a7a52dca5b48afc77810142b003b9dae1c0d6b522984319d44d135a","dfd6fa5eea999907c49f6be122fd9a078412eeb84f1696418903f2b369bec4e0","5ed4ffbd9a1a1acd44f4859c39a49639babe515434ca34bec603598b50211bab","62051ec55c990d2ff21f36a90115986e4ac0eada18306f39687e209f49f2c6ec","911153af684ef3460bdf568d18a4356b84efdb638e3e581609eb5cd5223f0010","85ea71c910ebb00ba8cae266bf18400a15b08bd341e37e12083ab9a79ff6c943","c96b098cab47c0a33d0b6d8f14b24e7c9ba897b0c59a2ac1f3dc608ca7a2ed7e")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("8a5c7fff7a7a52dca5b48afc77810142b003b9dae1c0d6b522984319d44d135a","dfd6fa5eea999907c49f6be122fd9a078412eeb84f1696418903f2b369bec4e0","5ed4ffbd9a1a1acd44f4859c39a49639babe515434ca34bec603598b50211bab","62051ec55c990d2ff21f36a90115986e4ac0eada18306f39687e209f49f2c6ec","911153af684ef3460bdf568d18a4356b84efdb638e3e581609eb5cd5223f0010","85ea71c910ebb00ba8cae266bf18400a15b08bd341e37e12083ab9a79ff6c943","c96b098cab47c0a33d0b6d8f14b24e7c9ba897b0c59a2ac1f3dc608ca7a2ed7e")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("8a5c7fff7a7a52dca5b48afc77810142b003b9dae1c0d6b522984319d44d135a","dfd6fa5eea999907c49f6be122fd9a078412eeb84f1696418903f2b369bec4e0","5ed4ffbd9a1a1acd44f4859c39a49639babe515434ca34bec603598b50211bab","62051ec55c990d2ff21f36a90115986e4ac0eada18306f39687e209f49f2c6ec","911153af684ef3460bdf568d18a4356b84efdb638e3e581609eb5cd5223f0010","85ea71c910ebb00ba8cae266bf18400a15b08bd341e37e12083ab9a79ff6c943","c96b098cab47c0a33d0b6d8f14b24e7c9ba897b0c59a2ac1f3dc608ca7a2ed7e")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("8a5c7fff7a7a52dca5b48afc77810142b003b9dae1c0d6b522984319d44d135a","dfd6fa5eea999907c49f6be122fd9a078412eeb84f1696418903f2b369bec4e0","5ed4ffbd9a1a1acd44f4859c39a49639babe515434ca34bec603598b50211bab","62051ec55c990d2ff21f36a90115986e4ac0eada18306f39687e209f49f2c6ec","911153af684ef3460bdf568d18a4356b84efdb638e3e581609eb5cd5223f0010","85ea71c910ebb00ba8cae266bf18400a15b08bd341e37e12083ab9a79ff6c943","c96b098cab47c0a33d0b6d8f14b24e7c9ba897b0c59a2ac1f3dc608ca7a2ed7e")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("8a5c7fff7a7a52dca5b48afc77810142b003b9dae1c0d6b522984319d44d135a","dfd6fa5eea999907c49f6be122fd9a078412eeb84f1696418903f2b369bec4e0","5ed4ffbd9a1a1acd44f4859c39a49639babe515434ca34bec603598b50211bab","62051ec55c990d2ff21f36a90115986e4ac0eada18306f39687e209f49f2c6ec","911153af684ef3460bdf568d18a4356b84efdb638e3e581609eb5cd5223f0010","85ea71c910ebb00ba8cae266bf18400a15b08bd341e37e12083ab9a79ff6c943","c96b098cab47c0a33d0b6d8f14b24e7c9ba897b0c59a2ac1f3dc608ca7a2ed7e")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("8a5c7fff7a7a52dca5b48afc77810142b003b9dae1c0d6b522984319d44d135a","dfd6fa5eea999907c49f6be122fd9a078412eeb84f1696418903f2b369bec4e0","5ed4ffbd9a1a1acd44f4859c39a49639babe515434ca34bec603598b50211bab","62051ec55c990d2ff21f36a90115986e4ac0eada18306f39687e209f49f2c6ec","911153af684ef3460bdf568d18a4356b84efdb638e3e581609eb5cd5223f0010","85ea71c910ebb00ba8cae266bf18400a15b08bd341e37e12083ab9a79ff6c943","c96b098cab47c0a33d0b6d8f14b24e7c9ba897b0c59a2ac1f3dc608ca7a2ed7e")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("8a5c7fff7a7a52dca5b48afc77810142b003b9dae1c0d6b522984319d44d135a","dfd6fa5eea999907c49f6be122fd9a078412eeb84f1696418903f2b369bec4e0","5ed4ffbd9a1a1acd44f4859c39a49639babe515434ca34bec603598b50211bab","62051ec55c990d2ff21f36a90115986e4ac0eada18306f39687e209f49f2c6ec","911153af684ef3460bdf568d18a4356b84efdb638e3e581609eb5cd5223f0010","85ea71c910ebb00ba8cae266bf18400a15b08bd341e37e12083ab9a79ff6c943","c96b098cab47c0a33d0b6d8f14b24e7c9ba897b0c59a2ac1f3dc608ca7a2ed7e")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("8a5c7fff7a7a52dca5b48afc77810142b003b9dae1c0d6b522984319d44d135a","dfd6fa5eea999907c49f6be122fd9a078412eeb84f1696418903f2b369bec4e0","5ed4ffbd9a1a1acd44f4859c39a49639babe515434ca34bec603598b50211bab","62051ec55c990d2ff21f36a90115986e4ac0eada18306f39687e209f49f2c6ec","911153af684ef3460bdf568d18a4356b84efdb638e3e581609eb5cd5223f0010","85ea71c910ebb00ba8cae266bf18400a15b08bd341e37e12083ab9a79ff6c943","c96b098cab47c0a33d0b6d8f14b24e7c9ba897b0c59a2ac1f3dc608ca7a2ed7e")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("8a5c7fff7a7a52dca5b48afc77810142b003b9dae1c0d6b522984319d44d135a","dfd6fa5eea999907c49f6be122fd9a078412eeb84f1696418903f2b369bec4e0","5ed4ffbd9a1a1acd44f4859c39a49639babe515434ca34bec603598b50211bab","62051ec55c990d2ff21f36a90115986e4ac0eada18306f39687e209f49f2c6ec","911153af684ef3460bdf568d18a4356b84efdb638e3e581609eb5cd5223f0010","85ea71c910ebb00ba8cae266bf18400a15b08bd341e37e12083ab9a79ff6c943","c96b098cab47c0a33d0b6d8f14b24e7c9ba897b0c59a2ac1f3dc608ca7a2ed7e")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("8a5c7fff7a7a52dca5b48afc77810142b003b9dae1c0d6b522984319d44d135a","dfd6fa5eea999907c49f6be122fd9a078412eeb84f1696418903f2b369bec4e0","5ed4ffbd9a1a1acd44f4859c39a49639babe515434ca34bec603598b50211bab","62051ec55c990d2ff21f36a90115986e4ac0eada18306f39687e209f49f2c6ec","911153af684ef3460bdf568d18a4356b84efdb638e3e581609eb5cd5223f0010","85ea71c910ebb00ba8cae266bf18400a15b08bd341e37e12083ab9a79ff6c943","c96b098cab47c0a33d0b6d8f14b24e7c9ba897b0c59a2ac1f3dc608ca7a2ed7e")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("8a5c7fff7a7a52dca5b48afc77810142b003b9dae1c0d6b522984319d44d135a","dfd6fa5eea999907c49f6be122fd9a078412eeb84f1696418903f2b369bec4e0","5ed4ffbd9a1a1acd44f4859c39a49639babe515434ca34bec603598b50211bab","62051ec55c990d2ff21f36a90115986e4ac0eada18306f39687e209f49f2c6ec","911153af684ef3460bdf568d18a4356b84efdb638e3e581609eb5cd5223f0010","85ea71c910ebb00ba8cae266bf18400a15b08bd341e37e12083ab9a79ff6c943","c96b098cab47c0a33d0b6d8f14b24e7c9ba897b0c59a2ac1f3dc608ca7a2ed7e")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("8a5c7fff7a7a52dca5b48afc77810142b003b9dae1c0d6b522984319d44d135a","dfd6fa5eea999907c49f6be122fd9a078412eeb84f1696418903f2b369bec4e0","5ed4ffbd9a1a1acd44f4859c39a49639babe515434ca34bec603598b50211bab","62051ec55c990d2ff21f36a90115986e4ac0eada18306f39687e209f49f2c6ec","911153af684ef3460bdf568d18a4356b84efdb638e3e581609eb5cd5223f0010","85ea71c910ebb00ba8cae266bf18400a15b08bd341e37e12083ab9a79ff6c943","c96b098cab47c0a33d0b6d8f14b24e7c9ba897b0c59a2ac1f3dc608ca7a2ed7e")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("8a5c7fff7a7a52dca5b48afc77810142b003b9dae1c0d6b522984319d44d135a","dfd6fa5eea999907c49f6be122fd9a078412eeb84f1696418903f2b369bec4e0","5ed4ffbd9a1a1acd44f4859c39a49639babe515434ca34bec603598b50211bab","62051ec55c990d2ff21f36a90115986e4ac0eada18306f39687e209f49f2c6ec","911153af684ef3460bdf568d18a4356b84efdb638e3e581609eb5cd5223f0010","85ea71c910ebb00ba8cae266bf18400a15b08bd341e37e12083ab9a79ff6c943","c96b098cab47c0a33d0b6d8f14b24e7c9ba897b0c59a2ac1f3dc608ca7a2ed7e")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("8a5c7fff7a7a52dca5b48afc77810142b003b9dae1c0d6b522984319d44d135a","dfd6fa5eea999907c49f6be122fd9a078412eeb84f1696418903f2b369bec4e0","5ed4ffbd9a1a1acd44f4859c39a49639babe515434ca34bec603598b50211bab","62051ec55c990d2ff21f36a90115986e4ac0eada18306f39687e209f49f2c6ec","911153af684ef3460bdf568d18a4356b84efdb638e3e581609eb5cd5223f0010","85ea71c910ebb00ba8cae266bf18400a15b08bd341e37e12083ab9a79ff6c943","c96b098cab47c0a33d0b6d8f14b24e7c9ba897b0c59a2ac1f3dc608ca7a2ed7e")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("8a5c7fff7a7a52dca5b48afc77810142b003b9dae1c0d6b522984319d44d135a","dfd6fa5eea999907c49f6be122fd9a078412eeb84f1696418903f2b369bec4e0","5ed4ffbd9a1a1acd44f4859c39a49639babe515434ca34bec603598b50211bab","62051ec55c990d2ff21f36a90115986e4ac0eada18306f39687e209f49f2c6ec","911153af684ef3460bdf568d18a4356b84efdb638e3e581609eb5cd5223f0010","85ea71c910ebb00ba8cae266bf18400a15b08bd341e37e12083ab9a79ff6c943","c96b098cab47c0a33d0b6d8f14b24e7c9ba897b0c59a2ac1f3dc608ca7a2ed7e")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("8a5c7fff7a7a52dca5b48afc77810142b003b9dae1c0d6b522984319d44d135a","dfd6fa5eea999907c49f6be122fd9a078412eeb84f1696418903f2b369bec4e0","5ed4ffbd9a1a1acd44f4859c39a49639babe515434ca34bec603598b50211bab","62051ec55c990d2ff21f36a90115986e4ac0eada18306f39687e209f49f2c6ec","911153af684ef3460bdf568d18a4356b84efdb638e3e581609eb5cd5223f0010","85ea71c910ebb00ba8cae266bf18400a15b08bd341e37e12083ab9a79ff6c943","c96b098cab47c0a33d0b6d8f14b24e7c9ba897b0c59a2ac1f3dc608ca7a2ed7e")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("8a5c7fff7a7a52dca5b48afc77810142b003b9dae1c0d6b522984319d44d135a","dfd6fa5eea999907c49f6be122fd9a078412eeb84f1696418903f2b369bec4e0","5ed4ffbd9a1a1acd44f4859c39a49639babe515434ca34bec603598b50211bab","62051ec55c990d2ff21f36a90115986e4ac0eada18306f39687e209f49f2c6ec","911153af684ef3460bdf568d18a4356b84efdb638e3e581609eb5cd5223f0010","85ea71c910ebb00ba8cae266bf18400a15b08bd341e37e12083ab9a79ff6c943","c96b098cab47c0a33d0b6d8f14b24e7c9ba897b0c59a2ac1f3dc608ca7a2ed7e")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("8a5c7fff7a7a52dca5b48afc77810142b003b9dae1c0d6b522984319d44d135a","dfd6fa5eea999907c49f6be122fd9a078412eeb84f1696418903f2b369bec4e0","5ed4ffbd9a1a1acd44f4859c39a49639babe515434ca34bec603598b50211bab","62051ec55c990d2ff21f36a90115986e4ac0eada18306f39687e209f49f2c6ec","911153af684ef3460bdf568d18a4356b84efdb638e3e581609eb5cd5223f0010","85ea71c910ebb00ba8cae266bf18400a15b08bd341e37e12083ab9a79ff6c943","c96b098cab47c0a33d0b6d8f14b24e7c9ba897b0c59a2ac1f3dc608ca7a2ed7e")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("8a5c7fff7a7a52dca5b48afc77810142b003b9dae1c0d6b522984319d44d135a","dfd6fa5eea999907c49f6be122fd9a078412eeb84f1696418903f2b369bec4e0","5ed4ffbd9a1a1acd44f4859c39a49639babe515434ca34bec603598b50211bab","62051ec55c990d2ff21f36a90115986e4ac0eada18306f39687e209f49f2c6ec","911153af684ef3460bdf568d18a4356b84efdb638e3e581609eb5cd5223f0010","85ea71c910ebb00ba8cae266bf18400a15b08bd341e37e12083ab9a79ff6c943","c96b098cab47c0a33d0b6d8f14b24e7c9ba897b0c59a2ac1f3dc608ca7a2ed7e")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("8a5c7fff7a7a52dca5b48afc77810142b003b9dae1c0d6b522984319d44d135a","dfd6fa5eea999907c49f6be122fd9a078412eeb84f1696418903f2b369bec4e0","5ed4ffbd9a1a1acd44f4859c39a49639babe515434ca34bec603598b50211bab","62051ec55c990d2ff21f36a90115986e4ac0eada18306f39687e209f49f2c6ec","911153af684ef3460bdf568d18a4356b84efdb638e3e581609eb5cd5223f0010","85ea71c910ebb00ba8cae266bf18400a15b08bd341e37e12083ab9a79ff6c943","c96b098cab47c0a33d0b6d8f14b24e7c9ba897b0c59a2ac1f3dc608ca7a2ed7e")
