index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("cf3bdf0f8ea4c8ece5f5a76524ab4c81fea6c3a1715b5a86b3ad4d397fca76f3","b0a010e5a9b353a11fb664501de91fc47878d89bf97cb57bc03428c7a45981b9","17ea24ce8866da7ef4a842cba16961eafba89d526d3efe5d783bb7a30c5d1565","08565f345878369fdbbcf4a064d9f4762f4549f67d1e2aa3907a112a5e5322b6","5c061e188979d3b744a102d5d855e845a3b51453488530ea5dca6b098add2821","60167b6a14b7da2257cb6cbdc7f1ebcb4bdfa16c76cc9a7539c9b8d36478d127","71ba916a7f35fe661cb6affc183f1ce83ee068dbc9a123663f93acf7b5a4263e")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("cf3bdf0f8ea4c8ece5f5a76524ab4c81fea6c3a1715b5a86b3ad4d397fca76f3","b0a010e5a9b353a11fb664501de91fc47878d89bf97cb57bc03428c7a45981b9","17ea24ce8866da7ef4a842cba16961eafba89d526d3efe5d783bb7a30c5d1565","08565f345878369fdbbcf4a064d9f4762f4549f67d1e2aa3907a112a5e5322b6","5c061e188979d3b744a102d5d855e845a3b51453488530ea5dca6b098add2821","60167b6a14b7da2257cb6cbdc7f1ebcb4bdfa16c76cc9a7539c9b8d36478d127","71ba916a7f35fe661cb6affc183f1ce83ee068dbc9a123663f93acf7b5a4263e")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("cf3bdf0f8ea4c8ece5f5a76524ab4c81fea6c3a1715b5a86b3ad4d397fca76f3","b0a010e5a9b353a11fb664501de91fc47878d89bf97cb57bc03428c7a45981b9","17ea24ce8866da7ef4a842cba16961eafba89d526d3efe5d783bb7a30c5d1565","08565f345878369fdbbcf4a064d9f4762f4549f67d1e2aa3907a112a5e5322b6","5c061e188979d3b744a102d5d855e845a3b51453488530ea5dca6b098add2821","60167b6a14b7da2257cb6cbdc7f1ebcb4bdfa16c76cc9a7539c9b8d36478d127","71ba916a7f35fe661cb6affc183f1ce83ee068dbc9a123663f93acf7b5a4263e")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("cf3bdf0f8ea4c8ece5f5a76524ab4c81fea6c3a1715b5a86b3ad4d397fca76f3","b0a010e5a9b353a11fb664501de91fc47878d89bf97cb57bc03428c7a45981b9","17ea24ce8866da7ef4a842cba16961eafba89d526d3efe5d783bb7a30c5d1565","08565f345878369fdbbcf4a064d9f4762f4549f67d1e2aa3907a112a5e5322b6","5c061e188979d3b744a102d5d855e845a3b51453488530ea5dca6b098add2821","60167b6a14b7da2257cb6cbdc7f1ebcb4bdfa16c76cc9a7539c9b8d36478d127","71ba916a7f35fe661cb6affc183f1ce83ee068dbc9a123663f93acf7b5a4263e")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("cf3bdf0f8ea4c8ece5f5a76524ab4c81fea6c3a1715b5a86b3ad4d397fca76f3","b0a010e5a9b353a11fb664501de91fc47878d89bf97cb57bc03428c7a45981b9","17ea24ce8866da7ef4a842cba16961eafba89d526d3efe5d783bb7a30c5d1565","08565f345878369fdbbcf4a064d9f4762f4549f67d1e2aa3907a112a5e5322b6","5c061e188979d3b744a102d5d855e845a3b51453488530ea5dca6b098add2821","60167b6a14b7da2257cb6cbdc7f1ebcb4bdfa16c76cc9a7539c9b8d36478d127","71ba916a7f35fe661cb6affc183f1ce83ee068dbc9a123663f93acf7b5a4263e")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("cf3bdf0f8ea4c8ece5f5a76524ab4c81fea6c3a1715b5a86b3ad4d397fca76f3","b0a010e5a9b353a11fb664501de91fc47878d89bf97cb57bc03428c7a45981b9","17ea24ce8866da7ef4a842cba16961eafba89d526d3efe5d783bb7a30c5d1565","08565f345878369fdbbcf4a064d9f4762f4549f67d1e2aa3907a112a5e5322b6","5c061e188979d3b744a102d5d855e845a3b51453488530ea5dca6b098add2821","60167b6a14b7da2257cb6cbdc7f1ebcb4bdfa16c76cc9a7539c9b8d36478d127","71ba916a7f35fe661cb6affc183f1ce83ee068dbc9a123663f93acf7b5a4263e")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("cf3bdf0f8ea4c8ece5f5a76524ab4c81fea6c3a1715b5a86b3ad4d397fca76f3","b0a010e5a9b353a11fb664501de91fc47878d89bf97cb57bc03428c7a45981b9","17ea24ce8866da7ef4a842cba16961eafba89d526d3efe5d783bb7a30c5d1565","08565f345878369fdbbcf4a064d9f4762f4549f67d1e2aa3907a112a5e5322b6","5c061e188979d3b744a102d5d855e845a3b51453488530ea5dca6b098add2821","60167b6a14b7da2257cb6cbdc7f1ebcb4bdfa16c76cc9a7539c9b8d36478d127","71ba916a7f35fe661cb6affc183f1ce83ee068dbc9a123663f93acf7b5a4263e")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("cf3bdf0f8ea4c8ece5f5a76524ab4c81fea6c3a1715b5a86b3ad4d397fca76f3","b0a010e5a9b353a11fb664501de91fc47878d89bf97cb57bc03428c7a45981b9","17ea24ce8866da7ef4a842cba16961eafba89d526d3efe5d783bb7a30c5d1565","08565f345878369fdbbcf4a064d9f4762f4549f67d1e2aa3907a112a5e5322b6","5c061e188979d3b744a102d5d855e845a3b51453488530ea5dca6b098add2821","60167b6a14b7da2257cb6cbdc7f1ebcb4bdfa16c76cc9a7539c9b8d36478d127","71ba916a7f35fe661cb6affc183f1ce83ee068dbc9a123663f93acf7b5a4263e")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("cf3bdf0f8ea4c8ece5f5a76524ab4c81fea6c3a1715b5a86b3ad4d397fca76f3","b0a010e5a9b353a11fb664501de91fc47878d89bf97cb57bc03428c7a45981b9","17ea24ce8866da7ef4a842cba16961eafba89d526d3efe5d783bb7a30c5d1565","08565f345878369fdbbcf4a064d9f4762f4549f67d1e2aa3907a112a5e5322b6","5c061e188979d3b744a102d5d855e845a3b51453488530ea5dca6b098add2821","60167b6a14b7da2257cb6cbdc7f1ebcb4bdfa16c76cc9a7539c9b8d36478d127","71ba916a7f35fe661cb6affc183f1ce83ee068dbc9a123663f93acf7b5a4263e")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("cf3bdf0f8ea4c8ece5f5a76524ab4c81fea6c3a1715b5a86b3ad4d397fca76f3","b0a010e5a9b353a11fb664501de91fc47878d89bf97cb57bc03428c7a45981b9","17ea24ce8866da7ef4a842cba16961eafba89d526d3efe5d783bb7a30c5d1565","08565f345878369fdbbcf4a064d9f4762f4549f67d1e2aa3907a112a5e5322b6","5c061e188979d3b744a102d5d855e845a3b51453488530ea5dca6b098add2821","60167b6a14b7da2257cb6cbdc7f1ebcb4bdfa16c76cc9a7539c9b8d36478d127","71ba916a7f35fe661cb6affc183f1ce83ee068dbc9a123663f93acf7b5a4263e")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("cf3bdf0f8ea4c8ece5f5a76524ab4c81fea6c3a1715b5a86b3ad4d397fca76f3","b0a010e5a9b353a11fb664501de91fc47878d89bf97cb57bc03428c7a45981b9","17ea24ce8866da7ef4a842cba16961eafba89d526d3efe5d783bb7a30c5d1565","08565f345878369fdbbcf4a064d9f4762f4549f67d1e2aa3907a112a5e5322b6","5c061e188979d3b744a102d5d855e845a3b51453488530ea5dca6b098add2821","60167b6a14b7da2257cb6cbdc7f1ebcb4bdfa16c76cc9a7539c9b8d36478d127","71ba916a7f35fe661cb6affc183f1ce83ee068dbc9a123663f93acf7b5a4263e")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("cf3bdf0f8ea4c8ece5f5a76524ab4c81fea6c3a1715b5a86b3ad4d397fca76f3","b0a010e5a9b353a11fb664501de91fc47878d89bf97cb57bc03428c7a45981b9","17ea24ce8866da7ef4a842cba16961eafba89d526d3efe5d783bb7a30c5d1565","08565f345878369fdbbcf4a064d9f4762f4549f67d1e2aa3907a112a5e5322b6","5c061e188979d3b744a102d5d855e845a3b51453488530ea5dca6b098add2821","60167b6a14b7da2257cb6cbdc7f1ebcb4bdfa16c76cc9a7539c9b8d36478d127","71ba916a7f35fe661cb6affc183f1ce83ee068dbc9a123663f93acf7b5a4263e")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("cf3bdf0f8ea4c8ece5f5a76524ab4c81fea6c3a1715b5a86b3ad4d397fca76f3","b0a010e5a9b353a11fb664501de91fc47878d89bf97cb57bc03428c7a45981b9","17ea24ce8866da7ef4a842cba16961eafba89d526d3efe5d783bb7a30c5d1565","08565f345878369fdbbcf4a064d9f4762f4549f67d1e2aa3907a112a5e5322b6","5c061e188979d3b744a102d5d855e845a3b51453488530ea5dca6b098add2821","60167b6a14b7da2257cb6cbdc7f1ebcb4bdfa16c76cc9a7539c9b8d36478d127","71ba916a7f35fe661cb6affc183f1ce83ee068dbc9a123663f93acf7b5a4263e")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("cf3bdf0f8ea4c8ece5f5a76524ab4c81fea6c3a1715b5a86b3ad4d397fca76f3","b0a010e5a9b353a11fb664501de91fc47878d89bf97cb57bc03428c7a45981b9","17ea24ce8866da7ef4a842cba16961eafba89d526d3efe5d783bb7a30c5d1565","08565f345878369fdbbcf4a064d9f4762f4549f67d1e2aa3907a112a5e5322b6","5c061e188979d3b744a102d5d855e845a3b51453488530ea5dca6b098add2821","60167b6a14b7da2257cb6cbdc7f1ebcb4bdfa16c76cc9a7539c9b8d36478d127","71ba916a7f35fe661cb6affc183f1ce83ee068dbc9a123663f93acf7b5a4263e")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("cf3bdf0f8ea4c8ece5f5a76524ab4c81fea6c3a1715b5a86b3ad4d397fca76f3","b0a010e5a9b353a11fb664501de91fc47878d89bf97cb57bc03428c7a45981b9","17ea24ce8866da7ef4a842cba16961eafba89d526d3efe5d783bb7a30c5d1565","08565f345878369fdbbcf4a064d9f4762f4549f67d1e2aa3907a112a5e5322b6","5c061e188979d3b744a102d5d855e845a3b51453488530ea5dca6b098add2821","60167b6a14b7da2257cb6cbdc7f1ebcb4bdfa16c76cc9a7539c9b8d36478d127","71ba916a7f35fe661cb6affc183f1ce83ee068dbc9a123663f93acf7b5a4263e")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("cf3bdf0f8ea4c8ece5f5a76524ab4c81fea6c3a1715b5a86b3ad4d397fca76f3","b0a010e5a9b353a11fb664501de91fc47878d89bf97cb57bc03428c7a45981b9","17ea24ce8866da7ef4a842cba16961eafba89d526d3efe5d783bb7a30c5d1565","08565f345878369fdbbcf4a064d9f4762f4549f67d1e2aa3907a112a5e5322b6","5c061e188979d3b744a102d5d855e845a3b51453488530ea5dca6b098add2821","60167b6a14b7da2257cb6cbdc7f1ebcb4bdfa16c76cc9a7539c9b8d36478d127","71ba916a7f35fe661cb6affc183f1ce83ee068dbc9a123663f93acf7b5a4263e")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("cf3bdf0f8ea4c8ece5f5a76524ab4c81fea6c3a1715b5a86b3ad4d397fca76f3","b0a010e5a9b353a11fb664501de91fc47878d89bf97cb57bc03428c7a45981b9","17ea24ce8866da7ef4a842cba16961eafba89d526d3efe5d783bb7a30c5d1565","08565f345878369fdbbcf4a064d9f4762f4549f67d1e2aa3907a112a5e5322b6","5c061e188979d3b744a102d5d855e845a3b51453488530ea5dca6b098add2821","60167b6a14b7da2257cb6cbdc7f1ebcb4bdfa16c76cc9a7539c9b8d36478d127","71ba916a7f35fe661cb6affc183f1ce83ee068dbc9a123663f93acf7b5a4263e")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("cf3bdf0f8ea4c8ece5f5a76524ab4c81fea6c3a1715b5a86b3ad4d397fca76f3","b0a010e5a9b353a11fb664501de91fc47878d89bf97cb57bc03428c7a45981b9","17ea24ce8866da7ef4a842cba16961eafba89d526d3efe5d783bb7a30c5d1565","08565f345878369fdbbcf4a064d9f4762f4549f67d1e2aa3907a112a5e5322b6","5c061e188979d3b744a102d5d855e845a3b51453488530ea5dca6b098add2821","60167b6a14b7da2257cb6cbdc7f1ebcb4bdfa16c76cc9a7539c9b8d36478d127","71ba916a7f35fe661cb6affc183f1ce83ee068dbc9a123663f93acf7b5a4263e")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("cf3bdf0f8ea4c8ece5f5a76524ab4c81fea6c3a1715b5a86b3ad4d397fca76f3","b0a010e5a9b353a11fb664501de91fc47878d89bf97cb57bc03428c7a45981b9","17ea24ce8866da7ef4a842cba16961eafba89d526d3efe5d783bb7a30c5d1565","08565f345878369fdbbcf4a064d9f4762f4549f67d1e2aa3907a112a5e5322b6","5c061e188979d3b744a102d5d855e845a3b51453488530ea5dca6b098add2821","60167b6a14b7da2257cb6cbdc7f1ebcb4bdfa16c76cc9a7539c9b8d36478d127","71ba916a7f35fe661cb6affc183f1ce83ee068dbc9a123663f93acf7b5a4263e")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("cf3bdf0f8ea4c8ece5f5a76524ab4c81fea6c3a1715b5a86b3ad4d397fca76f3","b0a010e5a9b353a11fb664501de91fc47878d89bf97cb57bc03428c7a45981b9","17ea24ce8866da7ef4a842cba16961eafba89d526d3efe5d783bb7a30c5d1565","08565f345878369fdbbcf4a064d9f4762f4549f67d1e2aa3907a112a5e5322b6","5c061e188979d3b744a102d5d855e845a3b51453488530ea5dca6b098add2821","60167b6a14b7da2257cb6cbdc7f1ebcb4bdfa16c76cc9a7539c9b8d36478d127","71ba916a7f35fe661cb6affc183f1ce83ee068dbc9a123663f93acf7b5a4263e")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("cf3bdf0f8ea4c8ece5f5a76524ab4c81fea6c3a1715b5a86b3ad4d397fca76f3","b0a010e5a9b353a11fb664501de91fc47878d89bf97cb57bc03428c7a45981b9","17ea24ce8866da7ef4a842cba16961eafba89d526d3efe5d783bb7a30c5d1565","08565f345878369fdbbcf4a064d9f4762f4549f67d1e2aa3907a112a5e5322b6","5c061e188979d3b744a102d5d855e845a3b51453488530ea5dca6b098add2821","60167b6a14b7da2257cb6cbdc7f1ebcb4bdfa16c76cc9a7539c9b8d36478d127","71ba916a7f35fe661cb6affc183f1ce83ee068dbc9a123663f93acf7b5a4263e")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("cf3bdf0f8ea4c8ece5f5a76524ab4c81fea6c3a1715b5a86b3ad4d397fca76f3","b0a010e5a9b353a11fb664501de91fc47878d89bf97cb57bc03428c7a45981b9","17ea24ce8866da7ef4a842cba16961eafba89d526d3efe5d783bb7a30c5d1565","08565f345878369fdbbcf4a064d9f4762f4549f67d1e2aa3907a112a5e5322b6","5c061e188979d3b744a102d5d855e845a3b51453488530ea5dca6b098add2821","60167b6a14b7da2257cb6cbdc7f1ebcb4bdfa16c76cc9a7539c9b8d36478d127","71ba916a7f35fe661cb6affc183f1ce83ee068dbc9a123663f93acf7b5a4263e")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("cf3bdf0f8ea4c8ece5f5a76524ab4c81fea6c3a1715b5a86b3ad4d397fca76f3","b0a010e5a9b353a11fb664501de91fc47878d89bf97cb57bc03428c7a45981b9","17ea24ce8866da7ef4a842cba16961eafba89d526d3efe5d783bb7a30c5d1565","08565f345878369fdbbcf4a064d9f4762f4549f67d1e2aa3907a112a5e5322b6","5c061e188979d3b744a102d5d855e845a3b51453488530ea5dca6b098add2821","60167b6a14b7da2257cb6cbdc7f1ebcb4bdfa16c76cc9a7539c9b8d36478d127","71ba916a7f35fe661cb6affc183f1ce83ee068dbc9a123663f93acf7b5a4263e")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("cf3bdf0f8ea4c8ece5f5a76524ab4c81fea6c3a1715b5a86b3ad4d397fca76f3","b0a010e5a9b353a11fb664501de91fc47878d89bf97cb57bc03428c7a45981b9","17ea24ce8866da7ef4a842cba16961eafba89d526d3efe5d783bb7a30c5d1565","08565f345878369fdbbcf4a064d9f4762f4549f67d1e2aa3907a112a5e5322b6","5c061e188979d3b744a102d5d855e845a3b51453488530ea5dca6b098add2821","60167b6a14b7da2257cb6cbdc7f1ebcb4bdfa16c76cc9a7539c9b8d36478d127","71ba916a7f35fe661cb6affc183f1ce83ee068dbc9a123663f93acf7b5a4263e")
