index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("be70fc2d12433899f273dad8c580c96e62c6904b","720c467046514f7376473b11271ebcb8d0a7e439","a973e19aafa2de9ae63964e1fa06a8671eec91e7","ffa757edc725a21bb27c09cffe371a7892698c1b","4e265736eaa201e270d851074878dfa60259e806","4b80478091b204e76ecdfffa275637bb1b98d103","c5d38822b42a848a500ccf7cede470f5baa92253")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("be70fc2d12433899f273dad8c580c96e62c6904b","720c467046514f7376473b11271ebcb8d0a7e439","a973e19aafa2de9ae63964e1fa06a8671eec91e7","ffa757edc725a21bb27c09cffe371a7892698c1b","4e265736eaa201e270d851074878dfa60259e806","4b80478091b204e76ecdfffa275637bb1b98d103","c5d38822b42a848a500ccf7cede470f5baa92253")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("be70fc2d12433899f273dad8c580c96e62c6904b","720c467046514f7376473b11271ebcb8d0a7e439","a973e19aafa2de9ae63964e1fa06a8671eec91e7","ffa757edc725a21bb27c09cffe371a7892698c1b","4e265736eaa201e270d851074878dfa60259e806","4b80478091b204e76ecdfffa275637bb1b98d103","c5d38822b42a848a500ccf7cede470f5baa92253")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring64 NOT NULL AND customstring64 IN ("be70fc2d12433899f273dad8c580c96e62c6904b","720c467046514f7376473b11271ebcb8d0a7e439","a973e19aafa2de9ae63964e1fa06a8671eec91e7","ffa757edc725a21bb27c09cffe371a7892698c1b","4e265736eaa201e270d851074878dfa60259e806","4b80478091b204e76ecdfffa275637bb1b98d103","c5d38822b42a848a500ccf7cede470f5baa92253")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("be70fc2d12433899f273dad8c580c96e62c6904b","720c467046514f7376473b11271ebcb8d0a7e439","a973e19aafa2de9ae63964e1fa06a8671eec91e7","ffa757edc725a21bb27c09cffe371a7892698c1b","4e265736eaa201e270d851074878dfa60259e806","4b80478091b204e76ecdfffa275637bb1b98d103","c5d38822b42a848a500ccf7cede470f5baa92253")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("be70fc2d12433899f273dad8c580c96e62c6904b","720c467046514f7376473b11271ebcb8d0a7e439","a973e19aafa2de9ae63964e1fa06a8671eec91e7","ffa757edc725a21bb27c09cffe371a7892698c1b","4e265736eaa201e270d851074878dfa60259e806","4b80478091b204e76ecdfffa275637bb1b98d103","c5d38822b42a848a500ccf7cede470f5baa92253")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("be70fc2d12433899f273dad8c580c96e62c6904b","720c467046514f7376473b11271ebcb8d0a7e439","a973e19aafa2de9ae63964e1fa06a8671eec91e7","ffa757edc725a21bb27c09cffe371a7892698c1b","4e265736eaa201e270d851074878dfa60259e806","4b80478091b204e76ecdfffa275637bb1b98d103","c5d38822b42a848a500ccf7cede470f5baa92253")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("be70fc2d12433899f273dad8c580c96e62c6904b","720c467046514f7376473b11271ebcb8d0a7e439","a973e19aafa2de9ae63964e1fa06a8671eec91e7","ffa757edc725a21bb27c09cffe371a7892698c1b","4e265736eaa201e270d851074878dfa60259e806","4b80478091b204e76ecdfffa275637bb1b98d103","c5d38822b42a848a500ccf7cede470f5baa92253")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("be70fc2d12433899f273dad8c580c96e62c6904b","720c467046514f7376473b11271ebcb8d0a7e439","a973e19aafa2de9ae63964e1fa06a8671eec91e7","ffa757edc725a21bb27c09cffe371a7892698c1b","4e265736eaa201e270d851074878dfa60259e806","4b80478091b204e76ecdfffa275637bb1b98d103","c5d38822b42a848a500ccf7cede470f5baa92253")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("be70fc2d12433899f273dad8c580c96e62c6904b","720c467046514f7376473b11271ebcb8d0a7e439","a973e19aafa2de9ae63964e1fa06a8671eec91e7","ffa757edc725a21bb27c09cffe371a7892698c1b","4e265736eaa201e270d851074878dfa60259e806","4b80478091b204e76ecdfffa275637bb1b98d103","c5d38822b42a848a500ccf7cede470f5baa92253")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("be70fc2d12433899f273dad8c580c96e62c6904b","720c467046514f7376473b11271ebcb8d0a7e439","a973e19aafa2de9ae63964e1fa06a8671eec91e7","ffa757edc725a21bb27c09cffe371a7892698c1b","4e265736eaa201e270d851074878dfa60259e806","4b80478091b204e76ecdfffa275637bb1b98d103","c5d38822b42a848a500ccf7cede470f5baa92253")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("be70fc2d12433899f273dad8c580c96e62c6904b","720c467046514f7376473b11271ebcb8d0a7e439","a973e19aafa2de9ae63964e1fa06a8671eec91e7","ffa757edc725a21bb27c09cffe371a7892698c1b","4e265736eaa201e270d851074878dfa60259e806","4b80478091b204e76ecdfffa275637bb1b98d103","c5d38822b42a848a500ccf7cede470f5baa92253")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("be70fc2d12433899f273dad8c580c96e62c6904b","720c467046514f7376473b11271ebcb8d0a7e439","a973e19aafa2de9ae63964e1fa06a8671eec91e7","ffa757edc725a21bb27c09cffe371a7892698c1b","4e265736eaa201e270d851074878dfa60259e806","4b80478091b204e76ecdfffa275637bb1b98d103","c5d38822b42a848a500ccf7cede470f5baa92253")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("be70fc2d12433899f273dad8c580c96e62c6904b","720c467046514f7376473b11271ebcb8d0a7e439","a973e19aafa2de9ae63964e1fa06a8671eec91e7","ffa757edc725a21bb27c09cffe371a7892698c1b","4e265736eaa201e270d851074878dfa60259e806","4b80478091b204e76ecdfffa275637bb1b98d103","c5d38822b42a848a500ccf7cede470f5baa92253")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("be70fc2d12433899f273dad8c580c96e62c6904b","720c467046514f7376473b11271ebcb8d0a7e439","a973e19aafa2de9ae63964e1fa06a8671eec91e7","ffa757edc725a21bb27c09cffe371a7892698c1b","4e265736eaa201e270d851074878dfa60259e806","4b80478091b204e76ecdfffa275637bb1b98d103","c5d38822b42a848a500ccf7cede470f5baa92253")
index=activity AND rg_functionality="Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("be70fc2d12433899f273dad8c580c96e62c6904b","720c467046514f7376473b11271ebcb8d0a7e439","a973e19aafa2de9ae63964e1fa06a8671eec91e7","ffa757edc725a21bb27c09cffe371a7892698c1b","4e265736eaa201e270d851074878dfa60259e806","4b80478091b204e76ecdfffa275637bb1b98d103","c5d38822b42a848a500ccf7cede470f5baa92253")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("be70fc2d12433899f273dad8c580c96e62c6904b","720c467046514f7376473b11271ebcb8d0a7e439","a973e19aafa2de9ae63964e1fa06a8671eec91e7","ffa757edc725a21bb27c09cffe371a7892698c1b","4e265736eaa201e270d851074878dfa60259e806","4b80478091b204e76ecdfffa275637bb1b98d103","c5d38822b42a848a500ccf7cede470f5baa92253")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("be70fc2d12433899f273dad8c580c96e62c6904b","720c467046514f7376473b11271ebcb8d0a7e439","a973e19aafa2de9ae63964e1fa06a8671eec91e7","ffa757edc725a21bb27c09cffe371a7892698c1b","4e265736eaa201e270d851074878dfa60259e806","4b80478091b204e76ecdfffa275637bb1b98d103","c5d38822b42a848a500ccf7cede470f5baa92253")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("be70fc2d12433899f273dad8c580c96e62c6904b","720c467046514f7376473b11271ebcb8d0a7e439","a973e19aafa2de9ae63964e1fa06a8671eec91e7","ffa757edc725a21bb27c09cffe371a7892698c1b","4e265736eaa201e270d851074878dfa60259e806","4b80478091b204e76ecdfffa275637bb1b98d103","c5d38822b42a848a500ccf7cede470f5baa92253")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("be70fc2d12433899f273dad8c580c96e62c6904b","720c467046514f7376473b11271ebcb8d0a7e439","a973e19aafa2de9ae63964e1fa06a8671eec91e7","ffa757edc725a21bb27c09cffe371a7892698c1b","4e265736eaa201e270d851074878dfa60259e806","4b80478091b204e76ecdfffa275637bb1b98d103","c5d38822b42a848a500ccf7cede470f5baa92253")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("be70fc2d12433899f273dad8c580c96e62c6904b","720c467046514f7376473b11271ebcb8d0a7e439","a973e19aafa2de9ae63964e1fa06a8671eec91e7","ffa757edc725a21bb27c09cffe371a7892698c1b","4e265736eaa201e270d851074878dfa60259e806","4b80478091b204e76ecdfffa275637bb1b98d103","c5d38822b42a848a500ccf7cede470f5baa92253")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("be70fc2d12433899f273dad8c580c96e62c6904b","720c467046514f7376473b11271ebcb8d0a7e439","a973e19aafa2de9ae63964e1fa06a8671eec91e7","ffa757edc725a21bb27c09cffe371a7892698c1b","4e265736eaa201e270d851074878dfa60259e806","4b80478091b204e76ecdfffa275637bb1b98d103","c5d38822b42a848a500ccf7cede470f5baa92253")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("be70fc2d12433899f273dad8c580c96e62c6904b","720c467046514f7376473b11271ebcb8d0a7e439","a973e19aafa2de9ae63964e1fa06a8671eec91e7","ffa757edc725a21bb27c09cffe371a7892698c1b","4e265736eaa201e270d851074878dfa60259e806","4b80478091b204e76ecdfffa275637bb1b98d103","c5d38822b42a848a500ccf7cede470f5baa92253")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring64 NOT NULL AND customstring64 IN ("be70fc2d12433899f273dad8c580c96e62c6904b","720c467046514f7376473b11271ebcb8d0a7e439","a973e19aafa2de9ae63964e1fa06a8671eec91e7","ffa757edc725a21bb27c09cffe371a7892698c1b","4e265736eaa201e270d851074878dfa60259e806","4b80478091b204e76ecdfffa275637bb1b98d103","c5d38822b42a848a500ccf7cede470f5baa92253")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("be70fc2d12433899f273dad8c580c96e62c6904b","720c467046514f7376473b11271ebcb8d0a7e439","a973e19aafa2de9ae63964e1fa06a8671eec91e7","ffa757edc725a21bb27c09cffe371a7892698c1b","4e265736eaa201e270d851074878dfa60259e806","4b80478091b204e76ecdfffa275637bb1b98d103","c5d38822b42a848a500ccf7cede470f5baa92253")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("be70fc2d12433899f273dad8c580c96e62c6904b","720c467046514f7376473b11271ebcb8d0a7e439","a973e19aafa2de9ae63964e1fa06a8671eec91e7","ffa757edc725a21bb27c09cffe371a7892698c1b","4e265736eaa201e270d851074878dfa60259e806","4b80478091b204e76ecdfffa275637bb1b98d103","c5d38822b42a848a500ccf7cede470f5baa92253")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("be70fc2d12433899f273dad8c580c96e62c6904b","720c467046514f7376473b11271ebcb8d0a7e439","a973e19aafa2de9ae63964e1fa06a8671eec91e7","ffa757edc725a21bb27c09cffe371a7892698c1b","4e265736eaa201e270d851074878dfa60259e806","4b80478091b204e76ecdfffa275637bb1b98d103","c5d38822b42a848a500ccf7cede470f5baa92253")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring64 NOT NULL AND customstring64 IN ("be70fc2d12433899f273dad8c580c96e62c6904b","720c467046514f7376473b11271ebcb8d0a7e439","a973e19aafa2de9ae63964e1fa06a8671eec91e7","ffa757edc725a21bb27c09cffe371a7892698c1b","4e265736eaa201e270d851074878dfa60259e806","4b80478091b204e76ecdfffa275637bb1b98d103","c5d38822b42a848a500ccf7cede470f5baa92253")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("be70fc2d12433899f273dad8c580c96e62c6904b","720c467046514f7376473b11271ebcb8d0a7e439","a973e19aafa2de9ae63964e1fa06a8671eec91e7","ffa757edc725a21bb27c09cffe371a7892698c1b","4e265736eaa201e270d851074878dfa60259e806","4b80478091b204e76ecdfffa275637bb1b98d103","c5d38822b42a848a500ccf7cede470f5baa92253")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("be70fc2d12433899f273dad8c580c96e62c6904b","720c467046514f7376473b11271ebcb8d0a7e439","a973e19aafa2de9ae63964e1fa06a8671eec91e7","ffa757edc725a21bb27c09cffe371a7892698c1b","4e265736eaa201e270d851074878dfa60259e806","4b80478091b204e76ecdfffa275637bb1b98d103","c5d38822b42a848a500ccf7cede470f5baa92253")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("be70fc2d12433899f273dad8c580c96e62c6904b","720c467046514f7376473b11271ebcb8d0a7e439","a973e19aafa2de9ae63964e1fa06a8671eec91e7","ffa757edc725a21bb27c09cffe371a7892698c1b","4e265736eaa201e270d851074878dfa60259e806","4b80478091b204e76ecdfffa275637bb1b98d103","c5d38822b42a848a500ccf7cede470f5baa92253")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring64 NOT NULL AND customstring64 IN ("be70fc2d12433899f273dad8c580c96e62c6904b","720c467046514f7376473b11271ebcb8d0a7e439","a973e19aafa2de9ae63964e1fa06a8671eec91e7","ffa757edc725a21bb27c09cffe371a7892698c1b","4e265736eaa201e270d851074878dfa60259e806","4b80478091b204e76ecdfffa275637bb1b98d103","c5d38822b42a848a500ccf7cede470f5baa92253")
