index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("053c0cd2f56b2d8276d0c5e11cbe3a5c96ec278d","d36908ce63f5386ddffaa390a0baef6a045e2254","2c6fe45dbf760970b624b08cb1ff7bc5a5e21aa8","56b2d8a45e34384c4eb2c886037f22c9c90f3721","b07876f8254667e0f023559eed548de7ad967941","4c4a0d818dff16566e4bbad0d3e3fbba18e7063d","f82fb2f5f17a5bad4a0dce32ceaea377fe78c905","5da1c26703a80b3f8e663461ef9d612b4ccdee38")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("053c0cd2f56b2d8276d0c5e11cbe3a5c96ec278d","d36908ce63f5386ddffaa390a0baef6a045e2254","2c6fe45dbf760970b624b08cb1ff7bc5a5e21aa8","56b2d8a45e34384c4eb2c886037f22c9c90f3721","b07876f8254667e0f023559eed548de7ad967941","4c4a0d818dff16566e4bbad0d3e3fbba18e7063d","f82fb2f5f17a5bad4a0dce32ceaea377fe78c905","5da1c26703a80b3f8e663461ef9d612b4ccdee38")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("053c0cd2f56b2d8276d0c5e11cbe3a5c96ec278d","d36908ce63f5386ddffaa390a0baef6a045e2254","2c6fe45dbf760970b624b08cb1ff7bc5a5e21aa8","56b2d8a45e34384c4eb2c886037f22c9c90f3721","b07876f8254667e0f023559eed548de7ad967941","4c4a0d818dff16566e4bbad0d3e3fbba18e7063d","f82fb2f5f17a5bad4a0dce32ceaea377fe78c905","5da1c26703a80b3f8e663461ef9d612b4ccdee38")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring64 NOT NULL AND customstring64 IN ("053c0cd2f56b2d8276d0c5e11cbe3a5c96ec278d","d36908ce63f5386ddffaa390a0baef6a045e2254","2c6fe45dbf760970b624b08cb1ff7bc5a5e21aa8","56b2d8a45e34384c4eb2c886037f22c9c90f3721","b07876f8254667e0f023559eed548de7ad967941","4c4a0d818dff16566e4bbad0d3e3fbba18e7063d","f82fb2f5f17a5bad4a0dce32ceaea377fe78c905","5da1c26703a80b3f8e663461ef9d612b4ccdee38")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("053c0cd2f56b2d8276d0c5e11cbe3a5c96ec278d","d36908ce63f5386ddffaa390a0baef6a045e2254","2c6fe45dbf760970b624b08cb1ff7bc5a5e21aa8","56b2d8a45e34384c4eb2c886037f22c9c90f3721","b07876f8254667e0f023559eed548de7ad967941","4c4a0d818dff16566e4bbad0d3e3fbba18e7063d","f82fb2f5f17a5bad4a0dce32ceaea377fe78c905","5da1c26703a80b3f8e663461ef9d612b4ccdee38")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("053c0cd2f56b2d8276d0c5e11cbe3a5c96ec278d","d36908ce63f5386ddffaa390a0baef6a045e2254","2c6fe45dbf760970b624b08cb1ff7bc5a5e21aa8","56b2d8a45e34384c4eb2c886037f22c9c90f3721","b07876f8254667e0f023559eed548de7ad967941","4c4a0d818dff16566e4bbad0d3e3fbba18e7063d","f82fb2f5f17a5bad4a0dce32ceaea377fe78c905","5da1c26703a80b3f8e663461ef9d612b4ccdee38")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("053c0cd2f56b2d8276d0c5e11cbe3a5c96ec278d","d36908ce63f5386ddffaa390a0baef6a045e2254","2c6fe45dbf760970b624b08cb1ff7bc5a5e21aa8","56b2d8a45e34384c4eb2c886037f22c9c90f3721","b07876f8254667e0f023559eed548de7ad967941","4c4a0d818dff16566e4bbad0d3e3fbba18e7063d","f82fb2f5f17a5bad4a0dce32ceaea377fe78c905","5da1c26703a80b3f8e663461ef9d612b4ccdee38")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("053c0cd2f56b2d8276d0c5e11cbe3a5c96ec278d","d36908ce63f5386ddffaa390a0baef6a045e2254","2c6fe45dbf760970b624b08cb1ff7bc5a5e21aa8","56b2d8a45e34384c4eb2c886037f22c9c90f3721","b07876f8254667e0f023559eed548de7ad967941","4c4a0d818dff16566e4bbad0d3e3fbba18e7063d","f82fb2f5f17a5bad4a0dce32ceaea377fe78c905","5da1c26703a80b3f8e663461ef9d612b4ccdee38")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("053c0cd2f56b2d8276d0c5e11cbe3a5c96ec278d","d36908ce63f5386ddffaa390a0baef6a045e2254","2c6fe45dbf760970b624b08cb1ff7bc5a5e21aa8","56b2d8a45e34384c4eb2c886037f22c9c90f3721","b07876f8254667e0f023559eed548de7ad967941","4c4a0d818dff16566e4bbad0d3e3fbba18e7063d","f82fb2f5f17a5bad4a0dce32ceaea377fe78c905","5da1c26703a80b3f8e663461ef9d612b4ccdee38")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("053c0cd2f56b2d8276d0c5e11cbe3a5c96ec278d","d36908ce63f5386ddffaa390a0baef6a045e2254","2c6fe45dbf760970b624b08cb1ff7bc5a5e21aa8","56b2d8a45e34384c4eb2c886037f22c9c90f3721","b07876f8254667e0f023559eed548de7ad967941","4c4a0d818dff16566e4bbad0d3e3fbba18e7063d","f82fb2f5f17a5bad4a0dce32ceaea377fe78c905","5da1c26703a80b3f8e663461ef9d612b4ccdee38")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("053c0cd2f56b2d8276d0c5e11cbe3a5c96ec278d","d36908ce63f5386ddffaa390a0baef6a045e2254","2c6fe45dbf760970b624b08cb1ff7bc5a5e21aa8","56b2d8a45e34384c4eb2c886037f22c9c90f3721","b07876f8254667e0f023559eed548de7ad967941","4c4a0d818dff16566e4bbad0d3e3fbba18e7063d","f82fb2f5f17a5bad4a0dce32ceaea377fe78c905","5da1c26703a80b3f8e663461ef9d612b4ccdee38")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("053c0cd2f56b2d8276d0c5e11cbe3a5c96ec278d","d36908ce63f5386ddffaa390a0baef6a045e2254","2c6fe45dbf760970b624b08cb1ff7bc5a5e21aa8","56b2d8a45e34384c4eb2c886037f22c9c90f3721","b07876f8254667e0f023559eed548de7ad967941","4c4a0d818dff16566e4bbad0d3e3fbba18e7063d","f82fb2f5f17a5bad4a0dce32ceaea377fe78c905","5da1c26703a80b3f8e663461ef9d612b4ccdee38")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("053c0cd2f56b2d8276d0c5e11cbe3a5c96ec278d","d36908ce63f5386ddffaa390a0baef6a045e2254","2c6fe45dbf760970b624b08cb1ff7bc5a5e21aa8","56b2d8a45e34384c4eb2c886037f22c9c90f3721","b07876f8254667e0f023559eed548de7ad967941","4c4a0d818dff16566e4bbad0d3e3fbba18e7063d","f82fb2f5f17a5bad4a0dce32ceaea377fe78c905","5da1c26703a80b3f8e663461ef9d612b4ccdee38")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("053c0cd2f56b2d8276d0c5e11cbe3a5c96ec278d","d36908ce63f5386ddffaa390a0baef6a045e2254","2c6fe45dbf760970b624b08cb1ff7bc5a5e21aa8","56b2d8a45e34384c4eb2c886037f22c9c90f3721","b07876f8254667e0f023559eed548de7ad967941","4c4a0d818dff16566e4bbad0d3e3fbba18e7063d","f82fb2f5f17a5bad4a0dce32ceaea377fe78c905","5da1c26703a80b3f8e663461ef9d612b4ccdee38")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("053c0cd2f56b2d8276d0c5e11cbe3a5c96ec278d","d36908ce63f5386ddffaa390a0baef6a045e2254","2c6fe45dbf760970b624b08cb1ff7bc5a5e21aa8","56b2d8a45e34384c4eb2c886037f22c9c90f3721","b07876f8254667e0f023559eed548de7ad967941","4c4a0d818dff16566e4bbad0d3e3fbba18e7063d","f82fb2f5f17a5bad4a0dce32ceaea377fe78c905","5da1c26703a80b3f8e663461ef9d612b4ccdee38")
index=activity AND rg_functionality="Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("053c0cd2f56b2d8276d0c5e11cbe3a5c96ec278d","d36908ce63f5386ddffaa390a0baef6a045e2254","2c6fe45dbf760970b624b08cb1ff7bc5a5e21aa8","56b2d8a45e34384c4eb2c886037f22c9c90f3721","b07876f8254667e0f023559eed548de7ad967941","4c4a0d818dff16566e4bbad0d3e3fbba18e7063d","f82fb2f5f17a5bad4a0dce32ceaea377fe78c905","5da1c26703a80b3f8e663461ef9d612b4ccdee38")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("053c0cd2f56b2d8276d0c5e11cbe3a5c96ec278d","d36908ce63f5386ddffaa390a0baef6a045e2254","2c6fe45dbf760970b624b08cb1ff7bc5a5e21aa8","56b2d8a45e34384c4eb2c886037f22c9c90f3721","b07876f8254667e0f023559eed548de7ad967941","4c4a0d818dff16566e4bbad0d3e3fbba18e7063d","f82fb2f5f17a5bad4a0dce32ceaea377fe78c905","5da1c26703a80b3f8e663461ef9d612b4ccdee38")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("053c0cd2f56b2d8276d0c5e11cbe3a5c96ec278d","d36908ce63f5386ddffaa390a0baef6a045e2254","2c6fe45dbf760970b624b08cb1ff7bc5a5e21aa8","56b2d8a45e34384c4eb2c886037f22c9c90f3721","b07876f8254667e0f023559eed548de7ad967941","4c4a0d818dff16566e4bbad0d3e3fbba18e7063d","f82fb2f5f17a5bad4a0dce32ceaea377fe78c905","5da1c26703a80b3f8e663461ef9d612b4ccdee38")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("053c0cd2f56b2d8276d0c5e11cbe3a5c96ec278d","d36908ce63f5386ddffaa390a0baef6a045e2254","2c6fe45dbf760970b624b08cb1ff7bc5a5e21aa8","56b2d8a45e34384c4eb2c886037f22c9c90f3721","b07876f8254667e0f023559eed548de7ad967941","4c4a0d818dff16566e4bbad0d3e3fbba18e7063d","f82fb2f5f17a5bad4a0dce32ceaea377fe78c905","5da1c26703a80b3f8e663461ef9d612b4ccdee38")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("053c0cd2f56b2d8276d0c5e11cbe3a5c96ec278d","d36908ce63f5386ddffaa390a0baef6a045e2254","2c6fe45dbf760970b624b08cb1ff7bc5a5e21aa8","56b2d8a45e34384c4eb2c886037f22c9c90f3721","b07876f8254667e0f023559eed548de7ad967941","4c4a0d818dff16566e4bbad0d3e3fbba18e7063d","f82fb2f5f17a5bad4a0dce32ceaea377fe78c905","5da1c26703a80b3f8e663461ef9d612b4ccdee38")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("053c0cd2f56b2d8276d0c5e11cbe3a5c96ec278d","d36908ce63f5386ddffaa390a0baef6a045e2254","2c6fe45dbf760970b624b08cb1ff7bc5a5e21aa8","56b2d8a45e34384c4eb2c886037f22c9c90f3721","b07876f8254667e0f023559eed548de7ad967941","4c4a0d818dff16566e4bbad0d3e3fbba18e7063d","f82fb2f5f17a5bad4a0dce32ceaea377fe78c905","5da1c26703a80b3f8e663461ef9d612b4ccdee38")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("053c0cd2f56b2d8276d0c5e11cbe3a5c96ec278d","d36908ce63f5386ddffaa390a0baef6a045e2254","2c6fe45dbf760970b624b08cb1ff7bc5a5e21aa8","56b2d8a45e34384c4eb2c886037f22c9c90f3721","b07876f8254667e0f023559eed548de7ad967941","4c4a0d818dff16566e4bbad0d3e3fbba18e7063d","f82fb2f5f17a5bad4a0dce32ceaea377fe78c905","5da1c26703a80b3f8e663461ef9d612b4ccdee38")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("053c0cd2f56b2d8276d0c5e11cbe3a5c96ec278d","d36908ce63f5386ddffaa390a0baef6a045e2254","2c6fe45dbf760970b624b08cb1ff7bc5a5e21aa8","56b2d8a45e34384c4eb2c886037f22c9c90f3721","b07876f8254667e0f023559eed548de7ad967941","4c4a0d818dff16566e4bbad0d3e3fbba18e7063d","f82fb2f5f17a5bad4a0dce32ceaea377fe78c905","5da1c26703a80b3f8e663461ef9d612b4ccdee38")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring64 NOT NULL AND customstring64 IN ("053c0cd2f56b2d8276d0c5e11cbe3a5c96ec278d","d36908ce63f5386ddffaa390a0baef6a045e2254","2c6fe45dbf760970b624b08cb1ff7bc5a5e21aa8","56b2d8a45e34384c4eb2c886037f22c9c90f3721","b07876f8254667e0f023559eed548de7ad967941","4c4a0d818dff16566e4bbad0d3e3fbba18e7063d","f82fb2f5f17a5bad4a0dce32ceaea377fe78c905","5da1c26703a80b3f8e663461ef9d612b4ccdee38")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("053c0cd2f56b2d8276d0c5e11cbe3a5c96ec278d","d36908ce63f5386ddffaa390a0baef6a045e2254","2c6fe45dbf760970b624b08cb1ff7bc5a5e21aa8","56b2d8a45e34384c4eb2c886037f22c9c90f3721","b07876f8254667e0f023559eed548de7ad967941","4c4a0d818dff16566e4bbad0d3e3fbba18e7063d","f82fb2f5f17a5bad4a0dce32ceaea377fe78c905","5da1c26703a80b3f8e663461ef9d612b4ccdee38")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("053c0cd2f56b2d8276d0c5e11cbe3a5c96ec278d","d36908ce63f5386ddffaa390a0baef6a045e2254","2c6fe45dbf760970b624b08cb1ff7bc5a5e21aa8","56b2d8a45e34384c4eb2c886037f22c9c90f3721","b07876f8254667e0f023559eed548de7ad967941","4c4a0d818dff16566e4bbad0d3e3fbba18e7063d","f82fb2f5f17a5bad4a0dce32ceaea377fe78c905","5da1c26703a80b3f8e663461ef9d612b4ccdee38")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("053c0cd2f56b2d8276d0c5e11cbe3a5c96ec278d","d36908ce63f5386ddffaa390a0baef6a045e2254","2c6fe45dbf760970b624b08cb1ff7bc5a5e21aa8","56b2d8a45e34384c4eb2c886037f22c9c90f3721","b07876f8254667e0f023559eed548de7ad967941","4c4a0d818dff16566e4bbad0d3e3fbba18e7063d","f82fb2f5f17a5bad4a0dce32ceaea377fe78c905","5da1c26703a80b3f8e663461ef9d612b4ccdee38")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring64 NOT NULL AND customstring64 IN ("053c0cd2f56b2d8276d0c5e11cbe3a5c96ec278d","d36908ce63f5386ddffaa390a0baef6a045e2254","2c6fe45dbf760970b624b08cb1ff7bc5a5e21aa8","56b2d8a45e34384c4eb2c886037f22c9c90f3721","b07876f8254667e0f023559eed548de7ad967941","4c4a0d818dff16566e4bbad0d3e3fbba18e7063d","f82fb2f5f17a5bad4a0dce32ceaea377fe78c905","5da1c26703a80b3f8e663461ef9d612b4ccdee38")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("053c0cd2f56b2d8276d0c5e11cbe3a5c96ec278d","d36908ce63f5386ddffaa390a0baef6a045e2254","2c6fe45dbf760970b624b08cb1ff7bc5a5e21aa8","56b2d8a45e34384c4eb2c886037f22c9c90f3721","b07876f8254667e0f023559eed548de7ad967941","4c4a0d818dff16566e4bbad0d3e3fbba18e7063d","f82fb2f5f17a5bad4a0dce32ceaea377fe78c905","5da1c26703a80b3f8e663461ef9d612b4ccdee38")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("053c0cd2f56b2d8276d0c5e11cbe3a5c96ec278d","d36908ce63f5386ddffaa390a0baef6a045e2254","2c6fe45dbf760970b624b08cb1ff7bc5a5e21aa8","56b2d8a45e34384c4eb2c886037f22c9c90f3721","b07876f8254667e0f023559eed548de7ad967941","4c4a0d818dff16566e4bbad0d3e3fbba18e7063d","f82fb2f5f17a5bad4a0dce32ceaea377fe78c905","5da1c26703a80b3f8e663461ef9d612b4ccdee38")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("053c0cd2f56b2d8276d0c5e11cbe3a5c96ec278d","d36908ce63f5386ddffaa390a0baef6a045e2254","2c6fe45dbf760970b624b08cb1ff7bc5a5e21aa8","56b2d8a45e34384c4eb2c886037f22c9c90f3721","b07876f8254667e0f023559eed548de7ad967941","4c4a0d818dff16566e4bbad0d3e3fbba18e7063d","f82fb2f5f17a5bad4a0dce32ceaea377fe78c905","5da1c26703a80b3f8e663461ef9d612b4ccdee38")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring64 NOT NULL AND customstring64 IN ("053c0cd2f56b2d8276d0c5e11cbe3a5c96ec278d","d36908ce63f5386ddffaa390a0baef6a045e2254","2c6fe45dbf760970b624b08cb1ff7bc5a5e21aa8","56b2d8a45e34384c4eb2c886037f22c9c90f3721","b07876f8254667e0f023559eed548de7ad967941","4c4a0d818dff16566e4bbad0d3e3fbba18e7063d","f82fb2f5f17a5bad4a0dce32ceaea377fe78c905","5da1c26703a80b3f8e663461ef9d612b4ccdee38")
