index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("270fc72074c697ba5921f7b61a6128b968ca6ccbf8906645e796cfc3072d4c43","65a84f6a9b4ccddcdae812ab8783938e3f4c12cfba670131b1a80395710c6fb4","83d50fcf97b0c1ec3de25b11684ca8db6f159c212f7ff50c92083ec5fbd3a633","a1b09720edcab4d396a53ec568fe6f4ab2851ad00c954255bf1a0c04a9d53d0a","bace40f886aac1bab03bf26f2f463ac418616bacc956ed97045b7c3072f02d6b","e1c86a578e8d0b272e2df2d6dd9033c842c7ab5b09cda72c588e0410dc3048f7","85a77f08fd66aeabc887cb7d4eb8362259afa9c3699a70e3b81efac9042bb255","bf503b5eb456f74187a17bb8c08bccc9b3d91a7f0f6fd50110540b051510d1ca")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("270fc72074c697ba5921f7b61a6128b968ca6ccbf8906645e796cfc3072d4c43","65a84f6a9b4ccddcdae812ab8783938e3f4c12cfba670131b1a80395710c6fb4","83d50fcf97b0c1ec3de25b11684ca8db6f159c212f7ff50c92083ec5fbd3a633","a1b09720edcab4d396a53ec568fe6f4ab2851ad00c954255bf1a0c04a9d53d0a","bace40f886aac1bab03bf26f2f463ac418616bacc956ed97045b7c3072f02d6b","e1c86a578e8d0b272e2df2d6dd9033c842c7ab5b09cda72c588e0410dc3048f7","85a77f08fd66aeabc887cb7d4eb8362259afa9c3699a70e3b81efac9042bb255","bf503b5eb456f74187a17bb8c08bccc9b3d91a7f0f6fd50110540b051510d1ca")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("270fc72074c697ba5921f7b61a6128b968ca6ccbf8906645e796cfc3072d4c43","65a84f6a9b4ccddcdae812ab8783938e3f4c12cfba670131b1a80395710c6fb4","83d50fcf97b0c1ec3de25b11684ca8db6f159c212f7ff50c92083ec5fbd3a633","a1b09720edcab4d396a53ec568fe6f4ab2851ad00c954255bf1a0c04a9d53d0a","bace40f886aac1bab03bf26f2f463ac418616bacc956ed97045b7c3072f02d6b","e1c86a578e8d0b272e2df2d6dd9033c842c7ab5b09cda72c588e0410dc3048f7","85a77f08fd66aeabc887cb7d4eb8362259afa9c3699a70e3b81efac9042bb255","bf503b5eb456f74187a17bb8c08bccc9b3d91a7f0f6fd50110540b051510d1ca")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring64 NOT NULL AND customstring64 IN ("270fc72074c697ba5921f7b61a6128b968ca6ccbf8906645e796cfc3072d4c43","65a84f6a9b4ccddcdae812ab8783938e3f4c12cfba670131b1a80395710c6fb4","83d50fcf97b0c1ec3de25b11684ca8db6f159c212f7ff50c92083ec5fbd3a633","a1b09720edcab4d396a53ec568fe6f4ab2851ad00c954255bf1a0c04a9d53d0a","bace40f886aac1bab03bf26f2f463ac418616bacc956ed97045b7c3072f02d6b","e1c86a578e8d0b272e2df2d6dd9033c842c7ab5b09cda72c588e0410dc3048f7","85a77f08fd66aeabc887cb7d4eb8362259afa9c3699a70e3b81efac9042bb255","bf503b5eb456f74187a17bb8c08bccc9b3d91a7f0f6fd50110540b051510d1ca")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("270fc72074c697ba5921f7b61a6128b968ca6ccbf8906645e796cfc3072d4c43","65a84f6a9b4ccddcdae812ab8783938e3f4c12cfba670131b1a80395710c6fb4","83d50fcf97b0c1ec3de25b11684ca8db6f159c212f7ff50c92083ec5fbd3a633","a1b09720edcab4d396a53ec568fe6f4ab2851ad00c954255bf1a0c04a9d53d0a","bace40f886aac1bab03bf26f2f463ac418616bacc956ed97045b7c3072f02d6b","e1c86a578e8d0b272e2df2d6dd9033c842c7ab5b09cda72c588e0410dc3048f7","85a77f08fd66aeabc887cb7d4eb8362259afa9c3699a70e3b81efac9042bb255","bf503b5eb456f74187a17bb8c08bccc9b3d91a7f0f6fd50110540b051510d1ca")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("270fc72074c697ba5921f7b61a6128b968ca6ccbf8906645e796cfc3072d4c43","65a84f6a9b4ccddcdae812ab8783938e3f4c12cfba670131b1a80395710c6fb4","83d50fcf97b0c1ec3de25b11684ca8db6f159c212f7ff50c92083ec5fbd3a633","a1b09720edcab4d396a53ec568fe6f4ab2851ad00c954255bf1a0c04a9d53d0a","bace40f886aac1bab03bf26f2f463ac418616bacc956ed97045b7c3072f02d6b","e1c86a578e8d0b272e2df2d6dd9033c842c7ab5b09cda72c588e0410dc3048f7","85a77f08fd66aeabc887cb7d4eb8362259afa9c3699a70e3b81efac9042bb255","bf503b5eb456f74187a17bb8c08bccc9b3d91a7f0f6fd50110540b051510d1ca")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("270fc72074c697ba5921f7b61a6128b968ca6ccbf8906645e796cfc3072d4c43","65a84f6a9b4ccddcdae812ab8783938e3f4c12cfba670131b1a80395710c6fb4","83d50fcf97b0c1ec3de25b11684ca8db6f159c212f7ff50c92083ec5fbd3a633","a1b09720edcab4d396a53ec568fe6f4ab2851ad00c954255bf1a0c04a9d53d0a","bace40f886aac1bab03bf26f2f463ac418616bacc956ed97045b7c3072f02d6b","e1c86a578e8d0b272e2df2d6dd9033c842c7ab5b09cda72c588e0410dc3048f7","85a77f08fd66aeabc887cb7d4eb8362259afa9c3699a70e3b81efac9042bb255","bf503b5eb456f74187a17bb8c08bccc9b3d91a7f0f6fd50110540b051510d1ca")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("270fc72074c697ba5921f7b61a6128b968ca6ccbf8906645e796cfc3072d4c43","65a84f6a9b4ccddcdae812ab8783938e3f4c12cfba670131b1a80395710c6fb4","83d50fcf97b0c1ec3de25b11684ca8db6f159c212f7ff50c92083ec5fbd3a633","a1b09720edcab4d396a53ec568fe6f4ab2851ad00c954255bf1a0c04a9d53d0a","bace40f886aac1bab03bf26f2f463ac418616bacc956ed97045b7c3072f02d6b","e1c86a578e8d0b272e2df2d6dd9033c842c7ab5b09cda72c588e0410dc3048f7","85a77f08fd66aeabc887cb7d4eb8362259afa9c3699a70e3b81efac9042bb255","bf503b5eb456f74187a17bb8c08bccc9b3d91a7f0f6fd50110540b051510d1ca")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("270fc72074c697ba5921f7b61a6128b968ca6ccbf8906645e796cfc3072d4c43","65a84f6a9b4ccddcdae812ab8783938e3f4c12cfba670131b1a80395710c6fb4","83d50fcf97b0c1ec3de25b11684ca8db6f159c212f7ff50c92083ec5fbd3a633","a1b09720edcab4d396a53ec568fe6f4ab2851ad00c954255bf1a0c04a9d53d0a","bace40f886aac1bab03bf26f2f463ac418616bacc956ed97045b7c3072f02d6b","e1c86a578e8d0b272e2df2d6dd9033c842c7ab5b09cda72c588e0410dc3048f7","85a77f08fd66aeabc887cb7d4eb8362259afa9c3699a70e3b81efac9042bb255","bf503b5eb456f74187a17bb8c08bccc9b3d91a7f0f6fd50110540b051510d1ca")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("270fc72074c697ba5921f7b61a6128b968ca6ccbf8906645e796cfc3072d4c43","65a84f6a9b4ccddcdae812ab8783938e3f4c12cfba670131b1a80395710c6fb4","83d50fcf97b0c1ec3de25b11684ca8db6f159c212f7ff50c92083ec5fbd3a633","a1b09720edcab4d396a53ec568fe6f4ab2851ad00c954255bf1a0c04a9d53d0a","bace40f886aac1bab03bf26f2f463ac418616bacc956ed97045b7c3072f02d6b","e1c86a578e8d0b272e2df2d6dd9033c842c7ab5b09cda72c588e0410dc3048f7","85a77f08fd66aeabc887cb7d4eb8362259afa9c3699a70e3b81efac9042bb255","bf503b5eb456f74187a17bb8c08bccc9b3d91a7f0f6fd50110540b051510d1ca")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("270fc72074c697ba5921f7b61a6128b968ca6ccbf8906645e796cfc3072d4c43","65a84f6a9b4ccddcdae812ab8783938e3f4c12cfba670131b1a80395710c6fb4","83d50fcf97b0c1ec3de25b11684ca8db6f159c212f7ff50c92083ec5fbd3a633","a1b09720edcab4d396a53ec568fe6f4ab2851ad00c954255bf1a0c04a9d53d0a","bace40f886aac1bab03bf26f2f463ac418616bacc956ed97045b7c3072f02d6b","e1c86a578e8d0b272e2df2d6dd9033c842c7ab5b09cda72c588e0410dc3048f7","85a77f08fd66aeabc887cb7d4eb8362259afa9c3699a70e3b81efac9042bb255","bf503b5eb456f74187a17bb8c08bccc9b3d91a7f0f6fd50110540b051510d1ca")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("270fc72074c697ba5921f7b61a6128b968ca6ccbf8906645e796cfc3072d4c43","65a84f6a9b4ccddcdae812ab8783938e3f4c12cfba670131b1a80395710c6fb4","83d50fcf97b0c1ec3de25b11684ca8db6f159c212f7ff50c92083ec5fbd3a633","a1b09720edcab4d396a53ec568fe6f4ab2851ad00c954255bf1a0c04a9d53d0a","bace40f886aac1bab03bf26f2f463ac418616bacc956ed97045b7c3072f02d6b","e1c86a578e8d0b272e2df2d6dd9033c842c7ab5b09cda72c588e0410dc3048f7","85a77f08fd66aeabc887cb7d4eb8362259afa9c3699a70e3b81efac9042bb255","bf503b5eb456f74187a17bb8c08bccc9b3d91a7f0f6fd50110540b051510d1ca")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("270fc72074c697ba5921f7b61a6128b968ca6ccbf8906645e796cfc3072d4c43","65a84f6a9b4ccddcdae812ab8783938e3f4c12cfba670131b1a80395710c6fb4","83d50fcf97b0c1ec3de25b11684ca8db6f159c212f7ff50c92083ec5fbd3a633","a1b09720edcab4d396a53ec568fe6f4ab2851ad00c954255bf1a0c04a9d53d0a","bace40f886aac1bab03bf26f2f463ac418616bacc956ed97045b7c3072f02d6b","e1c86a578e8d0b272e2df2d6dd9033c842c7ab5b09cda72c588e0410dc3048f7","85a77f08fd66aeabc887cb7d4eb8362259afa9c3699a70e3b81efac9042bb255","bf503b5eb456f74187a17bb8c08bccc9b3d91a7f0f6fd50110540b051510d1ca")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("270fc72074c697ba5921f7b61a6128b968ca6ccbf8906645e796cfc3072d4c43","65a84f6a9b4ccddcdae812ab8783938e3f4c12cfba670131b1a80395710c6fb4","83d50fcf97b0c1ec3de25b11684ca8db6f159c212f7ff50c92083ec5fbd3a633","a1b09720edcab4d396a53ec568fe6f4ab2851ad00c954255bf1a0c04a9d53d0a","bace40f886aac1bab03bf26f2f463ac418616bacc956ed97045b7c3072f02d6b","e1c86a578e8d0b272e2df2d6dd9033c842c7ab5b09cda72c588e0410dc3048f7","85a77f08fd66aeabc887cb7d4eb8362259afa9c3699a70e3b81efac9042bb255","bf503b5eb456f74187a17bb8c08bccc9b3d91a7f0f6fd50110540b051510d1ca")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("270fc72074c697ba5921f7b61a6128b968ca6ccbf8906645e796cfc3072d4c43","65a84f6a9b4ccddcdae812ab8783938e3f4c12cfba670131b1a80395710c6fb4","83d50fcf97b0c1ec3de25b11684ca8db6f159c212f7ff50c92083ec5fbd3a633","a1b09720edcab4d396a53ec568fe6f4ab2851ad00c954255bf1a0c04a9d53d0a","bace40f886aac1bab03bf26f2f463ac418616bacc956ed97045b7c3072f02d6b","e1c86a578e8d0b272e2df2d6dd9033c842c7ab5b09cda72c588e0410dc3048f7","85a77f08fd66aeabc887cb7d4eb8362259afa9c3699a70e3b81efac9042bb255","bf503b5eb456f74187a17bb8c08bccc9b3d91a7f0f6fd50110540b051510d1ca")
index=activity AND rg_functionality="Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("270fc72074c697ba5921f7b61a6128b968ca6ccbf8906645e796cfc3072d4c43","65a84f6a9b4ccddcdae812ab8783938e3f4c12cfba670131b1a80395710c6fb4","83d50fcf97b0c1ec3de25b11684ca8db6f159c212f7ff50c92083ec5fbd3a633","a1b09720edcab4d396a53ec568fe6f4ab2851ad00c954255bf1a0c04a9d53d0a","bace40f886aac1bab03bf26f2f463ac418616bacc956ed97045b7c3072f02d6b","e1c86a578e8d0b272e2df2d6dd9033c842c7ab5b09cda72c588e0410dc3048f7","85a77f08fd66aeabc887cb7d4eb8362259afa9c3699a70e3b81efac9042bb255","bf503b5eb456f74187a17bb8c08bccc9b3d91a7f0f6fd50110540b051510d1ca")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("270fc72074c697ba5921f7b61a6128b968ca6ccbf8906645e796cfc3072d4c43","65a84f6a9b4ccddcdae812ab8783938e3f4c12cfba670131b1a80395710c6fb4","83d50fcf97b0c1ec3de25b11684ca8db6f159c212f7ff50c92083ec5fbd3a633","a1b09720edcab4d396a53ec568fe6f4ab2851ad00c954255bf1a0c04a9d53d0a","bace40f886aac1bab03bf26f2f463ac418616bacc956ed97045b7c3072f02d6b","e1c86a578e8d0b272e2df2d6dd9033c842c7ab5b09cda72c588e0410dc3048f7","85a77f08fd66aeabc887cb7d4eb8362259afa9c3699a70e3b81efac9042bb255","bf503b5eb456f74187a17bb8c08bccc9b3d91a7f0f6fd50110540b051510d1ca")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("270fc72074c697ba5921f7b61a6128b968ca6ccbf8906645e796cfc3072d4c43","65a84f6a9b4ccddcdae812ab8783938e3f4c12cfba670131b1a80395710c6fb4","83d50fcf97b0c1ec3de25b11684ca8db6f159c212f7ff50c92083ec5fbd3a633","a1b09720edcab4d396a53ec568fe6f4ab2851ad00c954255bf1a0c04a9d53d0a","bace40f886aac1bab03bf26f2f463ac418616bacc956ed97045b7c3072f02d6b","e1c86a578e8d0b272e2df2d6dd9033c842c7ab5b09cda72c588e0410dc3048f7","85a77f08fd66aeabc887cb7d4eb8362259afa9c3699a70e3b81efac9042bb255","bf503b5eb456f74187a17bb8c08bccc9b3d91a7f0f6fd50110540b051510d1ca")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("270fc72074c697ba5921f7b61a6128b968ca6ccbf8906645e796cfc3072d4c43","65a84f6a9b4ccddcdae812ab8783938e3f4c12cfba670131b1a80395710c6fb4","83d50fcf97b0c1ec3de25b11684ca8db6f159c212f7ff50c92083ec5fbd3a633","a1b09720edcab4d396a53ec568fe6f4ab2851ad00c954255bf1a0c04a9d53d0a","bace40f886aac1bab03bf26f2f463ac418616bacc956ed97045b7c3072f02d6b","e1c86a578e8d0b272e2df2d6dd9033c842c7ab5b09cda72c588e0410dc3048f7","85a77f08fd66aeabc887cb7d4eb8362259afa9c3699a70e3b81efac9042bb255","bf503b5eb456f74187a17bb8c08bccc9b3d91a7f0f6fd50110540b051510d1ca")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("270fc72074c697ba5921f7b61a6128b968ca6ccbf8906645e796cfc3072d4c43","65a84f6a9b4ccddcdae812ab8783938e3f4c12cfba670131b1a80395710c6fb4","83d50fcf97b0c1ec3de25b11684ca8db6f159c212f7ff50c92083ec5fbd3a633","a1b09720edcab4d396a53ec568fe6f4ab2851ad00c954255bf1a0c04a9d53d0a","bace40f886aac1bab03bf26f2f463ac418616bacc956ed97045b7c3072f02d6b","e1c86a578e8d0b272e2df2d6dd9033c842c7ab5b09cda72c588e0410dc3048f7","85a77f08fd66aeabc887cb7d4eb8362259afa9c3699a70e3b81efac9042bb255","bf503b5eb456f74187a17bb8c08bccc9b3d91a7f0f6fd50110540b051510d1ca")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("270fc72074c697ba5921f7b61a6128b968ca6ccbf8906645e796cfc3072d4c43","65a84f6a9b4ccddcdae812ab8783938e3f4c12cfba670131b1a80395710c6fb4","83d50fcf97b0c1ec3de25b11684ca8db6f159c212f7ff50c92083ec5fbd3a633","a1b09720edcab4d396a53ec568fe6f4ab2851ad00c954255bf1a0c04a9d53d0a","bace40f886aac1bab03bf26f2f463ac418616bacc956ed97045b7c3072f02d6b","e1c86a578e8d0b272e2df2d6dd9033c842c7ab5b09cda72c588e0410dc3048f7","85a77f08fd66aeabc887cb7d4eb8362259afa9c3699a70e3b81efac9042bb255","bf503b5eb456f74187a17bb8c08bccc9b3d91a7f0f6fd50110540b051510d1ca")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("270fc72074c697ba5921f7b61a6128b968ca6ccbf8906645e796cfc3072d4c43","65a84f6a9b4ccddcdae812ab8783938e3f4c12cfba670131b1a80395710c6fb4","83d50fcf97b0c1ec3de25b11684ca8db6f159c212f7ff50c92083ec5fbd3a633","a1b09720edcab4d396a53ec568fe6f4ab2851ad00c954255bf1a0c04a9d53d0a","bace40f886aac1bab03bf26f2f463ac418616bacc956ed97045b7c3072f02d6b","e1c86a578e8d0b272e2df2d6dd9033c842c7ab5b09cda72c588e0410dc3048f7","85a77f08fd66aeabc887cb7d4eb8362259afa9c3699a70e3b81efac9042bb255","bf503b5eb456f74187a17bb8c08bccc9b3d91a7f0f6fd50110540b051510d1ca")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("270fc72074c697ba5921f7b61a6128b968ca6ccbf8906645e796cfc3072d4c43","65a84f6a9b4ccddcdae812ab8783938e3f4c12cfba670131b1a80395710c6fb4","83d50fcf97b0c1ec3de25b11684ca8db6f159c212f7ff50c92083ec5fbd3a633","a1b09720edcab4d396a53ec568fe6f4ab2851ad00c954255bf1a0c04a9d53d0a","bace40f886aac1bab03bf26f2f463ac418616bacc956ed97045b7c3072f02d6b","e1c86a578e8d0b272e2df2d6dd9033c842c7ab5b09cda72c588e0410dc3048f7","85a77f08fd66aeabc887cb7d4eb8362259afa9c3699a70e3b81efac9042bb255","bf503b5eb456f74187a17bb8c08bccc9b3d91a7f0f6fd50110540b051510d1ca")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring64 NOT NULL AND customstring64 IN ("270fc72074c697ba5921f7b61a6128b968ca6ccbf8906645e796cfc3072d4c43","65a84f6a9b4ccddcdae812ab8783938e3f4c12cfba670131b1a80395710c6fb4","83d50fcf97b0c1ec3de25b11684ca8db6f159c212f7ff50c92083ec5fbd3a633","a1b09720edcab4d396a53ec568fe6f4ab2851ad00c954255bf1a0c04a9d53d0a","bace40f886aac1bab03bf26f2f463ac418616bacc956ed97045b7c3072f02d6b","e1c86a578e8d0b272e2df2d6dd9033c842c7ab5b09cda72c588e0410dc3048f7","85a77f08fd66aeabc887cb7d4eb8362259afa9c3699a70e3b81efac9042bb255","bf503b5eb456f74187a17bb8c08bccc9b3d91a7f0f6fd50110540b051510d1ca")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("270fc72074c697ba5921f7b61a6128b968ca6ccbf8906645e796cfc3072d4c43","65a84f6a9b4ccddcdae812ab8783938e3f4c12cfba670131b1a80395710c6fb4","83d50fcf97b0c1ec3de25b11684ca8db6f159c212f7ff50c92083ec5fbd3a633","a1b09720edcab4d396a53ec568fe6f4ab2851ad00c954255bf1a0c04a9d53d0a","bace40f886aac1bab03bf26f2f463ac418616bacc956ed97045b7c3072f02d6b","e1c86a578e8d0b272e2df2d6dd9033c842c7ab5b09cda72c588e0410dc3048f7","85a77f08fd66aeabc887cb7d4eb8362259afa9c3699a70e3b81efac9042bb255","bf503b5eb456f74187a17bb8c08bccc9b3d91a7f0f6fd50110540b051510d1ca")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("270fc72074c697ba5921f7b61a6128b968ca6ccbf8906645e796cfc3072d4c43","65a84f6a9b4ccddcdae812ab8783938e3f4c12cfba670131b1a80395710c6fb4","83d50fcf97b0c1ec3de25b11684ca8db6f159c212f7ff50c92083ec5fbd3a633","a1b09720edcab4d396a53ec568fe6f4ab2851ad00c954255bf1a0c04a9d53d0a","bace40f886aac1bab03bf26f2f463ac418616bacc956ed97045b7c3072f02d6b","e1c86a578e8d0b272e2df2d6dd9033c842c7ab5b09cda72c588e0410dc3048f7","85a77f08fd66aeabc887cb7d4eb8362259afa9c3699a70e3b81efac9042bb255","bf503b5eb456f74187a17bb8c08bccc9b3d91a7f0f6fd50110540b051510d1ca")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("270fc72074c697ba5921f7b61a6128b968ca6ccbf8906645e796cfc3072d4c43","65a84f6a9b4ccddcdae812ab8783938e3f4c12cfba670131b1a80395710c6fb4","83d50fcf97b0c1ec3de25b11684ca8db6f159c212f7ff50c92083ec5fbd3a633","a1b09720edcab4d396a53ec568fe6f4ab2851ad00c954255bf1a0c04a9d53d0a","bace40f886aac1bab03bf26f2f463ac418616bacc956ed97045b7c3072f02d6b","e1c86a578e8d0b272e2df2d6dd9033c842c7ab5b09cda72c588e0410dc3048f7","85a77f08fd66aeabc887cb7d4eb8362259afa9c3699a70e3b81efac9042bb255","bf503b5eb456f74187a17bb8c08bccc9b3d91a7f0f6fd50110540b051510d1ca")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring64 NOT NULL AND customstring64 IN ("270fc72074c697ba5921f7b61a6128b968ca6ccbf8906645e796cfc3072d4c43","65a84f6a9b4ccddcdae812ab8783938e3f4c12cfba670131b1a80395710c6fb4","83d50fcf97b0c1ec3de25b11684ca8db6f159c212f7ff50c92083ec5fbd3a633","a1b09720edcab4d396a53ec568fe6f4ab2851ad00c954255bf1a0c04a9d53d0a","bace40f886aac1bab03bf26f2f463ac418616bacc956ed97045b7c3072f02d6b","e1c86a578e8d0b272e2df2d6dd9033c842c7ab5b09cda72c588e0410dc3048f7","85a77f08fd66aeabc887cb7d4eb8362259afa9c3699a70e3b81efac9042bb255","bf503b5eb456f74187a17bb8c08bccc9b3d91a7f0f6fd50110540b051510d1ca")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("270fc72074c697ba5921f7b61a6128b968ca6ccbf8906645e796cfc3072d4c43","65a84f6a9b4ccddcdae812ab8783938e3f4c12cfba670131b1a80395710c6fb4","83d50fcf97b0c1ec3de25b11684ca8db6f159c212f7ff50c92083ec5fbd3a633","a1b09720edcab4d396a53ec568fe6f4ab2851ad00c954255bf1a0c04a9d53d0a","bace40f886aac1bab03bf26f2f463ac418616bacc956ed97045b7c3072f02d6b","e1c86a578e8d0b272e2df2d6dd9033c842c7ab5b09cda72c588e0410dc3048f7","85a77f08fd66aeabc887cb7d4eb8362259afa9c3699a70e3b81efac9042bb255","bf503b5eb456f74187a17bb8c08bccc9b3d91a7f0f6fd50110540b051510d1ca")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("270fc72074c697ba5921f7b61a6128b968ca6ccbf8906645e796cfc3072d4c43","65a84f6a9b4ccddcdae812ab8783938e3f4c12cfba670131b1a80395710c6fb4","83d50fcf97b0c1ec3de25b11684ca8db6f159c212f7ff50c92083ec5fbd3a633","a1b09720edcab4d396a53ec568fe6f4ab2851ad00c954255bf1a0c04a9d53d0a","bace40f886aac1bab03bf26f2f463ac418616bacc956ed97045b7c3072f02d6b","e1c86a578e8d0b272e2df2d6dd9033c842c7ab5b09cda72c588e0410dc3048f7","85a77f08fd66aeabc887cb7d4eb8362259afa9c3699a70e3b81efac9042bb255","bf503b5eb456f74187a17bb8c08bccc9b3d91a7f0f6fd50110540b051510d1ca")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("270fc72074c697ba5921f7b61a6128b968ca6ccbf8906645e796cfc3072d4c43","65a84f6a9b4ccddcdae812ab8783938e3f4c12cfba670131b1a80395710c6fb4","83d50fcf97b0c1ec3de25b11684ca8db6f159c212f7ff50c92083ec5fbd3a633","a1b09720edcab4d396a53ec568fe6f4ab2851ad00c954255bf1a0c04a9d53d0a","bace40f886aac1bab03bf26f2f463ac418616bacc956ed97045b7c3072f02d6b","e1c86a578e8d0b272e2df2d6dd9033c842c7ab5b09cda72c588e0410dc3048f7","85a77f08fd66aeabc887cb7d4eb8362259afa9c3699a70e3b81efac9042bb255","bf503b5eb456f74187a17bb8c08bccc9b3d91a7f0f6fd50110540b051510d1ca")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring64 NOT NULL AND customstring64 IN ("270fc72074c697ba5921f7b61a6128b968ca6ccbf8906645e796cfc3072d4c43","65a84f6a9b4ccddcdae812ab8783938e3f4c12cfba670131b1a80395710c6fb4","83d50fcf97b0c1ec3de25b11684ca8db6f159c212f7ff50c92083ec5fbd3a633","a1b09720edcab4d396a53ec568fe6f4ab2851ad00c954255bf1a0c04a9d53d0a","bace40f886aac1bab03bf26f2f463ac418616bacc956ed97045b7c3072f02d6b","e1c86a578e8d0b272e2df2d6dd9033c842c7ab5b09cda72c588e0410dc3048f7","85a77f08fd66aeabc887cb7d4eb8362259afa9c3699a70e3b81efac9042bb255","bf503b5eb456f74187a17bb8c08bccc9b3d91a7f0f6fd50110540b051510d1ca")
index=activity AND rg_functionality="O365 General" AND filehash NOT NULL AND filehash IN ("270fc72074c697ba5921f7b61a6128b968ca6ccbf8906645e796cfc3072d4c43","65a84f6a9b4ccddcdae812ab8783938e3f4c12cfba670131b1a80395710c6fb4","83d50fcf97b0c1ec3de25b11684ca8db6f159c212f7ff50c92083ec5fbd3a633","a1b09720edcab4d396a53ec568fe6f4ab2851ad00c954255bf1a0c04a9d53d0a","bace40f886aac1bab03bf26f2f463ac418616bacc956ed97045b7c3072f02d6b","e1c86a578e8d0b272e2df2d6dd9033c842c7ab5b09cda72c588e0410dc3048f7","85a77f08fd66aeabc887cb7d4eb8362259afa9c3699a70e3b81efac9042bb255","bf503b5eb456f74187a17bb8c08bccc9b3d91a7f0f6fd50110540b051510d1ca")
index=activity AND rg_functionality="O365 General" AND oldfilehash NOT NULL AND oldfilehash IN ("270fc72074c697ba5921f7b61a6128b968ca6ccbf8906645e796cfc3072d4c43","65a84f6a9b4ccddcdae812ab8783938e3f4c12cfba670131b1a80395710c6fb4","83d50fcf97b0c1ec3de25b11684ca8db6f159c212f7ff50c92083ec5fbd3a633","a1b09720edcab4d396a53ec568fe6f4ab2851ad00c954255bf1a0c04a9d53d0a","bace40f886aac1bab03bf26f2f463ac418616bacc956ed97045b7c3072f02d6b","e1c86a578e8d0b272e2df2d6dd9033c842c7ab5b09cda72c588e0410dc3048f7","85a77f08fd66aeabc887cb7d4eb8362259afa9c3699a70e3b81efac9042bb255","bf503b5eb456f74187a17bb8c08bccc9b3d91a7f0f6fd50110540b051510d1ca")
index=activity AND rg_functionality="O365 General" AND customstring3 NOT NULL AND customstring3 IN ("270fc72074c697ba5921f7b61a6128b968ca6ccbf8906645e796cfc3072d4c43","65a84f6a9b4ccddcdae812ab8783938e3f4c12cfba670131b1a80395710c6fb4","83d50fcf97b0c1ec3de25b11684ca8db6f159c212f7ff50c92083ec5fbd3a633","a1b09720edcab4d396a53ec568fe6f4ab2851ad00c954255bf1a0c04a9d53d0a","bace40f886aac1bab03bf26f2f463ac418616bacc956ed97045b7c3072f02d6b","e1c86a578e8d0b272e2df2d6dd9033c842c7ab5b09cda72c588e0410dc3048f7","85a77f08fd66aeabc887cb7d4eb8362259afa9c3699a70e3b81efac9042bb255","bf503b5eb456f74187a17bb8c08bccc9b3d91a7f0f6fd50110540b051510d1ca")
index=activity AND rg_functionality="O365 General" AND customstring64 NOT NULL AND customstring64 IN ("270fc72074c697ba5921f7b61a6128b968ca6ccbf8906645e796cfc3072d4c43","65a84f6a9b4ccddcdae812ab8783938e3f4c12cfba670131b1a80395710c6fb4","83d50fcf97b0c1ec3de25b11684ca8db6f159c212f7ff50c92083ec5fbd3a633","a1b09720edcab4d396a53ec568fe6f4ab2851ad00c954255bf1a0c04a9d53d0a","bace40f886aac1bab03bf26f2f463ac418616bacc956ed97045b7c3072f02d6b","e1c86a578e8d0b272e2df2d6dd9033c842c7ab5b09cda72c588e0410dc3048f7","85a77f08fd66aeabc887cb7d4eb8362259afa9c3699a70e3b81efac9042bb255","bf503b5eb456f74187a17bb8c08bccc9b3d91a7f0f6fd50110540b051510d1ca")
