index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("932c91020b74aaa7ffc687e21da0119c","4946b0de3b705878c514e2eead096e1e","3c96c1a9b3751339390be9d7a5c3694df46212fb97ebddc074547c2338a4c7ba","9e581d0506d2f6ec39226f052a58bc5a020ebc81ae539fa3a6b7fc0db1b94946","704e697441c0af67423458a99f30318c57f1a81c4146beb4dd1a88a88a8c97c3")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("932c91020b74aaa7ffc687e21da0119c","4946b0de3b705878c514e2eead096e1e","3c96c1a9b3751339390be9d7a5c3694df46212fb97ebddc074547c2338a4c7ba","9e581d0506d2f6ec39226f052a58bc5a020ebc81ae539fa3a6b7fc0db1b94946","704e697441c0af67423458a99f30318c57f1a81c4146beb4dd1a88a88a8c97c3")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("932c91020b74aaa7ffc687e21da0119c","4946b0de3b705878c514e2eead096e1e","3c96c1a9b3751339390be9d7a5c3694df46212fb97ebddc074547c2338a4c7ba","9e581d0506d2f6ec39226f052a58bc5a020ebc81ae539fa3a6b7fc0db1b94946","704e697441c0af67423458a99f30318c57f1a81c4146beb4dd1a88a88a8c97c3")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring64 NOT NULL AND customstring64 IN ("932c91020b74aaa7ffc687e21da0119c","4946b0de3b705878c514e2eead096e1e","3c96c1a9b3751339390be9d7a5c3694df46212fb97ebddc074547c2338a4c7ba","9e581d0506d2f6ec39226f052a58bc5a020ebc81ae539fa3a6b7fc0db1b94946","704e697441c0af67423458a99f30318c57f1a81c4146beb4dd1a88a88a8c97c3")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("932c91020b74aaa7ffc687e21da0119c","4946b0de3b705878c514e2eead096e1e","3c96c1a9b3751339390be9d7a5c3694df46212fb97ebddc074547c2338a4c7ba","9e581d0506d2f6ec39226f052a58bc5a020ebc81ae539fa3a6b7fc0db1b94946","704e697441c0af67423458a99f30318c57f1a81c4146beb4dd1a88a88a8c97c3")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("932c91020b74aaa7ffc687e21da0119c","4946b0de3b705878c514e2eead096e1e","3c96c1a9b3751339390be9d7a5c3694df46212fb97ebddc074547c2338a4c7ba","9e581d0506d2f6ec39226f052a58bc5a020ebc81ae539fa3a6b7fc0db1b94946","704e697441c0af67423458a99f30318c57f1a81c4146beb4dd1a88a88a8c97c3")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("932c91020b74aaa7ffc687e21da0119c","4946b0de3b705878c514e2eead096e1e","3c96c1a9b3751339390be9d7a5c3694df46212fb97ebddc074547c2338a4c7ba","9e581d0506d2f6ec39226f052a58bc5a020ebc81ae539fa3a6b7fc0db1b94946","704e697441c0af67423458a99f30318c57f1a81c4146beb4dd1a88a88a8c97c3")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("932c91020b74aaa7ffc687e21da0119c","4946b0de3b705878c514e2eead096e1e","3c96c1a9b3751339390be9d7a5c3694df46212fb97ebddc074547c2338a4c7ba","9e581d0506d2f6ec39226f052a58bc5a020ebc81ae539fa3a6b7fc0db1b94946","704e697441c0af67423458a99f30318c57f1a81c4146beb4dd1a88a88a8c97c3")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("932c91020b74aaa7ffc687e21da0119c","4946b0de3b705878c514e2eead096e1e","3c96c1a9b3751339390be9d7a5c3694df46212fb97ebddc074547c2338a4c7ba","9e581d0506d2f6ec39226f052a58bc5a020ebc81ae539fa3a6b7fc0db1b94946","704e697441c0af67423458a99f30318c57f1a81c4146beb4dd1a88a88a8c97c3")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("932c91020b74aaa7ffc687e21da0119c","4946b0de3b705878c514e2eead096e1e","3c96c1a9b3751339390be9d7a5c3694df46212fb97ebddc074547c2338a4c7ba","9e581d0506d2f6ec39226f052a58bc5a020ebc81ae539fa3a6b7fc0db1b94946","704e697441c0af67423458a99f30318c57f1a81c4146beb4dd1a88a88a8c97c3")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("932c91020b74aaa7ffc687e21da0119c","4946b0de3b705878c514e2eead096e1e","3c96c1a9b3751339390be9d7a5c3694df46212fb97ebddc074547c2338a4c7ba","9e581d0506d2f6ec39226f052a58bc5a020ebc81ae539fa3a6b7fc0db1b94946","704e697441c0af67423458a99f30318c57f1a81c4146beb4dd1a88a88a8c97c3")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("932c91020b74aaa7ffc687e21da0119c","4946b0de3b705878c514e2eead096e1e","3c96c1a9b3751339390be9d7a5c3694df46212fb97ebddc074547c2338a4c7ba","9e581d0506d2f6ec39226f052a58bc5a020ebc81ae539fa3a6b7fc0db1b94946","704e697441c0af67423458a99f30318c57f1a81c4146beb4dd1a88a88a8c97c3")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("932c91020b74aaa7ffc687e21da0119c","4946b0de3b705878c514e2eead096e1e","3c96c1a9b3751339390be9d7a5c3694df46212fb97ebddc074547c2338a4c7ba","9e581d0506d2f6ec39226f052a58bc5a020ebc81ae539fa3a6b7fc0db1b94946","704e697441c0af67423458a99f30318c57f1a81c4146beb4dd1a88a88a8c97c3")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("932c91020b74aaa7ffc687e21da0119c","4946b0de3b705878c514e2eead096e1e","3c96c1a9b3751339390be9d7a5c3694df46212fb97ebddc074547c2338a4c7ba","9e581d0506d2f6ec39226f052a58bc5a020ebc81ae539fa3a6b7fc0db1b94946","704e697441c0af67423458a99f30318c57f1a81c4146beb4dd1a88a88a8c97c3")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("932c91020b74aaa7ffc687e21da0119c","4946b0de3b705878c514e2eead096e1e","3c96c1a9b3751339390be9d7a5c3694df46212fb97ebddc074547c2338a4c7ba","9e581d0506d2f6ec39226f052a58bc5a020ebc81ae539fa3a6b7fc0db1b94946","704e697441c0af67423458a99f30318c57f1a81c4146beb4dd1a88a88a8c97c3")
index=activity AND rg_functionality="Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("932c91020b74aaa7ffc687e21da0119c","4946b0de3b705878c514e2eead096e1e","3c96c1a9b3751339390be9d7a5c3694df46212fb97ebddc074547c2338a4c7ba","9e581d0506d2f6ec39226f052a58bc5a020ebc81ae539fa3a6b7fc0db1b94946","704e697441c0af67423458a99f30318c57f1a81c4146beb4dd1a88a88a8c97c3")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("932c91020b74aaa7ffc687e21da0119c","4946b0de3b705878c514e2eead096e1e","3c96c1a9b3751339390be9d7a5c3694df46212fb97ebddc074547c2338a4c7ba","9e581d0506d2f6ec39226f052a58bc5a020ebc81ae539fa3a6b7fc0db1b94946","704e697441c0af67423458a99f30318c57f1a81c4146beb4dd1a88a88a8c97c3")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("932c91020b74aaa7ffc687e21da0119c","4946b0de3b705878c514e2eead096e1e","3c96c1a9b3751339390be9d7a5c3694df46212fb97ebddc074547c2338a4c7ba","9e581d0506d2f6ec39226f052a58bc5a020ebc81ae539fa3a6b7fc0db1b94946","704e697441c0af67423458a99f30318c57f1a81c4146beb4dd1a88a88a8c97c3")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("932c91020b74aaa7ffc687e21da0119c","4946b0de3b705878c514e2eead096e1e","3c96c1a9b3751339390be9d7a5c3694df46212fb97ebddc074547c2338a4c7ba","9e581d0506d2f6ec39226f052a58bc5a020ebc81ae539fa3a6b7fc0db1b94946","704e697441c0af67423458a99f30318c57f1a81c4146beb4dd1a88a88a8c97c3")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("932c91020b74aaa7ffc687e21da0119c","4946b0de3b705878c514e2eead096e1e","3c96c1a9b3751339390be9d7a5c3694df46212fb97ebddc074547c2338a4c7ba","9e581d0506d2f6ec39226f052a58bc5a020ebc81ae539fa3a6b7fc0db1b94946","704e697441c0af67423458a99f30318c57f1a81c4146beb4dd1a88a88a8c97c3")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("932c91020b74aaa7ffc687e21da0119c","4946b0de3b705878c514e2eead096e1e","3c96c1a9b3751339390be9d7a5c3694df46212fb97ebddc074547c2338a4c7ba","9e581d0506d2f6ec39226f052a58bc5a020ebc81ae539fa3a6b7fc0db1b94946","704e697441c0af67423458a99f30318c57f1a81c4146beb4dd1a88a88a8c97c3")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("932c91020b74aaa7ffc687e21da0119c","4946b0de3b705878c514e2eead096e1e","3c96c1a9b3751339390be9d7a5c3694df46212fb97ebddc074547c2338a4c7ba","9e581d0506d2f6ec39226f052a58bc5a020ebc81ae539fa3a6b7fc0db1b94946","704e697441c0af67423458a99f30318c57f1a81c4146beb4dd1a88a88a8c97c3")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("932c91020b74aaa7ffc687e21da0119c","4946b0de3b705878c514e2eead096e1e","3c96c1a9b3751339390be9d7a5c3694df46212fb97ebddc074547c2338a4c7ba","9e581d0506d2f6ec39226f052a58bc5a020ebc81ae539fa3a6b7fc0db1b94946","704e697441c0af67423458a99f30318c57f1a81c4146beb4dd1a88a88a8c97c3")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring64 NOT NULL AND customstring64 IN ("932c91020b74aaa7ffc687e21da0119c","4946b0de3b705878c514e2eead096e1e","3c96c1a9b3751339390be9d7a5c3694df46212fb97ebddc074547c2338a4c7ba","9e581d0506d2f6ec39226f052a58bc5a020ebc81ae539fa3a6b7fc0db1b94946","704e697441c0af67423458a99f30318c57f1a81c4146beb4dd1a88a88a8c97c3")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("932c91020b74aaa7ffc687e21da0119c","4946b0de3b705878c514e2eead096e1e","3c96c1a9b3751339390be9d7a5c3694df46212fb97ebddc074547c2338a4c7ba","9e581d0506d2f6ec39226f052a58bc5a020ebc81ae539fa3a6b7fc0db1b94946","704e697441c0af67423458a99f30318c57f1a81c4146beb4dd1a88a88a8c97c3")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("932c91020b74aaa7ffc687e21da0119c","4946b0de3b705878c514e2eead096e1e","3c96c1a9b3751339390be9d7a5c3694df46212fb97ebddc074547c2338a4c7ba","9e581d0506d2f6ec39226f052a58bc5a020ebc81ae539fa3a6b7fc0db1b94946","704e697441c0af67423458a99f30318c57f1a81c4146beb4dd1a88a88a8c97c3")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("932c91020b74aaa7ffc687e21da0119c","4946b0de3b705878c514e2eead096e1e","3c96c1a9b3751339390be9d7a5c3694df46212fb97ebddc074547c2338a4c7ba","9e581d0506d2f6ec39226f052a58bc5a020ebc81ae539fa3a6b7fc0db1b94946","704e697441c0af67423458a99f30318c57f1a81c4146beb4dd1a88a88a8c97c3")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring64 NOT NULL AND customstring64 IN ("932c91020b74aaa7ffc687e21da0119c","4946b0de3b705878c514e2eead096e1e","3c96c1a9b3751339390be9d7a5c3694df46212fb97ebddc074547c2338a4c7ba","9e581d0506d2f6ec39226f052a58bc5a020ebc81ae539fa3a6b7fc0db1b94946","704e697441c0af67423458a99f30318c57f1a81c4146beb4dd1a88a88a8c97c3")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("932c91020b74aaa7ffc687e21da0119c","4946b0de3b705878c514e2eead096e1e","3c96c1a9b3751339390be9d7a5c3694df46212fb97ebddc074547c2338a4c7ba","9e581d0506d2f6ec39226f052a58bc5a020ebc81ae539fa3a6b7fc0db1b94946","704e697441c0af67423458a99f30318c57f1a81c4146beb4dd1a88a88a8c97c3")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("932c91020b74aaa7ffc687e21da0119c","4946b0de3b705878c514e2eead096e1e","3c96c1a9b3751339390be9d7a5c3694df46212fb97ebddc074547c2338a4c7ba","9e581d0506d2f6ec39226f052a58bc5a020ebc81ae539fa3a6b7fc0db1b94946","704e697441c0af67423458a99f30318c57f1a81c4146beb4dd1a88a88a8c97c3")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("932c91020b74aaa7ffc687e21da0119c","4946b0de3b705878c514e2eead096e1e","3c96c1a9b3751339390be9d7a5c3694df46212fb97ebddc074547c2338a4c7ba","9e581d0506d2f6ec39226f052a58bc5a020ebc81ae539fa3a6b7fc0db1b94946","704e697441c0af67423458a99f30318c57f1a81c4146beb4dd1a88a88a8c97c3")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring64 NOT NULL AND customstring64 IN ("932c91020b74aaa7ffc687e21da0119c","4946b0de3b705878c514e2eead096e1e","3c96c1a9b3751339390be9d7a5c3694df46212fb97ebddc074547c2338a4c7ba","9e581d0506d2f6ec39226f052a58bc5a020ebc81ae539fa3a6b7fc0db1b94946","704e697441c0af67423458a99f30318c57f1a81c4146beb4dd1a88a88a8c97c3")
index=activity AND rg_functionality="O365 General" AND filehash NOT NULL AND filehash IN ("932c91020b74aaa7ffc687e21da0119c","4946b0de3b705878c514e2eead096e1e","3c96c1a9b3751339390be9d7a5c3694df46212fb97ebddc074547c2338a4c7ba","9e581d0506d2f6ec39226f052a58bc5a020ebc81ae539fa3a6b7fc0db1b94946","704e697441c0af67423458a99f30318c57f1a81c4146beb4dd1a88a88a8c97c3")
index=activity AND rg_functionality="O365 General" AND oldfilehash NOT NULL AND oldfilehash IN ("932c91020b74aaa7ffc687e21da0119c","4946b0de3b705878c514e2eead096e1e","3c96c1a9b3751339390be9d7a5c3694df46212fb97ebddc074547c2338a4c7ba","9e581d0506d2f6ec39226f052a58bc5a020ebc81ae539fa3a6b7fc0db1b94946","704e697441c0af67423458a99f30318c57f1a81c4146beb4dd1a88a88a8c97c3")
index=activity AND rg_functionality="O365 General" AND customstring3 NOT NULL AND customstring3 IN ("932c91020b74aaa7ffc687e21da0119c","4946b0de3b705878c514e2eead096e1e","3c96c1a9b3751339390be9d7a5c3694df46212fb97ebddc074547c2338a4c7ba","9e581d0506d2f6ec39226f052a58bc5a020ebc81ae539fa3a6b7fc0db1b94946","704e697441c0af67423458a99f30318c57f1a81c4146beb4dd1a88a88a8c97c3")
index=activity AND rg_functionality="O365 General" AND customstring64 NOT NULL AND customstring64 IN ("932c91020b74aaa7ffc687e21da0119c","4946b0de3b705878c514e2eead096e1e","3c96c1a9b3751339390be9d7a5c3694df46212fb97ebddc074547c2338a4c7ba","9e581d0506d2f6ec39226f052a58bc5a020ebc81ae539fa3a6b7fc0db1b94946","704e697441c0af67423458a99f30318c57f1a81c4146beb4dd1a88a88a8c97c3")
