index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("4b430e9e43611aa67263f03fd42207c8ad06267d9b971db876b6e62c19a0805e","6efb16aa4fd785f80914e110a4e78d3d430b18cbdd6ebd5e81f904dd58baae61","ea87d504aff24f7daf026008fa1043cb38077eccec9c15bbe24919fc413ec7c7","e3869a6b82e4cf54cc25c46f2324c4bd2411222fd19054d114e7ebd32ca32cd1","29d31cfc4746493730cda891cf88c84f4d2e5c630f61b861acc31f4904c5b16d","461f0803b67799da8548ebfd979053fb99cf110f40ac3fc073c3183e2f6e9ced","b337a3b55e9f6d72e22fe55aba4105805bb0cf121087a3f6c79850705593d904","54f0eaf2c0a3f79c5f95ef5d0c4c9ff30a727ccd08575e97cce278577d106f6b","b75a161caab0a90ef5ce57b889534b5809af3ce2f566af79da9184eaa41135bd","becbfc26aef38e669907a5e454655dc9699085ca9a4e5f6ccd3fe12cde5e0594","2e1c25bf7e2ce2d554fca51291eaeb90c1b7c374410e7656a48af1c0afa34db4")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("4b430e9e43611aa67263f03fd42207c8ad06267d9b971db876b6e62c19a0805e","6efb16aa4fd785f80914e110a4e78d3d430b18cbdd6ebd5e81f904dd58baae61","ea87d504aff24f7daf026008fa1043cb38077eccec9c15bbe24919fc413ec7c7","e3869a6b82e4cf54cc25c46f2324c4bd2411222fd19054d114e7ebd32ca32cd1","29d31cfc4746493730cda891cf88c84f4d2e5c630f61b861acc31f4904c5b16d","461f0803b67799da8548ebfd979053fb99cf110f40ac3fc073c3183e2f6e9ced","b337a3b55e9f6d72e22fe55aba4105805bb0cf121087a3f6c79850705593d904","54f0eaf2c0a3f79c5f95ef5d0c4c9ff30a727ccd08575e97cce278577d106f6b","b75a161caab0a90ef5ce57b889534b5809af3ce2f566af79da9184eaa41135bd","becbfc26aef38e669907a5e454655dc9699085ca9a4e5f6ccd3fe12cde5e0594","2e1c25bf7e2ce2d554fca51291eaeb90c1b7c374410e7656a48af1c0afa34db4")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("4b430e9e43611aa67263f03fd42207c8ad06267d9b971db876b6e62c19a0805e","6efb16aa4fd785f80914e110a4e78d3d430b18cbdd6ebd5e81f904dd58baae61","ea87d504aff24f7daf026008fa1043cb38077eccec9c15bbe24919fc413ec7c7","e3869a6b82e4cf54cc25c46f2324c4bd2411222fd19054d114e7ebd32ca32cd1","29d31cfc4746493730cda891cf88c84f4d2e5c630f61b861acc31f4904c5b16d","461f0803b67799da8548ebfd979053fb99cf110f40ac3fc073c3183e2f6e9ced","b337a3b55e9f6d72e22fe55aba4105805bb0cf121087a3f6c79850705593d904","54f0eaf2c0a3f79c5f95ef5d0c4c9ff30a727ccd08575e97cce278577d106f6b","b75a161caab0a90ef5ce57b889534b5809af3ce2f566af79da9184eaa41135bd","becbfc26aef38e669907a5e454655dc9699085ca9a4e5f6ccd3fe12cde5e0594","2e1c25bf7e2ce2d554fca51291eaeb90c1b7c374410e7656a48af1c0afa34db4")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring64 NOT NULL AND customstring64 IN ("4b430e9e43611aa67263f03fd42207c8ad06267d9b971db876b6e62c19a0805e","6efb16aa4fd785f80914e110a4e78d3d430b18cbdd6ebd5e81f904dd58baae61","ea87d504aff24f7daf026008fa1043cb38077eccec9c15bbe24919fc413ec7c7","e3869a6b82e4cf54cc25c46f2324c4bd2411222fd19054d114e7ebd32ca32cd1","29d31cfc4746493730cda891cf88c84f4d2e5c630f61b861acc31f4904c5b16d","461f0803b67799da8548ebfd979053fb99cf110f40ac3fc073c3183e2f6e9ced","b337a3b55e9f6d72e22fe55aba4105805bb0cf121087a3f6c79850705593d904","54f0eaf2c0a3f79c5f95ef5d0c4c9ff30a727ccd08575e97cce278577d106f6b","b75a161caab0a90ef5ce57b889534b5809af3ce2f566af79da9184eaa41135bd","becbfc26aef38e669907a5e454655dc9699085ca9a4e5f6ccd3fe12cde5e0594","2e1c25bf7e2ce2d554fca51291eaeb90c1b7c374410e7656a48af1c0afa34db4")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("4b430e9e43611aa67263f03fd42207c8ad06267d9b971db876b6e62c19a0805e","6efb16aa4fd785f80914e110a4e78d3d430b18cbdd6ebd5e81f904dd58baae61","ea87d504aff24f7daf026008fa1043cb38077eccec9c15bbe24919fc413ec7c7","e3869a6b82e4cf54cc25c46f2324c4bd2411222fd19054d114e7ebd32ca32cd1","29d31cfc4746493730cda891cf88c84f4d2e5c630f61b861acc31f4904c5b16d","461f0803b67799da8548ebfd979053fb99cf110f40ac3fc073c3183e2f6e9ced","b337a3b55e9f6d72e22fe55aba4105805bb0cf121087a3f6c79850705593d904","54f0eaf2c0a3f79c5f95ef5d0c4c9ff30a727ccd08575e97cce278577d106f6b","b75a161caab0a90ef5ce57b889534b5809af3ce2f566af79da9184eaa41135bd","becbfc26aef38e669907a5e454655dc9699085ca9a4e5f6ccd3fe12cde5e0594","2e1c25bf7e2ce2d554fca51291eaeb90c1b7c374410e7656a48af1c0afa34db4")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("4b430e9e43611aa67263f03fd42207c8ad06267d9b971db876b6e62c19a0805e","6efb16aa4fd785f80914e110a4e78d3d430b18cbdd6ebd5e81f904dd58baae61","ea87d504aff24f7daf026008fa1043cb38077eccec9c15bbe24919fc413ec7c7","e3869a6b82e4cf54cc25c46f2324c4bd2411222fd19054d114e7ebd32ca32cd1","29d31cfc4746493730cda891cf88c84f4d2e5c630f61b861acc31f4904c5b16d","461f0803b67799da8548ebfd979053fb99cf110f40ac3fc073c3183e2f6e9ced","b337a3b55e9f6d72e22fe55aba4105805bb0cf121087a3f6c79850705593d904","54f0eaf2c0a3f79c5f95ef5d0c4c9ff30a727ccd08575e97cce278577d106f6b","b75a161caab0a90ef5ce57b889534b5809af3ce2f566af79da9184eaa41135bd","becbfc26aef38e669907a5e454655dc9699085ca9a4e5f6ccd3fe12cde5e0594","2e1c25bf7e2ce2d554fca51291eaeb90c1b7c374410e7656a48af1c0afa34db4")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("4b430e9e43611aa67263f03fd42207c8ad06267d9b971db876b6e62c19a0805e","6efb16aa4fd785f80914e110a4e78d3d430b18cbdd6ebd5e81f904dd58baae61","ea87d504aff24f7daf026008fa1043cb38077eccec9c15bbe24919fc413ec7c7","e3869a6b82e4cf54cc25c46f2324c4bd2411222fd19054d114e7ebd32ca32cd1","29d31cfc4746493730cda891cf88c84f4d2e5c630f61b861acc31f4904c5b16d","461f0803b67799da8548ebfd979053fb99cf110f40ac3fc073c3183e2f6e9ced","b337a3b55e9f6d72e22fe55aba4105805bb0cf121087a3f6c79850705593d904","54f0eaf2c0a3f79c5f95ef5d0c4c9ff30a727ccd08575e97cce278577d106f6b","b75a161caab0a90ef5ce57b889534b5809af3ce2f566af79da9184eaa41135bd","becbfc26aef38e669907a5e454655dc9699085ca9a4e5f6ccd3fe12cde5e0594","2e1c25bf7e2ce2d554fca51291eaeb90c1b7c374410e7656a48af1c0afa34db4")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("4b430e9e43611aa67263f03fd42207c8ad06267d9b971db876b6e62c19a0805e","6efb16aa4fd785f80914e110a4e78d3d430b18cbdd6ebd5e81f904dd58baae61","ea87d504aff24f7daf026008fa1043cb38077eccec9c15bbe24919fc413ec7c7","e3869a6b82e4cf54cc25c46f2324c4bd2411222fd19054d114e7ebd32ca32cd1","29d31cfc4746493730cda891cf88c84f4d2e5c630f61b861acc31f4904c5b16d","461f0803b67799da8548ebfd979053fb99cf110f40ac3fc073c3183e2f6e9ced","b337a3b55e9f6d72e22fe55aba4105805bb0cf121087a3f6c79850705593d904","54f0eaf2c0a3f79c5f95ef5d0c4c9ff30a727ccd08575e97cce278577d106f6b","b75a161caab0a90ef5ce57b889534b5809af3ce2f566af79da9184eaa41135bd","becbfc26aef38e669907a5e454655dc9699085ca9a4e5f6ccd3fe12cde5e0594","2e1c25bf7e2ce2d554fca51291eaeb90c1b7c374410e7656a48af1c0afa34db4")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("4b430e9e43611aa67263f03fd42207c8ad06267d9b971db876b6e62c19a0805e","6efb16aa4fd785f80914e110a4e78d3d430b18cbdd6ebd5e81f904dd58baae61","ea87d504aff24f7daf026008fa1043cb38077eccec9c15bbe24919fc413ec7c7","e3869a6b82e4cf54cc25c46f2324c4bd2411222fd19054d114e7ebd32ca32cd1","29d31cfc4746493730cda891cf88c84f4d2e5c630f61b861acc31f4904c5b16d","461f0803b67799da8548ebfd979053fb99cf110f40ac3fc073c3183e2f6e9ced","b337a3b55e9f6d72e22fe55aba4105805bb0cf121087a3f6c79850705593d904","54f0eaf2c0a3f79c5f95ef5d0c4c9ff30a727ccd08575e97cce278577d106f6b","b75a161caab0a90ef5ce57b889534b5809af3ce2f566af79da9184eaa41135bd","becbfc26aef38e669907a5e454655dc9699085ca9a4e5f6ccd3fe12cde5e0594","2e1c25bf7e2ce2d554fca51291eaeb90c1b7c374410e7656a48af1c0afa34db4")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("4b430e9e43611aa67263f03fd42207c8ad06267d9b971db876b6e62c19a0805e","6efb16aa4fd785f80914e110a4e78d3d430b18cbdd6ebd5e81f904dd58baae61","ea87d504aff24f7daf026008fa1043cb38077eccec9c15bbe24919fc413ec7c7","e3869a6b82e4cf54cc25c46f2324c4bd2411222fd19054d114e7ebd32ca32cd1","29d31cfc4746493730cda891cf88c84f4d2e5c630f61b861acc31f4904c5b16d","461f0803b67799da8548ebfd979053fb99cf110f40ac3fc073c3183e2f6e9ced","b337a3b55e9f6d72e22fe55aba4105805bb0cf121087a3f6c79850705593d904","54f0eaf2c0a3f79c5f95ef5d0c4c9ff30a727ccd08575e97cce278577d106f6b","b75a161caab0a90ef5ce57b889534b5809af3ce2f566af79da9184eaa41135bd","becbfc26aef38e669907a5e454655dc9699085ca9a4e5f6ccd3fe12cde5e0594","2e1c25bf7e2ce2d554fca51291eaeb90c1b7c374410e7656a48af1c0afa34db4")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("4b430e9e43611aa67263f03fd42207c8ad06267d9b971db876b6e62c19a0805e","6efb16aa4fd785f80914e110a4e78d3d430b18cbdd6ebd5e81f904dd58baae61","ea87d504aff24f7daf026008fa1043cb38077eccec9c15bbe24919fc413ec7c7","e3869a6b82e4cf54cc25c46f2324c4bd2411222fd19054d114e7ebd32ca32cd1","29d31cfc4746493730cda891cf88c84f4d2e5c630f61b861acc31f4904c5b16d","461f0803b67799da8548ebfd979053fb99cf110f40ac3fc073c3183e2f6e9ced","b337a3b55e9f6d72e22fe55aba4105805bb0cf121087a3f6c79850705593d904","54f0eaf2c0a3f79c5f95ef5d0c4c9ff30a727ccd08575e97cce278577d106f6b","b75a161caab0a90ef5ce57b889534b5809af3ce2f566af79da9184eaa41135bd","becbfc26aef38e669907a5e454655dc9699085ca9a4e5f6ccd3fe12cde5e0594","2e1c25bf7e2ce2d554fca51291eaeb90c1b7c374410e7656a48af1c0afa34db4")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("4b430e9e43611aa67263f03fd42207c8ad06267d9b971db876b6e62c19a0805e","6efb16aa4fd785f80914e110a4e78d3d430b18cbdd6ebd5e81f904dd58baae61","ea87d504aff24f7daf026008fa1043cb38077eccec9c15bbe24919fc413ec7c7","e3869a6b82e4cf54cc25c46f2324c4bd2411222fd19054d114e7ebd32ca32cd1","29d31cfc4746493730cda891cf88c84f4d2e5c630f61b861acc31f4904c5b16d","461f0803b67799da8548ebfd979053fb99cf110f40ac3fc073c3183e2f6e9ced","b337a3b55e9f6d72e22fe55aba4105805bb0cf121087a3f6c79850705593d904","54f0eaf2c0a3f79c5f95ef5d0c4c9ff30a727ccd08575e97cce278577d106f6b","b75a161caab0a90ef5ce57b889534b5809af3ce2f566af79da9184eaa41135bd","becbfc26aef38e669907a5e454655dc9699085ca9a4e5f6ccd3fe12cde5e0594","2e1c25bf7e2ce2d554fca51291eaeb90c1b7c374410e7656a48af1c0afa34db4")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("4b430e9e43611aa67263f03fd42207c8ad06267d9b971db876b6e62c19a0805e","6efb16aa4fd785f80914e110a4e78d3d430b18cbdd6ebd5e81f904dd58baae61","ea87d504aff24f7daf026008fa1043cb38077eccec9c15bbe24919fc413ec7c7","e3869a6b82e4cf54cc25c46f2324c4bd2411222fd19054d114e7ebd32ca32cd1","29d31cfc4746493730cda891cf88c84f4d2e5c630f61b861acc31f4904c5b16d","461f0803b67799da8548ebfd979053fb99cf110f40ac3fc073c3183e2f6e9ced","b337a3b55e9f6d72e22fe55aba4105805bb0cf121087a3f6c79850705593d904","54f0eaf2c0a3f79c5f95ef5d0c4c9ff30a727ccd08575e97cce278577d106f6b","b75a161caab0a90ef5ce57b889534b5809af3ce2f566af79da9184eaa41135bd","becbfc26aef38e669907a5e454655dc9699085ca9a4e5f6ccd3fe12cde5e0594","2e1c25bf7e2ce2d554fca51291eaeb90c1b7c374410e7656a48af1c0afa34db4")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("4b430e9e43611aa67263f03fd42207c8ad06267d9b971db876b6e62c19a0805e","6efb16aa4fd785f80914e110a4e78d3d430b18cbdd6ebd5e81f904dd58baae61","ea87d504aff24f7daf026008fa1043cb38077eccec9c15bbe24919fc413ec7c7","e3869a6b82e4cf54cc25c46f2324c4bd2411222fd19054d114e7ebd32ca32cd1","29d31cfc4746493730cda891cf88c84f4d2e5c630f61b861acc31f4904c5b16d","461f0803b67799da8548ebfd979053fb99cf110f40ac3fc073c3183e2f6e9ced","b337a3b55e9f6d72e22fe55aba4105805bb0cf121087a3f6c79850705593d904","54f0eaf2c0a3f79c5f95ef5d0c4c9ff30a727ccd08575e97cce278577d106f6b","b75a161caab0a90ef5ce57b889534b5809af3ce2f566af79da9184eaa41135bd","becbfc26aef38e669907a5e454655dc9699085ca9a4e5f6ccd3fe12cde5e0594","2e1c25bf7e2ce2d554fca51291eaeb90c1b7c374410e7656a48af1c0afa34db4")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("4b430e9e43611aa67263f03fd42207c8ad06267d9b971db876b6e62c19a0805e","6efb16aa4fd785f80914e110a4e78d3d430b18cbdd6ebd5e81f904dd58baae61","ea87d504aff24f7daf026008fa1043cb38077eccec9c15bbe24919fc413ec7c7","e3869a6b82e4cf54cc25c46f2324c4bd2411222fd19054d114e7ebd32ca32cd1","29d31cfc4746493730cda891cf88c84f4d2e5c630f61b861acc31f4904c5b16d","461f0803b67799da8548ebfd979053fb99cf110f40ac3fc073c3183e2f6e9ced","b337a3b55e9f6d72e22fe55aba4105805bb0cf121087a3f6c79850705593d904","54f0eaf2c0a3f79c5f95ef5d0c4c9ff30a727ccd08575e97cce278577d106f6b","b75a161caab0a90ef5ce57b889534b5809af3ce2f566af79da9184eaa41135bd","becbfc26aef38e669907a5e454655dc9699085ca9a4e5f6ccd3fe12cde5e0594","2e1c25bf7e2ce2d554fca51291eaeb90c1b7c374410e7656a48af1c0afa34db4")
index=activity AND rg_functionality="Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("4b430e9e43611aa67263f03fd42207c8ad06267d9b971db876b6e62c19a0805e","6efb16aa4fd785f80914e110a4e78d3d430b18cbdd6ebd5e81f904dd58baae61","ea87d504aff24f7daf026008fa1043cb38077eccec9c15bbe24919fc413ec7c7","e3869a6b82e4cf54cc25c46f2324c4bd2411222fd19054d114e7ebd32ca32cd1","29d31cfc4746493730cda891cf88c84f4d2e5c630f61b861acc31f4904c5b16d","461f0803b67799da8548ebfd979053fb99cf110f40ac3fc073c3183e2f6e9ced","b337a3b55e9f6d72e22fe55aba4105805bb0cf121087a3f6c79850705593d904","54f0eaf2c0a3f79c5f95ef5d0c4c9ff30a727ccd08575e97cce278577d106f6b","b75a161caab0a90ef5ce57b889534b5809af3ce2f566af79da9184eaa41135bd","becbfc26aef38e669907a5e454655dc9699085ca9a4e5f6ccd3fe12cde5e0594","2e1c25bf7e2ce2d554fca51291eaeb90c1b7c374410e7656a48af1c0afa34db4")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("4b430e9e43611aa67263f03fd42207c8ad06267d9b971db876b6e62c19a0805e","6efb16aa4fd785f80914e110a4e78d3d430b18cbdd6ebd5e81f904dd58baae61","ea87d504aff24f7daf026008fa1043cb38077eccec9c15bbe24919fc413ec7c7","e3869a6b82e4cf54cc25c46f2324c4bd2411222fd19054d114e7ebd32ca32cd1","29d31cfc4746493730cda891cf88c84f4d2e5c630f61b861acc31f4904c5b16d","461f0803b67799da8548ebfd979053fb99cf110f40ac3fc073c3183e2f6e9ced","b337a3b55e9f6d72e22fe55aba4105805bb0cf121087a3f6c79850705593d904","54f0eaf2c0a3f79c5f95ef5d0c4c9ff30a727ccd08575e97cce278577d106f6b","b75a161caab0a90ef5ce57b889534b5809af3ce2f566af79da9184eaa41135bd","becbfc26aef38e669907a5e454655dc9699085ca9a4e5f6ccd3fe12cde5e0594","2e1c25bf7e2ce2d554fca51291eaeb90c1b7c374410e7656a48af1c0afa34db4")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("4b430e9e43611aa67263f03fd42207c8ad06267d9b971db876b6e62c19a0805e","6efb16aa4fd785f80914e110a4e78d3d430b18cbdd6ebd5e81f904dd58baae61","ea87d504aff24f7daf026008fa1043cb38077eccec9c15bbe24919fc413ec7c7","e3869a6b82e4cf54cc25c46f2324c4bd2411222fd19054d114e7ebd32ca32cd1","29d31cfc4746493730cda891cf88c84f4d2e5c630f61b861acc31f4904c5b16d","461f0803b67799da8548ebfd979053fb99cf110f40ac3fc073c3183e2f6e9ced","b337a3b55e9f6d72e22fe55aba4105805bb0cf121087a3f6c79850705593d904","54f0eaf2c0a3f79c5f95ef5d0c4c9ff30a727ccd08575e97cce278577d106f6b","b75a161caab0a90ef5ce57b889534b5809af3ce2f566af79da9184eaa41135bd","becbfc26aef38e669907a5e454655dc9699085ca9a4e5f6ccd3fe12cde5e0594","2e1c25bf7e2ce2d554fca51291eaeb90c1b7c374410e7656a48af1c0afa34db4")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("4b430e9e43611aa67263f03fd42207c8ad06267d9b971db876b6e62c19a0805e","6efb16aa4fd785f80914e110a4e78d3d430b18cbdd6ebd5e81f904dd58baae61","ea87d504aff24f7daf026008fa1043cb38077eccec9c15bbe24919fc413ec7c7","e3869a6b82e4cf54cc25c46f2324c4bd2411222fd19054d114e7ebd32ca32cd1","29d31cfc4746493730cda891cf88c84f4d2e5c630f61b861acc31f4904c5b16d","461f0803b67799da8548ebfd979053fb99cf110f40ac3fc073c3183e2f6e9ced","b337a3b55e9f6d72e22fe55aba4105805bb0cf121087a3f6c79850705593d904","54f0eaf2c0a3f79c5f95ef5d0c4c9ff30a727ccd08575e97cce278577d106f6b","b75a161caab0a90ef5ce57b889534b5809af3ce2f566af79da9184eaa41135bd","becbfc26aef38e669907a5e454655dc9699085ca9a4e5f6ccd3fe12cde5e0594","2e1c25bf7e2ce2d554fca51291eaeb90c1b7c374410e7656a48af1c0afa34db4")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("4b430e9e43611aa67263f03fd42207c8ad06267d9b971db876b6e62c19a0805e","6efb16aa4fd785f80914e110a4e78d3d430b18cbdd6ebd5e81f904dd58baae61","ea87d504aff24f7daf026008fa1043cb38077eccec9c15bbe24919fc413ec7c7","e3869a6b82e4cf54cc25c46f2324c4bd2411222fd19054d114e7ebd32ca32cd1","29d31cfc4746493730cda891cf88c84f4d2e5c630f61b861acc31f4904c5b16d","461f0803b67799da8548ebfd979053fb99cf110f40ac3fc073c3183e2f6e9ced","b337a3b55e9f6d72e22fe55aba4105805bb0cf121087a3f6c79850705593d904","54f0eaf2c0a3f79c5f95ef5d0c4c9ff30a727ccd08575e97cce278577d106f6b","b75a161caab0a90ef5ce57b889534b5809af3ce2f566af79da9184eaa41135bd","becbfc26aef38e669907a5e454655dc9699085ca9a4e5f6ccd3fe12cde5e0594","2e1c25bf7e2ce2d554fca51291eaeb90c1b7c374410e7656a48af1c0afa34db4")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("4b430e9e43611aa67263f03fd42207c8ad06267d9b971db876b6e62c19a0805e","6efb16aa4fd785f80914e110a4e78d3d430b18cbdd6ebd5e81f904dd58baae61","ea87d504aff24f7daf026008fa1043cb38077eccec9c15bbe24919fc413ec7c7","e3869a6b82e4cf54cc25c46f2324c4bd2411222fd19054d114e7ebd32ca32cd1","29d31cfc4746493730cda891cf88c84f4d2e5c630f61b861acc31f4904c5b16d","461f0803b67799da8548ebfd979053fb99cf110f40ac3fc073c3183e2f6e9ced","b337a3b55e9f6d72e22fe55aba4105805bb0cf121087a3f6c79850705593d904","54f0eaf2c0a3f79c5f95ef5d0c4c9ff30a727ccd08575e97cce278577d106f6b","b75a161caab0a90ef5ce57b889534b5809af3ce2f566af79da9184eaa41135bd","becbfc26aef38e669907a5e454655dc9699085ca9a4e5f6ccd3fe12cde5e0594","2e1c25bf7e2ce2d554fca51291eaeb90c1b7c374410e7656a48af1c0afa34db4")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("4b430e9e43611aa67263f03fd42207c8ad06267d9b971db876b6e62c19a0805e","6efb16aa4fd785f80914e110a4e78d3d430b18cbdd6ebd5e81f904dd58baae61","ea87d504aff24f7daf026008fa1043cb38077eccec9c15bbe24919fc413ec7c7","e3869a6b82e4cf54cc25c46f2324c4bd2411222fd19054d114e7ebd32ca32cd1","29d31cfc4746493730cda891cf88c84f4d2e5c630f61b861acc31f4904c5b16d","461f0803b67799da8548ebfd979053fb99cf110f40ac3fc073c3183e2f6e9ced","b337a3b55e9f6d72e22fe55aba4105805bb0cf121087a3f6c79850705593d904","54f0eaf2c0a3f79c5f95ef5d0c4c9ff30a727ccd08575e97cce278577d106f6b","b75a161caab0a90ef5ce57b889534b5809af3ce2f566af79da9184eaa41135bd","becbfc26aef38e669907a5e454655dc9699085ca9a4e5f6ccd3fe12cde5e0594","2e1c25bf7e2ce2d554fca51291eaeb90c1b7c374410e7656a48af1c0afa34db4")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("4b430e9e43611aa67263f03fd42207c8ad06267d9b971db876b6e62c19a0805e","6efb16aa4fd785f80914e110a4e78d3d430b18cbdd6ebd5e81f904dd58baae61","ea87d504aff24f7daf026008fa1043cb38077eccec9c15bbe24919fc413ec7c7","e3869a6b82e4cf54cc25c46f2324c4bd2411222fd19054d114e7ebd32ca32cd1","29d31cfc4746493730cda891cf88c84f4d2e5c630f61b861acc31f4904c5b16d","461f0803b67799da8548ebfd979053fb99cf110f40ac3fc073c3183e2f6e9ced","b337a3b55e9f6d72e22fe55aba4105805bb0cf121087a3f6c79850705593d904","54f0eaf2c0a3f79c5f95ef5d0c4c9ff30a727ccd08575e97cce278577d106f6b","b75a161caab0a90ef5ce57b889534b5809af3ce2f566af79da9184eaa41135bd","becbfc26aef38e669907a5e454655dc9699085ca9a4e5f6ccd3fe12cde5e0594","2e1c25bf7e2ce2d554fca51291eaeb90c1b7c374410e7656a48af1c0afa34db4")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring64 NOT NULL AND customstring64 IN ("4b430e9e43611aa67263f03fd42207c8ad06267d9b971db876b6e62c19a0805e","6efb16aa4fd785f80914e110a4e78d3d430b18cbdd6ebd5e81f904dd58baae61","ea87d504aff24f7daf026008fa1043cb38077eccec9c15bbe24919fc413ec7c7","e3869a6b82e4cf54cc25c46f2324c4bd2411222fd19054d114e7ebd32ca32cd1","29d31cfc4746493730cda891cf88c84f4d2e5c630f61b861acc31f4904c5b16d","461f0803b67799da8548ebfd979053fb99cf110f40ac3fc073c3183e2f6e9ced","b337a3b55e9f6d72e22fe55aba4105805bb0cf121087a3f6c79850705593d904","54f0eaf2c0a3f79c5f95ef5d0c4c9ff30a727ccd08575e97cce278577d106f6b","b75a161caab0a90ef5ce57b889534b5809af3ce2f566af79da9184eaa41135bd","becbfc26aef38e669907a5e454655dc9699085ca9a4e5f6ccd3fe12cde5e0594","2e1c25bf7e2ce2d554fca51291eaeb90c1b7c374410e7656a48af1c0afa34db4")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("4b430e9e43611aa67263f03fd42207c8ad06267d9b971db876b6e62c19a0805e","6efb16aa4fd785f80914e110a4e78d3d430b18cbdd6ebd5e81f904dd58baae61","ea87d504aff24f7daf026008fa1043cb38077eccec9c15bbe24919fc413ec7c7","e3869a6b82e4cf54cc25c46f2324c4bd2411222fd19054d114e7ebd32ca32cd1","29d31cfc4746493730cda891cf88c84f4d2e5c630f61b861acc31f4904c5b16d","461f0803b67799da8548ebfd979053fb99cf110f40ac3fc073c3183e2f6e9ced","b337a3b55e9f6d72e22fe55aba4105805bb0cf121087a3f6c79850705593d904","54f0eaf2c0a3f79c5f95ef5d0c4c9ff30a727ccd08575e97cce278577d106f6b","b75a161caab0a90ef5ce57b889534b5809af3ce2f566af79da9184eaa41135bd","becbfc26aef38e669907a5e454655dc9699085ca9a4e5f6ccd3fe12cde5e0594","2e1c25bf7e2ce2d554fca51291eaeb90c1b7c374410e7656a48af1c0afa34db4")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("4b430e9e43611aa67263f03fd42207c8ad06267d9b971db876b6e62c19a0805e","6efb16aa4fd785f80914e110a4e78d3d430b18cbdd6ebd5e81f904dd58baae61","ea87d504aff24f7daf026008fa1043cb38077eccec9c15bbe24919fc413ec7c7","e3869a6b82e4cf54cc25c46f2324c4bd2411222fd19054d114e7ebd32ca32cd1","29d31cfc4746493730cda891cf88c84f4d2e5c630f61b861acc31f4904c5b16d","461f0803b67799da8548ebfd979053fb99cf110f40ac3fc073c3183e2f6e9ced","b337a3b55e9f6d72e22fe55aba4105805bb0cf121087a3f6c79850705593d904","54f0eaf2c0a3f79c5f95ef5d0c4c9ff30a727ccd08575e97cce278577d106f6b","b75a161caab0a90ef5ce57b889534b5809af3ce2f566af79da9184eaa41135bd","becbfc26aef38e669907a5e454655dc9699085ca9a4e5f6ccd3fe12cde5e0594","2e1c25bf7e2ce2d554fca51291eaeb90c1b7c374410e7656a48af1c0afa34db4")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("4b430e9e43611aa67263f03fd42207c8ad06267d9b971db876b6e62c19a0805e","6efb16aa4fd785f80914e110a4e78d3d430b18cbdd6ebd5e81f904dd58baae61","ea87d504aff24f7daf026008fa1043cb38077eccec9c15bbe24919fc413ec7c7","e3869a6b82e4cf54cc25c46f2324c4bd2411222fd19054d114e7ebd32ca32cd1","29d31cfc4746493730cda891cf88c84f4d2e5c630f61b861acc31f4904c5b16d","461f0803b67799da8548ebfd979053fb99cf110f40ac3fc073c3183e2f6e9ced","b337a3b55e9f6d72e22fe55aba4105805bb0cf121087a3f6c79850705593d904","54f0eaf2c0a3f79c5f95ef5d0c4c9ff30a727ccd08575e97cce278577d106f6b","b75a161caab0a90ef5ce57b889534b5809af3ce2f566af79da9184eaa41135bd","becbfc26aef38e669907a5e454655dc9699085ca9a4e5f6ccd3fe12cde5e0594","2e1c25bf7e2ce2d554fca51291eaeb90c1b7c374410e7656a48af1c0afa34db4")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring64 NOT NULL AND customstring64 IN ("4b430e9e43611aa67263f03fd42207c8ad06267d9b971db876b6e62c19a0805e","6efb16aa4fd785f80914e110a4e78d3d430b18cbdd6ebd5e81f904dd58baae61","ea87d504aff24f7daf026008fa1043cb38077eccec9c15bbe24919fc413ec7c7","e3869a6b82e4cf54cc25c46f2324c4bd2411222fd19054d114e7ebd32ca32cd1","29d31cfc4746493730cda891cf88c84f4d2e5c630f61b861acc31f4904c5b16d","461f0803b67799da8548ebfd979053fb99cf110f40ac3fc073c3183e2f6e9ced","b337a3b55e9f6d72e22fe55aba4105805bb0cf121087a3f6c79850705593d904","54f0eaf2c0a3f79c5f95ef5d0c4c9ff30a727ccd08575e97cce278577d106f6b","b75a161caab0a90ef5ce57b889534b5809af3ce2f566af79da9184eaa41135bd","becbfc26aef38e669907a5e454655dc9699085ca9a4e5f6ccd3fe12cde5e0594","2e1c25bf7e2ce2d554fca51291eaeb90c1b7c374410e7656a48af1c0afa34db4")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("4b430e9e43611aa67263f03fd42207c8ad06267d9b971db876b6e62c19a0805e","6efb16aa4fd785f80914e110a4e78d3d430b18cbdd6ebd5e81f904dd58baae61","ea87d504aff24f7daf026008fa1043cb38077eccec9c15bbe24919fc413ec7c7","e3869a6b82e4cf54cc25c46f2324c4bd2411222fd19054d114e7ebd32ca32cd1","29d31cfc4746493730cda891cf88c84f4d2e5c630f61b861acc31f4904c5b16d","461f0803b67799da8548ebfd979053fb99cf110f40ac3fc073c3183e2f6e9ced","b337a3b55e9f6d72e22fe55aba4105805bb0cf121087a3f6c79850705593d904","54f0eaf2c0a3f79c5f95ef5d0c4c9ff30a727ccd08575e97cce278577d106f6b","b75a161caab0a90ef5ce57b889534b5809af3ce2f566af79da9184eaa41135bd","becbfc26aef38e669907a5e454655dc9699085ca9a4e5f6ccd3fe12cde5e0594","2e1c25bf7e2ce2d554fca51291eaeb90c1b7c374410e7656a48af1c0afa34db4")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("4b430e9e43611aa67263f03fd42207c8ad06267d9b971db876b6e62c19a0805e","6efb16aa4fd785f80914e110a4e78d3d430b18cbdd6ebd5e81f904dd58baae61","ea87d504aff24f7daf026008fa1043cb38077eccec9c15bbe24919fc413ec7c7","e3869a6b82e4cf54cc25c46f2324c4bd2411222fd19054d114e7ebd32ca32cd1","29d31cfc4746493730cda891cf88c84f4d2e5c630f61b861acc31f4904c5b16d","461f0803b67799da8548ebfd979053fb99cf110f40ac3fc073c3183e2f6e9ced","b337a3b55e9f6d72e22fe55aba4105805bb0cf121087a3f6c79850705593d904","54f0eaf2c0a3f79c5f95ef5d0c4c9ff30a727ccd08575e97cce278577d106f6b","b75a161caab0a90ef5ce57b889534b5809af3ce2f566af79da9184eaa41135bd","becbfc26aef38e669907a5e454655dc9699085ca9a4e5f6ccd3fe12cde5e0594","2e1c25bf7e2ce2d554fca51291eaeb90c1b7c374410e7656a48af1c0afa34db4")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("4b430e9e43611aa67263f03fd42207c8ad06267d9b971db876b6e62c19a0805e","6efb16aa4fd785f80914e110a4e78d3d430b18cbdd6ebd5e81f904dd58baae61","ea87d504aff24f7daf026008fa1043cb38077eccec9c15bbe24919fc413ec7c7","e3869a6b82e4cf54cc25c46f2324c4bd2411222fd19054d114e7ebd32ca32cd1","29d31cfc4746493730cda891cf88c84f4d2e5c630f61b861acc31f4904c5b16d","461f0803b67799da8548ebfd979053fb99cf110f40ac3fc073c3183e2f6e9ced","b337a3b55e9f6d72e22fe55aba4105805bb0cf121087a3f6c79850705593d904","54f0eaf2c0a3f79c5f95ef5d0c4c9ff30a727ccd08575e97cce278577d106f6b","b75a161caab0a90ef5ce57b889534b5809af3ce2f566af79da9184eaa41135bd","becbfc26aef38e669907a5e454655dc9699085ca9a4e5f6ccd3fe12cde5e0594","2e1c25bf7e2ce2d554fca51291eaeb90c1b7c374410e7656a48af1c0afa34db4")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring64 NOT NULL AND customstring64 IN ("4b430e9e43611aa67263f03fd42207c8ad06267d9b971db876b6e62c19a0805e","6efb16aa4fd785f80914e110a4e78d3d430b18cbdd6ebd5e81f904dd58baae61","ea87d504aff24f7daf026008fa1043cb38077eccec9c15bbe24919fc413ec7c7","e3869a6b82e4cf54cc25c46f2324c4bd2411222fd19054d114e7ebd32ca32cd1","29d31cfc4746493730cda891cf88c84f4d2e5c630f61b861acc31f4904c5b16d","461f0803b67799da8548ebfd979053fb99cf110f40ac3fc073c3183e2f6e9ced","b337a3b55e9f6d72e22fe55aba4105805bb0cf121087a3f6c79850705593d904","54f0eaf2c0a3f79c5f95ef5d0c4c9ff30a727ccd08575e97cce278577d106f6b","b75a161caab0a90ef5ce57b889534b5809af3ce2f566af79da9184eaa41135bd","becbfc26aef38e669907a5e454655dc9699085ca9a4e5f6ccd3fe12cde5e0594","2e1c25bf7e2ce2d554fca51291eaeb90c1b7c374410e7656a48af1c0afa34db4")
index=activity AND rg_functionality="O365 General" AND filehash NOT NULL AND filehash IN ("4b430e9e43611aa67263f03fd42207c8ad06267d9b971db876b6e62c19a0805e","6efb16aa4fd785f80914e110a4e78d3d430b18cbdd6ebd5e81f904dd58baae61","ea87d504aff24f7daf026008fa1043cb38077eccec9c15bbe24919fc413ec7c7","e3869a6b82e4cf54cc25c46f2324c4bd2411222fd19054d114e7ebd32ca32cd1","29d31cfc4746493730cda891cf88c84f4d2e5c630f61b861acc31f4904c5b16d","461f0803b67799da8548ebfd979053fb99cf110f40ac3fc073c3183e2f6e9ced","b337a3b55e9f6d72e22fe55aba4105805bb0cf121087a3f6c79850705593d904","54f0eaf2c0a3f79c5f95ef5d0c4c9ff30a727ccd08575e97cce278577d106f6b","b75a161caab0a90ef5ce57b889534b5809af3ce2f566af79da9184eaa41135bd","becbfc26aef38e669907a5e454655dc9699085ca9a4e5f6ccd3fe12cde5e0594","2e1c25bf7e2ce2d554fca51291eaeb90c1b7c374410e7656a48af1c0afa34db4")
index=activity AND rg_functionality="O365 General" AND oldfilehash NOT NULL AND oldfilehash IN ("4b430e9e43611aa67263f03fd42207c8ad06267d9b971db876b6e62c19a0805e","6efb16aa4fd785f80914e110a4e78d3d430b18cbdd6ebd5e81f904dd58baae61","ea87d504aff24f7daf026008fa1043cb38077eccec9c15bbe24919fc413ec7c7","e3869a6b82e4cf54cc25c46f2324c4bd2411222fd19054d114e7ebd32ca32cd1","29d31cfc4746493730cda891cf88c84f4d2e5c630f61b861acc31f4904c5b16d","461f0803b67799da8548ebfd979053fb99cf110f40ac3fc073c3183e2f6e9ced","b337a3b55e9f6d72e22fe55aba4105805bb0cf121087a3f6c79850705593d904","54f0eaf2c0a3f79c5f95ef5d0c4c9ff30a727ccd08575e97cce278577d106f6b","b75a161caab0a90ef5ce57b889534b5809af3ce2f566af79da9184eaa41135bd","becbfc26aef38e669907a5e454655dc9699085ca9a4e5f6ccd3fe12cde5e0594","2e1c25bf7e2ce2d554fca51291eaeb90c1b7c374410e7656a48af1c0afa34db4")
index=activity AND rg_functionality="O365 General" AND customstring3 NOT NULL AND customstring3 IN ("4b430e9e43611aa67263f03fd42207c8ad06267d9b971db876b6e62c19a0805e","6efb16aa4fd785f80914e110a4e78d3d430b18cbdd6ebd5e81f904dd58baae61","ea87d504aff24f7daf026008fa1043cb38077eccec9c15bbe24919fc413ec7c7","e3869a6b82e4cf54cc25c46f2324c4bd2411222fd19054d114e7ebd32ca32cd1","29d31cfc4746493730cda891cf88c84f4d2e5c630f61b861acc31f4904c5b16d","461f0803b67799da8548ebfd979053fb99cf110f40ac3fc073c3183e2f6e9ced","b337a3b55e9f6d72e22fe55aba4105805bb0cf121087a3f6c79850705593d904","54f0eaf2c0a3f79c5f95ef5d0c4c9ff30a727ccd08575e97cce278577d106f6b","b75a161caab0a90ef5ce57b889534b5809af3ce2f566af79da9184eaa41135bd","becbfc26aef38e669907a5e454655dc9699085ca9a4e5f6ccd3fe12cde5e0594","2e1c25bf7e2ce2d554fca51291eaeb90c1b7c374410e7656a48af1c0afa34db4")
index=activity AND rg_functionality="O365 General" AND customstring64 NOT NULL AND customstring64 IN ("4b430e9e43611aa67263f03fd42207c8ad06267d9b971db876b6e62c19a0805e","6efb16aa4fd785f80914e110a4e78d3d430b18cbdd6ebd5e81f904dd58baae61","ea87d504aff24f7daf026008fa1043cb38077eccec9c15bbe24919fc413ec7c7","e3869a6b82e4cf54cc25c46f2324c4bd2411222fd19054d114e7ebd32ca32cd1","29d31cfc4746493730cda891cf88c84f4d2e5c630f61b861acc31f4904c5b16d","461f0803b67799da8548ebfd979053fb99cf110f40ac3fc073c3183e2f6e9ced","b337a3b55e9f6d72e22fe55aba4105805bb0cf121087a3f6c79850705593d904","54f0eaf2c0a3f79c5f95ef5d0c4c9ff30a727ccd08575e97cce278577d106f6b","b75a161caab0a90ef5ce57b889534b5809af3ce2f566af79da9184eaa41135bd","becbfc26aef38e669907a5e454655dc9699085ca9a4e5f6ccd3fe12cde5e0594","2e1c25bf7e2ce2d554fca51291eaeb90c1b7c374410e7656a48af1c0afa34db4")
