index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("01b99ff47ec6394753f9ccdd2d43b3e804f9ee36","1c757accbc2755e83e530dda11b3f81007325e67","272cf34e8db2078a3170cf0e54255d89785e3c50","37859e94086ec47b3665328e9c9baf665cb869f6","3d21e1c9dfba38ec6997ae6e426df9291f89762a","4954e8ace23b48ec55f1ff3a47033351e9fa2d6c","562e1678ec8fdc1d83a3f73eb511a6dda08f3b3d","66bd8db40f4169c7f0fca3d5d15c978efe143cf8","6973d3ff8852a3292380b07858d43d0b80c0616e","73d0faa475c6e489b2c5c95bb51dede4719d199e","b8afc21ef2aa854896b97f1c81b376dcdde2466d","bb4ffcdbfad40125080c13fa4917a1e836a8d101","be0ad25b7b48347984908175404996531cfd74b7","e8e6e6afef3f574c1f5228bdb28abb34f8a0d09a","f28d8c5c2283019e6ed788d20240abc8554cadb5")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("01b99ff47ec6394753f9ccdd2d43b3e804f9ee36","1c757accbc2755e83e530dda11b3f81007325e67","272cf34e8db2078a3170cf0e54255d89785e3c50","37859e94086ec47b3665328e9c9baf665cb869f6","3d21e1c9dfba38ec6997ae6e426df9291f89762a","4954e8ace23b48ec55f1ff3a47033351e9fa2d6c","562e1678ec8fdc1d83a3f73eb511a6dda08f3b3d","66bd8db40f4169c7f0fca3d5d15c978efe143cf8","6973d3ff8852a3292380b07858d43d0b80c0616e","73d0faa475c6e489b2c5c95bb51dede4719d199e","b8afc21ef2aa854896b97f1c81b376dcdde2466d","bb4ffcdbfad40125080c13fa4917a1e836a8d101","be0ad25b7b48347984908175404996531cfd74b7","e8e6e6afef3f574c1f5228bdb28abb34f8a0d09a","f28d8c5c2283019e6ed788d20240abc8554cadb5")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("01b99ff47ec6394753f9ccdd2d43b3e804f9ee36","1c757accbc2755e83e530dda11b3f81007325e67","272cf34e8db2078a3170cf0e54255d89785e3c50","37859e94086ec47b3665328e9c9baf665cb869f6","3d21e1c9dfba38ec6997ae6e426df9291f89762a","4954e8ace23b48ec55f1ff3a47033351e9fa2d6c","562e1678ec8fdc1d83a3f73eb511a6dda08f3b3d","66bd8db40f4169c7f0fca3d5d15c978efe143cf8","6973d3ff8852a3292380b07858d43d0b80c0616e","73d0faa475c6e489b2c5c95bb51dede4719d199e","b8afc21ef2aa854896b97f1c81b376dcdde2466d","bb4ffcdbfad40125080c13fa4917a1e836a8d101","be0ad25b7b48347984908175404996531cfd74b7","e8e6e6afef3f574c1f5228bdb28abb34f8a0d09a","f28d8c5c2283019e6ed788d20240abc8554cadb5")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring64 NOT NULL AND customstring64 IN ("01b99ff47ec6394753f9ccdd2d43b3e804f9ee36","1c757accbc2755e83e530dda11b3f81007325e67","272cf34e8db2078a3170cf0e54255d89785e3c50","37859e94086ec47b3665328e9c9baf665cb869f6","3d21e1c9dfba38ec6997ae6e426df9291f89762a","4954e8ace23b48ec55f1ff3a47033351e9fa2d6c","562e1678ec8fdc1d83a3f73eb511a6dda08f3b3d","66bd8db40f4169c7f0fca3d5d15c978efe143cf8","6973d3ff8852a3292380b07858d43d0b80c0616e","73d0faa475c6e489b2c5c95bb51dede4719d199e","b8afc21ef2aa854896b97f1c81b376dcdde2466d","bb4ffcdbfad40125080c13fa4917a1e836a8d101","be0ad25b7b48347984908175404996531cfd74b7","e8e6e6afef3f574c1f5228bdb28abb34f8a0d09a","f28d8c5c2283019e6ed788d20240abc8554cadb5")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("01b99ff47ec6394753f9ccdd2d43b3e804f9ee36","1c757accbc2755e83e530dda11b3f81007325e67","272cf34e8db2078a3170cf0e54255d89785e3c50","37859e94086ec47b3665328e9c9baf665cb869f6","3d21e1c9dfba38ec6997ae6e426df9291f89762a","4954e8ace23b48ec55f1ff3a47033351e9fa2d6c","562e1678ec8fdc1d83a3f73eb511a6dda08f3b3d","66bd8db40f4169c7f0fca3d5d15c978efe143cf8","6973d3ff8852a3292380b07858d43d0b80c0616e","73d0faa475c6e489b2c5c95bb51dede4719d199e","b8afc21ef2aa854896b97f1c81b376dcdde2466d","bb4ffcdbfad40125080c13fa4917a1e836a8d101","be0ad25b7b48347984908175404996531cfd74b7","e8e6e6afef3f574c1f5228bdb28abb34f8a0d09a","f28d8c5c2283019e6ed788d20240abc8554cadb5")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("01b99ff47ec6394753f9ccdd2d43b3e804f9ee36","1c757accbc2755e83e530dda11b3f81007325e67","272cf34e8db2078a3170cf0e54255d89785e3c50","37859e94086ec47b3665328e9c9baf665cb869f6","3d21e1c9dfba38ec6997ae6e426df9291f89762a","4954e8ace23b48ec55f1ff3a47033351e9fa2d6c","562e1678ec8fdc1d83a3f73eb511a6dda08f3b3d","66bd8db40f4169c7f0fca3d5d15c978efe143cf8","6973d3ff8852a3292380b07858d43d0b80c0616e","73d0faa475c6e489b2c5c95bb51dede4719d199e","b8afc21ef2aa854896b97f1c81b376dcdde2466d","bb4ffcdbfad40125080c13fa4917a1e836a8d101","be0ad25b7b48347984908175404996531cfd74b7","e8e6e6afef3f574c1f5228bdb28abb34f8a0d09a","f28d8c5c2283019e6ed788d20240abc8554cadb5")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("01b99ff47ec6394753f9ccdd2d43b3e804f9ee36","1c757accbc2755e83e530dda11b3f81007325e67","272cf34e8db2078a3170cf0e54255d89785e3c50","37859e94086ec47b3665328e9c9baf665cb869f6","3d21e1c9dfba38ec6997ae6e426df9291f89762a","4954e8ace23b48ec55f1ff3a47033351e9fa2d6c","562e1678ec8fdc1d83a3f73eb511a6dda08f3b3d","66bd8db40f4169c7f0fca3d5d15c978efe143cf8","6973d3ff8852a3292380b07858d43d0b80c0616e","73d0faa475c6e489b2c5c95bb51dede4719d199e","b8afc21ef2aa854896b97f1c81b376dcdde2466d","bb4ffcdbfad40125080c13fa4917a1e836a8d101","be0ad25b7b48347984908175404996531cfd74b7","e8e6e6afef3f574c1f5228bdb28abb34f8a0d09a","f28d8c5c2283019e6ed788d20240abc8554cadb5")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("01b99ff47ec6394753f9ccdd2d43b3e804f9ee36","1c757accbc2755e83e530dda11b3f81007325e67","272cf34e8db2078a3170cf0e54255d89785e3c50","37859e94086ec47b3665328e9c9baf665cb869f6","3d21e1c9dfba38ec6997ae6e426df9291f89762a","4954e8ace23b48ec55f1ff3a47033351e9fa2d6c","562e1678ec8fdc1d83a3f73eb511a6dda08f3b3d","66bd8db40f4169c7f0fca3d5d15c978efe143cf8","6973d3ff8852a3292380b07858d43d0b80c0616e","73d0faa475c6e489b2c5c95bb51dede4719d199e","b8afc21ef2aa854896b97f1c81b376dcdde2466d","bb4ffcdbfad40125080c13fa4917a1e836a8d101","be0ad25b7b48347984908175404996531cfd74b7","e8e6e6afef3f574c1f5228bdb28abb34f8a0d09a","f28d8c5c2283019e6ed788d20240abc8554cadb5")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("01b99ff47ec6394753f9ccdd2d43b3e804f9ee36","1c757accbc2755e83e530dda11b3f81007325e67","272cf34e8db2078a3170cf0e54255d89785e3c50","37859e94086ec47b3665328e9c9baf665cb869f6","3d21e1c9dfba38ec6997ae6e426df9291f89762a","4954e8ace23b48ec55f1ff3a47033351e9fa2d6c","562e1678ec8fdc1d83a3f73eb511a6dda08f3b3d","66bd8db40f4169c7f0fca3d5d15c978efe143cf8","6973d3ff8852a3292380b07858d43d0b80c0616e","73d0faa475c6e489b2c5c95bb51dede4719d199e","b8afc21ef2aa854896b97f1c81b376dcdde2466d","bb4ffcdbfad40125080c13fa4917a1e836a8d101","be0ad25b7b48347984908175404996531cfd74b7","e8e6e6afef3f574c1f5228bdb28abb34f8a0d09a","f28d8c5c2283019e6ed788d20240abc8554cadb5")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("01b99ff47ec6394753f9ccdd2d43b3e804f9ee36","1c757accbc2755e83e530dda11b3f81007325e67","272cf34e8db2078a3170cf0e54255d89785e3c50","37859e94086ec47b3665328e9c9baf665cb869f6","3d21e1c9dfba38ec6997ae6e426df9291f89762a","4954e8ace23b48ec55f1ff3a47033351e9fa2d6c","562e1678ec8fdc1d83a3f73eb511a6dda08f3b3d","66bd8db40f4169c7f0fca3d5d15c978efe143cf8","6973d3ff8852a3292380b07858d43d0b80c0616e","73d0faa475c6e489b2c5c95bb51dede4719d199e","b8afc21ef2aa854896b97f1c81b376dcdde2466d","bb4ffcdbfad40125080c13fa4917a1e836a8d101","be0ad25b7b48347984908175404996531cfd74b7","e8e6e6afef3f574c1f5228bdb28abb34f8a0d09a","f28d8c5c2283019e6ed788d20240abc8554cadb5")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("01b99ff47ec6394753f9ccdd2d43b3e804f9ee36","1c757accbc2755e83e530dda11b3f81007325e67","272cf34e8db2078a3170cf0e54255d89785e3c50","37859e94086ec47b3665328e9c9baf665cb869f6","3d21e1c9dfba38ec6997ae6e426df9291f89762a","4954e8ace23b48ec55f1ff3a47033351e9fa2d6c","562e1678ec8fdc1d83a3f73eb511a6dda08f3b3d","66bd8db40f4169c7f0fca3d5d15c978efe143cf8","6973d3ff8852a3292380b07858d43d0b80c0616e","73d0faa475c6e489b2c5c95bb51dede4719d199e","b8afc21ef2aa854896b97f1c81b376dcdde2466d","bb4ffcdbfad40125080c13fa4917a1e836a8d101","be0ad25b7b48347984908175404996531cfd74b7","e8e6e6afef3f574c1f5228bdb28abb34f8a0d09a","f28d8c5c2283019e6ed788d20240abc8554cadb5")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("01b99ff47ec6394753f9ccdd2d43b3e804f9ee36","1c757accbc2755e83e530dda11b3f81007325e67","272cf34e8db2078a3170cf0e54255d89785e3c50","37859e94086ec47b3665328e9c9baf665cb869f6","3d21e1c9dfba38ec6997ae6e426df9291f89762a","4954e8ace23b48ec55f1ff3a47033351e9fa2d6c","562e1678ec8fdc1d83a3f73eb511a6dda08f3b3d","66bd8db40f4169c7f0fca3d5d15c978efe143cf8","6973d3ff8852a3292380b07858d43d0b80c0616e","73d0faa475c6e489b2c5c95bb51dede4719d199e","b8afc21ef2aa854896b97f1c81b376dcdde2466d","bb4ffcdbfad40125080c13fa4917a1e836a8d101","be0ad25b7b48347984908175404996531cfd74b7","e8e6e6afef3f574c1f5228bdb28abb34f8a0d09a","f28d8c5c2283019e6ed788d20240abc8554cadb5")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("01b99ff47ec6394753f9ccdd2d43b3e804f9ee36","1c757accbc2755e83e530dda11b3f81007325e67","272cf34e8db2078a3170cf0e54255d89785e3c50","37859e94086ec47b3665328e9c9baf665cb869f6","3d21e1c9dfba38ec6997ae6e426df9291f89762a","4954e8ace23b48ec55f1ff3a47033351e9fa2d6c","562e1678ec8fdc1d83a3f73eb511a6dda08f3b3d","66bd8db40f4169c7f0fca3d5d15c978efe143cf8","6973d3ff8852a3292380b07858d43d0b80c0616e","73d0faa475c6e489b2c5c95bb51dede4719d199e","b8afc21ef2aa854896b97f1c81b376dcdde2466d","bb4ffcdbfad40125080c13fa4917a1e836a8d101","be0ad25b7b48347984908175404996531cfd74b7","e8e6e6afef3f574c1f5228bdb28abb34f8a0d09a","f28d8c5c2283019e6ed788d20240abc8554cadb5")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("01b99ff47ec6394753f9ccdd2d43b3e804f9ee36","1c757accbc2755e83e530dda11b3f81007325e67","272cf34e8db2078a3170cf0e54255d89785e3c50","37859e94086ec47b3665328e9c9baf665cb869f6","3d21e1c9dfba38ec6997ae6e426df9291f89762a","4954e8ace23b48ec55f1ff3a47033351e9fa2d6c","562e1678ec8fdc1d83a3f73eb511a6dda08f3b3d","66bd8db40f4169c7f0fca3d5d15c978efe143cf8","6973d3ff8852a3292380b07858d43d0b80c0616e","73d0faa475c6e489b2c5c95bb51dede4719d199e","b8afc21ef2aa854896b97f1c81b376dcdde2466d","bb4ffcdbfad40125080c13fa4917a1e836a8d101","be0ad25b7b48347984908175404996531cfd74b7","e8e6e6afef3f574c1f5228bdb28abb34f8a0d09a","f28d8c5c2283019e6ed788d20240abc8554cadb5")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("01b99ff47ec6394753f9ccdd2d43b3e804f9ee36","1c757accbc2755e83e530dda11b3f81007325e67","272cf34e8db2078a3170cf0e54255d89785e3c50","37859e94086ec47b3665328e9c9baf665cb869f6","3d21e1c9dfba38ec6997ae6e426df9291f89762a","4954e8ace23b48ec55f1ff3a47033351e9fa2d6c","562e1678ec8fdc1d83a3f73eb511a6dda08f3b3d","66bd8db40f4169c7f0fca3d5d15c978efe143cf8","6973d3ff8852a3292380b07858d43d0b80c0616e","73d0faa475c6e489b2c5c95bb51dede4719d199e","b8afc21ef2aa854896b97f1c81b376dcdde2466d","bb4ffcdbfad40125080c13fa4917a1e836a8d101","be0ad25b7b48347984908175404996531cfd74b7","e8e6e6afef3f574c1f5228bdb28abb34f8a0d09a","f28d8c5c2283019e6ed788d20240abc8554cadb5")
index=activity AND rg_functionality="Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("01b99ff47ec6394753f9ccdd2d43b3e804f9ee36","1c757accbc2755e83e530dda11b3f81007325e67","272cf34e8db2078a3170cf0e54255d89785e3c50","37859e94086ec47b3665328e9c9baf665cb869f6","3d21e1c9dfba38ec6997ae6e426df9291f89762a","4954e8ace23b48ec55f1ff3a47033351e9fa2d6c","562e1678ec8fdc1d83a3f73eb511a6dda08f3b3d","66bd8db40f4169c7f0fca3d5d15c978efe143cf8","6973d3ff8852a3292380b07858d43d0b80c0616e","73d0faa475c6e489b2c5c95bb51dede4719d199e","b8afc21ef2aa854896b97f1c81b376dcdde2466d","bb4ffcdbfad40125080c13fa4917a1e836a8d101","be0ad25b7b48347984908175404996531cfd74b7","e8e6e6afef3f574c1f5228bdb28abb34f8a0d09a","f28d8c5c2283019e6ed788d20240abc8554cadb5")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("01b99ff47ec6394753f9ccdd2d43b3e804f9ee36","1c757accbc2755e83e530dda11b3f81007325e67","272cf34e8db2078a3170cf0e54255d89785e3c50","37859e94086ec47b3665328e9c9baf665cb869f6","3d21e1c9dfba38ec6997ae6e426df9291f89762a","4954e8ace23b48ec55f1ff3a47033351e9fa2d6c","562e1678ec8fdc1d83a3f73eb511a6dda08f3b3d","66bd8db40f4169c7f0fca3d5d15c978efe143cf8","6973d3ff8852a3292380b07858d43d0b80c0616e","73d0faa475c6e489b2c5c95bb51dede4719d199e","b8afc21ef2aa854896b97f1c81b376dcdde2466d","bb4ffcdbfad40125080c13fa4917a1e836a8d101","be0ad25b7b48347984908175404996531cfd74b7","e8e6e6afef3f574c1f5228bdb28abb34f8a0d09a","f28d8c5c2283019e6ed788d20240abc8554cadb5")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("01b99ff47ec6394753f9ccdd2d43b3e804f9ee36","1c757accbc2755e83e530dda11b3f81007325e67","272cf34e8db2078a3170cf0e54255d89785e3c50","37859e94086ec47b3665328e9c9baf665cb869f6","3d21e1c9dfba38ec6997ae6e426df9291f89762a","4954e8ace23b48ec55f1ff3a47033351e9fa2d6c","562e1678ec8fdc1d83a3f73eb511a6dda08f3b3d","66bd8db40f4169c7f0fca3d5d15c978efe143cf8","6973d3ff8852a3292380b07858d43d0b80c0616e","73d0faa475c6e489b2c5c95bb51dede4719d199e","b8afc21ef2aa854896b97f1c81b376dcdde2466d","bb4ffcdbfad40125080c13fa4917a1e836a8d101","be0ad25b7b48347984908175404996531cfd74b7","e8e6e6afef3f574c1f5228bdb28abb34f8a0d09a","f28d8c5c2283019e6ed788d20240abc8554cadb5")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("01b99ff47ec6394753f9ccdd2d43b3e804f9ee36","1c757accbc2755e83e530dda11b3f81007325e67","272cf34e8db2078a3170cf0e54255d89785e3c50","37859e94086ec47b3665328e9c9baf665cb869f6","3d21e1c9dfba38ec6997ae6e426df9291f89762a","4954e8ace23b48ec55f1ff3a47033351e9fa2d6c","562e1678ec8fdc1d83a3f73eb511a6dda08f3b3d","66bd8db40f4169c7f0fca3d5d15c978efe143cf8","6973d3ff8852a3292380b07858d43d0b80c0616e","73d0faa475c6e489b2c5c95bb51dede4719d199e","b8afc21ef2aa854896b97f1c81b376dcdde2466d","bb4ffcdbfad40125080c13fa4917a1e836a8d101","be0ad25b7b48347984908175404996531cfd74b7","e8e6e6afef3f574c1f5228bdb28abb34f8a0d09a","f28d8c5c2283019e6ed788d20240abc8554cadb5")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("01b99ff47ec6394753f9ccdd2d43b3e804f9ee36","1c757accbc2755e83e530dda11b3f81007325e67","272cf34e8db2078a3170cf0e54255d89785e3c50","37859e94086ec47b3665328e9c9baf665cb869f6","3d21e1c9dfba38ec6997ae6e426df9291f89762a","4954e8ace23b48ec55f1ff3a47033351e9fa2d6c","562e1678ec8fdc1d83a3f73eb511a6dda08f3b3d","66bd8db40f4169c7f0fca3d5d15c978efe143cf8","6973d3ff8852a3292380b07858d43d0b80c0616e","73d0faa475c6e489b2c5c95bb51dede4719d199e","b8afc21ef2aa854896b97f1c81b376dcdde2466d","bb4ffcdbfad40125080c13fa4917a1e836a8d101","be0ad25b7b48347984908175404996531cfd74b7","e8e6e6afef3f574c1f5228bdb28abb34f8a0d09a","f28d8c5c2283019e6ed788d20240abc8554cadb5")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("01b99ff47ec6394753f9ccdd2d43b3e804f9ee36","1c757accbc2755e83e530dda11b3f81007325e67","272cf34e8db2078a3170cf0e54255d89785e3c50","37859e94086ec47b3665328e9c9baf665cb869f6","3d21e1c9dfba38ec6997ae6e426df9291f89762a","4954e8ace23b48ec55f1ff3a47033351e9fa2d6c","562e1678ec8fdc1d83a3f73eb511a6dda08f3b3d","66bd8db40f4169c7f0fca3d5d15c978efe143cf8","6973d3ff8852a3292380b07858d43d0b80c0616e","73d0faa475c6e489b2c5c95bb51dede4719d199e","b8afc21ef2aa854896b97f1c81b376dcdde2466d","bb4ffcdbfad40125080c13fa4917a1e836a8d101","be0ad25b7b48347984908175404996531cfd74b7","e8e6e6afef3f574c1f5228bdb28abb34f8a0d09a","f28d8c5c2283019e6ed788d20240abc8554cadb5")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("01b99ff47ec6394753f9ccdd2d43b3e804f9ee36","1c757accbc2755e83e530dda11b3f81007325e67","272cf34e8db2078a3170cf0e54255d89785e3c50","37859e94086ec47b3665328e9c9baf665cb869f6","3d21e1c9dfba38ec6997ae6e426df9291f89762a","4954e8ace23b48ec55f1ff3a47033351e9fa2d6c","562e1678ec8fdc1d83a3f73eb511a6dda08f3b3d","66bd8db40f4169c7f0fca3d5d15c978efe143cf8","6973d3ff8852a3292380b07858d43d0b80c0616e","73d0faa475c6e489b2c5c95bb51dede4719d199e","b8afc21ef2aa854896b97f1c81b376dcdde2466d","bb4ffcdbfad40125080c13fa4917a1e836a8d101","be0ad25b7b48347984908175404996531cfd74b7","e8e6e6afef3f574c1f5228bdb28abb34f8a0d09a","f28d8c5c2283019e6ed788d20240abc8554cadb5")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("01b99ff47ec6394753f9ccdd2d43b3e804f9ee36","1c757accbc2755e83e530dda11b3f81007325e67","272cf34e8db2078a3170cf0e54255d89785e3c50","37859e94086ec47b3665328e9c9baf665cb869f6","3d21e1c9dfba38ec6997ae6e426df9291f89762a","4954e8ace23b48ec55f1ff3a47033351e9fa2d6c","562e1678ec8fdc1d83a3f73eb511a6dda08f3b3d","66bd8db40f4169c7f0fca3d5d15c978efe143cf8","6973d3ff8852a3292380b07858d43d0b80c0616e","73d0faa475c6e489b2c5c95bb51dede4719d199e","b8afc21ef2aa854896b97f1c81b376dcdde2466d","bb4ffcdbfad40125080c13fa4917a1e836a8d101","be0ad25b7b48347984908175404996531cfd74b7","e8e6e6afef3f574c1f5228bdb28abb34f8a0d09a","f28d8c5c2283019e6ed788d20240abc8554cadb5")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring64 NOT NULL AND customstring64 IN ("01b99ff47ec6394753f9ccdd2d43b3e804f9ee36","1c757accbc2755e83e530dda11b3f81007325e67","272cf34e8db2078a3170cf0e54255d89785e3c50","37859e94086ec47b3665328e9c9baf665cb869f6","3d21e1c9dfba38ec6997ae6e426df9291f89762a","4954e8ace23b48ec55f1ff3a47033351e9fa2d6c","562e1678ec8fdc1d83a3f73eb511a6dda08f3b3d","66bd8db40f4169c7f0fca3d5d15c978efe143cf8","6973d3ff8852a3292380b07858d43d0b80c0616e","73d0faa475c6e489b2c5c95bb51dede4719d199e","b8afc21ef2aa854896b97f1c81b376dcdde2466d","bb4ffcdbfad40125080c13fa4917a1e836a8d101","be0ad25b7b48347984908175404996531cfd74b7","e8e6e6afef3f574c1f5228bdb28abb34f8a0d09a","f28d8c5c2283019e6ed788d20240abc8554cadb5")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("01b99ff47ec6394753f9ccdd2d43b3e804f9ee36","1c757accbc2755e83e530dda11b3f81007325e67","272cf34e8db2078a3170cf0e54255d89785e3c50","37859e94086ec47b3665328e9c9baf665cb869f6","3d21e1c9dfba38ec6997ae6e426df9291f89762a","4954e8ace23b48ec55f1ff3a47033351e9fa2d6c","562e1678ec8fdc1d83a3f73eb511a6dda08f3b3d","66bd8db40f4169c7f0fca3d5d15c978efe143cf8","6973d3ff8852a3292380b07858d43d0b80c0616e","73d0faa475c6e489b2c5c95bb51dede4719d199e","b8afc21ef2aa854896b97f1c81b376dcdde2466d","bb4ffcdbfad40125080c13fa4917a1e836a8d101","be0ad25b7b48347984908175404996531cfd74b7","e8e6e6afef3f574c1f5228bdb28abb34f8a0d09a","f28d8c5c2283019e6ed788d20240abc8554cadb5")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("01b99ff47ec6394753f9ccdd2d43b3e804f9ee36","1c757accbc2755e83e530dda11b3f81007325e67","272cf34e8db2078a3170cf0e54255d89785e3c50","37859e94086ec47b3665328e9c9baf665cb869f6","3d21e1c9dfba38ec6997ae6e426df9291f89762a","4954e8ace23b48ec55f1ff3a47033351e9fa2d6c","562e1678ec8fdc1d83a3f73eb511a6dda08f3b3d","66bd8db40f4169c7f0fca3d5d15c978efe143cf8","6973d3ff8852a3292380b07858d43d0b80c0616e","73d0faa475c6e489b2c5c95bb51dede4719d199e","b8afc21ef2aa854896b97f1c81b376dcdde2466d","bb4ffcdbfad40125080c13fa4917a1e836a8d101","be0ad25b7b48347984908175404996531cfd74b7","e8e6e6afef3f574c1f5228bdb28abb34f8a0d09a","f28d8c5c2283019e6ed788d20240abc8554cadb5")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("01b99ff47ec6394753f9ccdd2d43b3e804f9ee36","1c757accbc2755e83e530dda11b3f81007325e67","272cf34e8db2078a3170cf0e54255d89785e3c50","37859e94086ec47b3665328e9c9baf665cb869f6","3d21e1c9dfba38ec6997ae6e426df9291f89762a","4954e8ace23b48ec55f1ff3a47033351e9fa2d6c","562e1678ec8fdc1d83a3f73eb511a6dda08f3b3d","66bd8db40f4169c7f0fca3d5d15c978efe143cf8","6973d3ff8852a3292380b07858d43d0b80c0616e","73d0faa475c6e489b2c5c95bb51dede4719d199e","b8afc21ef2aa854896b97f1c81b376dcdde2466d","bb4ffcdbfad40125080c13fa4917a1e836a8d101","be0ad25b7b48347984908175404996531cfd74b7","e8e6e6afef3f574c1f5228bdb28abb34f8a0d09a","f28d8c5c2283019e6ed788d20240abc8554cadb5")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring64 NOT NULL AND customstring64 IN ("01b99ff47ec6394753f9ccdd2d43b3e804f9ee36","1c757accbc2755e83e530dda11b3f81007325e67","272cf34e8db2078a3170cf0e54255d89785e3c50","37859e94086ec47b3665328e9c9baf665cb869f6","3d21e1c9dfba38ec6997ae6e426df9291f89762a","4954e8ace23b48ec55f1ff3a47033351e9fa2d6c","562e1678ec8fdc1d83a3f73eb511a6dda08f3b3d","66bd8db40f4169c7f0fca3d5d15c978efe143cf8","6973d3ff8852a3292380b07858d43d0b80c0616e","73d0faa475c6e489b2c5c95bb51dede4719d199e","b8afc21ef2aa854896b97f1c81b376dcdde2466d","bb4ffcdbfad40125080c13fa4917a1e836a8d101","be0ad25b7b48347984908175404996531cfd74b7","e8e6e6afef3f574c1f5228bdb28abb34f8a0d09a","f28d8c5c2283019e6ed788d20240abc8554cadb5")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("01b99ff47ec6394753f9ccdd2d43b3e804f9ee36","1c757accbc2755e83e530dda11b3f81007325e67","272cf34e8db2078a3170cf0e54255d89785e3c50","37859e94086ec47b3665328e9c9baf665cb869f6","3d21e1c9dfba38ec6997ae6e426df9291f89762a","4954e8ace23b48ec55f1ff3a47033351e9fa2d6c","562e1678ec8fdc1d83a3f73eb511a6dda08f3b3d","66bd8db40f4169c7f0fca3d5d15c978efe143cf8","6973d3ff8852a3292380b07858d43d0b80c0616e","73d0faa475c6e489b2c5c95bb51dede4719d199e","b8afc21ef2aa854896b97f1c81b376dcdde2466d","bb4ffcdbfad40125080c13fa4917a1e836a8d101","be0ad25b7b48347984908175404996531cfd74b7","e8e6e6afef3f574c1f5228bdb28abb34f8a0d09a","f28d8c5c2283019e6ed788d20240abc8554cadb5")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("01b99ff47ec6394753f9ccdd2d43b3e804f9ee36","1c757accbc2755e83e530dda11b3f81007325e67","272cf34e8db2078a3170cf0e54255d89785e3c50","37859e94086ec47b3665328e9c9baf665cb869f6","3d21e1c9dfba38ec6997ae6e426df9291f89762a","4954e8ace23b48ec55f1ff3a47033351e9fa2d6c","562e1678ec8fdc1d83a3f73eb511a6dda08f3b3d","66bd8db40f4169c7f0fca3d5d15c978efe143cf8","6973d3ff8852a3292380b07858d43d0b80c0616e","73d0faa475c6e489b2c5c95bb51dede4719d199e","b8afc21ef2aa854896b97f1c81b376dcdde2466d","bb4ffcdbfad40125080c13fa4917a1e836a8d101","be0ad25b7b48347984908175404996531cfd74b7","e8e6e6afef3f574c1f5228bdb28abb34f8a0d09a","f28d8c5c2283019e6ed788d20240abc8554cadb5")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("01b99ff47ec6394753f9ccdd2d43b3e804f9ee36","1c757accbc2755e83e530dda11b3f81007325e67","272cf34e8db2078a3170cf0e54255d89785e3c50","37859e94086ec47b3665328e9c9baf665cb869f6","3d21e1c9dfba38ec6997ae6e426df9291f89762a","4954e8ace23b48ec55f1ff3a47033351e9fa2d6c","562e1678ec8fdc1d83a3f73eb511a6dda08f3b3d","66bd8db40f4169c7f0fca3d5d15c978efe143cf8","6973d3ff8852a3292380b07858d43d0b80c0616e","73d0faa475c6e489b2c5c95bb51dede4719d199e","b8afc21ef2aa854896b97f1c81b376dcdde2466d","bb4ffcdbfad40125080c13fa4917a1e836a8d101","be0ad25b7b48347984908175404996531cfd74b7","e8e6e6afef3f574c1f5228bdb28abb34f8a0d09a","f28d8c5c2283019e6ed788d20240abc8554cadb5")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring64 NOT NULL AND customstring64 IN ("01b99ff47ec6394753f9ccdd2d43b3e804f9ee36","1c757accbc2755e83e530dda11b3f81007325e67","272cf34e8db2078a3170cf0e54255d89785e3c50","37859e94086ec47b3665328e9c9baf665cb869f6","3d21e1c9dfba38ec6997ae6e426df9291f89762a","4954e8ace23b48ec55f1ff3a47033351e9fa2d6c","562e1678ec8fdc1d83a3f73eb511a6dda08f3b3d","66bd8db40f4169c7f0fca3d5d15c978efe143cf8","6973d3ff8852a3292380b07858d43d0b80c0616e","73d0faa475c6e489b2c5c95bb51dede4719d199e","b8afc21ef2aa854896b97f1c81b376dcdde2466d","bb4ffcdbfad40125080c13fa4917a1e836a8d101","be0ad25b7b48347984908175404996531cfd74b7","e8e6e6afef3f574c1f5228bdb28abb34f8a0d09a","f28d8c5c2283019e6ed788d20240abc8554cadb5")
index=activity AND rg_functionality="O365 General" AND filehash NOT NULL AND filehash IN ("01b99ff47ec6394753f9ccdd2d43b3e804f9ee36","1c757accbc2755e83e530dda11b3f81007325e67","272cf34e8db2078a3170cf0e54255d89785e3c50","37859e94086ec47b3665328e9c9baf665cb869f6","3d21e1c9dfba38ec6997ae6e426df9291f89762a","4954e8ace23b48ec55f1ff3a47033351e9fa2d6c","562e1678ec8fdc1d83a3f73eb511a6dda08f3b3d","66bd8db40f4169c7f0fca3d5d15c978efe143cf8","6973d3ff8852a3292380b07858d43d0b80c0616e","73d0faa475c6e489b2c5c95bb51dede4719d199e","b8afc21ef2aa854896b97f1c81b376dcdde2466d","bb4ffcdbfad40125080c13fa4917a1e836a8d101","be0ad25b7b48347984908175404996531cfd74b7","e8e6e6afef3f574c1f5228bdb28abb34f8a0d09a","f28d8c5c2283019e6ed788d20240abc8554cadb5")
index=activity AND rg_functionality="O365 General" AND oldfilehash NOT NULL AND oldfilehash IN ("01b99ff47ec6394753f9ccdd2d43b3e804f9ee36","1c757accbc2755e83e530dda11b3f81007325e67","272cf34e8db2078a3170cf0e54255d89785e3c50","37859e94086ec47b3665328e9c9baf665cb869f6","3d21e1c9dfba38ec6997ae6e426df9291f89762a","4954e8ace23b48ec55f1ff3a47033351e9fa2d6c","562e1678ec8fdc1d83a3f73eb511a6dda08f3b3d","66bd8db40f4169c7f0fca3d5d15c978efe143cf8","6973d3ff8852a3292380b07858d43d0b80c0616e","73d0faa475c6e489b2c5c95bb51dede4719d199e","b8afc21ef2aa854896b97f1c81b376dcdde2466d","bb4ffcdbfad40125080c13fa4917a1e836a8d101","be0ad25b7b48347984908175404996531cfd74b7","e8e6e6afef3f574c1f5228bdb28abb34f8a0d09a","f28d8c5c2283019e6ed788d20240abc8554cadb5")
index=activity AND rg_functionality="O365 General" AND customstring3 NOT NULL AND customstring3 IN ("01b99ff47ec6394753f9ccdd2d43b3e804f9ee36","1c757accbc2755e83e530dda11b3f81007325e67","272cf34e8db2078a3170cf0e54255d89785e3c50","37859e94086ec47b3665328e9c9baf665cb869f6","3d21e1c9dfba38ec6997ae6e426df9291f89762a","4954e8ace23b48ec55f1ff3a47033351e9fa2d6c","562e1678ec8fdc1d83a3f73eb511a6dda08f3b3d","66bd8db40f4169c7f0fca3d5d15c978efe143cf8","6973d3ff8852a3292380b07858d43d0b80c0616e","73d0faa475c6e489b2c5c95bb51dede4719d199e","b8afc21ef2aa854896b97f1c81b376dcdde2466d","bb4ffcdbfad40125080c13fa4917a1e836a8d101","be0ad25b7b48347984908175404996531cfd74b7","e8e6e6afef3f574c1f5228bdb28abb34f8a0d09a","f28d8c5c2283019e6ed788d20240abc8554cadb5")
index=activity AND rg_functionality="O365 General" AND customstring64 NOT NULL AND customstring64 IN ("01b99ff47ec6394753f9ccdd2d43b3e804f9ee36","1c757accbc2755e83e530dda11b3f81007325e67","272cf34e8db2078a3170cf0e54255d89785e3c50","37859e94086ec47b3665328e9c9baf665cb869f6","3d21e1c9dfba38ec6997ae6e426df9291f89762a","4954e8ace23b48ec55f1ff3a47033351e9fa2d6c","562e1678ec8fdc1d83a3f73eb511a6dda08f3b3d","66bd8db40f4169c7f0fca3d5d15c978efe143cf8","6973d3ff8852a3292380b07858d43d0b80c0616e","73d0faa475c6e489b2c5c95bb51dede4719d199e","b8afc21ef2aa854896b97f1c81b376dcdde2466d","bb4ffcdbfad40125080c13fa4917a1e836a8d101","be0ad25b7b48347984908175404996531cfd74b7","e8e6e6afef3f574c1f5228bdb28abb34f8a0d09a","f28d8c5c2283019e6ed788d20240abc8554cadb5")
