index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("aa1a1328e0d0042d071bca13ff9a13116d8f3cf77e6e9769293e2b144c9b73b3","c3404f768f436924e954e48d35c27a9d44c02b7a346096929a1b26a1693b20b3","b2f84d595e8abf3b7aa744c737cacc2cc34c9afd6e7167e55369161bc5372a9b","e4cae16e643a03eec4e68f7d727224e0bbf5415ebb0a831eb72cb7ff31027605","3766a8654d3954c8c91e658fa8f8ddcd6844a13956318242a31f52e205d467d0","17c3d4c216b2cde74b143bfc2f0c73279f2a007f627e3a764036baf272b4971a","59f80ca5386ed29eda3efb01a92fa31fb7b73168e84456ac06f88fdb4cd82e9e")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("aa1a1328e0d0042d071bca13ff9a13116d8f3cf77e6e9769293e2b144c9b73b3","c3404f768f436924e954e48d35c27a9d44c02b7a346096929a1b26a1693b20b3","b2f84d595e8abf3b7aa744c737cacc2cc34c9afd6e7167e55369161bc5372a9b","e4cae16e643a03eec4e68f7d727224e0bbf5415ebb0a831eb72cb7ff31027605","3766a8654d3954c8c91e658fa8f8ddcd6844a13956318242a31f52e205d467d0","17c3d4c216b2cde74b143bfc2f0c73279f2a007f627e3a764036baf272b4971a","59f80ca5386ed29eda3efb01a92fa31fb7b73168e84456ac06f88fdb4cd82e9e")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("aa1a1328e0d0042d071bca13ff9a13116d8f3cf77e6e9769293e2b144c9b73b3","c3404f768f436924e954e48d35c27a9d44c02b7a346096929a1b26a1693b20b3","b2f84d595e8abf3b7aa744c737cacc2cc34c9afd6e7167e55369161bc5372a9b","e4cae16e643a03eec4e68f7d727224e0bbf5415ebb0a831eb72cb7ff31027605","3766a8654d3954c8c91e658fa8f8ddcd6844a13956318242a31f52e205d467d0","17c3d4c216b2cde74b143bfc2f0c73279f2a007f627e3a764036baf272b4971a","59f80ca5386ed29eda3efb01a92fa31fb7b73168e84456ac06f88fdb4cd82e9e")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring64 NOT NULL AND customstring64 IN ("aa1a1328e0d0042d071bca13ff9a13116d8f3cf77e6e9769293e2b144c9b73b3","c3404f768f436924e954e48d35c27a9d44c02b7a346096929a1b26a1693b20b3","b2f84d595e8abf3b7aa744c737cacc2cc34c9afd6e7167e55369161bc5372a9b","e4cae16e643a03eec4e68f7d727224e0bbf5415ebb0a831eb72cb7ff31027605","3766a8654d3954c8c91e658fa8f8ddcd6844a13956318242a31f52e205d467d0","17c3d4c216b2cde74b143bfc2f0c73279f2a007f627e3a764036baf272b4971a","59f80ca5386ed29eda3efb01a92fa31fb7b73168e84456ac06f88fdb4cd82e9e")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("aa1a1328e0d0042d071bca13ff9a13116d8f3cf77e6e9769293e2b144c9b73b3","c3404f768f436924e954e48d35c27a9d44c02b7a346096929a1b26a1693b20b3","b2f84d595e8abf3b7aa744c737cacc2cc34c9afd6e7167e55369161bc5372a9b","e4cae16e643a03eec4e68f7d727224e0bbf5415ebb0a831eb72cb7ff31027605","3766a8654d3954c8c91e658fa8f8ddcd6844a13956318242a31f52e205d467d0","17c3d4c216b2cde74b143bfc2f0c73279f2a007f627e3a764036baf272b4971a","59f80ca5386ed29eda3efb01a92fa31fb7b73168e84456ac06f88fdb4cd82e9e")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("aa1a1328e0d0042d071bca13ff9a13116d8f3cf77e6e9769293e2b144c9b73b3","c3404f768f436924e954e48d35c27a9d44c02b7a346096929a1b26a1693b20b3","b2f84d595e8abf3b7aa744c737cacc2cc34c9afd6e7167e55369161bc5372a9b","e4cae16e643a03eec4e68f7d727224e0bbf5415ebb0a831eb72cb7ff31027605","3766a8654d3954c8c91e658fa8f8ddcd6844a13956318242a31f52e205d467d0","17c3d4c216b2cde74b143bfc2f0c73279f2a007f627e3a764036baf272b4971a","59f80ca5386ed29eda3efb01a92fa31fb7b73168e84456ac06f88fdb4cd82e9e")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("aa1a1328e0d0042d071bca13ff9a13116d8f3cf77e6e9769293e2b144c9b73b3","c3404f768f436924e954e48d35c27a9d44c02b7a346096929a1b26a1693b20b3","b2f84d595e8abf3b7aa744c737cacc2cc34c9afd6e7167e55369161bc5372a9b","e4cae16e643a03eec4e68f7d727224e0bbf5415ebb0a831eb72cb7ff31027605","3766a8654d3954c8c91e658fa8f8ddcd6844a13956318242a31f52e205d467d0","17c3d4c216b2cde74b143bfc2f0c73279f2a007f627e3a764036baf272b4971a","59f80ca5386ed29eda3efb01a92fa31fb7b73168e84456ac06f88fdb4cd82e9e")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("aa1a1328e0d0042d071bca13ff9a13116d8f3cf77e6e9769293e2b144c9b73b3","c3404f768f436924e954e48d35c27a9d44c02b7a346096929a1b26a1693b20b3","b2f84d595e8abf3b7aa744c737cacc2cc34c9afd6e7167e55369161bc5372a9b","e4cae16e643a03eec4e68f7d727224e0bbf5415ebb0a831eb72cb7ff31027605","3766a8654d3954c8c91e658fa8f8ddcd6844a13956318242a31f52e205d467d0","17c3d4c216b2cde74b143bfc2f0c73279f2a007f627e3a764036baf272b4971a","59f80ca5386ed29eda3efb01a92fa31fb7b73168e84456ac06f88fdb4cd82e9e")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("aa1a1328e0d0042d071bca13ff9a13116d8f3cf77e6e9769293e2b144c9b73b3","c3404f768f436924e954e48d35c27a9d44c02b7a346096929a1b26a1693b20b3","b2f84d595e8abf3b7aa744c737cacc2cc34c9afd6e7167e55369161bc5372a9b","e4cae16e643a03eec4e68f7d727224e0bbf5415ebb0a831eb72cb7ff31027605","3766a8654d3954c8c91e658fa8f8ddcd6844a13956318242a31f52e205d467d0","17c3d4c216b2cde74b143bfc2f0c73279f2a007f627e3a764036baf272b4971a","59f80ca5386ed29eda3efb01a92fa31fb7b73168e84456ac06f88fdb4cd82e9e")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("aa1a1328e0d0042d071bca13ff9a13116d8f3cf77e6e9769293e2b144c9b73b3","c3404f768f436924e954e48d35c27a9d44c02b7a346096929a1b26a1693b20b3","b2f84d595e8abf3b7aa744c737cacc2cc34c9afd6e7167e55369161bc5372a9b","e4cae16e643a03eec4e68f7d727224e0bbf5415ebb0a831eb72cb7ff31027605","3766a8654d3954c8c91e658fa8f8ddcd6844a13956318242a31f52e205d467d0","17c3d4c216b2cde74b143bfc2f0c73279f2a007f627e3a764036baf272b4971a","59f80ca5386ed29eda3efb01a92fa31fb7b73168e84456ac06f88fdb4cd82e9e")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("aa1a1328e0d0042d071bca13ff9a13116d8f3cf77e6e9769293e2b144c9b73b3","c3404f768f436924e954e48d35c27a9d44c02b7a346096929a1b26a1693b20b3","b2f84d595e8abf3b7aa744c737cacc2cc34c9afd6e7167e55369161bc5372a9b","e4cae16e643a03eec4e68f7d727224e0bbf5415ebb0a831eb72cb7ff31027605","3766a8654d3954c8c91e658fa8f8ddcd6844a13956318242a31f52e205d467d0","17c3d4c216b2cde74b143bfc2f0c73279f2a007f627e3a764036baf272b4971a","59f80ca5386ed29eda3efb01a92fa31fb7b73168e84456ac06f88fdb4cd82e9e")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("aa1a1328e0d0042d071bca13ff9a13116d8f3cf77e6e9769293e2b144c9b73b3","c3404f768f436924e954e48d35c27a9d44c02b7a346096929a1b26a1693b20b3","b2f84d595e8abf3b7aa744c737cacc2cc34c9afd6e7167e55369161bc5372a9b","e4cae16e643a03eec4e68f7d727224e0bbf5415ebb0a831eb72cb7ff31027605","3766a8654d3954c8c91e658fa8f8ddcd6844a13956318242a31f52e205d467d0","17c3d4c216b2cde74b143bfc2f0c73279f2a007f627e3a764036baf272b4971a","59f80ca5386ed29eda3efb01a92fa31fb7b73168e84456ac06f88fdb4cd82e9e")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("aa1a1328e0d0042d071bca13ff9a13116d8f3cf77e6e9769293e2b144c9b73b3","c3404f768f436924e954e48d35c27a9d44c02b7a346096929a1b26a1693b20b3","b2f84d595e8abf3b7aa744c737cacc2cc34c9afd6e7167e55369161bc5372a9b","e4cae16e643a03eec4e68f7d727224e0bbf5415ebb0a831eb72cb7ff31027605","3766a8654d3954c8c91e658fa8f8ddcd6844a13956318242a31f52e205d467d0","17c3d4c216b2cde74b143bfc2f0c73279f2a007f627e3a764036baf272b4971a","59f80ca5386ed29eda3efb01a92fa31fb7b73168e84456ac06f88fdb4cd82e9e")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("aa1a1328e0d0042d071bca13ff9a13116d8f3cf77e6e9769293e2b144c9b73b3","c3404f768f436924e954e48d35c27a9d44c02b7a346096929a1b26a1693b20b3","b2f84d595e8abf3b7aa744c737cacc2cc34c9afd6e7167e55369161bc5372a9b","e4cae16e643a03eec4e68f7d727224e0bbf5415ebb0a831eb72cb7ff31027605","3766a8654d3954c8c91e658fa8f8ddcd6844a13956318242a31f52e205d467d0","17c3d4c216b2cde74b143bfc2f0c73279f2a007f627e3a764036baf272b4971a","59f80ca5386ed29eda3efb01a92fa31fb7b73168e84456ac06f88fdb4cd82e9e")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("aa1a1328e0d0042d071bca13ff9a13116d8f3cf77e6e9769293e2b144c9b73b3","c3404f768f436924e954e48d35c27a9d44c02b7a346096929a1b26a1693b20b3","b2f84d595e8abf3b7aa744c737cacc2cc34c9afd6e7167e55369161bc5372a9b","e4cae16e643a03eec4e68f7d727224e0bbf5415ebb0a831eb72cb7ff31027605","3766a8654d3954c8c91e658fa8f8ddcd6844a13956318242a31f52e205d467d0","17c3d4c216b2cde74b143bfc2f0c73279f2a007f627e3a764036baf272b4971a","59f80ca5386ed29eda3efb01a92fa31fb7b73168e84456ac06f88fdb4cd82e9e")
index=activity AND rg_functionality="Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("aa1a1328e0d0042d071bca13ff9a13116d8f3cf77e6e9769293e2b144c9b73b3","c3404f768f436924e954e48d35c27a9d44c02b7a346096929a1b26a1693b20b3","b2f84d595e8abf3b7aa744c737cacc2cc34c9afd6e7167e55369161bc5372a9b","e4cae16e643a03eec4e68f7d727224e0bbf5415ebb0a831eb72cb7ff31027605","3766a8654d3954c8c91e658fa8f8ddcd6844a13956318242a31f52e205d467d0","17c3d4c216b2cde74b143bfc2f0c73279f2a007f627e3a764036baf272b4971a","59f80ca5386ed29eda3efb01a92fa31fb7b73168e84456ac06f88fdb4cd82e9e")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("aa1a1328e0d0042d071bca13ff9a13116d8f3cf77e6e9769293e2b144c9b73b3","c3404f768f436924e954e48d35c27a9d44c02b7a346096929a1b26a1693b20b3","b2f84d595e8abf3b7aa744c737cacc2cc34c9afd6e7167e55369161bc5372a9b","e4cae16e643a03eec4e68f7d727224e0bbf5415ebb0a831eb72cb7ff31027605","3766a8654d3954c8c91e658fa8f8ddcd6844a13956318242a31f52e205d467d0","17c3d4c216b2cde74b143bfc2f0c73279f2a007f627e3a764036baf272b4971a","59f80ca5386ed29eda3efb01a92fa31fb7b73168e84456ac06f88fdb4cd82e9e")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("aa1a1328e0d0042d071bca13ff9a13116d8f3cf77e6e9769293e2b144c9b73b3","c3404f768f436924e954e48d35c27a9d44c02b7a346096929a1b26a1693b20b3","b2f84d595e8abf3b7aa744c737cacc2cc34c9afd6e7167e55369161bc5372a9b","e4cae16e643a03eec4e68f7d727224e0bbf5415ebb0a831eb72cb7ff31027605","3766a8654d3954c8c91e658fa8f8ddcd6844a13956318242a31f52e205d467d0","17c3d4c216b2cde74b143bfc2f0c73279f2a007f627e3a764036baf272b4971a","59f80ca5386ed29eda3efb01a92fa31fb7b73168e84456ac06f88fdb4cd82e9e")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("aa1a1328e0d0042d071bca13ff9a13116d8f3cf77e6e9769293e2b144c9b73b3","c3404f768f436924e954e48d35c27a9d44c02b7a346096929a1b26a1693b20b3","b2f84d595e8abf3b7aa744c737cacc2cc34c9afd6e7167e55369161bc5372a9b","e4cae16e643a03eec4e68f7d727224e0bbf5415ebb0a831eb72cb7ff31027605","3766a8654d3954c8c91e658fa8f8ddcd6844a13956318242a31f52e205d467d0","17c3d4c216b2cde74b143bfc2f0c73279f2a007f627e3a764036baf272b4971a","59f80ca5386ed29eda3efb01a92fa31fb7b73168e84456ac06f88fdb4cd82e9e")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("aa1a1328e0d0042d071bca13ff9a13116d8f3cf77e6e9769293e2b144c9b73b3","c3404f768f436924e954e48d35c27a9d44c02b7a346096929a1b26a1693b20b3","b2f84d595e8abf3b7aa744c737cacc2cc34c9afd6e7167e55369161bc5372a9b","e4cae16e643a03eec4e68f7d727224e0bbf5415ebb0a831eb72cb7ff31027605","3766a8654d3954c8c91e658fa8f8ddcd6844a13956318242a31f52e205d467d0","17c3d4c216b2cde74b143bfc2f0c73279f2a007f627e3a764036baf272b4971a","59f80ca5386ed29eda3efb01a92fa31fb7b73168e84456ac06f88fdb4cd82e9e")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("aa1a1328e0d0042d071bca13ff9a13116d8f3cf77e6e9769293e2b144c9b73b3","c3404f768f436924e954e48d35c27a9d44c02b7a346096929a1b26a1693b20b3","b2f84d595e8abf3b7aa744c737cacc2cc34c9afd6e7167e55369161bc5372a9b","e4cae16e643a03eec4e68f7d727224e0bbf5415ebb0a831eb72cb7ff31027605","3766a8654d3954c8c91e658fa8f8ddcd6844a13956318242a31f52e205d467d0","17c3d4c216b2cde74b143bfc2f0c73279f2a007f627e3a764036baf272b4971a","59f80ca5386ed29eda3efb01a92fa31fb7b73168e84456ac06f88fdb4cd82e9e")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("aa1a1328e0d0042d071bca13ff9a13116d8f3cf77e6e9769293e2b144c9b73b3","c3404f768f436924e954e48d35c27a9d44c02b7a346096929a1b26a1693b20b3","b2f84d595e8abf3b7aa744c737cacc2cc34c9afd6e7167e55369161bc5372a9b","e4cae16e643a03eec4e68f7d727224e0bbf5415ebb0a831eb72cb7ff31027605","3766a8654d3954c8c91e658fa8f8ddcd6844a13956318242a31f52e205d467d0","17c3d4c216b2cde74b143bfc2f0c73279f2a007f627e3a764036baf272b4971a","59f80ca5386ed29eda3efb01a92fa31fb7b73168e84456ac06f88fdb4cd82e9e")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("aa1a1328e0d0042d071bca13ff9a13116d8f3cf77e6e9769293e2b144c9b73b3","c3404f768f436924e954e48d35c27a9d44c02b7a346096929a1b26a1693b20b3","b2f84d595e8abf3b7aa744c737cacc2cc34c9afd6e7167e55369161bc5372a9b","e4cae16e643a03eec4e68f7d727224e0bbf5415ebb0a831eb72cb7ff31027605","3766a8654d3954c8c91e658fa8f8ddcd6844a13956318242a31f52e205d467d0","17c3d4c216b2cde74b143bfc2f0c73279f2a007f627e3a764036baf272b4971a","59f80ca5386ed29eda3efb01a92fa31fb7b73168e84456ac06f88fdb4cd82e9e")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring64 NOT NULL AND customstring64 IN ("aa1a1328e0d0042d071bca13ff9a13116d8f3cf77e6e9769293e2b144c9b73b3","c3404f768f436924e954e48d35c27a9d44c02b7a346096929a1b26a1693b20b3","b2f84d595e8abf3b7aa744c737cacc2cc34c9afd6e7167e55369161bc5372a9b","e4cae16e643a03eec4e68f7d727224e0bbf5415ebb0a831eb72cb7ff31027605","3766a8654d3954c8c91e658fa8f8ddcd6844a13956318242a31f52e205d467d0","17c3d4c216b2cde74b143bfc2f0c73279f2a007f627e3a764036baf272b4971a","59f80ca5386ed29eda3efb01a92fa31fb7b73168e84456ac06f88fdb4cd82e9e")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("aa1a1328e0d0042d071bca13ff9a13116d8f3cf77e6e9769293e2b144c9b73b3","c3404f768f436924e954e48d35c27a9d44c02b7a346096929a1b26a1693b20b3","b2f84d595e8abf3b7aa744c737cacc2cc34c9afd6e7167e55369161bc5372a9b","e4cae16e643a03eec4e68f7d727224e0bbf5415ebb0a831eb72cb7ff31027605","3766a8654d3954c8c91e658fa8f8ddcd6844a13956318242a31f52e205d467d0","17c3d4c216b2cde74b143bfc2f0c73279f2a007f627e3a764036baf272b4971a","59f80ca5386ed29eda3efb01a92fa31fb7b73168e84456ac06f88fdb4cd82e9e")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("aa1a1328e0d0042d071bca13ff9a13116d8f3cf77e6e9769293e2b144c9b73b3","c3404f768f436924e954e48d35c27a9d44c02b7a346096929a1b26a1693b20b3","b2f84d595e8abf3b7aa744c737cacc2cc34c9afd6e7167e55369161bc5372a9b","e4cae16e643a03eec4e68f7d727224e0bbf5415ebb0a831eb72cb7ff31027605","3766a8654d3954c8c91e658fa8f8ddcd6844a13956318242a31f52e205d467d0","17c3d4c216b2cde74b143bfc2f0c73279f2a007f627e3a764036baf272b4971a","59f80ca5386ed29eda3efb01a92fa31fb7b73168e84456ac06f88fdb4cd82e9e")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("aa1a1328e0d0042d071bca13ff9a13116d8f3cf77e6e9769293e2b144c9b73b3","c3404f768f436924e954e48d35c27a9d44c02b7a346096929a1b26a1693b20b3","b2f84d595e8abf3b7aa744c737cacc2cc34c9afd6e7167e55369161bc5372a9b","e4cae16e643a03eec4e68f7d727224e0bbf5415ebb0a831eb72cb7ff31027605","3766a8654d3954c8c91e658fa8f8ddcd6844a13956318242a31f52e205d467d0","17c3d4c216b2cde74b143bfc2f0c73279f2a007f627e3a764036baf272b4971a","59f80ca5386ed29eda3efb01a92fa31fb7b73168e84456ac06f88fdb4cd82e9e")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring64 NOT NULL AND customstring64 IN ("aa1a1328e0d0042d071bca13ff9a13116d8f3cf77e6e9769293e2b144c9b73b3","c3404f768f436924e954e48d35c27a9d44c02b7a346096929a1b26a1693b20b3","b2f84d595e8abf3b7aa744c737cacc2cc34c9afd6e7167e55369161bc5372a9b","e4cae16e643a03eec4e68f7d727224e0bbf5415ebb0a831eb72cb7ff31027605","3766a8654d3954c8c91e658fa8f8ddcd6844a13956318242a31f52e205d467d0","17c3d4c216b2cde74b143bfc2f0c73279f2a007f627e3a764036baf272b4971a","59f80ca5386ed29eda3efb01a92fa31fb7b73168e84456ac06f88fdb4cd82e9e")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("aa1a1328e0d0042d071bca13ff9a13116d8f3cf77e6e9769293e2b144c9b73b3","c3404f768f436924e954e48d35c27a9d44c02b7a346096929a1b26a1693b20b3","b2f84d595e8abf3b7aa744c737cacc2cc34c9afd6e7167e55369161bc5372a9b","e4cae16e643a03eec4e68f7d727224e0bbf5415ebb0a831eb72cb7ff31027605","3766a8654d3954c8c91e658fa8f8ddcd6844a13956318242a31f52e205d467d0","17c3d4c216b2cde74b143bfc2f0c73279f2a007f627e3a764036baf272b4971a","59f80ca5386ed29eda3efb01a92fa31fb7b73168e84456ac06f88fdb4cd82e9e")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("aa1a1328e0d0042d071bca13ff9a13116d8f3cf77e6e9769293e2b144c9b73b3","c3404f768f436924e954e48d35c27a9d44c02b7a346096929a1b26a1693b20b3","b2f84d595e8abf3b7aa744c737cacc2cc34c9afd6e7167e55369161bc5372a9b","e4cae16e643a03eec4e68f7d727224e0bbf5415ebb0a831eb72cb7ff31027605","3766a8654d3954c8c91e658fa8f8ddcd6844a13956318242a31f52e205d467d0","17c3d4c216b2cde74b143bfc2f0c73279f2a007f627e3a764036baf272b4971a","59f80ca5386ed29eda3efb01a92fa31fb7b73168e84456ac06f88fdb4cd82e9e")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("aa1a1328e0d0042d071bca13ff9a13116d8f3cf77e6e9769293e2b144c9b73b3","c3404f768f436924e954e48d35c27a9d44c02b7a346096929a1b26a1693b20b3","b2f84d595e8abf3b7aa744c737cacc2cc34c9afd6e7167e55369161bc5372a9b","e4cae16e643a03eec4e68f7d727224e0bbf5415ebb0a831eb72cb7ff31027605","3766a8654d3954c8c91e658fa8f8ddcd6844a13956318242a31f52e205d467d0","17c3d4c216b2cde74b143bfc2f0c73279f2a007f627e3a764036baf272b4971a","59f80ca5386ed29eda3efb01a92fa31fb7b73168e84456ac06f88fdb4cd82e9e")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring64 NOT NULL AND customstring64 IN ("aa1a1328e0d0042d071bca13ff9a13116d8f3cf77e6e9769293e2b144c9b73b3","c3404f768f436924e954e48d35c27a9d44c02b7a346096929a1b26a1693b20b3","b2f84d595e8abf3b7aa744c737cacc2cc34c9afd6e7167e55369161bc5372a9b","e4cae16e643a03eec4e68f7d727224e0bbf5415ebb0a831eb72cb7ff31027605","3766a8654d3954c8c91e658fa8f8ddcd6844a13956318242a31f52e205d467d0","17c3d4c216b2cde74b143bfc2f0c73279f2a007f627e3a764036baf272b4971a","59f80ca5386ed29eda3efb01a92fa31fb7b73168e84456ac06f88fdb4cd82e9e")
index=activity AND rg_functionality="O365 General" AND filehash NOT NULL AND filehash IN ("aa1a1328e0d0042d071bca13ff9a13116d8f3cf77e6e9769293e2b144c9b73b3","c3404f768f436924e954e48d35c27a9d44c02b7a346096929a1b26a1693b20b3","b2f84d595e8abf3b7aa744c737cacc2cc34c9afd6e7167e55369161bc5372a9b","e4cae16e643a03eec4e68f7d727224e0bbf5415ebb0a831eb72cb7ff31027605","3766a8654d3954c8c91e658fa8f8ddcd6844a13956318242a31f52e205d467d0","17c3d4c216b2cde74b143bfc2f0c73279f2a007f627e3a764036baf272b4971a","59f80ca5386ed29eda3efb01a92fa31fb7b73168e84456ac06f88fdb4cd82e9e")
index=activity AND rg_functionality="O365 General" AND oldfilehash NOT NULL AND oldfilehash IN ("aa1a1328e0d0042d071bca13ff9a13116d8f3cf77e6e9769293e2b144c9b73b3","c3404f768f436924e954e48d35c27a9d44c02b7a346096929a1b26a1693b20b3","b2f84d595e8abf3b7aa744c737cacc2cc34c9afd6e7167e55369161bc5372a9b","e4cae16e643a03eec4e68f7d727224e0bbf5415ebb0a831eb72cb7ff31027605","3766a8654d3954c8c91e658fa8f8ddcd6844a13956318242a31f52e205d467d0","17c3d4c216b2cde74b143bfc2f0c73279f2a007f627e3a764036baf272b4971a","59f80ca5386ed29eda3efb01a92fa31fb7b73168e84456ac06f88fdb4cd82e9e")
index=activity AND rg_functionality="O365 General" AND customstring3 NOT NULL AND customstring3 IN ("aa1a1328e0d0042d071bca13ff9a13116d8f3cf77e6e9769293e2b144c9b73b3","c3404f768f436924e954e48d35c27a9d44c02b7a346096929a1b26a1693b20b3","b2f84d595e8abf3b7aa744c737cacc2cc34c9afd6e7167e55369161bc5372a9b","e4cae16e643a03eec4e68f7d727224e0bbf5415ebb0a831eb72cb7ff31027605","3766a8654d3954c8c91e658fa8f8ddcd6844a13956318242a31f52e205d467d0","17c3d4c216b2cde74b143bfc2f0c73279f2a007f627e3a764036baf272b4971a","59f80ca5386ed29eda3efb01a92fa31fb7b73168e84456ac06f88fdb4cd82e9e")
index=activity AND rg_functionality="O365 General" AND customstring64 NOT NULL AND customstring64 IN ("aa1a1328e0d0042d071bca13ff9a13116d8f3cf77e6e9769293e2b144c9b73b3","c3404f768f436924e954e48d35c27a9d44c02b7a346096929a1b26a1693b20b3","b2f84d595e8abf3b7aa744c737cacc2cc34c9afd6e7167e55369161bc5372a9b","e4cae16e643a03eec4e68f7d727224e0bbf5415ebb0a831eb72cb7ff31027605","3766a8654d3954c8c91e658fa8f8ddcd6844a13956318242a31f52e205d467d0","17c3d4c216b2cde74b143bfc2f0c73279f2a007f627e3a764036baf272b4971a","59f80ca5386ed29eda3efb01a92fa31fb7b73168e84456ac06f88fdb4cd82e9e")
