index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("2280898cb29faf1785e782596d8029cb471537ec38352e5c17cc263f1f52b8ef","3e035f2d7d30869ce53171ef5a0f761bfb9c14d94d9fe6da385e20b8d96dc2fb","840af927adbfdeb7070e1cf73ed195cf48c8d5f35b6de12f58b73898d7056d3d","b5b105751a2bf965a6b78eeff100fe4c75282ad6f37f98b9adcd15d8c64283ec","c75748dc544629a8a5d08c0d8ba7fda3508a3efdaed905ad800ffddbc8d3b8df","e75717be1633b5e3602827dc3b5788ff691dd325b0eddd2d0d9ddcee29de364f","08f491d46a9d05f1aebc83d724ca32c8063a2613250d50ce5b7e8ba469680605","969a4a55bb5cabc96ff003467bd8468b3079f5c95c5823985416c019eb8abe2f","c4e47cba1c5fedf9ba522bc2d2de54a482e0ac29c98358390af6dadc0a7d65ce","cf64c08d97e6dfa5588c5fa016c25c4131ccc61b8deada7f9c8b2a41d8f5a32c","6c94a1bc67af21cedb0bffac03019dbf870649a182e58cc5960969adf4fbdd48","58db85f0c86640b4c3a2584e9ef5696c526190faf87eaa19085737685bc9e7f5","9ca0e858ff6f163a128fb699d2b801b6b13a2eb1d6cd995302effa5f587cd8d8","aecfc82fa44790e0533f0bece0a1ab0860b163838646aa0c019187a37326d477","be3e665d389e8b85ceda1e2fc80a41a247de27d1d0b13ee0c2574c1e36ebc6d4","4d696c106f568b99308565172116933c0e26ce2e9ace003a110e8bde0216ddab","aa7ff8badcffdff66df6d30bde51b6e3c960be0a3719b73d3875af8e1173bd94","0dfe7a93ff40834c072c7fdd9381771b1086b67f545fa83c766b2d67a911e47b","1a30e0d65a8a09abc3feb1c86a0619845fc6ab9bdba3ae8800ecec55a647910e","624f129189a05897c176e9feb519521c1b6ef528b0b52e1a7a3290e5a2313a6b","fe2e5df2fae90fb90b56e4ea268e8ca68f46dc3365c22b840d865193a48be189")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("2280898cb29faf1785e782596d8029cb471537ec38352e5c17cc263f1f52b8ef","3e035f2d7d30869ce53171ef5a0f761bfb9c14d94d9fe6da385e20b8d96dc2fb","840af927adbfdeb7070e1cf73ed195cf48c8d5f35b6de12f58b73898d7056d3d","b5b105751a2bf965a6b78eeff100fe4c75282ad6f37f98b9adcd15d8c64283ec","c75748dc544629a8a5d08c0d8ba7fda3508a3efdaed905ad800ffddbc8d3b8df","e75717be1633b5e3602827dc3b5788ff691dd325b0eddd2d0d9ddcee29de364f","08f491d46a9d05f1aebc83d724ca32c8063a2613250d50ce5b7e8ba469680605","969a4a55bb5cabc96ff003467bd8468b3079f5c95c5823985416c019eb8abe2f","c4e47cba1c5fedf9ba522bc2d2de54a482e0ac29c98358390af6dadc0a7d65ce","cf64c08d97e6dfa5588c5fa016c25c4131ccc61b8deada7f9c8b2a41d8f5a32c","6c94a1bc67af21cedb0bffac03019dbf870649a182e58cc5960969adf4fbdd48","58db85f0c86640b4c3a2584e9ef5696c526190faf87eaa19085737685bc9e7f5","9ca0e858ff6f163a128fb699d2b801b6b13a2eb1d6cd995302effa5f587cd8d8","aecfc82fa44790e0533f0bece0a1ab0860b163838646aa0c019187a37326d477","be3e665d389e8b85ceda1e2fc80a41a247de27d1d0b13ee0c2574c1e36ebc6d4","4d696c106f568b99308565172116933c0e26ce2e9ace003a110e8bde0216ddab","aa7ff8badcffdff66df6d30bde51b6e3c960be0a3719b73d3875af8e1173bd94","0dfe7a93ff40834c072c7fdd9381771b1086b67f545fa83c766b2d67a911e47b","1a30e0d65a8a09abc3feb1c86a0619845fc6ab9bdba3ae8800ecec55a647910e","624f129189a05897c176e9feb519521c1b6ef528b0b52e1a7a3290e5a2313a6b","fe2e5df2fae90fb90b56e4ea268e8ca68f46dc3365c22b840d865193a48be189")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("2280898cb29faf1785e782596d8029cb471537ec38352e5c17cc263f1f52b8ef","3e035f2d7d30869ce53171ef5a0f761bfb9c14d94d9fe6da385e20b8d96dc2fb","840af927adbfdeb7070e1cf73ed195cf48c8d5f35b6de12f58b73898d7056d3d","b5b105751a2bf965a6b78eeff100fe4c75282ad6f37f98b9adcd15d8c64283ec","c75748dc544629a8a5d08c0d8ba7fda3508a3efdaed905ad800ffddbc8d3b8df","e75717be1633b5e3602827dc3b5788ff691dd325b0eddd2d0d9ddcee29de364f","08f491d46a9d05f1aebc83d724ca32c8063a2613250d50ce5b7e8ba469680605","969a4a55bb5cabc96ff003467bd8468b3079f5c95c5823985416c019eb8abe2f","c4e47cba1c5fedf9ba522bc2d2de54a482e0ac29c98358390af6dadc0a7d65ce","cf64c08d97e6dfa5588c5fa016c25c4131ccc61b8deada7f9c8b2a41d8f5a32c","6c94a1bc67af21cedb0bffac03019dbf870649a182e58cc5960969adf4fbdd48","58db85f0c86640b4c3a2584e9ef5696c526190faf87eaa19085737685bc9e7f5","9ca0e858ff6f163a128fb699d2b801b6b13a2eb1d6cd995302effa5f587cd8d8","aecfc82fa44790e0533f0bece0a1ab0860b163838646aa0c019187a37326d477","be3e665d389e8b85ceda1e2fc80a41a247de27d1d0b13ee0c2574c1e36ebc6d4","4d696c106f568b99308565172116933c0e26ce2e9ace003a110e8bde0216ddab","aa7ff8badcffdff66df6d30bde51b6e3c960be0a3719b73d3875af8e1173bd94","0dfe7a93ff40834c072c7fdd9381771b1086b67f545fa83c766b2d67a911e47b","1a30e0d65a8a09abc3feb1c86a0619845fc6ab9bdba3ae8800ecec55a647910e","624f129189a05897c176e9feb519521c1b6ef528b0b52e1a7a3290e5a2313a6b","fe2e5df2fae90fb90b56e4ea268e8ca68f46dc3365c22b840d865193a48be189")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("2280898cb29faf1785e782596d8029cb471537ec38352e5c17cc263f1f52b8ef","3e035f2d7d30869ce53171ef5a0f761bfb9c14d94d9fe6da385e20b8d96dc2fb","840af927adbfdeb7070e1cf73ed195cf48c8d5f35b6de12f58b73898d7056d3d","b5b105751a2bf965a6b78eeff100fe4c75282ad6f37f98b9adcd15d8c64283ec","c75748dc544629a8a5d08c0d8ba7fda3508a3efdaed905ad800ffddbc8d3b8df","e75717be1633b5e3602827dc3b5788ff691dd325b0eddd2d0d9ddcee29de364f","08f491d46a9d05f1aebc83d724ca32c8063a2613250d50ce5b7e8ba469680605","969a4a55bb5cabc96ff003467bd8468b3079f5c95c5823985416c019eb8abe2f","c4e47cba1c5fedf9ba522bc2d2de54a482e0ac29c98358390af6dadc0a7d65ce","cf64c08d97e6dfa5588c5fa016c25c4131ccc61b8deada7f9c8b2a41d8f5a32c","6c94a1bc67af21cedb0bffac03019dbf870649a182e58cc5960969adf4fbdd48","58db85f0c86640b4c3a2584e9ef5696c526190faf87eaa19085737685bc9e7f5","9ca0e858ff6f163a128fb699d2b801b6b13a2eb1d6cd995302effa5f587cd8d8","aecfc82fa44790e0533f0bece0a1ab0860b163838646aa0c019187a37326d477","be3e665d389e8b85ceda1e2fc80a41a247de27d1d0b13ee0c2574c1e36ebc6d4","4d696c106f568b99308565172116933c0e26ce2e9ace003a110e8bde0216ddab","aa7ff8badcffdff66df6d30bde51b6e3c960be0a3719b73d3875af8e1173bd94","0dfe7a93ff40834c072c7fdd9381771b1086b67f545fa83c766b2d67a911e47b","1a30e0d65a8a09abc3feb1c86a0619845fc6ab9bdba3ae8800ecec55a647910e","624f129189a05897c176e9feb519521c1b6ef528b0b52e1a7a3290e5a2313a6b","fe2e5df2fae90fb90b56e4ea268e8ca68f46dc3365c22b840d865193a48be189")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("2280898cb29faf1785e782596d8029cb471537ec38352e5c17cc263f1f52b8ef","3e035f2d7d30869ce53171ef5a0f761bfb9c14d94d9fe6da385e20b8d96dc2fb","840af927adbfdeb7070e1cf73ed195cf48c8d5f35b6de12f58b73898d7056d3d","b5b105751a2bf965a6b78eeff100fe4c75282ad6f37f98b9adcd15d8c64283ec","c75748dc544629a8a5d08c0d8ba7fda3508a3efdaed905ad800ffddbc8d3b8df","e75717be1633b5e3602827dc3b5788ff691dd325b0eddd2d0d9ddcee29de364f","08f491d46a9d05f1aebc83d724ca32c8063a2613250d50ce5b7e8ba469680605","969a4a55bb5cabc96ff003467bd8468b3079f5c95c5823985416c019eb8abe2f","c4e47cba1c5fedf9ba522bc2d2de54a482e0ac29c98358390af6dadc0a7d65ce","cf64c08d97e6dfa5588c5fa016c25c4131ccc61b8deada7f9c8b2a41d8f5a32c","6c94a1bc67af21cedb0bffac03019dbf870649a182e58cc5960969adf4fbdd48","58db85f0c86640b4c3a2584e9ef5696c526190faf87eaa19085737685bc9e7f5","9ca0e858ff6f163a128fb699d2b801b6b13a2eb1d6cd995302effa5f587cd8d8","aecfc82fa44790e0533f0bece0a1ab0860b163838646aa0c019187a37326d477","be3e665d389e8b85ceda1e2fc80a41a247de27d1d0b13ee0c2574c1e36ebc6d4","4d696c106f568b99308565172116933c0e26ce2e9ace003a110e8bde0216ddab","aa7ff8badcffdff66df6d30bde51b6e3c960be0a3719b73d3875af8e1173bd94","0dfe7a93ff40834c072c7fdd9381771b1086b67f545fa83c766b2d67a911e47b","1a30e0d65a8a09abc3feb1c86a0619845fc6ab9bdba3ae8800ecec55a647910e","624f129189a05897c176e9feb519521c1b6ef528b0b52e1a7a3290e5a2313a6b","fe2e5df2fae90fb90b56e4ea268e8ca68f46dc3365c22b840d865193a48be189")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("2280898cb29faf1785e782596d8029cb471537ec38352e5c17cc263f1f52b8ef","3e035f2d7d30869ce53171ef5a0f761bfb9c14d94d9fe6da385e20b8d96dc2fb","840af927adbfdeb7070e1cf73ed195cf48c8d5f35b6de12f58b73898d7056d3d","b5b105751a2bf965a6b78eeff100fe4c75282ad6f37f98b9adcd15d8c64283ec","c75748dc544629a8a5d08c0d8ba7fda3508a3efdaed905ad800ffddbc8d3b8df","e75717be1633b5e3602827dc3b5788ff691dd325b0eddd2d0d9ddcee29de364f","08f491d46a9d05f1aebc83d724ca32c8063a2613250d50ce5b7e8ba469680605","969a4a55bb5cabc96ff003467bd8468b3079f5c95c5823985416c019eb8abe2f","c4e47cba1c5fedf9ba522bc2d2de54a482e0ac29c98358390af6dadc0a7d65ce","cf64c08d97e6dfa5588c5fa016c25c4131ccc61b8deada7f9c8b2a41d8f5a32c","6c94a1bc67af21cedb0bffac03019dbf870649a182e58cc5960969adf4fbdd48","58db85f0c86640b4c3a2584e9ef5696c526190faf87eaa19085737685bc9e7f5","9ca0e858ff6f163a128fb699d2b801b6b13a2eb1d6cd995302effa5f587cd8d8","aecfc82fa44790e0533f0bece0a1ab0860b163838646aa0c019187a37326d477","be3e665d389e8b85ceda1e2fc80a41a247de27d1d0b13ee0c2574c1e36ebc6d4","4d696c106f568b99308565172116933c0e26ce2e9ace003a110e8bde0216ddab","aa7ff8badcffdff66df6d30bde51b6e3c960be0a3719b73d3875af8e1173bd94","0dfe7a93ff40834c072c7fdd9381771b1086b67f545fa83c766b2d67a911e47b","1a30e0d65a8a09abc3feb1c86a0619845fc6ab9bdba3ae8800ecec55a647910e","624f129189a05897c176e9feb519521c1b6ef528b0b52e1a7a3290e5a2313a6b","fe2e5df2fae90fb90b56e4ea268e8ca68f46dc3365c22b840d865193a48be189")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("2280898cb29faf1785e782596d8029cb471537ec38352e5c17cc263f1f52b8ef","3e035f2d7d30869ce53171ef5a0f761bfb9c14d94d9fe6da385e20b8d96dc2fb","840af927adbfdeb7070e1cf73ed195cf48c8d5f35b6de12f58b73898d7056d3d","b5b105751a2bf965a6b78eeff100fe4c75282ad6f37f98b9adcd15d8c64283ec","c75748dc544629a8a5d08c0d8ba7fda3508a3efdaed905ad800ffddbc8d3b8df","e75717be1633b5e3602827dc3b5788ff691dd325b0eddd2d0d9ddcee29de364f","08f491d46a9d05f1aebc83d724ca32c8063a2613250d50ce5b7e8ba469680605","969a4a55bb5cabc96ff003467bd8468b3079f5c95c5823985416c019eb8abe2f","c4e47cba1c5fedf9ba522bc2d2de54a482e0ac29c98358390af6dadc0a7d65ce","cf64c08d97e6dfa5588c5fa016c25c4131ccc61b8deada7f9c8b2a41d8f5a32c","6c94a1bc67af21cedb0bffac03019dbf870649a182e58cc5960969adf4fbdd48","58db85f0c86640b4c3a2584e9ef5696c526190faf87eaa19085737685bc9e7f5","9ca0e858ff6f163a128fb699d2b801b6b13a2eb1d6cd995302effa5f587cd8d8","aecfc82fa44790e0533f0bece0a1ab0860b163838646aa0c019187a37326d477","be3e665d389e8b85ceda1e2fc80a41a247de27d1d0b13ee0c2574c1e36ebc6d4","4d696c106f568b99308565172116933c0e26ce2e9ace003a110e8bde0216ddab","aa7ff8badcffdff66df6d30bde51b6e3c960be0a3719b73d3875af8e1173bd94","0dfe7a93ff40834c072c7fdd9381771b1086b67f545fa83c766b2d67a911e47b","1a30e0d65a8a09abc3feb1c86a0619845fc6ab9bdba3ae8800ecec55a647910e","624f129189a05897c176e9feb519521c1b6ef528b0b52e1a7a3290e5a2313a6b","fe2e5df2fae90fb90b56e4ea268e8ca68f46dc3365c22b840d865193a48be189")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("2280898cb29faf1785e782596d8029cb471537ec38352e5c17cc263f1f52b8ef","3e035f2d7d30869ce53171ef5a0f761bfb9c14d94d9fe6da385e20b8d96dc2fb","840af927adbfdeb7070e1cf73ed195cf48c8d5f35b6de12f58b73898d7056d3d","b5b105751a2bf965a6b78eeff100fe4c75282ad6f37f98b9adcd15d8c64283ec","c75748dc544629a8a5d08c0d8ba7fda3508a3efdaed905ad800ffddbc8d3b8df","e75717be1633b5e3602827dc3b5788ff691dd325b0eddd2d0d9ddcee29de364f","08f491d46a9d05f1aebc83d724ca32c8063a2613250d50ce5b7e8ba469680605","969a4a55bb5cabc96ff003467bd8468b3079f5c95c5823985416c019eb8abe2f","c4e47cba1c5fedf9ba522bc2d2de54a482e0ac29c98358390af6dadc0a7d65ce","cf64c08d97e6dfa5588c5fa016c25c4131ccc61b8deada7f9c8b2a41d8f5a32c","6c94a1bc67af21cedb0bffac03019dbf870649a182e58cc5960969adf4fbdd48","58db85f0c86640b4c3a2584e9ef5696c526190faf87eaa19085737685bc9e7f5","9ca0e858ff6f163a128fb699d2b801b6b13a2eb1d6cd995302effa5f587cd8d8","aecfc82fa44790e0533f0bece0a1ab0860b163838646aa0c019187a37326d477","be3e665d389e8b85ceda1e2fc80a41a247de27d1d0b13ee0c2574c1e36ebc6d4","4d696c106f568b99308565172116933c0e26ce2e9ace003a110e8bde0216ddab","aa7ff8badcffdff66df6d30bde51b6e3c960be0a3719b73d3875af8e1173bd94","0dfe7a93ff40834c072c7fdd9381771b1086b67f545fa83c766b2d67a911e47b","1a30e0d65a8a09abc3feb1c86a0619845fc6ab9bdba3ae8800ecec55a647910e","624f129189a05897c176e9feb519521c1b6ef528b0b52e1a7a3290e5a2313a6b","fe2e5df2fae90fb90b56e4ea268e8ca68f46dc3365c22b840d865193a48be189")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("2280898cb29faf1785e782596d8029cb471537ec38352e5c17cc263f1f52b8ef","3e035f2d7d30869ce53171ef5a0f761bfb9c14d94d9fe6da385e20b8d96dc2fb","840af927adbfdeb7070e1cf73ed195cf48c8d5f35b6de12f58b73898d7056d3d","b5b105751a2bf965a6b78eeff100fe4c75282ad6f37f98b9adcd15d8c64283ec","c75748dc544629a8a5d08c0d8ba7fda3508a3efdaed905ad800ffddbc8d3b8df","e75717be1633b5e3602827dc3b5788ff691dd325b0eddd2d0d9ddcee29de364f","08f491d46a9d05f1aebc83d724ca32c8063a2613250d50ce5b7e8ba469680605","969a4a55bb5cabc96ff003467bd8468b3079f5c95c5823985416c019eb8abe2f","c4e47cba1c5fedf9ba522bc2d2de54a482e0ac29c98358390af6dadc0a7d65ce","cf64c08d97e6dfa5588c5fa016c25c4131ccc61b8deada7f9c8b2a41d8f5a32c","6c94a1bc67af21cedb0bffac03019dbf870649a182e58cc5960969adf4fbdd48","58db85f0c86640b4c3a2584e9ef5696c526190faf87eaa19085737685bc9e7f5","9ca0e858ff6f163a128fb699d2b801b6b13a2eb1d6cd995302effa5f587cd8d8","aecfc82fa44790e0533f0bece0a1ab0860b163838646aa0c019187a37326d477","be3e665d389e8b85ceda1e2fc80a41a247de27d1d0b13ee0c2574c1e36ebc6d4","4d696c106f568b99308565172116933c0e26ce2e9ace003a110e8bde0216ddab","aa7ff8badcffdff66df6d30bde51b6e3c960be0a3719b73d3875af8e1173bd94","0dfe7a93ff40834c072c7fdd9381771b1086b67f545fa83c766b2d67a911e47b","1a30e0d65a8a09abc3feb1c86a0619845fc6ab9bdba3ae8800ecec55a647910e","624f129189a05897c176e9feb519521c1b6ef528b0b52e1a7a3290e5a2313a6b","fe2e5df2fae90fb90b56e4ea268e8ca68f46dc3365c22b840d865193a48be189")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("2280898cb29faf1785e782596d8029cb471537ec38352e5c17cc263f1f52b8ef","3e035f2d7d30869ce53171ef5a0f761bfb9c14d94d9fe6da385e20b8d96dc2fb","840af927adbfdeb7070e1cf73ed195cf48c8d5f35b6de12f58b73898d7056d3d","b5b105751a2bf965a6b78eeff100fe4c75282ad6f37f98b9adcd15d8c64283ec","c75748dc544629a8a5d08c0d8ba7fda3508a3efdaed905ad800ffddbc8d3b8df","e75717be1633b5e3602827dc3b5788ff691dd325b0eddd2d0d9ddcee29de364f","08f491d46a9d05f1aebc83d724ca32c8063a2613250d50ce5b7e8ba469680605","969a4a55bb5cabc96ff003467bd8468b3079f5c95c5823985416c019eb8abe2f","c4e47cba1c5fedf9ba522bc2d2de54a482e0ac29c98358390af6dadc0a7d65ce","cf64c08d97e6dfa5588c5fa016c25c4131ccc61b8deada7f9c8b2a41d8f5a32c","6c94a1bc67af21cedb0bffac03019dbf870649a182e58cc5960969adf4fbdd48","58db85f0c86640b4c3a2584e9ef5696c526190faf87eaa19085737685bc9e7f5","9ca0e858ff6f163a128fb699d2b801b6b13a2eb1d6cd995302effa5f587cd8d8","aecfc82fa44790e0533f0bece0a1ab0860b163838646aa0c019187a37326d477","be3e665d389e8b85ceda1e2fc80a41a247de27d1d0b13ee0c2574c1e36ebc6d4","4d696c106f568b99308565172116933c0e26ce2e9ace003a110e8bde0216ddab","aa7ff8badcffdff66df6d30bde51b6e3c960be0a3719b73d3875af8e1173bd94","0dfe7a93ff40834c072c7fdd9381771b1086b67f545fa83c766b2d67a911e47b","1a30e0d65a8a09abc3feb1c86a0619845fc6ab9bdba3ae8800ecec55a647910e","624f129189a05897c176e9feb519521c1b6ef528b0b52e1a7a3290e5a2313a6b","fe2e5df2fae90fb90b56e4ea268e8ca68f46dc3365c22b840d865193a48be189")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("2280898cb29faf1785e782596d8029cb471537ec38352e5c17cc263f1f52b8ef","3e035f2d7d30869ce53171ef5a0f761bfb9c14d94d9fe6da385e20b8d96dc2fb","840af927adbfdeb7070e1cf73ed195cf48c8d5f35b6de12f58b73898d7056d3d","b5b105751a2bf965a6b78eeff100fe4c75282ad6f37f98b9adcd15d8c64283ec","c75748dc544629a8a5d08c0d8ba7fda3508a3efdaed905ad800ffddbc8d3b8df","e75717be1633b5e3602827dc3b5788ff691dd325b0eddd2d0d9ddcee29de364f","08f491d46a9d05f1aebc83d724ca32c8063a2613250d50ce5b7e8ba469680605","969a4a55bb5cabc96ff003467bd8468b3079f5c95c5823985416c019eb8abe2f","c4e47cba1c5fedf9ba522bc2d2de54a482e0ac29c98358390af6dadc0a7d65ce","cf64c08d97e6dfa5588c5fa016c25c4131ccc61b8deada7f9c8b2a41d8f5a32c","6c94a1bc67af21cedb0bffac03019dbf870649a182e58cc5960969adf4fbdd48","58db85f0c86640b4c3a2584e9ef5696c526190faf87eaa19085737685bc9e7f5","9ca0e858ff6f163a128fb699d2b801b6b13a2eb1d6cd995302effa5f587cd8d8","aecfc82fa44790e0533f0bece0a1ab0860b163838646aa0c019187a37326d477","be3e665d389e8b85ceda1e2fc80a41a247de27d1d0b13ee0c2574c1e36ebc6d4","4d696c106f568b99308565172116933c0e26ce2e9ace003a110e8bde0216ddab","aa7ff8badcffdff66df6d30bde51b6e3c960be0a3719b73d3875af8e1173bd94","0dfe7a93ff40834c072c7fdd9381771b1086b67f545fa83c766b2d67a911e47b","1a30e0d65a8a09abc3feb1c86a0619845fc6ab9bdba3ae8800ecec55a647910e","624f129189a05897c176e9feb519521c1b6ef528b0b52e1a7a3290e5a2313a6b","fe2e5df2fae90fb90b56e4ea268e8ca68f46dc3365c22b840d865193a48be189")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("2280898cb29faf1785e782596d8029cb471537ec38352e5c17cc263f1f52b8ef","3e035f2d7d30869ce53171ef5a0f761bfb9c14d94d9fe6da385e20b8d96dc2fb","840af927adbfdeb7070e1cf73ed195cf48c8d5f35b6de12f58b73898d7056d3d","b5b105751a2bf965a6b78eeff100fe4c75282ad6f37f98b9adcd15d8c64283ec","c75748dc544629a8a5d08c0d8ba7fda3508a3efdaed905ad800ffddbc8d3b8df","e75717be1633b5e3602827dc3b5788ff691dd325b0eddd2d0d9ddcee29de364f","08f491d46a9d05f1aebc83d724ca32c8063a2613250d50ce5b7e8ba469680605","969a4a55bb5cabc96ff003467bd8468b3079f5c95c5823985416c019eb8abe2f","c4e47cba1c5fedf9ba522bc2d2de54a482e0ac29c98358390af6dadc0a7d65ce","cf64c08d97e6dfa5588c5fa016c25c4131ccc61b8deada7f9c8b2a41d8f5a32c","6c94a1bc67af21cedb0bffac03019dbf870649a182e58cc5960969adf4fbdd48","58db85f0c86640b4c3a2584e9ef5696c526190faf87eaa19085737685bc9e7f5","9ca0e858ff6f163a128fb699d2b801b6b13a2eb1d6cd995302effa5f587cd8d8","aecfc82fa44790e0533f0bece0a1ab0860b163838646aa0c019187a37326d477","be3e665d389e8b85ceda1e2fc80a41a247de27d1d0b13ee0c2574c1e36ebc6d4","4d696c106f568b99308565172116933c0e26ce2e9ace003a110e8bde0216ddab","aa7ff8badcffdff66df6d30bde51b6e3c960be0a3719b73d3875af8e1173bd94","0dfe7a93ff40834c072c7fdd9381771b1086b67f545fa83c766b2d67a911e47b","1a30e0d65a8a09abc3feb1c86a0619845fc6ab9bdba3ae8800ecec55a647910e","624f129189a05897c176e9feb519521c1b6ef528b0b52e1a7a3290e5a2313a6b","fe2e5df2fae90fb90b56e4ea268e8ca68f46dc3365c22b840d865193a48be189")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("2280898cb29faf1785e782596d8029cb471537ec38352e5c17cc263f1f52b8ef","3e035f2d7d30869ce53171ef5a0f761bfb9c14d94d9fe6da385e20b8d96dc2fb","840af927adbfdeb7070e1cf73ed195cf48c8d5f35b6de12f58b73898d7056d3d","b5b105751a2bf965a6b78eeff100fe4c75282ad6f37f98b9adcd15d8c64283ec","c75748dc544629a8a5d08c0d8ba7fda3508a3efdaed905ad800ffddbc8d3b8df","e75717be1633b5e3602827dc3b5788ff691dd325b0eddd2d0d9ddcee29de364f","08f491d46a9d05f1aebc83d724ca32c8063a2613250d50ce5b7e8ba469680605","969a4a55bb5cabc96ff003467bd8468b3079f5c95c5823985416c019eb8abe2f","c4e47cba1c5fedf9ba522bc2d2de54a482e0ac29c98358390af6dadc0a7d65ce","cf64c08d97e6dfa5588c5fa016c25c4131ccc61b8deada7f9c8b2a41d8f5a32c","6c94a1bc67af21cedb0bffac03019dbf870649a182e58cc5960969adf4fbdd48","58db85f0c86640b4c3a2584e9ef5696c526190faf87eaa19085737685bc9e7f5","9ca0e858ff6f163a128fb699d2b801b6b13a2eb1d6cd995302effa5f587cd8d8","aecfc82fa44790e0533f0bece0a1ab0860b163838646aa0c019187a37326d477","be3e665d389e8b85ceda1e2fc80a41a247de27d1d0b13ee0c2574c1e36ebc6d4","4d696c106f568b99308565172116933c0e26ce2e9ace003a110e8bde0216ddab","aa7ff8badcffdff66df6d30bde51b6e3c960be0a3719b73d3875af8e1173bd94","0dfe7a93ff40834c072c7fdd9381771b1086b67f545fa83c766b2d67a911e47b","1a30e0d65a8a09abc3feb1c86a0619845fc6ab9bdba3ae8800ecec55a647910e","624f129189a05897c176e9feb519521c1b6ef528b0b52e1a7a3290e5a2313a6b","fe2e5df2fae90fb90b56e4ea268e8ca68f46dc3365c22b840d865193a48be189")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("2280898cb29faf1785e782596d8029cb471537ec38352e5c17cc263f1f52b8ef","3e035f2d7d30869ce53171ef5a0f761bfb9c14d94d9fe6da385e20b8d96dc2fb","840af927adbfdeb7070e1cf73ed195cf48c8d5f35b6de12f58b73898d7056d3d","b5b105751a2bf965a6b78eeff100fe4c75282ad6f37f98b9adcd15d8c64283ec","c75748dc544629a8a5d08c0d8ba7fda3508a3efdaed905ad800ffddbc8d3b8df","e75717be1633b5e3602827dc3b5788ff691dd325b0eddd2d0d9ddcee29de364f","08f491d46a9d05f1aebc83d724ca32c8063a2613250d50ce5b7e8ba469680605","969a4a55bb5cabc96ff003467bd8468b3079f5c95c5823985416c019eb8abe2f","c4e47cba1c5fedf9ba522bc2d2de54a482e0ac29c98358390af6dadc0a7d65ce","cf64c08d97e6dfa5588c5fa016c25c4131ccc61b8deada7f9c8b2a41d8f5a32c","6c94a1bc67af21cedb0bffac03019dbf870649a182e58cc5960969adf4fbdd48","58db85f0c86640b4c3a2584e9ef5696c526190faf87eaa19085737685bc9e7f5","9ca0e858ff6f163a128fb699d2b801b6b13a2eb1d6cd995302effa5f587cd8d8","aecfc82fa44790e0533f0bece0a1ab0860b163838646aa0c019187a37326d477","be3e665d389e8b85ceda1e2fc80a41a247de27d1d0b13ee0c2574c1e36ebc6d4","4d696c106f568b99308565172116933c0e26ce2e9ace003a110e8bde0216ddab","aa7ff8badcffdff66df6d30bde51b6e3c960be0a3719b73d3875af8e1173bd94","0dfe7a93ff40834c072c7fdd9381771b1086b67f545fa83c766b2d67a911e47b","1a30e0d65a8a09abc3feb1c86a0619845fc6ab9bdba3ae8800ecec55a647910e","624f129189a05897c176e9feb519521c1b6ef528b0b52e1a7a3290e5a2313a6b","fe2e5df2fae90fb90b56e4ea268e8ca68f46dc3365c22b840d865193a48be189")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("2280898cb29faf1785e782596d8029cb471537ec38352e5c17cc263f1f52b8ef","3e035f2d7d30869ce53171ef5a0f761bfb9c14d94d9fe6da385e20b8d96dc2fb","840af927adbfdeb7070e1cf73ed195cf48c8d5f35b6de12f58b73898d7056d3d","b5b105751a2bf965a6b78eeff100fe4c75282ad6f37f98b9adcd15d8c64283ec","c75748dc544629a8a5d08c0d8ba7fda3508a3efdaed905ad800ffddbc8d3b8df","e75717be1633b5e3602827dc3b5788ff691dd325b0eddd2d0d9ddcee29de364f","08f491d46a9d05f1aebc83d724ca32c8063a2613250d50ce5b7e8ba469680605","969a4a55bb5cabc96ff003467bd8468b3079f5c95c5823985416c019eb8abe2f","c4e47cba1c5fedf9ba522bc2d2de54a482e0ac29c98358390af6dadc0a7d65ce","cf64c08d97e6dfa5588c5fa016c25c4131ccc61b8deada7f9c8b2a41d8f5a32c","6c94a1bc67af21cedb0bffac03019dbf870649a182e58cc5960969adf4fbdd48","58db85f0c86640b4c3a2584e9ef5696c526190faf87eaa19085737685bc9e7f5","9ca0e858ff6f163a128fb699d2b801b6b13a2eb1d6cd995302effa5f587cd8d8","aecfc82fa44790e0533f0bece0a1ab0860b163838646aa0c019187a37326d477","be3e665d389e8b85ceda1e2fc80a41a247de27d1d0b13ee0c2574c1e36ebc6d4","4d696c106f568b99308565172116933c0e26ce2e9ace003a110e8bde0216ddab","aa7ff8badcffdff66df6d30bde51b6e3c960be0a3719b73d3875af8e1173bd94","0dfe7a93ff40834c072c7fdd9381771b1086b67f545fa83c766b2d67a911e47b","1a30e0d65a8a09abc3feb1c86a0619845fc6ab9bdba3ae8800ecec55a647910e","624f129189a05897c176e9feb519521c1b6ef528b0b52e1a7a3290e5a2313a6b","fe2e5df2fae90fb90b56e4ea268e8ca68f46dc3365c22b840d865193a48be189")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("2280898cb29faf1785e782596d8029cb471537ec38352e5c17cc263f1f52b8ef","3e035f2d7d30869ce53171ef5a0f761bfb9c14d94d9fe6da385e20b8d96dc2fb","840af927adbfdeb7070e1cf73ed195cf48c8d5f35b6de12f58b73898d7056d3d","b5b105751a2bf965a6b78eeff100fe4c75282ad6f37f98b9adcd15d8c64283ec","c75748dc544629a8a5d08c0d8ba7fda3508a3efdaed905ad800ffddbc8d3b8df","e75717be1633b5e3602827dc3b5788ff691dd325b0eddd2d0d9ddcee29de364f","08f491d46a9d05f1aebc83d724ca32c8063a2613250d50ce5b7e8ba469680605","969a4a55bb5cabc96ff003467bd8468b3079f5c95c5823985416c019eb8abe2f","c4e47cba1c5fedf9ba522bc2d2de54a482e0ac29c98358390af6dadc0a7d65ce","cf64c08d97e6dfa5588c5fa016c25c4131ccc61b8deada7f9c8b2a41d8f5a32c","6c94a1bc67af21cedb0bffac03019dbf870649a182e58cc5960969adf4fbdd48","58db85f0c86640b4c3a2584e9ef5696c526190faf87eaa19085737685bc9e7f5","9ca0e858ff6f163a128fb699d2b801b6b13a2eb1d6cd995302effa5f587cd8d8","aecfc82fa44790e0533f0bece0a1ab0860b163838646aa0c019187a37326d477","be3e665d389e8b85ceda1e2fc80a41a247de27d1d0b13ee0c2574c1e36ebc6d4","4d696c106f568b99308565172116933c0e26ce2e9ace003a110e8bde0216ddab","aa7ff8badcffdff66df6d30bde51b6e3c960be0a3719b73d3875af8e1173bd94","0dfe7a93ff40834c072c7fdd9381771b1086b67f545fa83c766b2d67a911e47b","1a30e0d65a8a09abc3feb1c86a0619845fc6ab9bdba3ae8800ecec55a647910e","624f129189a05897c176e9feb519521c1b6ef528b0b52e1a7a3290e5a2313a6b","fe2e5df2fae90fb90b56e4ea268e8ca68f46dc3365c22b840d865193a48be189")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("2280898cb29faf1785e782596d8029cb471537ec38352e5c17cc263f1f52b8ef","3e035f2d7d30869ce53171ef5a0f761bfb9c14d94d9fe6da385e20b8d96dc2fb","840af927adbfdeb7070e1cf73ed195cf48c8d5f35b6de12f58b73898d7056d3d","b5b105751a2bf965a6b78eeff100fe4c75282ad6f37f98b9adcd15d8c64283ec","c75748dc544629a8a5d08c0d8ba7fda3508a3efdaed905ad800ffddbc8d3b8df","e75717be1633b5e3602827dc3b5788ff691dd325b0eddd2d0d9ddcee29de364f","08f491d46a9d05f1aebc83d724ca32c8063a2613250d50ce5b7e8ba469680605","969a4a55bb5cabc96ff003467bd8468b3079f5c95c5823985416c019eb8abe2f","c4e47cba1c5fedf9ba522bc2d2de54a482e0ac29c98358390af6dadc0a7d65ce","cf64c08d97e6dfa5588c5fa016c25c4131ccc61b8deada7f9c8b2a41d8f5a32c","6c94a1bc67af21cedb0bffac03019dbf870649a182e58cc5960969adf4fbdd48","58db85f0c86640b4c3a2584e9ef5696c526190faf87eaa19085737685bc9e7f5","9ca0e858ff6f163a128fb699d2b801b6b13a2eb1d6cd995302effa5f587cd8d8","aecfc82fa44790e0533f0bece0a1ab0860b163838646aa0c019187a37326d477","be3e665d389e8b85ceda1e2fc80a41a247de27d1d0b13ee0c2574c1e36ebc6d4","4d696c106f568b99308565172116933c0e26ce2e9ace003a110e8bde0216ddab","aa7ff8badcffdff66df6d30bde51b6e3c960be0a3719b73d3875af8e1173bd94","0dfe7a93ff40834c072c7fdd9381771b1086b67f545fa83c766b2d67a911e47b","1a30e0d65a8a09abc3feb1c86a0619845fc6ab9bdba3ae8800ecec55a647910e","624f129189a05897c176e9feb519521c1b6ef528b0b52e1a7a3290e5a2313a6b","fe2e5df2fae90fb90b56e4ea268e8ca68f46dc3365c22b840d865193a48be189")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("2280898cb29faf1785e782596d8029cb471537ec38352e5c17cc263f1f52b8ef","3e035f2d7d30869ce53171ef5a0f761bfb9c14d94d9fe6da385e20b8d96dc2fb","840af927adbfdeb7070e1cf73ed195cf48c8d5f35b6de12f58b73898d7056d3d","b5b105751a2bf965a6b78eeff100fe4c75282ad6f37f98b9adcd15d8c64283ec","c75748dc544629a8a5d08c0d8ba7fda3508a3efdaed905ad800ffddbc8d3b8df","e75717be1633b5e3602827dc3b5788ff691dd325b0eddd2d0d9ddcee29de364f","08f491d46a9d05f1aebc83d724ca32c8063a2613250d50ce5b7e8ba469680605","969a4a55bb5cabc96ff003467bd8468b3079f5c95c5823985416c019eb8abe2f","c4e47cba1c5fedf9ba522bc2d2de54a482e0ac29c98358390af6dadc0a7d65ce","cf64c08d97e6dfa5588c5fa016c25c4131ccc61b8deada7f9c8b2a41d8f5a32c","6c94a1bc67af21cedb0bffac03019dbf870649a182e58cc5960969adf4fbdd48","58db85f0c86640b4c3a2584e9ef5696c526190faf87eaa19085737685bc9e7f5","9ca0e858ff6f163a128fb699d2b801b6b13a2eb1d6cd995302effa5f587cd8d8","aecfc82fa44790e0533f0bece0a1ab0860b163838646aa0c019187a37326d477","be3e665d389e8b85ceda1e2fc80a41a247de27d1d0b13ee0c2574c1e36ebc6d4","4d696c106f568b99308565172116933c0e26ce2e9ace003a110e8bde0216ddab","aa7ff8badcffdff66df6d30bde51b6e3c960be0a3719b73d3875af8e1173bd94","0dfe7a93ff40834c072c7fdd9381771b1086b67f545fa83c766b2d67a911e47b","1a30e0d65a8a09abc3feb1c86a0619845fc6ab9bdba3ae8800ecec55a647910e","624f129189a05897c176e9feb519521c1b6ef528b0b52e1a7a3290e5a2313a6b","fe2e5df2fae90fb90b56e4ea268e8ca68f46dc3365c22b840d865193a48be189")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("2280898cb29faf1785e782596d8029cb471537ec38352e5c17cc263f1f52b8ef","3e035f2d7d30869ce53171ef5a0f761bfb9c14d94d9fe6da385e20b8d96dc2fb","840af927adbfdeb7070e1cf73ed195cf48c8d5f35b6de12f58b73898d7056d3d","b5b105751a2bf965a6b78eeff100fe4c75282ad6f37f98b9adcd15d8c64283ec","c75748dc544629a8a5d08c0d8ba7fda3508a3efdaed905ad800ffddbc8d3b8df","e75717be1633b5e3602827dc3b5788ff691dd325b0eddd2d0d9ddcee29de364f","08f491d46a9d05f1aebc83d724ca32c8063a2613250d50ce5b7e8ba469680605","969a4a55bb5cabc96ff003467bd8468b3079f5c95c5823985416c019eb8abe2f","c4e47cba1c5fedf9ba522bc2d2de54a482e0ac29c98358390af6dadc0a7d65ce","cf64c08d97e6dfa5588c5fa016c25c4131ccc61b8deada7f9c8b2a41d8f5a32c","6c94a1bc67af21cedb0bffac03019dbf870649a182e58cc5960969adf4fbdd48","58db85f0c86640b4c3a2584e9ef5696c526190faf87eaa19085737685bc9e7f5","9ca0e858ff6f163a128fb699d2b801b6b13a2eb1d6cd995302effa5f587cd8d8","aecfc82fa44790e0533f0bece0a1ab0860b163838646aa0c019187a37326d477","be3e665d389e8b85ceda1e2fc80a41a247de27d1d0b13ee0c2574c1e36ebc6d4","4d696c106f568b99308565172116933c0e26ce2e9ace003a110e8bde0216ddab","aa7ff8badcffdff66df6d30bde51b6e3c960be0a3719b73d3875af8e1173bd94","0dfe7a93ff40834c072c7fdd9381771b1086b67f545fa83c766b2d67a911e47b","1a30e0d65a8a09abc3feb1c86a0619845fc6ab9bdba3ae8800ecec55a647910e","624f129189a05897c176e9feb519521c1b6ef528b0b52e1a7a3290e5a2313a6b","fe2e5df2fae90fb90b56e4ea268e8ca68f46dc3365c22b840d865193a48be189")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("2280898cb29faf1785e782596d8029cb471537ec38352e5c17cc263f1f52b8ef","3e035f2d7d30869ce53171ef5a0f761bfb9c14d94d9fe6da385e20b8d96dc2fb","840af927adbfdeb7070e1cf73ed195cf48c8d5f35b6de12f58b73898d7056d3d","b5b105751a2bf965a6b78eeff100fe4c75282ad6f37f98b9adcd15d8c64283ec","c75748dc544629a8a5d08c0d8ba7fda3508a3efdaed905ad800ffddbc8d3b8df","e75717be1633b5e3602827dc3b5788ff691dd325b0eddd2d0d9ddcee29de364f","08f491d46a9d05f1aebc83d724ca32c8063a2613250d50ce5b7e8ba469680605","969a4a55bb5cabc96ff003467bd8468b3079f5c95c5823985416c019eb8abe2f","c4e47cba1c5fedf9ba522bc2d2de54a482e0ac29c98358390af6dadc0a7d65ce","cf64c08d97e6dfa5588c5fa016c25c4131ccc61b8deada7f9c8b2a41d8f5a32c","6c94a1bc67af21cedb0bffac03019dbf870649a182e58cc5960969adf4fbdd48","58db85f0c86640b4c3a2584e9ef5696c526190faf87eaa19085737685bc9e7f5","9ca0e858ff6f163a128fb699d2b801b6b13a2eb1d6cd995302effa5f587cd8d8","aecfc82fa44790e0533f0bece0a1ab0860b163838646aa0c019187a37326d477","be3e665d389e8b85ceda1e2fc80a41a247de27d1d0b13ee0c2574c1e36ebc6d4","4d696c106f568b99308565172116933c0e26ce2e9ace003a110e8bde0216ddab","aa7ff8badcffdff66df6d30bde51b6e3c960be0a3719b73d3875af8e1173bd94","0dfe7a93ff40834c072c7fdd9381771b1086b67f545fa83c766b2d67a911e47b","1a30e0d65a8a09abc3feb1c86a0619845fc6ab9bdba3ae8800ecec55a647910e","624f129189a05897c176e9feb519521c1b6ef528b0b52e1a7a3290e5a2313a6b","fe2e5df2fae90fb90b56e4ea268e8ca68f46dc3365c22b840d865193a48be189")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("2280898cb29faf1785e782596d8029cb471537ec38352e5c17cc263f1f52b8ef","3e035f2d7d30869ce53171ef5a0f761bfb9c14d94d9fe6da385e20b8d96dc2fb","840af927adbfdeb7070e1cf73ed195cf48c8d5f35b6de12f58b73898d7056d3d","b5b105751a2bf965a6b78eeff100fe4c75282ad6f37f98b9adcd15d8c64283ec","c75748dc544629a8a5d08c0d8ba7fda3508a3efdaed905ad800ffddbc8d3b8df","e75717be1633b5e3602827dc3b5788ff691dd325b0eddd2d0d9ddcee29de364f","08f491d46a9d05f1aebc83d724ca32c8063a2613250d50ce5b7e8ba469680605","969a4a55bb5cabc96ff003467bd8468b3079f5c95c5823985416c019eb8abe2f","c4e47cba1c5fedf9ba522bc2d2de54a482e0ac29c98358390af6dadc0a7d65ce","cf64c08d97e6dfa5588c5fa016c25c4131ccc61b8deada7f9c8b2a41d8f5a32c","6c94a1bc67af21cedb0bffac03019dbf870649a182e58cc5960969adf4fbdd48","58db85f0c86640b4c3a2584e9ef5696c526190faf87eaa19085737685bc9e7f5","9ca0e858ff6f163a128fb699d2b801b6b13a2eb1d6cd995302effa5f587cd8d8","aecfc82fa44790e0533f0bece0a1ab0860b163838646aa0c019187a37326d477","be3e665d389e8b85ceda1e2fc80a41a247de27d1d0b13ee0c2574c1e36ebc6d4","4d696c106f568b99308565172116933c0e26ce2e9ace003a110e8bde0216ddab","aa7ff8badcffdff66df6d30bde51b6e3c960be0a3719b73d3875af8e1173bd94","0dfe7a93ff40834c072c7fdd9381771b1086b67f545fa83c766b2d67a911e47b","1a30e0d65a8a09abc3feb1c86a0619845fc6ab9bdba3ae8800ecec55a647910e","624f129189a05897c176e9feb519521c1b6ef528b0b52e1a7a3290e5a2313a6b","fe2e5df2fae90fb90b56e4ea268e8ca68f46dc3365c22b840d865193a48be189")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("2280898cb29faf1785e782596d8029cb471537ec38352e5c17cc263f1f52b8ef","3e035f2d7d30869ce53171ef5a0f761bfb9c14d94d9fe6da385e20b8d96dc2fb","840af927adbfdeb7070e1cf73ed195cf48c8d5f35b6de12f58b73898d7056d3d","b5b105751a2bf965a6b78eeff100fe4c75282ad6f37f98b9adcd15d8c64283ec","c75748dc544629a8a5d08c0d8ba7fda3508a3efdaed905ad800ffddbc8d3b8df","e75717be1633b5e3602827dc3b5788ff691dd325b0eddd2d0d9ddcee29de364f","08f491d46a9d05f1aebc83d724ca32c8063a2613250d50ce5b7e8ba469680605","969a4a55bb5cabc96ff003467bd8468b3079f5c95c5823985416c019eb8abe2f","c4e47cba1c5fedf9ba522bc2d2de54a482e0ac29c98358390af6dadc0a7d65ce","cf64c08d97e6dfa5588c5fa016c25c4131ccc61b8deada7f9c8b2a41d8f5a32c","6c94a1bc67af21cedb0bffac03019dbf870649a182e58cc5960969adf4fbdd48","58db85f0c86640b4c3a2584e9ef5696c526190faf87eaa19085737685bc9e7f5","9ca0e858ff6f163a128fb699d2b801b6b13a2eb1d6cd995302effa5f587cd8d8","aecfc82fa44790e0533f0bece0a1ab0860b163838646aa0c019187a37326d477","be3e665d389e8b85ceda1e2fc80a41a247de27d1d0b13ee0c2574c1e36ebc6d4","4d696c106f568b99308565172116933c0e26ce2e9ace003a110e8bde0216ddab","aa7ff8badcffdff66df6d30bde51b6e3c960be0a3719b73d3875af8e1173bd94","0dfe7a93ff40834c072c7fdd9381771b1086b67f545fa83c766b2d67a911e47b","1a30e0d65a8a09abc3feb1c86a0619845fc6ab9bdba3ae8800ecec55a647910e","624f129189a05897c176e9feb519521c1b6ef528b0b52e1a7a3290e5a2313a6b","fe2e5df2fae90fb90b56e4ea268e8ca68f46dc3365c22b840d865193a48be189")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("2280898cb29faf1785e782596d8029cb471537ec38352e5c17cc263f1f52b8ef","3e035f2d7d30869ce53171ef5a0f761bfb9c14d94d9fe6da385e20b8d96dc2fb","840af927adbfdeb7070e1cf73ed195cf48c8d5f35b6de12f58b73898d7056d3d","b5b105751a2bf965a6b78eeff100fe4c75282ad6f37f98b9adcd15d8c64283ec","c75748dc544629a8a5d08c0d8ba7fda3508a3efdaed905ad800ffddbc8d3b8df","e75717be1633b5e3602827dc3b5788ff691dd325b0eddd2d0d9ddcee29de364f","08f491d46a9d05f1aebc83d724ca32c8063a2613250d50ce5b7e8ba469680605","969a4a55bb5cabc96ff003467bd8468b3079f5c95c5823985416c019eb8abe2f","c4e47cba1c5fedf9ba522bc2d2de54a482e0ac29c98358390af6dadc0a7d65ce","cf64c08d97e6dfa5588c5fa016c25c4131ccc61b8deada7f9c8b2a41d8f5a32c","6c94a1bc67af21cedb0bffac03019dbf870649a182e58cc5960969adf4fbdd48","58db85f0c86640b4c3a2584e9ef5696c526190faf87eaa19085737685bc9e7f5","9ca0e858ff6f163a128fb699d2b801b6b13a2eb1d6cd995302effa5f587cd8d8","aecfc82fa44790e0533f0bece0a1ab0860b163838646aa0c019187a37326d477","be3e665d389e8b85ceda1e2fc80a41a247de27d1d0b13ee0c2574c1e36ebc6d4","4d696c106f568b99308565172116933c0e26ce2e9ace003a110e8bde0216ddab","aa7ff8badcffdff66df6d30bde51b6e3c960be0a3719b73d3875af8e1173bd94","0dfe7a93ff40834c072c7fdd9381771b1086b67f545fa83c766b2d67a911e47b","1a30e0d65a8a09abc3feb1c86a0619845fc6ab9bdba3ae8800ecec55a647910e","624f129189a05897c176e9feb519521c1b6ef528b0b52e1a7a3290e5a2313a6b","fe2e5df2fae90fb90b56e4ea268e8ca68f46dc3365c22b840d865193a48be189")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("2280898cb29faf1785e782596d8029cb471537ec38352e5c17cc263f1f52b8ef","3e035f2d7d30869ce53171ef5a0f761bfb9c14d94d9fe6da385e20b8d96dc2fb","840af927adbfdeb7070e1cf73ed195cf48c8d5f35b6de12f58b73898d7056d3d","b5b105751a2bf965a6b78eeff100fe4c75282ad6f37f98b9adcd15d8c64283ec","c75748dc544629a8a5d08c0d8ba7fda3508a3efdaed905ad800ffddbc8d3b8df","e75717be1633b5e3602827dc3b5788ff691dd325b0eddd2d0d9ddcee29de364f","08f491d46a9d05f1aebc83d724ca32c8063a2613250d50ce5b7e8ba469680605","969a4a55bb5cabc96ff003467bd8468b3079f5c95c5823985416c019eb8abe2f","c4e47cba1c5fedf9ba522bc2d2de54a482e0ac29c98358390af6dadc0a7d65ce","cf64c08d97e6dfa5588c5fa016c25c4131ccc61b8deada7f9c8b2a41d8f5a32c","6c94a1bc67af21cedb0bffac03019dbf870649a182e58cc5960969adf4fbdd48","58db85f0c86640b4c3a2584e9ef5696c526190faf87eaa19085737685bc9e7f5","9ca0e858ff6f163a128fb699d2b801b6b13a2eb1d6cd995302effa5f587cd8d8","aecfc82fa44790e0533f0bece0a1ab0860b163838646aa0c019187a37326d477","be3e665d389e8b85ceda1e2fc80a41a247de27d1d0b13ee0c2574c1e36ebc6d4","4d696c106f568b99308565172116933c0e26ce2e9ace003a110e8bde0216ddab","aa7ff8badcffdff66df6d30bde51b6e3c960be0a3719b73d3875af8e1173bd94","0dfe7a93ff40834c072c7fdd9381771b1086b67f545fa83c766b2d67a911e47b","1a30e0d65a8a09abc3feb1c86a0619845fc6ab9bdba3ae8800ecec55a647910e","624f129189a05897c176e9feb519521c1b6ef528b0b52e1a7a3290e5a2313a6b","fe2e5df2fae90fb90b56e4ea268e8ca68f46dc3365c22b840d865193a48be189")
index=activity AND rg_functionality="Endpoint Management Systems" AND requesturl NOT NULL AND requesturl IN ("https://kmsauto.us/someone/start.ps1","https://kmsauto.us/someone/","https://kmsauto.us/someone/l.exe","https://kmsauto.us/app1.bin","https://kmsauto.us/server.txt","https://kmsauto.us/encoding.txt","https://kmsauto.us/all.txt","https://kmsauto.us/someone/spooler.exe","https://kmsauto.us/sti/sti.bin","https://kmsauto.us/someone/potato.exe","https://kmsauto.us/someone/ghost.exe","http://ccpyeuptrlatb2piua4ukhnhi7lrxgerrcrj4p2b5uhbzqm2xgdjaqid.onion")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND requesturl NOT NULL AND requesturl IN ("https://kmsauto.us/someone/start.ps1","https://kmsauto.us/someone/","https://kmsauto.us/someone/l.exe","https://kmsauto.us/app1.bin","https://kmsauto.us/server.txt","https://kmsauto.us/encoding.txt","https://kmsauto.us/all.txt","https://kmsauto.us/someone/spooler.exe","https://kmsauto.us/sti/sti.bin","https://kmsauto.us/someone/potato.exe","https://kmsauto.us/someone/ghost.exe","http://ccpyeuptrlatb2piua4ukhnhi7lrxgerrcrj4p2b5uhbzqm2xgdjaqid.onion")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND requesturl NOT NULL AND requesturl IN ("https://kmsauto.us/someone/start.ps1","https://kmsauto.us/someone/","https://kmsauto.us/someone/l.exe","https://kmsauto.us/app1.bin","https://kmsauto.us/server.txt","https://kmsauto.us/encoding.txt","https://kmsauto.us/all.txt","https://kmsauto.us/someone/spooler.exe","https://kmsauto.us/sti/sti.bin","https://kmsauto.us/someone/potato.exe","https://kmsauto.us/someone/ghost.exe","http://ccpyeuptrlatb2piua4ukhnhi7lrxgerrcrj4p2b5uhbzqm2xgdjaqid.onion")
index=activity AND rg_functionality="Email / Email Security" AND requesturl NOT NULL AND requesturl IN ("https://kmsauto.us/someone/start.ps1","https://kmsauto.us/someone/","https://kmsauto.us/someone/l.exe","https://kmsauto.us/app1.bin","https://kmsauto.us/server.txt","https://kmsauto.us/encoding.txt","https://kmsauto.us/all.txt","https://kmsauto.us/someone/spooler.exe","https://kmsauto.us/sti/sti.bin","https://kmsauto.us/someone/potato.exe","https://kmsauto.us/someone/ghost.exe","http://ccpyeuptrlatb2piua4ukhnhi7lrxgerrcrj4p2b5uhbzqm2xgdjaqid.onion")
index=activity AND rg_functionality="Cloud Email / Email Security" AND requesturl NOT NULL AND requesturl IN ("https://kmsauto.us/someone/start.ps1","https://kmsauto.us/someone/","https://kmsauto.us/someone/l.exe","https://kmsauto.us/app1.bin","https://kmsauto.us/server.txt","https://kmsauto.us/encoding.txt","https://kmsauto.us/all.txt","https://kmsauto.us/someone/spooler.exe","https://kmsauto.us/sti/sti.bin","https://kmsauto.us/someone/potato.exe","https://kmsauto.us/someone/ghost.exe","http://ccpyeuptrlatb2piua4ukhnhi7lrxgerrcrj4p2b5uhbzqm2xgdjaqid.onion")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND requesturl NOT NULL AND requesturl IN ("https://kmsauto.us/someone/start.ps1","https://kmsauto.us/someone/","https://kmsauto.us/someone/l.exe","https://kmsauto.us/app1.bin","https://kmsauto.us/server.txt","https://kmsauto.us/encoding.txt","https://kmsauto.us/all.txt","https://kmsauto.us/someone/spooler.exe","https://kmsauto.us/sti/sti.bin","https://kmsauto.us/someone/potato.exe","https://kmsauto.us/someone/ghost.exe","http://ccpyeuptrlatb2piua4ukhnhi7lrxgerrcrj4p2b5uhbzqm2xgdjaqid.onion")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND requesturl NOT NULL AND requesturl IN ("https://kmsauto.us/someone/start.ps1","https://kmsauto.us/someone/","https://kmsauto.us/someone/l.exe","https://kmsauto.us/app1.bin","https://kmsauto.us/server.txt","https://kmsauto.us/encoding.txt","https://kmsauto.us/all.txt","https://kmsauto.us/someone/spooler.exe","https://kmsauto.us/sti/sti.bin","https://kmsauto.us/someone/potato.exe","https://kmsauto.us/someone/ghost.exe","http://ccpyeuptrlatb2piua4ukhnhi7lrxgerrcrj4p2b5uhbzqm2xgdjaqid.onion")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND requesturl NOT NULL AND requesturl IN ("https://kmsauto.us/someone/start.ps1","https://kmsauto.us/someone/","https://kmsauto.us/someone/l.exe","https://kmsauto.us/app1.bin","https://kmsauto.us/server.txt","https://kmsauto.us/encoding.txt","https://kmsauto.us/all.txt","https://kmsauto.us/someone/spooler.exe","https://kmsauto.us/sti/sti.bin","https://kmsauto.us/someone/potato.exe","https://kmsauto.us/someone/ghost.exe","http://ccpyeuptrlatb2piua4ukhnhi7lrxgerrcrj4p2b5uhbzqm2xgdjaqid.onion")
index=activity AND rg_functionality="Web Proxy" AND requesturl NOT NULL AND requesturl IN ("https://kmsauto.us/someone/start.ps1","https://kmsauto.us/someone/","https://kmsauto.us/someone/l.exe","https://kmsauto.us/app1.bin","https://kmsauto.us/server.txt","https://kmsauto.us/encoding.txt","https://kmsauto.us/all.txt","https://kmsauto.us/someone/spooler.exe","https://kmsauto.us/sti/sti.bin","https://kmsauto.us/someone/potato.exe","https://kmsauto.us/someone/ghost.exe","http://ccpyeuptrlatb2piua4ukhnhi7lrxgerrcrj4p2b5uhbzqm2xgdjaqid.onion")
index=activity AND rg_functionality="Next Generation Firewall" AND requesturl NOT NULL AND requesturl IN ("https://kmsauto.us/someone/start.ps1","https://kmsauto.us/someone/","https://kmsauto.us/someone/l.exe","https://kmsauto.us/app1.bin","https://kmsauto.us/server.txt","https://kmsauto.us/encoding.txt","https://kmsauto.us/all.txt","https://kmsauto.us/someone/spooler.exe","https://kmsauto.us/sti/sti.bin","https://kmsauto.us/someone/potato.exe","https://kmsauto.us/someone/ghost.exe","http://ccpyeuptrlatb2piua4ukhnhi7lrxgerrcrj4p2b5uhbzqm2xgdjaqid.onion")
index=activity AND rg_functionality="Flow" AND requesturl NOT NULL AND requesturl IN ("https://kmsauto.us/someone/start.ps1","https://kmsauto.us/someone/","https://kmsauto.us/someone/l.exe","https://kmsauto.us/app1.bin","https://kmsauto.us/server.txt","https://kmsauto.us/encoding.txt","https://kmsauto.us/all.txt","https://kmsauto.us/someone/spooler.exe","https://kmsauto.us/sti/sti.bin","https://kmsauto.us/someone/potato.exe","https://kmsauto.us/someone/ghost.exe","http://ccpyeuptrlatb2piua4ukhnhi7lrxgerrcrj4p2b5uhbzqm2xgdjaqid.onion")
index=activity AND rg_functionality="Web Server" AND requesturl NOT NULL AND requesturl IN ("https://kmsauto.us/someone/start.ps1","https://kmsauto.us/someone/","https://kmsauto.us/someone/l.exe","https://kmsauto.us/app1.bin","https://kmsauto.us/server.txt","https://kmsauto.us/encoding.txt","https://kmsauto.us/all.txt","https://kmsauto.us/someone/spooler.exe","https://kmsauto.us/sti/sti.bin","https://kmsauto.us/someone/potato.exe","https://kmsauto.us/someone/ghost.exe","http://ccpyeuptrlatb2piua4ukhnhi7lrxgerrcrj4p2b5uhbzqm2xgdjaqid.onion")
index=activity AND rg_functionality="Email / Email Security" AND requesturl NOT NULL AND requesturl IN ("https://kmsauto.us/someone/start.ps1","https://kmsauto.us/someone/","https://kmsauto.us/someone/l.exe","https://kmsauto.us/app1.bin","https://kmsauto.us/server.txt","https://kmsauto.us/encoding.txt","https://kmsauto.us/all.txt","https://kmsauto.us/someone/spooler.exe","https://kmsauto.us/sti/sti.bin","https://kmsauto.us/someone/potato.exe","https://kmsauto.us/someone/ghost.exe","http://ccpyeuptrlatb2piua4ukhnhi7lrxgerrcrj4p2b5uhbzqm2xgdjaqid.onion")
index=activity AND rg_functionality="Cloud Email / Email Security" AND requesturl NOT NULL AND requesturl IN ("https://kmsauto.us/someone/start.ps1","https://kmsauto.us/someone/","https://kmsauto.us/someone/l.exe","https://kmsauto.us/app1.bin","https://kmsauto.us/server.txt","https://kmsauto.us/encoding.txt","https://kmsauto.us/all.txt","https://kmsauto.us/someone/spooler.exe","https://kmsauto.us/sti/sti.bin","https://kmsauto.us/someone/potato.exe","https://kmsauto.us/someone/ghost.exe","http://ccpyeuptrlatb2piua4ukhnhi7lrxgerrcrj4p2b5uhbzqm2xgdjaqid.onion")
index=activity AND rg_functionality="Web Application Firewall" AND requesturl NOT NULL AND requesturl IN ("https://kmsauto.us/someone/start.ps1","https://kmsauto.us/someone/","https://kmsauto.us/someone/l.exe","https://kmsauto.us/app1.bin","https://kmsauto.us/server.txt","https://kmsauto.us/encoding.txt","https://kmsauto.us/all.txt","https://kmsauto.us/someone/spooler.exe","https://kmsauto.us/sti/sti.bin","https://kmsauto.us/someone/potato.exe","https://kmsauto.us/someone/ghost.exe","http://ccpyeuptrlatb2piua4ukhnhi7lrxgerrcrj4p2b5uhbzqm2xgdjaqid.onion")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND requesturl NOT NULL AND requesturl IN ("https://kmsauto.us/someone/start.ps1","https://kmsauto.us/someone/","https://kmsauto.us/someone/l.exe","https://kmsauto.us/app1.bin","https://kmsauto.us/server.txt","https://kmsauto.us/encoding.txt","https://kmsauto.us/all.txt","https://kmsauto.us/someone/spooler.exe","https://kmsauto.us/sti/sti.bin","https://kmsauto.us/someone/potato.exe","https://kmsauto.us/someone/ghost.exe","http://ccpyeuptrlatb2piua4ukhnhi7lrxgerrcrj4p2b5uhbzqm2xgdjaqid.onion")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND requesturl NOT NULL AND requesturl IN ("https://kmsauto.us/someone/start.ps1","https://kmsauto.us/someone/","https://kmsauto.us/someone/l.exe","https://kmsauto.us/app1.bin","https://kmsauto.us/server.txt","https://kmsauto.us/encoding.txt","https://kmsauto.us/all.txt","https://kmsauto.us/someone/spooler.exe","https://kmsauto.us/sti/sti.bin","https://kmsauto.us/someone/potato.exe","https://kmsauto.us/someone/ghost.exe","http://ccpyeuptrlatb2piua4ukhnhi7lrxgerrcrj4p2b5uhbzqm2xgdjaqid.onion")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND requesturl NOT NULL AND requesturl IN ("https://kmsauto.us/someone/start.ps1","https://kmsauto.us/someone/","https://kmsauto.us/someone/l.exe","https://kmsauto.us/app1.bin","https://kmsauto.us/server.txt","https://kmsauto.us/encoding.txt","https://kmsauto.us/all.txt","https://kmsauto.us/someone/spooler.exe","https://kmsauto.us/sti/sti.bin","https://kmsauto.us/someone/potato.exe","https://kmsauto.us/someone/ghost.exe","http://ccpyeuptrlatb2piua4ukhnhi7lrxgerrcrj4p2b5uhbzqm2xgdjaqid.onion")
index=activity AND rg_functionality="Cloud Application Security Broker" AND requesturl NOT NULL AND requesturl IN ("https://kmsauto.us/someone/start.ps1","https://kmsauto.us/someone/","https://kmsauto.us/someone/l.exe","https://kmsauto.us/app1.bin","https://kmsauto.us/server.txt","https://kmsauto.us/encoding.txt","https://kmsauto.us/all.txt","https://kmsauto.us/someone/spooler.exe","https://kmsauto.us/sti/sti.bin","https://kmsauto.us/someone/potato.exe","https://kmsauto.us/someone/ghost.exe","http://ccpyeuptrlatb2piua4ukhnhi7lrxgerrcrj4p2b5uhbzqm2xgdjaqid.onion")
index=activity AND rg_functionality="Source Code Repository" AND requesturl NOT NULL AND requesturl IN ("https://kmsauto.us/someone/start.ps1","https://kmsauto.us/someone/","https://kmsauto.us/someone/l.exe","https://kmsauto.us/app1.bin","https://kmsauto.us/server.txt","https://kmsauto.us/encoding.txt","https://kmsauto.us/all.txt","https://kmsauto.us/someone/spooler.exe","https://kmsauto.us/sti/sti.bin","https://kmsauto.us/someone/potato.exe","https://kmsauto.us/someone/ghost.exe","http://ccpyeuptrlatb2piua4ukhnhi7lrxgerrcrj4p2b5uhbzqm2xgdjaqid.onion")
