index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("eba24c92b51d8fb24697952135a7d7bdf4a7511ab94be850fda1fc512675f6ad","67c00ede3964cb78c64575b65b301f808958311b99779b71597f6282b1a4e9f2","4ebef5d23ce0fe6c2940ba7a2f6bfc512b1ec5f01458284d2ce0e71ee8787b81","d4c097412ab05630e6cb97b544dc7c0a0e238a4bdf5c79da679c7545face2dad","aab2b9cd5a946739bbb41ae2234adaf34ba9761445315c2b5ba270a7b931a2e2","56d627adc6e6e8967ade649f707134a501cfea5ec66322514536ee8ace3053fb","7c9128d197301fcd89d6fd1b0077d2a35f2a98c6219386900d7e8c89e4799a86","a428d2602ad3bad2d590ed68b17a308cff8ab7ff61da2a51acb83fd202b5358d","8bcfc6dd444f3f577f026d465d826194db45cd205b24f77b9080debba96e3b7b")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("eba24c92b51d8fb24697952135a7d7bdf4a7511ab94be850fda1fc512675f6ad","67c00ede3964cb78c64575b65b301f808958311b99779b71597f6282b1a4e9f2","4ebef5d23ce0fe6c2940ba7a2f6bfc512b1ec5f01458284d2ce0e71ee8787b81","d4c097412ab05630e6cb97b544dc7c0a0e238a4bdf5c79da679c7545face2dad","aab2b9cd5a946739bbb41ae2234adaf34ba9761445315c2b5ba270a7b931a2e2","56d627adc6e6e8967ade649f707134a501cfea5ec66322514536ee8ace3053fb","7c9128d197301fcd89d6fd1b0077d2a35f2a98c6219386900d7e8c89e4799a86","a428d2602ad3bad2d590ed68b17a308cff8ab7ff61da2a51acb83fd202b5358d","8bcfc6dd444f3f577f026d465d826194db45cd205b24f77b9080debba96e3b7b")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("eba24c92b51d8fb24697952135a7d7bdf4a7511ab94be850fda1fc512675f6ad","67c00ede3964cb78c64575b65b301f808958311b99779b71597f6282b1a4e9f2","4ebef5d23ce0fe6c2940ba7a2f6bfc512b1ec5f01458284d2ce0e71ee8787b81","d4c097412ab05630e6cb97b544dc7c0a0e238a4bdf5c79da679c7545face2dad","aab2b9cd5a946739bbb41ae2234adaf34ba9761445315c2b5ba270a7b931a2e2","56d627adc6e6e8967ade649f707134a501cfea5ec66322514536ee8ace3053fb","7c9128d197301fcd89d6fd1b0077d2a35f2a98c6219386900d7e8c89e4799a86","a428d2602ad3bad2d590ed68b17a308cff8ab7ff61da2a51acb83fd202b5358d","8bcfc6dd444f3f577f026d465d826194db45cd205b24f77b9080debba96e3b7b")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring64 NOT NULL AND customstring64 IN ("eba24c92b51d8fb24697952135a7d7bdf4a7511ab94be850fda1fc512675f6ad","67c00ede3964cb78c64575b65b301f808958311b99779b71597f6282b1a4e9f2","4ebef5d23ce0fe6c2940ba7a2f6bfc512b1ec5f01458284d2ce0e71ee8787b81","d4c097412ab05630e6cb97b544dc7c0a0e238a4bdf5c79da679c7545face2dad","aab2b9cd5a946739bbb41ae2234adaf34ba9761445315c2b5ba270a7b931a2e2","56d627adc6e6e8967ade649f707134a501cfea5ec66322514536ee8ace3053fb","7c9128d197301fcd89d6fd1b0077d2a35f2a98c6219386900d7e8c89e4799a86","a428d2602ad3bad2d590ed68b17a308cff8ab7ff61da2a51acb83fd202b5358d","8bcfc6dd444f3f577f026d465d826194db45cd205b24f77b9080debba96e3b7b")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("eba24c92b51d8fb24697952135a7d7bdf4a7511ab94be850fda1fc512675f6ad","67c00ede3964cb78c64575b65b301f808958311b99779b71597f6282b1a4e9f2","4ebef5d23ce0fe6c2940ba7a2f6bfc512b1ec5f01458284d2ce0e71ee8787b81","d4c097412ab05630e6cb97b544dc7c0a0e238a4bdf5c79da679c7545face2dad","aab2b9cd5a946739bbb41ae2234adaf34ba9761445315c2b5ba270a7b931a2e2","56d627adc6e6e8967ade649f707134a501cfea5ec66322514536ee8ace3053fb","7c9128d197301fcd89d6fd1b0077d2a35f2a98c6219386900d7e8c89e4799a86","a428d2602ad3bad2d590ed68b17a308cff8ab7ff61da2a51acb83fd202b5358d","8bcfc6dd444f3f577f026d465d826194db45cd205b24f77b9080debba96e3b7b")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("eba24c92b51d8fb24697952135a7d7bdf4a7511ab94be850fda1fc512675f6ad","67c00ede3964cb78c64575b65b301f808958311b99779b71597f6282b1a4e9f2","4ebef5d23ce0fe6c2940ba7a2f6bfc512b1ec5f01458284d2ce0e71ee8787b81","d4c097412ab05630e6cb97b544dc7c0a0e238a4bdf5c79da679c7545face2dad","aab2b9cd5a946739bbb41ae2234adaf34ba9761445315c2b5ba270a7b931a2e2","56d627adc6e6e8967ade649f707134a501cfea5ec66322514536ee8ace3053fb","7c9128d197301fcd89d6fd1b0077d2a35f2a98c6219386900d7e8c89e4799a86","a428d2602ad3bad2d590ed68b17a308cff8ab7ff61da2a51acb83fd202b5358d","8bcfc6dd444f3f577f026d465d826194db45cd205b24f77b9080debba96e3b7b")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("eba24c92b51d8fb24697952135a7d7bdf4a7511ab94be850fda1fc512675f6ad","67c00ede3964cb78c64575b65b301f808958311b99779b71597f6282b1a4e9f2","4ebef5d23ce0fe6c2940ba7a2f6bfc512b1ec5f01458284d2ce0e71ee8787b81","d4c097412ab05630e6cb97b544dc7c0a0e238a4bdf5c79da679c7545face2dad","aab2b9cd5a946739bbb41ae2234adaf34ba9761445315c2b5ba270a7b931a2e2","56d627adc6e6e8967ade649f707134a501cfea5ec66322514536ee8ace3053fb","7c9128d197301fcd89d6fd1b0077d2a35f2a98c6219386900d7e8c89e4799a86","a428d2602ad3bad2d590ed68b17a308cff8ab7ff61da2a51acb83fd202b5358d","8bcfc6dd444f3f577f026d465d826194db45cd205b24f77b9080debba96e3b7b")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("eba24c92b51d8fb24697952135a7d7bdf4a7511ab94be850fda1fc512675f6ad","67c00ede3964cb78c64575b65b301f808958311b99779b71597f6282b1a4e9f2","4ebef5d23ce0fe6c2940ba7a2f6bfc512b1ec5f01458284d2ce0e71ee8787b81","d4c097412ab05630e6cb97b544dc7c0a0e238a4bdf5c79da679c7545face2dad","aab2b9cd5a946739bbb41ae2234adaf34ba9761445315c2b5ba270a7b931a2e2","56d627adc6e6e8967ade649f707134a501cfea5ec66322514536ee8ace3053fb","7c9128d197301fcd89d6fd1b0077d2a35f2a98c6219386900d7e8c89e4799a86","a428d2602ad3bad2d590ed68b17a308cff8ab7ff61da2a51acb83fd202b5358d","8bcfc6dd444f3f577f026d465d826194db45cd205b24f77b9080debba96e3b7b")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("eba24c92b51d8fb24697952135a7d7bdf4a7511ab94be850fda1fc512675f6ad","67c00ede3964cb78c64575b65b301f808958311b99779b71597f6282b1a4e9f2","4ebef5d23ce0fe6c2940ba7a2f6bfc512b1ec5f01458284d2ce0e71ee8787b81","d4c097412ab05630e6cb97b544dc7c0a0e238a4bdf5c79da679c7545face2dad","aab2b9cd5a946739bbb41ae2234adaf34ba9761445315c2b5ba270a7b931a2e2","56d627adc6e6e8967ade649f707134a501cfea5ec66322514536ee8ace3053fb","7c9128d197301fcd89d6fd1b0077d2a35f2a98c6219386900d7e8c89e4799a86","a428d2602ad3bad2d590ed68b17a308cff8ab7ff61da2a51acb83fd202b5358d","8bcfc6dd444f3f577f026d465d826194db45cd205b24f77b9080debba96e3b7b")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("eba24c92b51d8fb24697952135a7d7bdf4a7511ab94be850fda1fc512675f6ad","67c00ede3964cb78c64575b65b301f808958311b99779b71597f6282b1a4e9f2","4ebef5d23ce0fe6c2940ba7a2f6bfc512b1ec5f01458284d2ce0e71ee8787b81","d4c097412ab05630e6cb97b544dc7c0a0e238a4bdf5c79da679c7545face2dad","aab2b9cd5a946739bbb41ae2234adaf34ba9761445315c2b5ba270a7b931a2e2","56d627adc6e6e8967ade649f707134a501cfea5ec66322514536ee8ace3053fb","7c9128d197301fcd89d6fd1b0077d2a35f2a98c6219386900d7e8c89e4799a86","a428d2602ad3bad2d590ed68b17a308cff8ab7ff61da2a51acb83fd202b5358d","8bcfc6dd444f3f577f026d465d826194db45cd205b24f77b9080debba96e3b7b")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("eba24c92b51d8fb24697952135a7d7bdf4a7511ab94be850fda1fc512675f6ad","67c00ede3964cb78c64575b65b301f808958311b99779b71597f6282b1a4e9f2","4ebef5d23ce0fe6c2940ba7a2f6bfc512b1ec5f01458284d2ce0e71ee8787b81","d4c097412ab05630e6cb97b544dc7c0a0e238a4bdf5c79da679c7545face2dad","aab2b9cd5a946739bbb41ae2234adaf34ba9761445315c2b5ba270a7b931a2e2","56d627adc6e6e8967ade649f707134a501cfea5ec66322514536ee8ace3053fb","7c9128d197301fcd89d6fd1b0077d2a35f2a98c6219386900d7e8c89e4799a86","a428d2602ad3bad2d590ed68b17a308cff8ab7ff61da2a51acb83fd202b5358d","8bcfc6dd444f3f577f026d465d826194db45cd205b24f77b9080debba96e3b7b")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("eba24c92b51d8fb24697952135a7d7bdf4a7511ab94be850fda1fc512675f6ad","67c00ede3964cb78c64575b65b301f808958311b99779b71597f6282b1a4e9f2","4ebef5d23ce0fe6c2940ba7a2f6bfc512b1ec5f01458284d2ce0e71ee8787b81","d4c097412ab05630e6cb97b544dc7c0a0e238a4bdf5c79da679c7545face2dad","aab2b9cd5a946739bbb41ae2234adaf34ba9761445315c2b5ba270a7b931a2e2","56d627adc6e6e8967ade649f707134a501cfea5ec66322514536ee8ace3053fb","7c9128d197301fcd89d6fd1b0077d2a35f2a98c6219386900d7e8c89e4799a86","a428d2602ad3bad2d590ed68b17a308cff8ab7ff61da2a51acb83fd202b5358d","8bcfc6dd444f3f577f026d465d826194db45cd205b24f77b9080debba96e3b7b")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("eba24c92b51d8fb24697952135a7d7bdf4a7511ab94be850fda1fc512675f6ad","67c00ede3964cb78c64575b65b301f808958311b99779b71597f6282b1a4e9f2","4ebef5d23ce0fe6c2940ba7a2f6bfc512b1ec5f01458284d2ce0e71ee8787b81","d4c097412ab05630e6cb97b544dc7c0a0e238a4bdf5c79da679c7545face2dad","aab2b9cd5a946739bbb41ae2234adaf34ba9761445315c2b5ba270a7b931a2e2","56d627adc6e6e8967ade649f707134a501cfea5ec66322514536ee8ace3053fb","7c9128d197301fcd89d6fd1b0077d2a35f2a98c6219386900d7e8c89e4799a86","a428d2602ad3bad2d590ed68b17a308cff8ab7ff61da2a51acb83fd202b5358d","8bcfc6dd444f3f577f026d465d826194db45cd205b24f77b9080debba96e3b7b")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("eba24c92b51d8fb24697952135a7d7bdf4a7511ab94be850fda1fc512675f6ad","67c00ede3964cb78c64575b65b301f808958311b99779b71597f6282b1a4e9f2","4ebef5d23ce0fe6c2940ba7a2f6bfc512b1ec5f01458284d2ce0e71ee8787b81","d4c097412ab05630e6cb97b544dc7c0a0e238a4bdf5c79da679c7545face2dad","aab2b9cd5a946739bbb41ae2234adaf34ba9761445315c2b5ba270a7b931a2e2","56d627adc6e6e8967ade649f707134a501cfea5ec66322514536ee8ace3053fb","7c9128d197301fcd89d6fd1b0077d2a35f2a98c6219386900d7e8c89e4799a86","a428d2602ad3bad2d590ed68b17a308cff8ab7ff61da2a51acb83fd202b5358d","8bcfc6dd444f3f577f026d465d826194db45cd205b24f77b9080debba96e3b7b")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("eba24c92b51d8fb24697952135a7d7bdf4a7511ab94be850fda1fc512675f6ad","67c00ede3964cb78c64575b65b301f808958311b99779b71597f6282b1a4e9f2","4ebef5d23ce0fe6c2940ba7a2f6bfc512b1ec5f01458284d2ce0e71ee8787b81","d4c097412ab05630e6cb97b544dc7c0a0e238a4bdf5c79da679c7545face2dad","aab2b9cd5a946739bbb41ae2234adaf34ba9761445315c2b5ba270a7b931a2e2","56d627adc6e6e8967ade649f707134a501cfea5ec66322514536ee8ace3053fb","7c9128d197301fcd89d6fd1b0077d2a35f2a98c6219386900d7e8c89e4799a86","a428d2602ad3bad2d590ed68b17a308cff8ab7ff61da2a51acb83fd202b5358d","8bcfc6dd444f3f577f026d465d826194db45cd205b24f77b9080debba96e3b7b")
index=activity AND rg_functionality="Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("eba24c92b51d8fb24697952135a7d7bdf4a7511ab94be850fda1fc512675f6ad","67c00ede3964cb78c64575b65b301f808958311b99779b71597f6282b1a4e9f2","4ebef5d23ce0fe6c2940ba7a2f6bfc512b1ec5f01458284d2ce0e71ee8787b81","d4c097412ab05630e6cb97b544dc7c0a0e238a4bdf5c79da679c7545face2dad","aab2b9cd5a946739bbb41ae2234adaf34ba9761445315c2b5ba270a7b931a2e2","56d627adc6e6e8967ade649f707134a501cfea5ec66322514536ee8ace3053fb","7c9128d197301fcd89d6fd1b0077d2a35f2a98c6219386900d7e8c89e4799a86","a428d2602ad3bad2d590ed68b17a308cff8ab7ff61da2a51acb83fd202b5358d","8bcfc6dd444f3f577f026d465d826194db45cd205b24f77b9080debba96e3b7b")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("eba24c92b51d8fb24697952135a7d7bdf4a7511ab94be850fda1fc512675f6ad","67c00ede3964cb78c64575b65b301f808958311b99779b71597f6282b1a4e9f2","4ebef5d23ce0fe6c2940ba7a2f6bfc512b1ec5f01458284d2ce0e71ee8787b81","d4c097412ab05630e6cb97b544dc7c0a0e238a4bdf5c79da679c7545face2dad","aab2b9cd5a946739bbb41ae2234adaf34ba9761445315c2b5ba270a7b931a2e2","56d627adc6e6e8967ade649f707134a501cfea5ec66322514536ee8ace3053fb","7c9128d197301fcd89d6fd1b0077d2a35f2a98c6219386900d7e8c89e4799a86","a428d2602ad3bad2d590ed68b17a308cff8ab7ff61da2a51acb83fd202b5358d","8bcfc6dd444f3f577f026d465d826194db45cd205b24f77b9080debba96e3b7b")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("eba24c92b51d8fb24697952135a7d7bdf4a7511ab94be850fda1fc512675f6ad","67c00ede3964cb78c64575b65b301f808958311b99779b71597f6282b1a4e9f2","4ebef5d23ce0fe6c2940ba7a2f6bfc512b1ec5f01458284d2ce0e71ee8787b81","d4c097412ab05630e6cb97b544dc7c0a0e238a4bdf5c79da679c7545face2dad","aab2b9cd5a946739bbb41ae2234adaf34ba9761445315c2b5ba270a7b931a2e2","56d627adc6e6e8967ade649f707134a501cfea5ec66322514536ee8ace3053fb","7c9128d197301fcd89d6fd1b0077d2a35f2a98c6219386900d7e8c89e4799a86","a428d2602ad3bad2d590ed68b17a308cff8ab7ff61da2a51acb83fd202b5358d","8bcfc6dd444f3f577f026d465d826194db45cd205b24f77b9080debba96e3b7b")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("eba24c92b51d8fb24697952135a7d7bdf4a7511ab94be850fda1fc512675f6ad","67c00ede3964cb78c64575b65b301f808958311b99779b71597f6282b1a4e9f2","4ebef5d23ce0fe6c2940ba7a2f6bfc512b1ec5f01458284d2ce0e71ee8787b81","d4c097412ab05630e6cb97b544dc7c0a0e238a4bdf5c79da679c7545face2dad","aab2b9cd5a946739bbb41ae2234adaf34ba9761445315c2b5ba270a7b931a2e2","56d627adc6e6e8967ade649f707134a501cfea5ec66322514536ee8ace3053fb","7c9128d197301fcd89d6fd1b0077d2a35f2a98c6219386900d7e8c89e4799a86","a428d2602ad3bad2d590ed68b17a308cff8ab7ff61da2a51acb83fd202b5358d","8bcfc6dd444f3f577f026d465d826194db45cd205b24f77b9080debba96e3b7b")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("eba24c92b51d8fb24697952135a7d7bdf4a7511ab94be850fda1fc512675f6ad","67c00ede3964cb78c64575b65b301f808958311b99779b71597f6282b1a4e9f2","4ebef5d23ce0fe6c2940ba7a2f6bfc512b1ec5f01458284d2ce0e71ee8787b81","d4c097412ab05630e6cb97b544dc7c0a0e238a4bdf5c79da679c7545face2dad","aab2b9cd5a946739bbb41ae2234adaf34ba9761445315c2b5ba270a7b931a2e2","56d627adc6e6e8967ade649f707134a501cfea5ec66322514536ee8ace3053fb","7c9128d197301fcd89d6fd1b0077d2a35f2a98c6219386900d7e8c89e4799a86","a428d2602ad3bad2d590ed68b17a308cff8ab7ff61da2a51acb83fd202b5358d","8bcfc6dd444f3f577f026d465d826194db45cd205b24f77b9080debba96e3b7b")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("eba24c92b51d8fb24697952135a7d7bdf4a7511ab94be850fda1fc512675f6ad","67c00ede3964cb78c64575b65b301f808958311b99779b71597f6282b1a4e9f2","4ebef5d23ce0fe6c2940ba7a2f6bfc512b1ec5f01458284d2ce0e71ee8787b81","d4c097412ab05630e6cb97b544dc7c0a0e238a4bdf5c79da679c7545face2dad","aab2b9cd5a946739bbb41ae2234adaf34ba9761445315c2b5ba270a7b931a2e2","56d627adc6e6e8967ade649f707134a501cfea5ec66322514536ee8ace3053fb","7c9128d197301fcd89d6fd1b0077d2a35f2a98c6219386900d7e8c89e4799a86","a428d2602ad3bad2d590ed68b17a308cff8ab7ff61da2a51acb83fd202b5358d","8bcfc6dd444f3f577f026d465d826194db45cd205b24f77b9080debba96e3b7b")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("eba24c92b51d8fb24697952135a7d7bdf4a7511ab94be850fda1fc512675f6ad","67c00ede3964cb78c64575b65b301f808958311b99779b71597f6282b1a4e9f2","4ebef5d23ce0fe6c2940ba7a2f6bfc512b1ec5f01458284d2ce0e71ee8787b81","d4c097412ab05630e6cb97b544dc7c0a0e238a4bdf5c79da679c7545face2dad","aab2b9cd5a946739bbb41ae2234adaf34ba9761445315c2b5ba270a7b931a2e2","56d627adc6e6e8967ade649f707134a501cfea5ec66322514536ee8ace3053fb","7c9128d197301fcd89d6fd1b0077d2a35f2a98c6219386900d7e8c89e4799a86","a428d2602ad3bad2d590ed68b17a308cff8ab7ff61da2a51acb83fd202b5358d","8bcfc6dd444f3f577f026d465d826194db45cd205b24f77b9080debba96e3b7b")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("eba24c92b51d8fb24697952135a7d7bdf4a7511ab94be850fda1fc512675f6ad","67c00ede3964cb78c64575b65b301f808958311b99779b71597f6282b1a4e9f2","4ebef5d23ce0fe6c2940ba7a2f6bfc512b1ec5f01458284d2ce0e71ee8787b81","d4c097412ab05630e6cb97b544dc7c0a0e238a4bdf5c79da679c7545face2dad","aab2b9cd5a946739bbb41ae2234adaf34ba9761445315c2b5ba270a7b931a2e2","56d627adc6e6e8967ade649f707134a501cfea5ec66322514536ee8ace3053fb","7c9128d197301fcd89d6fd1b0077d2a35f2a98c6219386900d7e8c89e4799a86","a428d2602ad3bad2d590ed68b17a308cff8ab7ff61da2a51acb83fd202b5358d","8bcfc6dd444f3f577f026d465d826194db45cd205b24f77b9080debba96e3b7b")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring64 NOT NULL AND customstring64 IN ("eba24c92b51d8fb24697952135a7d7bdf4a7511ab94be850fda1fc512675f6ad","67c00ede3964cb78c64575b65b301f808958311b99779b71597f6282b1a4e9f2","4ebef5d23ce0fe6c2940ba7a2f6bfc512b1ec5f01458284d2ce0e71ee8787b81","d4c097412ab05630e6cb97b544dc7c0a0e238a4bdf5c79da679c7545face2dad","aab2b9cd5a946739bbb41ae2234adaf34ba9761445315c2b5ba270a7b931a2e2","56d627adc6e6e8967ade649f707134a501cfea5ec66322514536ee8ace3053fb","7c9128d197301fcd89d6fd1b0077d2a35f2a98c6219386900d7e8c89e4799a86","a428d2602ad3bad2d590ed68b17a308cff8ab7ff61da2a51acb83fd202b5358d","8bcfc6dd444f3f577f026d465d826194db45cd205b24f77b9080debba96e3b7b")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("eba24c92b51d8fb24697952135a7d7bdf4a7511ab94be850fda1fc512675f6ad","67c00ede3964cb78c64575b65b301f808958311b99779b71597f6282b1a4e9f2","4ebef5d23ce0fe6c2940ba7a2f6bfc512b1ec5f01458284d2ce0e71ee8787b81","d4c097412ab05630e6cb97b544dc7c0a0e238a4bdf5c79da679c7545face2dad","aab2b9cd5a946739bbb41ae2234adaf34ba9761445315c2b5ba270a7b931a2e2","56d627adc6e6e8967ade649f707134a501cfea5ec66322514536ee8ace3053fb","7c9128d197301fcd89d6fd1b0077d2a35f2a98c6219386900d7e8c89e4799a86","a428d2602ad3bad2d590ed68b17a308cff8ab7ff61da2a51acb83fd202b5358d","8bcfc6dd444f3f577f026d465d826194db45cd205b24f77b9080debba96e3b7b")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("eba24c92b51d8fb24697952135a7d7bdf4a7511ab94be850fda1fc512675f6ad","67c00ede3964cb78c64575b65b301f808958311b99779b71597f6282b1a4e9f2","4ebef5d23ce0fe6c2940ba7a2f6bfc512b1ec5f01458284d2ce0e71ee8787b81","d4c097412ab05630e6cb97b544dc7c0a0e238a4bdf5c79da679c7545face2dad","aab2b9cd5a946739bbb41ae2234adaf34ba9761445315c2b5ba270a7b931a2e2","56d627adc6e6e8967ade649f707134a501cfea5ec66322514536ee8ace3053fb","7c9128d197301fcd89d6fd1b0077d2a35f2a98c6219386900d7e8c89e4799a86","a428d2602ad3bad2d590ed68b17a308cff8ab7ff61da2a51acb83fd202b5358d","8bcfc6dd444f3f577f026d465d826194db45cd205b24f77b9080debba96e3b7b")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("eba24c92b51d8fb24697952135a7d7bdf4a7511ab94be850fda1fc512675f6ad","67c00ede3964cb78c64575b65b301f808958311b99779b71597f6282b1a4e9f2","4ebef5d23ce0fe6c2940ba7a2f6bfc512b1ec5f01458284d2ce0e71ee8787b81","d4c097412ab05630e6cb97b544dc7c0a0e238a4bdf5c79da679c7545face2dad","aab2b9cd5a946739bbb41ae2234adaf34ba9761445315c2b5ba270a7b931a2e2","56d627adc6e6e8967ade649f707134a501cfea5ec66322514536ee8ace3053fb","7c9128d197301fcd89d6fd1b0077d2a35f2a98c6219386900d7e8c89e4799a86","a428d2602ad3bad2d590ed68b17a308cff8ab7ff61da2a51acb83fd202b5358d","8bcfc6dd444f3f577f026d465d826194db45cd205b24f77b9080debba96e3b7b")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring64 NOT NULL AND customstring64 IN ("eba24c92b51d8fb24697952135a7d7bdf4a7511ab94be850fda1fc512675f6ad","67c00ede3964cb78c64575b65b301f808958311b99779b71597f6282b1a4e9f2","4ebef5d23ce0fe6c2940ba7a2f6bfc512b1ec5f01458284d2ce0e71ee8787b81","d4c097412ab05630e6cb97b544dc7c0a0e238a4bdf5c79da679c7545face2dad","aab2b9cd5a946739bbb41ae2234adaf34ba9761445315c2b5ba270a7b931a2e2","56d627adc6e6e8967ade649f707134a501cfea5ec66322514536ee8ace3053fb","7c9128d197301fcd89d6fd1b0077d2a35f2a98c6219386900d7e8c89e4799a86","a428d2602ad3bad2d590ed68b17a308cff8ab7ff61da2a51acb83fd202b5358d","8bcfc6dd444f3f577f026d465d826194db45cd205b24f77b9080debba96e3b7b")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("eba24c92b51d8fb24697952135a7d7bdf4a7511ab94be850fda1fc512675f6ad","67c00ede3964cb78c64575b65b301f808958311b99779b71597f6282b1a4e9f2","4ebef5d23ce0fe6c2940ba7a2f6bfc512b1ec5f01458284d2ce0e71ee8787b81","d4c097412ab05630e6cb97b544dc7c0a0e238a4bdf5c79da679c7545face2dad","aab2b9cd5a946739bbb41ae2234adaf34ba9761445315c2b5ba270a7b931a2e2","56d627adc6e6e8967ade649f707134a501cfea5ec66322514536ee8ace3053fb","7c9128d197301fcd89d6fd1b0077d2a35f2a98c6219386900d7e8c89e4799a86","a428d2602ad3bad2d590ed68b17a308cff8ab7ff61da2a51acb83fd202b5358d","8bcfc6dd444f3f577f026d465d826194db45cd205b24f77b9080debba96e3b7b")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("eba24c92b51d8fb24697952135a7d7bdf4a7511ab94be850fda1fc512675f6ad","67c00ede3964cb78c64575b65b301f808958311b99779b71597f6282b1a4e9f2","4ebef5d23ce0fe6c2940ba7a2f6bfc512b1ec5f01458284d2ce0e71ee8787b81","d4c097412ab05630e6cb97b544dc7c0a0e238a4bdf5c79da679c7545face2dad","aab2b9cd5a946739bbb41ae2234adaf34ba9761445315c2b5ba270a7b931a2e2","56d627adc6e6e8967ade649f707134a501cfea5ec66322514536ee8ace3053fb","7c9128d197301fcd89d6fd1b0077d2a35f2a98c6219386900d7e8c89e4799a86","a428d2602ad3bad2d590ed68b17a308cff8ab7ff61da2a51acb83fd202b5358d","8bcfc6dd444f3f577f026d465d826194db45cd205b24f77b9080debba96e3b7b")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("eba24c92b51d8fb24697952135a7d7bdf4a7511ab94be850fda1fc512675f6ad","67c00ede3964cb78c64575b65b301f808958311b99779b71597f6282b1a4e9f2","4ebef5d23ce0fe6c2940ba7a2f6bfc512b1ec5f01458284d2ce0e71ee8787b81","d4c097412ab05630e6cb97b544dc7c0a0e238a4bdf5c79da679c7545face2dad","aab2b9cd5a946739bbb41ae2234adaf34ba9761445315c2b5ba270a7b931a2e2","56d627adc6e6e8967ade649f707134a501cfea5ec66322514536ee8ace3053fb","7c9128d197301fcd89d6fd1b0077d2a35f2a98c6219386900d7e8c89e4799a86","a428d2602ad3bad2d590ed68b17a308cff8ab7ff61da2a51acb83fd202b5358d","8bcfc6dd444f3f577f026d465d826194db45cd205b24f77b9080debba96e3b7b")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring64 NOT NULL AND customstring64 IN ("eba24c92b51d8fb24697952135a7d7bdf4a7511ab94be850fda1fc512675f6ad","67c00ede3964cb78c64575b65b301f808958311b99779b71597f6282b1a4e9f2","4ebef5d23ce0fe6c2940ba7a2f6bfc512b1ec5f01458284d2ce0e71ee8787b81","d4c097412ab05630e6cb97b544dc7c0a0e238a4bdf5c79da679c7545face2dad","aab2b9cd5a946739bbb41ae2234adaf34ba9761445315c2b5ba270a7b931a2e2","56d627adc6e6e8967ade649f707134a501cfea5ec66322514536ee8ace3053fb","7c9128d197301fcd89d6fd1b0077d2a35f2a98c6219386900d7e8c89e4799a86","a428d2602ad3bad2d590ed68b17a308cff8ab7ff61da2a51acb83fd202b5358d","8bcfc6dd444f3f577f026d465d826194db45cd205b24f77b9080debba96e3b7b")
index=activity AND rg_functionality="O365 General" AND filehash NOT NULL AND filehash IN ("eba24c92b51d8fb24697952135a7d7bdf4a7511ab94be850fda1fc512675f6ad","67c00ede3964cb78c64575b65b301f808958311b99779b71597f6282b1a4e9f2","4ebef5d23ce0fe6c2940ba7a2f6bfc512b1ec5f01458284d2ce0e71ee8787b81","d4c097412ab05630e6cb97b544dc7c0a0e238a4bdf5c79da679c7545face2dad","aab2b9cd5a946739bbb41ae2234adaf34ba9761445315c2b5ba270a7b931a2e2","56d627adc6e6e8967ade649f707134a501cfea5ec66322514536ee8ace3053fb","7c9128d197301fcd89d6fd1b0077d2a35f2a98c6219386900d7e8c89e4799a86","a428d2602ad3bad2d590ed68b17a308cff8ab7ff61da2a51acb83fd202b5358d","8bcfc6dd444f3f577f026d465d826194db45cd205b24f77b9080debba96e3b7b")
index=activity AND rg_functionality="O365 General" AND oldfilehash NOT NULL AND oldfilehash IN ("eba24c92b51d8fb24697952135a7d7bdf4a7511ab94be850fda1fc512675f6ad","67c00ede3964cb78c64575b65b301f808958311b99779b71597f6282b1a4e9f2","4ebef5d23ce0fe6c2940ba7a2f6bfc512b1ec5f01458284d2ce0e71ee8787b81","d4c097412ab05630e6cb97b544dc7c0a0e238a4bdf5c79da679c7545face2dad","aab2b9cd5a946739bbb41ae2234adaf34ba9761445315c2b5ba270a7b931a2e2","56d627adc6e6e8967ade649f707134a501cfea5ec66322514536ee8ace3053fb","7c9128d197301fcd89d6fd1b0077d2a35f2a98c6219386900d7e8c89e4799a86","a428d2602ad3bad2d590ed68b17a308cff8ab7ff61da2a51acb83fd202b5358d","8bcfc6dd444f3f577f026d465d826194db45cd205b24f77b9080debba96e3b7b")
index=activity AND rg_functionality="O365 General" AND customstring3 NOT NULL AND customstring3 IN ("eba24c92b51d8fb24697952135a7d7bdf4a7511ab94be850fda1fc512675f6ad","67c00ede3964cb78c64575b65b301f808958311b99779b71597f6282b1a4e9f2","4ebef5d23ce0fe6c2940ba7a2f6bfc512b1ec5f01458284d2ce0e71ee8787b81","d4c097412ab05630e6cb97b544dc7c0a0e238a4bdf5c79da679c7545face2dad","aab2b9cd5a946739bbb41ae2234adaf34ba9761445315c2b5ba270a7b931a2e2","56d627adc6e6e8967ade649f707134a501cfea5ec66322514536ee8ace3053fb","7c9128d197301fcd89d6fd1b0077d2a35f2a98c6219386900d7e8c89e4799a86","a428d2602ad3bad2d590ed68b17a308cff8ab7ff61da2a51acb83fd202b5358d","8bcfc6dd444f3f577f026d465d826194db45cd205b24f77b9080debba96e3b7b")
index=activity AND rg_functionality="O365 General" AND customstring64 NOT NULL AND customstring64 IN ("eba24c92b51d8fb24697952135a7d7bdf4a7511ab94be850fda1fc512675f6ad","67c00ede3964cb78c64575b65b301f808958311b99779b71597f6282b1a4e9f2","4ebef5d23ce0fe6c2940ba7a2f6bfc512b1ec5f01458284d2ce0e71ee8787b81","d4c097412ab05630e6cb97b544dc7c0a0e238a4bdf5c79da679c7545face2dad","aab2b9cd5a946739bbb41ae2234adaf34ba9761445315c2b5ba270a7b931a2e2","56d627adc6e6e8967ade649f707134a501cfea5ec66322514536ee8ace3053fb","7c9128d197301fcd89d6fd1b0077d2a35f2a98c6219386900d7e8c89e4799a86","a428d2602ad3bad2d590ed68b17a308cff8ab7ff61da2a51acb83fd202b5358d","8bcfc6dd444f3f577f026d465d826194db45cd205b24f77b9080debba96e3b7b")
