index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("1e87e9b5ee7597bdce796490f3ee09211df48ba1d11f6e2f5b255f05cc0ba176","ea6a416b320f32261da8dafcf2faf088924f99a3a84f7b43b964637ea87aef72","F1e8844dbfc812d39f369e7670545a29efef6764d673038b1c3edd11561d6902","B66b179eac03afafdc69f62c207819eceecfbf994c9efa464fda0d2ba44fe2d7","9d83817f7cae01554f77680ed7e6698966bcf020915c0dc411e5d57f6eea6ed4","5cc51f29c6074d9741d6e68bcf9ce8363d623437ea11506a36791b4763cefdc7")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("1e87e9b5ee7597bdce796490f3ee09211df48ba1d11f6e2f5b255f05cc0ba176","ea6a416b320f32261da8dafcf2faf088924f99a3a84f7b43b964637ea87aef72","F1e8844dbfc812d39f369e7670545a29efef6764d673038b1c3edd11561d6902","B66b179eac03afafdc69f62c207819eceecfbf994c9efa464fda0d2ba44fe2d7","9d83817f7cae01554f77680ed7e6698966bcf020915c0dc411e5d57f6eea6ed4","5cc51f29c6074d9741d6e68bcf9ce8363d623437ea11506a36791b4763cefdc7")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("1e87e9b5ee7597bdce796490f3ee09211df48ba1d11f6e2f5b255f05cc0ba176","ea6a416b320f32261da8dafcf2faf088924f99a3a84f7b43b964637ea87aef72","F1e8844dbfc812d39f369e7670545a29efef6764d673038b1c3edd11561d6902","B66b179eac03afafdc69f62c207819eceecfbf994c9efa464fda0d2ba44fe2d7","9d83817f7cae01554f77680ed7e6698966bcf020915c0dc411e5d57f6eea6ed4","5cc51f29c6074d9741d6e68bcf9ce8363d623437ea11506a36791b4763cefdc7")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("1e87e9b5ee7597bdce796490f3ee09211df48ba1d11f6e2f5b255f05cc0ba176","ea6a416b320f32261da8dafcf2faf088924f99a3a84f7b43b964637ea87aef72","F1e8844dbfc812d39f369e7670545a29efef6764d673038b1c3edd11561d6902","B66b179eac03afafdc69f62c207819eceecfbf994c9efa464fda0d2ba44fe2d7","9d83817f7cae01554f77680ed7e6698966bcf020915c0dc411e5d57f6eea6ed4","5cc51f29c6074d9741d6e68bcf9ce8363d623437ea11506a36791b4763cefdc7")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("1e87e9b5ee7597bdce796490f3ee09211df48ba1d11f6e2f5b255f05cc0ba176","ea6a416b320f32261da8dafcf2faf088924f99a3a84f7b43b964637ea87aef72","F1e8844dbfc812d39f369e7670545a29efef6764d673038b1c3edd11561d6902","B66b179eac03afafdc69f62c207819eceecfbf994c9efa464fda0d2ba44fe2d7","9d83817f7cae01554f77680ed7e6698966bcf020915c0dc411e5d57f6eea6ed4","5cc51f29c6074d9741d6e68bcf9ce8363d623437ea11506a36791b4763cefdc7")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("1e87e9b5ee7597bdce796490f3ee09211df48ba1d11f6e2f5b255f05cc0ba176","ea6a416b320f32261da8dafcf2faf088924f99a3a84f7b43b964637ea87aef72","F1e8844dbfc812d39f369e7670545a29efef6764d673038b1c3edd11561d6902","B66b179eac03afafdc69f62c207819eceecfbf994c9efa464fda0d2ba44fe2d7","9d83817f7cae01554f77680ed7e6698966bcf020915c0dc411e5d57f6eea6ed4","5cc51f29c6074d9741d6e68bcf9ce8363d623437ea11506a36791b4763cefdc7")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("1e87e9b5ee7597bdce796490f3ee09211df48ba1d11f6e2f5b255f05cc0ba176","ea6a416b320f32261da8dafcf2faf088924f99a3a84f7b43b964637ea87aef72","F1e8844dbfc812d39f369e7670545a29efef6764d673038b1c3edd11561d6902","B66b179eac03afafdc69f62c207819eceecfbf994c9efa464fda0d2ba44fe2d7","9d83817f7cae01554f77680ed7e6698966bcf020915c0dc411e5d57f6eea6ed4","5cc51f29c6074d9741d6e68bcf9ce8363d623437ea11506a36791b4763cefdc7")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("1e87e9b5ee7597bdce796490f3ee09211df48ba1d11f6e2f5b255f05cc0ba176","ea6a416b320f32261da8dafcf2faf088924f99a3a84f7b43b964637ea87aef72","F1e8844dbfc812d39f369e7670545a29efef6764d673038b1c3edd11561d6902","B66b179eac03afafdc69f62c207819eceecfbf994c9efa464fda0d2ba44fe2d7","9d83817f7cae01554f77680ed7e6698966bcf020915c0dc411e5d57f6eea6ed4","5cc51f29c6074d9741d6e68bcf9ce8363d623437ea11506a36791b4763cefdc7")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("1e87e9b5ee7597bdce796490f3ee09211df48ba1d11f6e2f5b255f05cc0ba176","ea6a416b320f32261da8dafcf2faf088924f99a3a84f7b43b964637ea87aef72","F1e8844dbfc812d39f369e7670545a29efef6764d673038b1c3edd11561d6902","B66b179eac03afafdc69f62c207819eceecfbf994c9efa464fda0d2ba44fe2d7","9d83817f7cae01554f77680ed7e6698966bcf020915c0dc411e5d57f6eea6ed4","5cc51f29c6074d9741d6e68bcf9ce8363d623437ea11506a36791b4763cefdc7")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("1e87e9b5ee7597bdce796490f3ee09211df48ba1d11f6e2f5b255f05cc0ba176","ea6a416b320f32261da8dafcf2faf088924f99a3a84f7b43b964637ea87aef72","F1e8844dbfc812d39f369e7670545a29efef6764d673038b1c3edd11561d6902","B66b179eac03afafdc69f62c207819eceecfbf994c9efa464fda0d2ba44fe2d7","9d83817f7cae01554f77680ed7e6698966bcf020915c0dc411e5d57f6eea6ed4","5cc51f29c6074d9741d6e68bcf9ce8363d623437ea11506a36791b4763cefdc7")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("1e87e9b5ee7597bdce796490f3ee09211df48ba1d11f6e2f5b255f05cc0ba176","ea6a416b320f32261da8dafcf2faf088924f99a3a84f7b43b964637ea87aef72","F1e8844dbfc812d39f369e7670545a29efef6764d673038b1c3edd11561d6902","B66b179eac03afafdc69f62c207819eceecfbf994c9efa464fda0d2ba44fe2d7","9d83817f7cae01554f77680ed7e6698966bcf020915c0dc411e5d57f6eea6ed4","5cc51f29c6074d9741d6e68bcf9ce8363d623437ea11506a36791b4763cefdc7")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("1e87e9b5ee7597bdce796490f3ee09211df48ba1d11f6e2f5b255f05cc0ba176","ea6a416b320f32261da8dafcf2faf088924f99a3a84f7b43b964637ea87aef72","F1e8844dbfc812d39f369e7670545a29efef6764d673038b1c3edd11561d6902","B66b179eac03afafdc69f62c207819eceecfbf994c9efa464fda0d2ba44fe2d7","9d83817f7cae01554f77680ed7e6698966bcf020915c0dc411e5d57f6eea6ed4","5cc51f29c6074d9741d6e68bcf9ce8363d623437ea11506a36791b4763cefdc7")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("1e87e9b5ee7597bdce796490f3ee09211df48ba1d11f6e2f5b255f05cc0ba176","ea6a416b320f32261da8dafcf2faf088924f99a3a84f7b43b964637ea87aef72","F1e8844dbfc812d39f369e7670545a29efef6764d673038b1c3edd11561d6902","B66b179eac03afafdc69f62c207819eceecfbf994c9efa464fda0d2ba44fe2d7","9d83817f7cae01554f77680ed7e6698966bcf020915c0dc411e5d57f6eea6ed4","5cc51f29c6074d9741d6e68bcf9ce8363d623437ea11506a36791b4763cefdc7")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("1e87e9b5ee7597bdce796490f3ee09211df48ba1d11f6e2f5b255f05cc0ba176","ea6a416b320f32261da8dafcf2faf088924f99a3a84f7b43b964637ea87aef72","F1e8844dbfc812d39f369e7670545a29efef6764d673038b1c3edd11561d6902","B66b179eac03afafdc69f62c207819eceecfbf994c9efa464fda0d2ba44fe2d7","9d83817f7cae01554f77680ed7e6698966bcf020915c0dc411e5d57f6eea6ed4","5cc51f29c6074d9741d6e68bcf9ce8363d623437ea11506a36791b4763cefdc7")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("1e87e9b5ee7597bdce796490f3ee09211df48ba1d11f6e2f5b255f05cc0ba176","ea6a416b320f32261da8dafcf2faf088924f99a3a84f7b43b964637ea87aef72","F1e8844dbfc812d39f369e7670545a29efef6764d673038b1c3edd11561d6902","B66b179eac03afafdc69f62c207819eceecfbf994c9efa464fda0d2ba44fe2d7","9d83817f7cae01554f77680ed7e6698966bcf020915c0dc411e5d57f6eea6ed4","5cc51f29c6074d9741d6e68bcf9ce8363d623437ea11506a36791b4763cefdc7")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("1e87e9b5ee7597bdce796490f3ee09211df48ba1d11f6e2f5b255f05cc0ba176","ea6a416b320f32261da8dafcf2faf088924f99a3a84f7b43b964637ea87aef72","F1e8844dbfc812d39f369e7670545a29efef6764d673038b1c3edd11561d6902","B66b179eac03afafdc69f62c207819eceecfbf994c9efa464fda0d2ba44fe2d7","9d83817f7cae01554f77680ed7e6698966bcf020915c0dc411e5d57f6eea6ed4","5cc51f29c6074d9741d6e68bcf9ce8363d623437ea11506a36791b4763cefdc7")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("1e87e9b5ee7597bdce796490f3ee09211df48ba1d11f6e2f5b255f05cc0ba176","ea6a416b320f32261da8dafcf2faf088924f99a3a84f7b43b964637ea87aef72","F1e8844dbfc812d39f369e7670545a29efef6764d673038b1c3edd11561d6902","B66b179eac03afafdc69f62c207819eceecfbf994c9efa464fda0d2ba44fe2d7","9d83817f7cae01554f77680ed7e6698966bcf020915c0dc411e5d57f6eea6ed4","5cc51f29c6074d9741d6e68bcf9ce8363d623437ea11506a36791b4763cefdc7")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("1e87e9b5ee7597bdce796490f3ee09211df48ba1d11f6e2f5b255f05cc0ba176","ea6a416b320f32261da8dafcf2faf088924f99a3a84f7b43b964637ea87aef72","F1e8844dbfc812d39f369e7670545a29efef6764d673038b1c3edd11561d6902","B66b179eac03afafdc69f62c207819eceecfbf994c9efa464fda0d2ba44fe2d7","9d83817f7cae01554f77680ed7e6698966bcf020915c0dc411e5d57f6eea6ed4","5cc51f29c6074d9741d6e68bcf9ce8363d623437ea11506a36791b4763cefdc7")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("1e87e9b5ee7597bdce796490f3ee09211df48ba1d11f6e2f5b255f05cc0ba176","ea6a416b320f32261da8dafcf2faf088924f99a3a84f7b43b964637ea87aef72","F1e8844dbfc812d39f369e7670545a29efef6764d673038b1c3edd11561d6902","B66b179eac03afafdc69f62c207819eceecfbf994c9efa464fda0d2ba44fe2d7","9d83817f7cae01554f77680ed7e6698966bcf020915c0dc411e5d57f6eea6ed4","5cc51f29c6074d9741d6e68bcf9ce8363d623437ea11506a36791b4763cefdc7")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("1e87e9b5ee7597bdce796490f3ee09211df48ba1d11f6e2f5b255f05cc0ba176","ea6a416b320f32261da8dafcf2faf088924f99a3a84f7b43b964637ea87aef72","F1e8844dbfc812d39f369e7670545a29efef6764d673038b1c3edd11561d6902","B66b179eac03afafdc69f62c207819eceecfbf994c9efa464fda0d2ba44fe2d7","9d83817f7cae01554f77680ed7e6698966bcf020915c0dc411e5d57f6eea6ed4","5cc51f29c6074d9741d6e68bcf9ce8363d623437ea11506a36791b4763cefdc7")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("1e87e9b5ee7597bdce796490f3ee09211df48ba1d11f6e2f5b255f05cc0ba176","ea6a416b320f32261da8dafcf2faf088924f99a3a84f7b43b964637ea87aef72","F1e8844dbfc812d39f369e7670545a29efef6764d673038b1c3edd11561d6902","B66b179eac03afafdc69f62c207819eceecfbf994c9efa464fda0d2ba44fe2d7","9d83817f7cae01554f77680ed7e6698966bcf020915c0dc411e5d57f6eea6ed4","5cc51f29c6074d9741d6e68bcf9ce8363d623437ea11506a36791b4763cefdc7")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("1e87e9b5ee7597bdce796490f3ee09211df48ba1d11f6e2f5b255f05cc0ba176","ea6a416b320f32261da8dafcf2faf088924f99a3a84f7b43b964637ea87aef72","F1e8844dbfc812d39f369e7670545a29efef6764d673038b1c3edd11561d6902","B66b179eac03afafdc69f62c207819eceecfbf994c9efa464fda0d2ba44fe2d7","9d83817f7cae01554f77680ed7e6698966bcf020915c0dc411e5d57f6eea6ed4","5cc51f29c6074d9741d6e68bcf9ce8363d623437ea11506a36791b4763cefdc7")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("1e87e9b5ee7597bdce796490f3ee09211df48ba1d11f6e2f5b255f05cc0ba176","ea6a416b320f32261da8dafcf2faf088924f99a3a84f7b43b964637ea87aef72","F1e8844dbfc812d39f369e7670545a29efef6764d673038b1c3edd11561d6902","B66b179eac03afafdc69f62c207819eceecfbf994c9efa464fda0d2ba44fe2d7","9d83817f7cae01554f77680ed7e6698966bcf020915c0dc411e5d57f6eea6ed4","5cc51f29c6074d9741d6e68bcf9ce8363d623437ea11506a36791b4763cefdc7")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("1e87e9b5ee7597bdce796490f3ee09211df48ba1d11f6e2f5b255f05cc0ba176","ea6a416b320f32261da8dafcf2faf088924f99a3a84f7b43b964637ea87aef72","F1e8844dbfc812d39f369e7670545a29efef6764d673038b1c3edd11561d6902","B66b179eac03afafdc69f62c207819eceecfbf994c9efa464fda0d2ba44fe2d7","9d83817f7cae01554f77680ed7e6698966bcf020915c0dc411e5d57f6eea6ed4","5cc51f29c6074d9741d6e68bcf9ce8363d623437ea11506a36791b4763cefdc7")
