index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("e8997e7d0cfee9875eb64b3aae8cc76a","ec336ebe46d1ed6b0381801d06fb30b4","407eee5f4342af292a66b8d49794f64f","0bd9711e8566b28142dde063c0fc2e55","5a8eee8fe217634cb47f2967a3d6bb37","a88e1eaf5576d27572ccc5655afb9d1a","dd7c9fe604867e2705dc581fedc1f554","2d9c5507f204fc5a223bff457b4cb0e7")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("e8997e7d0cfee9875eb64b3aae8cc76a","ec336ebe46d1ed6b0381801d06fb30b4","407eee5f4342af292a66b8d49794f64f","0bd9711e8566b28142dde063c0fc2e55","5a8eee8fe217634cb47f2967a3d6bb37","a88e1eaf5576d27572ccc5655afb9d1a","dd7c9fe604867e2705dc581fedc1f554","2d9c5507f204fc5a223bff457b4cb0e7")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("e8997e7d0cfee9875eb64b3aae8cc76a","ec336ebe46d1ed6b0381801d06fb30b4","407eee5f4342af292a66b8d49794f64f","0bd9711e8566b28142dde063c0fc2e55","5a8eee8fe217634cb47f2967a3d6bb37","a88e1eaf5576d27572ccc5655afb9d1a","dd7c9fe604867e2705dc581fedc1f554","2d9c5507f204fc5a223bff457b4cb0e7")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring64 NOT NULL AND customstring64 IN ("e8997e7d0cfee9875eb64b3aae8cc76a","ec336ebe46d1ed6b0381801d06fb30b4","407eee5f4342af292a66b8d49794f64f","0bd9711e8566b28142dde063c0fc2e55","5a8eee8fe217634cb47f2967a3d6bb37","a88e1eaf5576d27572ccc5655afb9d1a","dd7c9fe604867e2705dc581fedc1f554","2d9c5507f204fc5a223bff457b4cb0e7")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("e8997e7d0cfee9875eb64b3aae8cc76a","ec336ebe46d1ed6b0381801d06fb30b4","407eee5f4342af292a66b8d49794f64f","0bd9711e8566b28142dde063c0fc2e55","5a8eee8fe217634cb47f2967a3d6bb37","a88e1eaf5576d27572ccc5655afb9d1a","dd7c9fe604867e2705dc581fedc1f554","2d9c5507f204fc5a223bff457b4cb0e7")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("e8997e7d0cfee9875eb64b3aae8cc76a","ec336ebe46d1ed6b0381801d06fb30b4","407eee5f4342af292a66b8d49794f64f","0bd9711e8566b28142dde063c0fc2e55","5a8eee8fe217634cb47f2967a3d6bb37","a88e1eaf5576d27572ccc5655afb9d1a","dd7c9fe604867e2705dc581fedc1f554","2d9c5507f204fc5a223bff457b4cb0e7")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("e8997e7d0cfee9875eb64b3aae8cc76a","ec336ebe46d1ed6b0381801d06fb30b4","407eee5f4342af292a66b8d49794f64f","0bd9711e8566b28142dde063c0fc2e55","5a8eee8fe217634cb47f2967a3d6bb37","a88e1eaf5576d27572ccc5655afb9d1a","dd7c9fe604867e2705dc581fedc1f554","2d9c5507f204fc5a223bff457b4cb0e7")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("e8997e7d0cfee9875eb64b3aae8cc76a","ec336ebe46d1ed6b0381801d06fb30b4","407eee5f4342af292a66b8d49794f64f","0bd9711e8566b28142dde063c0fc2e55","5a8eee8fe217634cb47f2967a3d6bb37","a88e1eaf5576d27572ccc5655afb9d1a","dd7c9fe604867e2705dc581fedc1f554","2d9c5507f204fc5a223bff457b4cb0e7")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("e8997e7d0cfee9875eb64b3aae8cc76a","ec336ebe46d1ed6b0381801d06fb30b4","407eee5f4342af292a66b8d49794f64f","0bd9711e8566b28142dde063c0fc2e55","5a8eee8fe217634cb47f2967a3d6bb37","a88e1eaf5576d27572ccc5655afb9d1a","dd7c9fe604867e2705dc581fedc1f554","2d9c5507f204fc5a223bff457b4cb0e7")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("e8997e7d0cfee9875eb64b3aae8cc76a","ec336ebe46d1ed6b0381801d06fb30b4","407eee5f4342af292a66b8d49794f64f","0bd9711e8566b28142dde063c0fc2e55","5a8eee8fe217634cb47f2967a3d6bb37","a88e1eaf5576d27572ccc5655afb9d1a","dd7c9fe604867e2705dc581fedc1f554","2d9c5507f204fc5a223bff457b4cb0e7")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("e8997e7d0cfee9875eb64b3aae8cc76a","ec336ebe46d1ed6b0381801d06fb30b4","407eee5f4342af292a66b8d49794f64f","0bd9711e8566b28142dde063c0fc2e55","5a8eee8fe217634cb47f2967a3d6bb37","a88e1eaf5576d27572ccc5655afb9d1a","dd7c9fe604867e2705dc581fedc1f554","2d9c5507f204fc5a223bff457b4cb0e7")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("e8997e7d0cfee9875eb64b3aae8cc76a","ec336ebe46d1ed6b0381801d06fb30b4","407eee5f4342af292a66b8d49794f64f","0bd9711e8566b28142dde063c0fc2e55","5a8eee8fe217634cb47f2967a3d6bb37","a88e1eaf5576d27572ccc5655afb9d1a","dd7c9fe604867e2705dc581fedc1f554","2d9c5507f204fc5a223bff457b4cb0e7")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("e8997e7d0cfee9875eb64b3aae8cc76a","ec336ebe46d1ed6b0381801d06fb30b4","407eee5f4342af292a66b8d49794f64f","0bd9711e8566b28142dde063c0fc2e55","5a8eee8fe217634cb47f2967a3d6bb37","a88e1eaf5576d27572ccc5655afb9d1a","dd7c9fe604867e2705dc581fedc1f554","2d9c5507f204fc5a223bff457b4cb0e7")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("e8997e7d0cfee9875eb64b3aae8cc76a","ec336ebe46d1ed6b0381801d06fb30b4","407eee5f4342af292a66b8d49794f64f","0bd9711e8566b28142dde063c0fc2e55","5a8eee8fe217634cb47f2967a3d6bb37","a88e1eaf5576d27572ccc5655afb9d1a","dd7c9fe604867e2705dc581fedc1f554","2d9c5507f204fc5a223bff457b4cb0e7")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("e8997e7d0cfee9875eb64b3aae8cc76a","ec336ebe46d1ed6b0381801d06fb30b4","407eee5f4342af292a66b8d49794f64f","0bd9711e8566b28142dde063c0fc2e55","5a8eee8fe217634cb47f2967a3d6bb37","a88e1eaf5576d27572ccc5655afb9d1a","dd7c9fe604867e2705dc581fedc1f554","2d9c5507f204fc5a223bff457b4cb0e7")
index=activity AND rg_functionality="Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("e8997e7d0cfee9875eb64b3aae8cc76a","ec336ebe46d1ed6b0381801d06fb30b4","407eee5f4342af292a66b8d49794f64f","0bd9711e8566b28142dde063c0fc2e55","5a8eee8fe217634cb47f2967a3d6bb37","a88e1eaf5576d27572ccc5655afb9d1a","dd7c9fe604867e2705dc581fedc1f554","2d9c5507f204fc5a223bff457b4cb0e7")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("e8997e7d0cfee9875eb64b3aae8cc76a","ec336ebe46d1ed6b0381801d06fb30b4","407eee5f4342af292a66b8d49794f64f","0bd9711e8566b28142dde063c0fc2e55","5a8eee8fe217634cb47f2967a3d6bb37","a88e1eaf5576d27572ccc5655afb9d1a","dd7c9fe604867e2705dc581fedc1f554","2d9c5507f204fc5a223bff457b4cb0e7")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("e8997e7d0cfee9875eb64b3aae8cc76a","ec336ebe46d1ed6b0381801d06fb30b4","407eee5f4342af292a66b8d49794f64f","0bd9711e8566b28142dde063c0fc2e55","5a8eee8fe217634cb47f2967a3d6bb37","a88e1eaf5576d27572ccc5655afb9d1a","dd7c9fe604867e2705dc581fedc1f554","2d9c5507f204fc5a223bff457b4cb0e7")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("e8997e7d0cfee9875eb64b3aae8cc76a","ec336ebe46d1ed6b0381801d06fb30b4","407eee5f4342af292a66b8d49794f64f","0bd9711e8566b28142dde063c0fc2e55","5a8eee8fe217634cb47f2967a3d6bb37","a88e1eaf5576d27572ccc5655afb9d1a","dd7c9fe604867e2705dc581fedc1f554","2d9c5507f204fc5a223bff457b4cb0e7")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("e8997e7d0cfee9875eb64b3aae8cc76a","ec336ebe46d1ed6b0381801d06fb30b4","407eee5f4342af292a66b8d49794f64f","0bd9711e8566b28142dde063c0fc2e55","5a8eee8fe217634cb47f2967a3d6bb37","a88e1eaf5576d27572ccc5655afb9d1a","dd7c9fe604867e2705dc581fedc1f554","2d9c5507f204fc5a223bff457b4cb0e7")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("e8997e7d0cfee9875eb64b3aae8cc76a","ec336ebe46d1ed6b0381801d06fb30b4","407eee5f4342af292a66b8d49794f64f","0bd9711e8566b28142dde063c0fc2e55","5a8eee8fe217634cb47f2967a3d6bb37","a88e1eaf5576d27572ccc5655afb9d1a","dd7c9fe604867e2705dc581fedc1f554","2d9c5507f204fc5a223bff457b4cb0e7")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("e8997e7d0cfee9875eb64b3aae8cc76a","ec336ebe46d1ed6b0381801d06fb30b4","407eee5f4342af292a66b8d49794f64f","0bd9711e8566b28142dde063c0fc2e55","5a8eee8fe217634cb47f2967a3d6bb37","a88e1eaf5576d27572ccc5655afb9d1a","dd7c9fe604867e2705dc581fedc1f554","2d9c5507f204fc5a223bff457b4cb0e7")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("e8997e7d0cfee9875eb64b3aae8cc76a","ec336ebe46d1ed6b0381801d06fb30b4","407eee5f4342af292a66b8d49794f64f","0bd9711e8566b28142dde063c0fc2e55","5a8eee8fe217634cb47f2967a3d6bb37","a88e1eaf5576d27572ccc5655afb9d1a","dd7c9fe604867e2705dc581fedc1f554","2d9c5507f204fc5a223bff457b4cb0e7")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring64 NOT NULL AND customstring64 IN ("e8997e7d0cfee9875eb64b3aae8cc76a","ec336ebe46d1ed6b0381801d06fb30b4","407eee5f4342af292a66b8d49794f64f","0bd9711e8566b28142dde063c0fc2e55","5a8eee8fe217634cb47f2967a3d6bb37","a88e1eaf5576d27572ccc5655afb9d1a","dd7c9fe604867e2705dc581fedc1f554","2d9c5507f204fc5a223bff457b4cb0e7")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("e8997e7d0cfee9875eb64b3aae8cc76a","ec336ebe46d1ed6b0381801d06fb30b4","407eee5f4342af292a66b8d49794f64f","0bd9711e8566b28142dde063c0fc2e55","5a8eee8fe217634cb47f2967a3d6bb37","a88e1eaf5576d27572ccc5655afb9d1a","dd7c9fe604867e2705dc581fedc1f554","2d9c5507f204fc5a223bff457b4cb0e7")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("e8997e7d0cfee9875eb64b3aae8cc76a","ec336ebe46d1ed6b0381801d06fb30b4","407eee5f4342af292a66b8d49794f64f","0bd9711e8566b28142dde063c0fc2e55","5a8eee8fe217634cb47f2967a3d6bb37","a88e1eaf5576d27572ccc5655afb9d1a","dd7c9fe604867e2705dc581fedc1f554","2d9c5507f204fc5a223bff457b4cb0e7")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("e8997e7d0cfee9875eb64b3aae8cc76a","ec336ebe46d1ed6b0381801d06fb30b4","407eee5f4342af292a66b8d49794f64f","0bd9711e8566b28142dde063c0fc2e55","5a8eee8fe217634cb47f2967a3d6bb37","a88e1eaf5576d27572ccc5655afb9d1a","dd7c9fe604867e2705dc581fedc1f554","2d9c5507f204fc5a223bff457b4cb0e7")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring64 NOT NULL AND customstring64 IN ("e8997e7d0cfee9875eb64b3aae8cc76a","ec336ebe46d1ed6b0381801d06fb30b4","407eee5f4342af292a66b8d49794f64f","0bd9711e8566b28142dde063c0fc2e55","5a8eee8fe217634cb47f2967a3d6bb37","a88e1eaf5576d27572ccc5655afb9d1a","dd7c9fe604867e2705dc581fedc1f554","2d9c5507f204fc5a223bff457b4cb0e7")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("e8997e7d0cfee9875eb64b3aae8cc76a","ec336ebe46d1ed6b0381801d06fb30b4","407eee5f4342af292a66b8d49794f64f","0bd9711e8566b28142dde063c0fc2e55","5a8eee8fe217634cb47f2967a3d6bb37","a88e1eaf5576d27572ccc5655afb9d1a","dd7c9fe604867e2705dc581fedc1f554","2d9c5507f204fc5a223bff457b4cb0e7")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("e8997e7d0cfee9875eb64b3aae8cc76a","ec336ebe46d1ed6b0381801d06fb30b4","407eee5f4342af292a66b8d49794f64f","0bd9711e8566b28142dde063c0fc2e55","5a8eee8fe217634cb47f2967a3d6bb37","a88e1eaf5576d27572ccc5655afb9d1a","dd7c9fe604867e2705dc581fedc1f554","2d9c5507f204fc5a223bff457b4cb0e7")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("e8997e7d0cfee9875eb64b3aae8cc76a","ec336ebe46d1ed6b0381801d06fb30b4","407eee5f4342af292a66b8d49794f64f","0bd9711e8566b28142dde063c0fc2e55","5a8eee8fe217634cb47f2967a3d6bb37","a88e1eaf5576d27572ccc5655afb9d1a","dd7c9fe604867e2705dc581fedc1f554","2d9c5507f204fc5a223bff457b4cb0e7")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring64 NOT NULL AND customstring64 IN ("e8997e7d0cfee9875eb64b3aae8cc76a","ec336ebe46d1ed6b0381801d06fb30b4","407eee5f4342af292a66b8d49794f64f","0bd9711e8566b28142dde063c0fc2e55","5a8eee8fe217634cb47f2967a3d6bb37","a88e1eaf5576d27572ccc5655afb9d1a","dd7c9fe604867e2705dc581fedc1f554","2d9c5507f204fc5a223bff457b4cb0e7")
