index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("963c012d56c62093d105ab5044517fdcce4ab826f7782b3e377932da1df6896d","f2ff4cbcd6d015af20e4e858b0f216c077ec6d146d3b2e0cbe68b56b3db7a0be","4ef63fa536134ad296e83e37f9d323beb45087f7d306debdc3e096fed8357395","282fa3476294e2b57aa9a8ab4bc1cc00f334197298e4afb2aae812b77e755207")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("963c012d56c62093d105ab5044517fdcce4ab826f7782b3e377932da1df6896d","f2ff4cbcd6d015af20e4e858b0f216c077ec6d146d3b2e0cbe68b56b3db7a0be","4ef63fa536134ad296e83e37f9d323beb45087f7d306debdc3e096fed8357395","282fa3476294e2b57aa9a8ab4bc1cc00f334197298e4afb2aae812b77e755207")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("963c012d56c62093d105ab5044517fdcce4ab826f7782b3e377932da1df6896d","f2ff4cbcd6d015af20e4e858b0f216c077ec6d146d3b2e0cbe68b56b3db7a0be","4ef63fa536134ad296e83e37f9d323beb45087f7d306debdc3e096fed8357395","282fa3476294e2b57aa9a8ab4bc1cc00f334197298e4afb2aae812b77e755207")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring64 NOT NULL AND customstring64 IN ("963c012d56c62093d105ab5044517fdcce4ab826f7782b3e377932da1df6896d","f2ff4cbcd6d015af20e4e858b0f216c077ec6d146d3b2e0cbe68b56b3db7a0be","4ef63fa536134ad296e83e37f9d323beb45087f7d306debdc3e096fed8357395","282fa3476294e2b57aa9a8ab4bc1cc00f334197298e4afb2aae812b77e755207")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("963c012d56c62093d105ab5044517fdcce4ab826f7782b3e377932da1df6896d","f2ff4cbcd6d015af20e4e858b0f216c077ec6d146d3b2e0cbe68b56b3db7a0be","4ef63fa536134ad296e83e37f9d323beb45087f7d306debdc3e096fed8357395","282fa3476294e2b57aa9a8ab4bc1cc00f334197298e4afb2aae812b77e755207")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("963c012d56c62093d105ab5044517fdcce4ab826f7782b3e377932da1df6896d","f2ff4cbcd6d015af20e4e858b0f216c077ec6d146d3b2e0cbe68b56b3db7a0be","4ef63fa536134ad296e83e37f9d323beb45087f7d306debdc3e096fed8357395","282fa3476294e2b57aa9a8ab4bc1cc00f334197298e4afb2aae812b77e755207")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("963c012d56c62093d105ab5044517fdcce4ab826f7782b3e377932da1df6896d","f2ff4cbcd6d015af20e4e858b0f216c077ec6d146d3b2e0cbe68b56b3db7a0be","4ef63fa536134ad296e83e37f9d323beb45087f7d306debdc3e096fed8357395","282fa3476294e2b57aa9a8ab4bc1cc00f334197298e4afb2aae812b77e755207")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("963c012d56c62093d105ab5044517fdcce4ab826f7782b3e377932da1df6896d","f2ff4cbcd6d015af20e4e858b0f216c077ec6d146d3b2e0cbe68b56b3db7a0be","4ef63fa536134ad296e83e37f9d323beb45087f7d306debdc3e096fed8357395","282fa3476294e2b57aa9a8ab4bc1cc00f334197298e4afb2aae812b77e755207")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("963c012d56c62093d105ab5044517fdcce4ab826f7782b3e377932da1df6896d","f2ff4cbcd6d015af20e4e858b0f216c077ec6d146d3b2e0cbe68b56b3db7a0be","4ef63fa536134ad296e83e37f9d323beb45087f7d306debdc3e096fed8357395","282fa3476294e2b57aa9a8ab4bc1cc00f334197298e4afb2aae812b77e755207")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("963c012d56c62093d105ab5044517fdcce4ab826f7782b3e377932da1df6896d","f2ff4cbcd6d015af20e4e858b0f216c077ec6d146d3b2e0cbe68b56b3db7a0be","4ef63fa536134ad296e83e37f9d323beb45087f7d306debdc3e096fed8357395","282fa3476294e2b57aa9a8ab4bc1cc00f334197298e4afb2aae812b77e755207")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("963c012d56c62093d105ab5044517fdcce4ab826f7782b3e377932da1df6896d","f2ff4cbcd6d015af20e4e858b0f216c077ec6d146d3b2e0cbe68b56b3db7a0be","4ef63fa536134ad296e83e37f9d323beb45087f7d306debdc3e096fed8357395","282fa3476294e2b57aa9a8ab4bc1cc00f334197298e4afb2aae812b77e755207")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("963c012d56c62093d105ab5044517fdcce4ab826f7782b3e377932da1df6896d","f2ff4cbcd6d015af20e4e858b0f216c077ec6d146d3b2e0cbe68b56b3db7a0be","4ef63fa536134ad296e83e37f9d323beb45087f7d306debdc3e096fed8357395","282fa3476294e2b57aa9a8ab4bc1cc00f334197298e4afb2aae812b77e755207")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("963c012d56c62093d105ab5044517fdcce4ab826f7782b3e377932da1df6896d","f2ff4cbcd6d015af20e4e858b0f216c077ec6d146d3b2e0cbe68b56b3db7a0be","4ef63fa536134ad296e83e37f9d323beb45087f7d306debdc3e096fed8357395","282fa3476294e2b57aa9a8ab4bc1cc00f334197298e4afb2aae812b77e755207")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("963c012d56c62093d105ab5044517fdcce4ab826f7782b3e377932da1df6896d","f2ff4cbcd6d015af20e4e858b0f216c077ec6d146d3b2e0cbe68b56b3db7a0be","4ef63fa536134ad296e83e37f9d323beb45087f7d306debdc3e096fed8357395","282fa3476294e2b57aa9a8ab4bc1cc00f334197298e4afb2aae812b77e755207")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("963c012d56c62093d105ab5044517fdcce4ab826f7782b3e377932da1df6896d","f2ff4cbcd6d015af20e4e858b0f216c077ec6d146d3b2e0cbe68b56b3db7a0be","4ef63fa536134ad296e83e37f9d323beb45087f7d306debdc3e096fed8357395","282fa3476294e2b57aa9a8ab4bc1cc00f334197298e4afb2aae812b77e755207")
index=activity AND rg_functionality="Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("963c012d56c62093d105ab5044517fdcce4ab826f7782b3e377932da1df6896d","f2ff4cbcd6d015af20e4e858b0f216c077ec6d146d3b2e0cbe68b56b3db7a0be","4ef63fa536134ad296e83e37f9d323beb45087f7d306debdc3e096fed8357395","282fa3476294e2b57aa9a8ab4bc1cc00f334197298e4afb2aae812b77e755207")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("963c012d56c62093d105ab5044517fdcce4ab826f7782b3e377932da1df6896d","f2ff4cbcd6d015af20e4e858b0f216c077ec6d146d3b2e0cbe68b56b3db7a0be","4ef63fa536134ad296e83e37f9d323beb45087f7d306debdc3e096fed8357395","282fa3476294e2b57aa9a8ab4bc1cc00f334197298e4afb2aae812b77e755207")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("963c012d56c62093d105ab5044517fdcce4ab826f7782b3e377932da1df6896d","f2ff4cbcd6d015af20e4e858b0f216c077ec6d146d3b2e0cbe68b56b3db7a0be","4ef63fa536134ad296e83e37f9d323beb45087f7d306debdc3e096fed8357395","282fa3476294e2b57aa9a8ab4bc1cc00f334197298e4afb2aae812b77e755207")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("963c012d56c62093d105ab5044517fdcce4ab826f7782b3e377932da1df6896d","f2ff4cbcd6d015af20e4e858b0f216c077ec6d146d3b2e0cbe68b56b3db7a0be","4ef63fa536134ad296e83e37f9d323beb45087f7d306debdc3e096fed8357395","282fa3476294e2b57aa9a8ab4bc1cc00f334197298e4afb2aae812b77e755207")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("963c012d56c62093d105ab5044517fdcce4ab826f7782b3e377932da1df6896d","f2ff4cbcd6d015af20e4e858b0f216c077ec6d146d3b2e0cbe68b56b3db7a0be","4ef63fa536134ad296e83e37f9d323beb45087f7d306debdc3e096fed8357395","282fa3476294e2b57aa9a8ab4bc1cc00f334197298e4afb2aae812b77e755207")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("963c012d56c62093d105ab5044517fdcce4ab826f7782b3e377932da1df6896d","f2ff4cbcd6d015af20e4e858b0f216c077ec6d146d3b2e0cbe68b56b3db7a0be","4ef63fa536134ad296e83e37f9d323beb45087f7d306debdc3e096fed8357395","282fa3476294e2b57aa9a8ab4bc1cc00f334197298e4afb2aae812b77e755207")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("963c012d56c62093d105ab5044517fdcce4ab826f7782b3e377932da1df6896d","f2ff4cbcd6d015af20e4e858b0f216c077ec6d146d3b2e0cbe68b56b3db7a0be","4ef63fa536134ad296e83e37f9d323beb45087f7d306debdc3e096fed8357395","282fa3476294e2b57aa9a8ab4bc1cc00f334197298e4afb2aae812b77e755207")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("963c012d56c62093d105ab5044517fdcce4ab826f7782b3e377932da1df6896d","f2ff4cbcd6d015af20e4e858b0f216c077ec6d146d3b2e0cbe68b56b3db7a0be","4ef63fa536134ad296e83e37f9d323beb45087f7d306debdc3e096fed8357395","282fa3476294e2b57aa9a8ab4bc1cc00f334197298e4afb2aae812b77e755207")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring64 NOT NULL AND customstring64 IN ("963c012d56c62093d105ab5044517fdcce4ab826f7782b3e377932da1df6896d","f2ff4cbcd6d015af20e4e858b0f216c077ec6d146d3b2e0cbe68b56b3db7a0be","4ef63fa536134ad296e83e37f9d323beb45087f7d306debdc3e096fed8357395","282fa3476294e2b57aa9a8ab4bc1cc00f334197298e4afb2aae812b77e755207")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("963c012d56c62093d105ab5044517fdcce4ab826f7782b3e377932da1df6896d","f2ff4cbcd6d015af20e4e858b0f216c077ec6d146d3b2e0cbe68b56b3db7a0be","4ef63fa536134ad296e83e37f9d323beb45087f7d306debdc3e096fed8357395","282fa3476294e2b57aa9a8ab4bc1cc00f334197298e4afb2aae812b77e755207")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("963c012d56c62093d105ab5044517fdcce4ab826f7782b3e377932da1df6896d","f2ff4cbcd6d015af20e4e858b0f216c077ec6d146d3b2e0cbe68b56b3db7a0be","4ef63fa536134ad296e83e37f9d323beb45087f7d306debdc3e096fed8357395","282fa3476294e2b57aa9a8ab4bc1cc00f334197298e4afb2aae812b77e755207")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("963c012d56c62093d105ab5044517fdcce4ab826f7782b3e377932da1df6896d","f2ff4cbcd6d015af20e4e858b0f216c077ec6d146d3b2e0cbe68b56b3db7a0be","4ef63fa536134ad296e83e37f9d323beb45087f7d306debdc3e096fed8357395","282fa3476294e2b57aa9a8ab4bc1cc00f334197298e4afb2aae812b77e755207")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring64 NOT NULL AND customstring64 IN ("963c012d56c62093d105ab5044517fdcce4ab826f7782b3e377932da1df6896d","f2ff4cbcd6d015af20e4e858b0f216c077ec6d146d3b2e0cbe68b56b3db7a0be","4ef63fa536134ad296e83e37f9d323beb45087f7d306debdc3e096fed8357395","282fa3476294e2b57aa9a8ab4bc1cc00f334197298e4afb2aae812b77e755207")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("963c012d56c62093d105ab5044517fdcce4ab826f7782b3e377932da1df6896d","f2ff4cbcd6d015af20e4e858b0f216c077ec6d146d3b2e0cbe68b56b3db7a0be","4ef63fa536134ad296e83e37f9d323beb45087f7d306debdc3e096fed8357395","282fa3476294e2b57aa9a8ab4bc1cc00f334197298e4afb2aae812b77e755207")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("963c012d56c62093d105ab5044517fdcce4ab826f7782b3e377932da1df6896d","f2ff4cbcd6d015af20e4e858b0f216c077ec6d146d3b2e0cbe68b56b3db7a0be","4ef63fa536134ad296e83e37f9d323beb45087f7d306debdc3e096fed8357395","282fa3476294e2b57aa9a8ab4bc1cc00f334197298e4afb2aae812b77e755207")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("963c012d56c62093d105ab5044517fdcce4ab826f7782b3e377932da1df6896d","f2ff4cbcd6d015af20e4e858b0f216c077ec6d146d3b2e0cbe68b56b3db7a0be","4ef63fa536134ad296e83e37f9d323beb45087f7d306debdc3e096fed8357395","282fa3476294e2b57aa9a8ab4bc1cc00f334197298e4afb2aae812b77e755207")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring64 NOT NULL AND customstring64 IN ("963c012d56c62093d105ab5044517fdcce4ab826f7782b3e377932da1df6896d","f2ff4cbcd6d015af20e4e858b0f216c077ec6d146d3b2e0cbe68b56b3db7a0be","4ef63fa536134ad296e83e37f9d323beb45087f7d306debdc3e096fed8357395","282fa3476294e2b57aa9a8ab4bc1cc00f334197298e4afb2aae812b77e755207")
index=activity AND rg_functionality="O365 General" AND filehash NOT NULL AND filehash IN ("963c012d56c62093d105ab5044517fdcce4ab826f7782b3e377932da1df6896d","f2ff4cbcd6d015af20e4e858b0f216c077ec6d146d3b2e0cbe68b56b3db7a0be","4ef63fa536134ad296e83e37f9d323beb45087f7d306debdc3e096fed8357395","282fa3476294e2b57aa9a8ab4bc1cc00f334197298e4afb2aae812b77e755207")
index=activity AND rg_functionality="O365 General" AND oldfilehash NOT NULL AND oldfilehash IN ("963c012d56c62093d105ab5044517fdcce4ab826f7782b3e377932da1df6896d","f2ff4cbcd6d015af20e4e858b0f216c077ec6d146d3b2e0cbe68b56b3db7a0be","4ef63fa536134ad296e83e37f9d323beb45087f7d306debdc3e096fed8357395","282fa3476294e2b57aa9a8ab4bc1cc00f334197298e4afb2aae812b77e755207")
index=activity AND rg_functionality="O365 General" AND customstring3 NOT NULL AND customstring3 IN ("963c012d56c62093d105ab5044517fdcce4ab826f7782b3e377932da1df6896d","f2ff4cbcd6d015af20e4e858b0f216c077ec6d146d3b2e0cbe68b56b3db7a0be","4ef63fa536134ad296e83e37f9d323beb45087f7d306debdc3e096fed8357395","282fa3476294e2b57aa9a8ab4bc1cc00f334197298e4afb2aae812b77e755207")
index=activity AND rg_functionality="O365 General" AND customstring64 NOT NULL AND customstring64 IN ("963c012d56c62093d105ab5044517fdcce4ab826f7782b3e377932da1df6896d","f2ff4cbcd6d015af20e4e858b0f216c077ec6d146d3b2e0cbe68b56b3db7a0be","4ef63fa536134ad296e83e37f9d323beb45087f7d306debdc3e096fed8357395","282fa3476294e2b57aa9a8ab4bc1cc00f334197298e4afb2aae812b77e755207")
