index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("5a741df3e4a61b8632f62109a65afc0f297f4ed03cd7e208ffd2ea5e2badf318","3dd877835c04fde3f2d14ce96f23a1c00002fefa9d731e8c4ce3b656aac90063","7e0d097412ca8c3acdbaaa7c1f79c42cda3a4e50b52c0a8b34d6c75cc764ce42","66aac2857eee73b1f5f715214bb50a03c0dc052d4bb3e64d6b0b492f2c85f374","a97ff41736299857a3cae7c1917456eef5e0fcc703d0a1e475d0b9cfe42452c7","7a682be245a2e51f473ee1c60d537e57423ab2c3d9ae990445cdb6e43aeb5c76","ce6a7af556090b3ff762e27058be2327e6c5188d6ed54703d794089f577fd20c","b0b24ff78ab1c4322764bcb332254069504b168cb8aaca469bdf1d37f313d4d3","c2054617b8dcb619749c0402dc31eeb473386b3829f17176bc27b1447a8b6d92","60125159523c356d711ffa1076211359906e6283e25f75f4cf0f9dc8da6bf7b0","1ff6ee23b4cd9ac90ee569067b9e649c76dafac234761706724ae0c1943e4a75","d51f81ee026df39447143b67eaf16326c30e0c9477c0d50507f1fbfffe53abd6","e6bcdf375649a7cbf092fcab65a24d832d8725d833e422e28dfa634498b00928","f2ff4cbcd6d015af20e4e858b0f216c077ec6d146d3b2e0cbe68b56b3db7a0be")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("5a741df3e4a61b8632f62109a65afc0f297f4ed03cd7e208ffd2ea5e2badf318","3dd877835c04fde3f2d14ce96f23a1c00002fefa9d731e8c4ce3b656aac90063","7e0d097412ca8c3acdbaaa7c1f79c42cda3a4e50b52c0a8b34d6c75cc764ce42","66aac2857eee73b1f5f715214bb50a03c0dc052d4bb3e64d6b0b492f2c85f374","a97ff41736299857a3cae7c1917456eef5e0fcc703d0a1e475d0b9cfe42452c7","7a682be245a2e51f473ee1c60d537e57423ab2c3d9ae990445cdb6e43aeb5c76","ce6a7af556090b3ff762e27058be2327e6c5188d6ed54703d794089f577fd20c","b0b24ff78ab1c4322764bcb332254069504b168cb8aaca469bdf1d37f313d4d3","c2054617b8dcb619749c0402dc31eeb473386b3829f17176bc27b1447a8b6d92","60125159523c356d711ffa1076211359906e6283e25f75f4cf0f9dc8da6bf7b0","1ff6ee23b4cd9ac90ee569067b9e649c76dafac234761706724ae0c1943e4a75","d51f81ee026df39447143b67eaf16326c30e0c9477c0d50507f1fbfffe53abd6","e6bcdf375649a7cbf092fcab65a24d832d8725d833e422e28dfa634498b00928","f2ff4cbcd6d015af20e4e858b0f216c077ec6d146d3b2e0cbe68b56b3db7a0be")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("5a741df3e4a61b8632f62109a65afc0f297f4ed03cd7e208ffd2ea5e2badf318","3dd877835c04fde3f2d14ce96f23a1c00002fefa9d731e8c4ce3b656aac90063","7e0d097412ca8c3acdbaaa7c1f79c42cda3a4e50b52c0a8b34d6c75cc764ce42","66aac2857eee73b1f5f715214bb50a03c0dc052d4bb3e64d6b0b492f2c85f374","a97ff41736299857a3cae7c1917456eef5e0fcc703d0a1e475d0b9cfe42452c7","7a682be245a2e51f473ee1c60d537e57423ab2c3d9ae990445cdb6e43aeb5c76","ce6a7af556090b3ff762e27058be2327e6c5188d6ed54703d794089f577fd20c","b0b24ff78ab1c4322764bcb332254069504b168cb8aaca469bdf1d37f313d4d3","c2054617b8dcb619749c0402dc31eeb473386b3829f17176bc27b1447a8b6d92","60125159523c356d711ffa1076211359906e6283e25f75f4cf0f9dc8da6bf7b0","1ff6ee23b4cd9ac90ee569067b9e649c76dafac234761706724ae0c1943e4a75","d51f81ee026df39447143b67eaf16326c30e0c9477c0d50507f1fbfffe53abd6","e6bcdf375649a7cbf092fcab65a24d832d8725d833e422e28dfa634498b00928","f2ff4cbcd6d015af20e4e858b0f216c077ec6d146d3b2e0cbe68b56b3db7a0be")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring64 NOT NULL AND customstring64 IN ("5a741df3e4a61b8632f62109a65afc0f297f4ed03cd7e208ffd2ea5e2badf318","3dd877835c04fde3f2d14ce96f23a1c00002fefa9d731e8c4ce3b656aac90063","7e0d097412ca8c3acdbaaa7c1f79c42cda3a4e50b52c0a8b34d6c75cc764ce42","66aac2857eee73b1f5f715214bb50a03c0dc052d4bb3e64d6b0b492f2c85f374","a97ff41736299857a3cae7c1917456eef5e0fcc703d0a1e475d0b9cfe42452c7","7a682be245a2e51f473ee1c60d537e57423ab2c3d9ae990445cdb6e43aeb5c76","ce6a7af556090b3ff762e27058be2327e6c5188d6ed54703d794089f577fd20c","b0b24ff78ab1c4322764bcb332254069504b168cb8aaca469bdf1d37f313d4d3","c2054617b8dcb619749c0402dc31eeb473386b3829f17176bc27b1447a8b6d92","60125159523c356d711ffa1076211359906e6283e25f75f4cf0f9dc8da6bf7b0","1ff6ee23b4cd9ac90ee569067b9e649c76dafac234761706724ae0c1943e4a75","d51f81ee026df39447143b67eaf16326c30e0c9477c0d50507f1fbfffe53abd6","e6bcdf375649a7cbf092fcab65a24d832d8725d833e422e28dfa634498b00928","f2ff4cbcd6d015af20e4e858b0f216c077ec6d146d3b2e0cbe68b56b3db7a0be")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("5a741df3e4a61b8632f62109a65afc0f297f4ed03cd7e208ffd2ea5e2badf318","3dd877835c04fde3f2d14ce96f23a1c00002fefa9d731e8c4ce3b656aac90063","7e0d097412ca8c3acdbaaa7c1f79c42cda3a4e50b52c0a8b34d6c75cc764ce42","66aac2857eee73b1f5f715214bb50a03c0dc052d4bb3e64d6b0b492f2c85f374","a97ff41736299857a3cae7c1917456eef5e0fcc703d0a1e475d0b9cfe42452c7","7a682be245a2e51f473ee1c60d537e57423ab2c3d9ae990445cdb6e43aeb5c76","ce6a7af556090b3ff762e27058be2327e6c5188d6ed54703d794089f577fd20c","b0b24ff78ab1c4322764bcb332254069504b168cb8aaca469bdf1d37f313d4d3","c2054617b8dcb619749c0402dc31eeb473386b3829f17176bc27b1447a8b6d92","60125159523c356d711ffa1076211359906e6283e25f75f4cf0f9dc8da6bf7b0","1ff6ee23b4cd9ac90ee569067b9e649c76dafac234761706724ae0c1943e4a75","d51f81ee026df39447143b67eaf16326c30e0c9477c0d50507f1fbfffe53abd6","e6bcdf375649a7cbf092fcab65a24d832d8725d833e422e28dfa634498b00928","f2ff4cbcd6d015af20e4e858b0f216c077ec6d146d3b2e0cbe68b56b3db7a0be")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("5a741df3e4a61b8632f62109a65afc0f297f4ed03cd7e208ffd2ea5e2badf318","3dd877835c04fde3f2d14ce96f23a1c00002fefa9d731e8c4ce3b656aac90063","7e0d097412ca8c3acdbaaa7c1f79c42cda3a4e50b52c0a8b34d6c75cc764ce42","66aac2857eee73b1f5f715214bb50a03c0dc052d4bb3e64d6b0b492f2c85f374","a97ff41736299857a3cae7c1917456eef5e0fcc703d0a1e475d0b9cfe42452c7","7a682be245a2e51f473ee1c60d537e57423ab2c3d9ae990445cdb6e43aeb5c76","ce6a7af556090b3ff762e27058be2327e6c5188d6ed54703d794089f577fd20c","b0b24ff78ab1c4322764bcb332254069504b168cb8aaca469bdf1d37f313d4d3","c2054617b8dcb619749c0402dc31eeb473386b3829f17176bc27b1447a8b6d92","60125159523c356d711ffa1076211359906e6283e25f75f4cf0f9dc8da6bf7b0","1ff6ee23b4cd9ac90ee569067b9e649c76dafac234761706724ae0c1943e4a75","d51f81ee026df39447143b67eaf16326c30e0c9477c0d50507f1fbfffe53abd6","e6bcdf375649a7cbf092fcab65a24d832d8725d833e422e28dfa634498b00928","f2ff4cbcd6d015af20e4e858b0f216c077ec6d146d3b2e0cbe68b56b3db7a0be")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("5a741df3e4a61b8632f62109a65afc0f297f4ed03cd7e208ffd2ea5e2badf318","3dd877835c04fde3f2d14ce96f23a1c00002fefa9d731e8c4ce3b656aac90063","7e0d097412ca8c3acdbaaa7c1f79c42cda3a4e50b52c0a8b34d6c75cc764ce42","66aac2857eee73b1f5f715214bb50a03c0dc052d4bb3e64d6b0b492f2c85f374","a97ff41736299857a3cae7c1917456eef5e0fcc703d0a1e475d0b9cfe42452c7","7a682be245a2e51f473ee1c60d537e57423ab2c3d9ae990445cdb6e43aeb5c76","ce6a7af556090b3ff762e27058be2327e6c5188d6ed54703d794089f577fd20c","b0b24ff78ab1c4322764bcb332254069504b168cb8aaca469bdf1d37f313d4d3","c2054617b8dcb619749c0402dc31eeb473386b3829f17176bc27b1447a8b6d92","60125159523c356d711ffa1076211359906e6283e25f75f4cf0f9dc8da6bf7b0","1ff6ee23b4cd9ac90ee569067b9e649c76dafac234761706724ae0c1943e4a75","d51f81ee026df39447143b67eaf16326c30e0c9477c0d50507f1fbfffe53abd6","e6bcdf375649a7cbf092fcab65a24d832d8725d833e422e28dfa634498b00928","f2ff4cbcd6d015af20e4e858b0f216c077ec6d146d3b2e0cbe68b56b3db7a0be")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("5a741df3e4a61b8632f62109a65afc0f297f4ed03cd7e208ffd2ea5e2badf318","3dd877835c04fde3f2d14ce96f23a1c00002fefa9d731e8c4ce3b656aac90063","7e0d097412ca8c3acdbaaa7c1f79c42cda3a4e50b52c0a8b34d6c75cc764ce42","66aac2857eee73b1f5f715214bb50a03c0dc052d4bb3e64d6b0b492f2c85f374","a97ff41736299857a3cae7c1917456eef5e0fcc703d0a1e475d0b9cfe42452c7","7a682be245a2e51f473ee1c60d537e57423ab2c3d9ae990445cdb6e43aeb5c76","ce6a7af556090b3ff762e27058be2327e6c5188d6ed54703d794089f577fd20c","b0b24ff78ab1c4322764bcb332254069504b168cb8aaca469bdf1d37f313d4d3","c2054617b8dcb619749c0402dc31eeb473386b3829f17176bc27b1447a8b6d92","60125159523c356d711ffa1076211359906e6283e25f75f4cf0f9dc8da6bf7b0","1ff6ee23b4cd9ac90ee569067b9e649c76dafac234761706724ae0c1943e4a75","d51f81ee026df39447143b67eaf16326c30e0c9477c0d50507f1fbfffe53abd6","e6bcdf375649a7cbf092fcab65a24d832d8725d833e422e28dfa634498b00928","f2ff4cbcd6d015af20e4e858b0f216c077ec6d146d3b2e0cbe68b56b3db7a0be")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("5a741df3e4a61b8632f62109a65afc0f297f4ed03cd7e208ffd2ea5e2badf318","3dd877835c04fde3f2d14ce96f23a1c00002fefa9d731e8c4ce3b656aac90063","7e0d097412ca8c3acdbaaa7c1f79c42cda3a4e50b52c0a8b34d6c75cc764ce42","66aac2857eee73b1f5f715214bb50a03c0dc052d4bb3e64d6b0b492f2c85f374","a97ff41736299857a3cae7c1917456eef5e0fcc703d0a1e475d0b9cfe42452c7","7a682be245a2e51f473ee1c60d537e57423ab2c3d9ae990445cdb6e43aeb5c76","ce6a7af556090b3ff762e27058be2327e6c5188d6ed54703d794089f577fd20c","b0b24ff78ab1c4322764bcb332254069504b168cb8aaca469bdf1d37f313d4d3","c2054617b8dcb619749c0402dc31eeb473386b3829f17176bc27b1447a8b6d92","60125159523c356d711ffa1076211359906e6283e25f75f4cf0f9dc8da6bf7b0","1ff6ee23b4cd9ac90ee569067b9e649c76dafac234761706724ae0c1943e4a75","d51f81ee026df39447143b67eaf16326c30e0c9477c0d50507f1fbfffe53abd6","e6bcdf375649a7cbf092fcab65a24d832d8725d833e422e28dfa634498b00928","f2ff4cbcd6d015af20e4e858b0f216c077ec6d146d3b2e0cbe68b56b3db7a0be")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("5a741df3e4a61b8632f62109a65afc0f297f4ed03cd7e208ffd2ea5e2badf318","3dd877835c04fde3f2d14ce96f23a1c00002fefa9d731e8c4ce3b656aac90063","7e0d097412ca8c3acdbaaa7c1f79c42cda3a4e50b52c0a8b34d6c75cc764ce42","66aac2857eee73b1f5f715214bb50a03c0dc052d4bb3e64d6b0b492f2c85f374","a97ff41736299857a3cae7c1917456eef5e0fcc703d0a1e475d0b9cfe42452c7","7a682be245a2e51f473ee1c60d537e57423ab2c3d9ae990445cdb6e43aeb5c76","ce6a7af556090b3ff762e27058be2327e6c5188d6ed54703d794089f577fd20c","b0b24ff78ab1c4322764bcb332254069504b168cb8aaca469bdf1d37f313d4d3","c2054617b8dcb619749c0402dc31eeb473386b3829f17176bc27b1447a8b6d92","60125159523c356d711ffa1076211359906e6283e25f75f4cf0f9dc8da6bf7b0","1ff6ee23b4cd9ac90ee569067b9e649c76dafac234761706724ae0c1943e4a75","d51f81ee026df39447143b67eaf16326c30e0c9477c0d50507f1fbfffe53abd6","e6bcdf375649a7cbf092fcab65a24d832d8725d833e422e28dfa634498b00928","f2ff4cbcd6d015af20e4e858b0f216c077ec6d146d3b2e0cbe68b56b3db7a0be")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("5a741df3e4a61b8632f62109a65afc0f297f4ed03cd7e208ffd2ea5e2badf318","3dd877835c04fde3f2d14ce96f23a1c00002fefa9d731e8c4ce3b656aac90063","7e0d097412ca8c3acdbaaa7c1f79c42cda3a4e50b52c0a8b34d6c75cc764ce42","66aac2857eee73b1f5f715214bb50a03c0dc052d4bb3e64d6b0b492f2c85f374","a97ff41736299857a3cae7c1917456eef5e0fcc703d0a1e475d0b9cfe42452c7","7a682be245a2e51f473ee1c60d537e57423ab2c3d9ae990445cdb6e43aeb5c76","ce6a7af556090b3ff762e27058be2327e6c5188d6ed54703d794089f577fd20c","b0b24ff78ab1c4322764bcb332254069504b168cb8aaca469bdf1d37f313d4d3","c2054617b8dcb619749c0402dc31eeb473386b3829f17176bc27b1447a8b6d92","60125159523c356d711ffa1076211359906e6283e25f75f4cf0f9dc8da6bf7b0","1ff6ee23b4cd9ac90ee569067b9e649c76dafac234761706724ae0c1943e4a75","d51f81ee026df39447143b67eaf16326c30e0c9477c0d50507f1fbfffe53abd6","e6bcdf375649a7cbf092fcab65a24d832d8725d833e422e28dfa634498b00928","f2ff4cbcd6d015af20e4e858b0f216c077ec6d146d3b2e0cbe68b56b3db7a0be")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("5a741df3e4a61b8632f62109a65afc0f297f4ed03cd7e208ffd2ea5e2badf318","3dd877835c04fde3f2d14ce96f23a1c00002fefa9d731e8c4ce3b656aac90063","7e0d097412ca8c3acdbaaa7c1f79c42cda3a4e50b52c0a8b34d6c75cc764ce42","66aac2857eee73b1f5f715214bb50a03c0dc052d4bb3e64d6b0b492f2c85f374","a97ff41736299857a3cae7c1917456eef5e0fcc703d0a1e475d0b9cfe42452c7","7a682be245a2e51f473ee1c60d537e57423ab2c3d9ae990445cdb6e43aeb5c76","ce6a7af556090b3ff762e27058be2327e6c5188d6ed54703d794089f577fd20c","b0b24ff78ab1c4322764bcb332254069504b168cb8aaca469bdf1d37f313d4d3","c2054617b8dcb619749c0402dc31eeb473386b3829f17176bc27b1447a8b6d92","60125159523c356d711ffa1076211359906e6283e25f75f4cf0f9dc8da6bf7b0","1ff6ee23b4cd9ac90ee569067b9e649c76dafac234761706724ae0c1943e4a75","d51f81ee026df39447143b67eaf16326c30e0c9477c0d50507f1fbfffe53abd6","e6bcdf375649a7cbf092fcab65a24d832d8725d833e422e28dfa634498b00928","f2ff4cbcd6d015af20e4e858b0f216c077ec6d146d3b2e0cbe68b56b3db7a0be")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("5a741df3e4a61b8632f62109a65afc0f297f4ed03cd7e208ffd2ea5e2badf318","3dd877835c04fde3f2d14ce96f23a1c00002fefa9d731e8c4ce3b656aac90063","7e0d097412ca8c3acdbaaa7c1f79c42cda3a4e50b52c0a8b34d6c75cc764ce42","66aac2857eee73b1f5f715214bb50a03c0dc052d4bb3e64d6b0b492f2c85f374","a97ff41736299857a3cae7c1917456eef5e0fcc703d0a1e475d0b9cfe42452c7","7a682be245a2e51f473ee1c60d537e57423ab2c3d9ae990445cdb6e43aeb5c76","ce6a7af556090b3ff762e27058be2327e6c5188d6ed54703d794089f577fd20c","b0b24ff78ab1c4322764bcb332254069504b168cb8aaca469bdf1d37f313d4d3","c2054617b8dcb619749c0402dc31eeb473386b3829f17176bc27b1447a8b6d92","60125159523c356d711ffa1076211359906e6283e25f75f4cf0f9dc8da6bf7b0","1ff6ee23b4cd9ac90ee569067b9e649c76dafac234761706724ae0c1943e4a75","d51f81ee026df39447143b67eaf16326c30e0c9477c0d50507f1fbfffe53abd6","e6bcdf375649a7cbf092fcab65a24d832d8725d833e422e28dfa634498b00928","f2ff4cbcd6d015af20e4e858b0f216c077ec6d146d3b2e0cbe68b56b3db7a0be")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("5a741df3e4a61b8632f62109a65afc0f297f4ed03cd7e208ffd2ea5e2badf318","3dd877835c04fde3f2d14ce96f23a1c00002fefa9d731e8c4ce3b656aac90063","7e0d097412ca8c3acdbaaa7c1f79c42cda3a4e50b52c0a8b34d6c75cc764ce42","66aac2857eee73b1f5f715214bb50a03c0dc052d4bb3e64d6b0b492f2c85f374","a97ff41736299857a3cae7c1917456eef5e0fcc703d0a1e475d0b9cfe42452c7","7a682be245a2e51f473ee1c60d537e57423ab2c3d9ae990445cdb6e43aeb5c76","ce6a7af556090b3ff762e27058be2327e6c5188d6ed54703d794089f577fd20c","b0b24ff78ab1c4322764bcb332254069504b168cb8aaca469bdf1d37f313d4d3","c2054617b8dcb619749c0402dc31eeb473386b3829f17176bc27b1447a8b6d92","60125159523c356d711ffa1076211359906e6283e25f75f4cf0f9dc8da6bf7b0","1ff6ee23b4cd9ac90ee569067b9e649c76dafac234761706724ae0c1943e4a75","d51f81ee026df39447143b67eaf16326c30e0c9477c0d50507f1fbfffe53abd6","e6bcdf375649a7cbf092fcab65a24d832d8725d833e422e28dfa634498b00928","f2ff4cbcd6d015af20e4e858b0f216c077ec6d146d3b2e0cbe68b56b3db7a0be")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("5a741df3e4a61b8632f62109a65afc0f297f4ed03cd7e208ffd2ea5e2badf318","3dd877835c04fde3f2d14ce96f23a1c00002fefa9d731e8c4ce3b656aac90063","7e0d097412ca8c3acdbaaa7c1f79c42cda3a4e50b52c0a8b34d6c75cc764ce42","66aac2857eee73b1f5f715214bb50a03c0dc052d4bb3e64d6b0b492f2c85f374","a97ff41736299857a3cae7c1917456eef5e0fcc703d0a1e475d0b9cfe42452c7","7a682be245a2e51f473ee1c60d537e57423ab2c3d9ae990445cdb6e43aeb5c76","ce6a7af556090b3ff762e27058be2327e6c5188d6ed54703d794089f577fd20c","b0b24ff78ab1c4322764bcb332254069504b168cb8aaca469bdf1d37f313d4d3","c2054617b8dcb619749c0402dc31eeb473386b3829f17176bc27b1447a8b6d92","60125159523c356d711ffa1076211359906e6283e25f75f4cf0f9dc8da6bf7b0","1ff6ee23b4cd9ac90ee569067b9e649c76dafac234761706724ae0c1943e4a75","d51f81ee026df39447143b67eaf16326c30e0c9477c0d50507f1fbfffe53abd6","e6bcdf375649a7cbf092fcab65a24d832d8725d833e422e28dfa634498b00928","f2ff4cbcd6d015af20e4e858b0f216c077ec6d146d3b2e0cbe68b56b3db7a0be")
index=activity AND rg_functionality="Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("5a741df3e4a61b8632f62109a65afc0f297f4ed03cd7e208ffd2ea5e2badf318","3dd877835c04fde3f2d14ce96f23a1c00002fefa9d731e8c4ce3b656aac90063","7e0d097412ca8c3acdbaaa7c1f79c42cda3a4e50b52c0a8b34d6c75cc764ce42","66aac2857eee73b1f5f715214bb50a03c0dc052d4bb3e64d6b0b492f2c85f374","a97ff41736299857a3cae7c1917456eef5e0fcc703d0a1e475d0b9cfe42452c7","7a682be245a2e51f473ee1c60d537e57423ab2c3d9ae990445cdb6e43aeb5c76","ce6a7af556090b3ff762e27058be2327e6c5188d6ed54703d794089f577fd20c","b0b24ff78ab1c4322764bcb332254069504b168cb8aaca469bdf1d37f313d4d3","c2054617b8dcb619749c0402dc31eeb473386b3829f17176bc27b1447a8b6d92","60125159523c356d711ffa1076211359906e6283e25f75f4cf0f9dc8da6bf7b0","1ff6ee23b4cd9ac90ee569067b9e649c76dafac234761706724ae0c1943e4a75","d51f81ee026df39447143b67eaf16326c30e0c9477c0d50507f1fbfffe53abd6","e6bcdf375649a7cbf092fcab65a24d832d8725d833e422e28dfa634498b00928","f2ff4cbcd6d015af20e4e858b0f216c077ec6d146d3b2e0cbe68b56b3db7a0be")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("5a741df3e4a61b8632f62109a65afc0f297f4ed03cd7e208ffd2ea5e2badf318","3dd877835c04fde3f2d14ce96f23a1c00002fefa9d731e8c4ce3b656aac90063","7e0d097412ca8c3acdbaaa7c1f79c42cda3a4e50b52c0a8b34d6c75cc764ce42","66aac2857eee73b1f5f715214bb50a03c0dc052d4bb3e64d6b0b492f2c85f374","a97ff41736299857a3cae7c1917456eef5e0fcc703d0a1e475d0b9cfe42452c7","7a682be245a2e51f473ee1c60d537e57423ab2c3d9ae990445cdb6e43aeb5c76","ce6a7af556090b3ff762e27058be2327e6c5188d6ed54703d794089f577fd20c","b0b24ff78ab1c4322764bcb332254069504b168cb8aaca469bdf1d37f313d4d3","c2054617b8dcb619749c0402dc31eeb473386b3829f17176bc27b1447a8b6d92","60125159523c356d711ffa1076211359906e6283e25f75f4cf0f9dc8da6bf7b0","1ff6ee23b4cd9ac90ee569067b9e649c76dafac234761706724ae0c1943e4a75","d51f81ee026df39447143b67eaf16326c30e0c9477c0d50507f1fbfffe53abd6","e6bcdf375649a7cbf092fcab65a24d832d8725d833e422e28dfa634498b00928","f2ff4cbcd6d015af20e4e858b0f216c077ec6d146d3b2e0cbe68b56b3db7a0be")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("5a741df3e4a61b8632f62109a65afc0f297f4ed03cd7e208ffd2ea5e2badf318","3dd877835c04fde3f2d14ce96f23a1c00002fefa9d731e8c4ce3b656aac90063","7e0d097412ca8c3acdbaaa7c1f79c42cda3a4e50b52c0a8b34d6c75cc764ce42","66aac2857eee73b1f5f715214bb50a03c0dc052d4bb3e64d6b0b492f2c85f374","a97ff41736299857a3cae7c1917456eef5e0fcc703d0a1e475d0b9cfe42452c7","7a682be245a2e51f473ee1c60d537e57423ab2c3d9ae990445cdb6e43aeb5c76","ce6a7af556090b3ff762e27058be2327e6c5188d6ed54703d794089f577fd20c","b0b24ff78ab1c4322764bcb332254069504b168cb8aaca469bdf1d37f313d4d3","c2054617b8dcb619749c0402dc31eeb473386b3829f17176bc27b1447a8b6d92","60125159523c356d711ffa1076211359906e6283e25f75f4cf0f9dc8da6bf7b0","1ff6ee23b4cd9ac90ee569067b9e649c76dafac234761706724ae0c1943e4a75","d51f81ee026df39447143b67eaf16326c30e0c9477c0d50507f1fbfffe53abd6","e6bcdf375649a7cbf092fcab65a24d832d8725d833e422e28dfa634498b00928","f2ff4cbcd6d015af20e4e858b0f216c077ec6d146d3b2e0cbe68b56b3db7a0be")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("5a741df3e4a61b8632f62109a65afc0f297f4ed03cd7e208ffd2ea5e2badf318","3dd877835c04fde3f2d14ce96f23a1c00002fefa9d731e8c4ce3b656aac90063","7e0d097412ca8c3acdbaaa7c1f79c42cda3a4e50b52c0a8b34d6c75cc764ce42","66aac2857eee73b1f5f715214bb50a03c0dc052d4bb3e64d6b0b492f2c85f374","a97ff41736299857a3cae7c1917456eef5e0fcc703d0a1e475d0b9cfe42452c7","7a682be245a2e51f473ee1c60d537e57423ab2c3d9ae990445cdb6e43aeb5c76","ce6a7af556090b3ff762e27058be2327e6c5188d6ed54703d794089f577fd20c","b0b24ff78ab1c4322764bcb332254069504b168cb8aaca469bdf1d37f313d4d3","c2054617b8dcb619749c0402dc31eeb473386b3829f17176bc27b1447a8b6d92","60125159523c356d711ffa1076211359906e6283e25f75f4cf0f9dc8da6bf7b0","1ff6ee23b4cd9ac90ee569067b9e649c76dafac234761706724ae0c1943e4a75","d51f81ee026df39447143b67eaf16326c30e0c9477c0d50507f1fbfffe53abd6","e6bcdf375649a7cbf092fcab65a24d832d8725d833e422e28dfa634498b00928","f2ff4cbcd6d015af20e4e858b0f216c077ec6d146d3b2e0cbe68b56b3db7a0be")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("5a741df3e4a61b8632f62109a65afc0f297f4ed03cd7e208ffd2ea5e2badf318","3dd877835c04fde3f2d14ce96f23a1c00002fefa9d731e8c4ce3b656aac90063","7e0d097412ca8c3acdbaaa7c1f79c42cda3a4e50b52c0a8b34d6c75cc764ce42","66aac2857eee73b1f5f715214bb50a03c0dc052d4bb3e64d6b0b492f2c85f374","a97ff41736299857a3cae7c1917456eef5e0fcc703d0a1e475d0b9cfe42452c7","7a682be245a2e51f473ee1c60d537e57423ab2c3d9ae990445cdb6e43aeb5c76","ce6a7af556090b3ff762e27058be2327e6c5188d6ed54703d794089f577fd20c","b0b24ff78ab1c4322764bcb332254069504b168cb8aaca469bdf1d37f313d4d3","c2054617b8dcb619749c0402dc31eeb473386b3829f17176bc27b1447a8b6d92","60125159523c356d711ffa1076211359906e6283e25f75f4cf0f9dc8da6bf7b0","1ff6ee23b4cd9ac90ee569067b9e649c76dafac234761706724ae0c1943e4a75","d51f81ee026df39447143b67eaf16326c30e0c9477c0d50507f1fbfffe53abd6","e6bcdf375649a7cbf092fcab65a24d832d8725d833e422e28dfa634498b00928","f2ff4cbcd6d015af20e4e858b0f216c077ec6d146d3b2e0cbe68b56b3db7a0be")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("5a741df3e4a61b8632f62109a65afc0f297f4ed03cd7e208ffd2ea5e2badf318","3dd877835c04fde3f2d14ce96f23a1c00002fefa9d731e8c4ce3b656aac90063","7e0d097412ca8c3acdbaaa7c1f79c42cda3a4e50b52c0a8b34d6c75cc764ce42","66aac2857eee73b1f5f715214bb50a03c0dc052d4bb3e64d6b0b492f2c85f374","a97ff41736299857a3cae7c1917456eef5e0fcc703d0a1e475d0b9cfe42452c7","7a682be245a2e51f473ee1c60d537e57423ab2c3d9ae990445cdb6e43aeb5c76","ce6a7af556090b3ff762e27058be2327e6c5188d6ed54703d794089f577fd20c","b0b24ff78ab1c4322764bcb332254069504b168cb8aaca469bdf1d37f313d4d3","c2054617b8dcb619749c0402dc31eeb473386b3829f17176bc27b1447a8b6d92","60125159523c356d711ffa1076211359906e6283e25f75f4cf0f9dc8da6bf7b0","1ff6ee23b4cd9ac90ee569067b9e649c76dafac234761706724ae0c1943e4a75","d51f81ee026df39447143b67eaf16326c30e0c9477c0d50507f1fbfffe53abd6","e6bcdf375649a7cbf092fcab65a24d832d8725d833e422e28dfa634498b00928","f2ff4cbcd6d015af20e4e858b0f216c077ec6d146d3b2e0cbe68b56b3db7a0be")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("5a741df3e4a61b8632f62109a65afc0f297f4ed03cd7e208ffd2ea5e2badf318","3dd877835c04fde3f2d14ce96f23a1c00002fefa9d731e8c4ce3b656aac90063","7e0d097412ca8c3acdbaaa7c1f79c42cda3a4e50b52c0a8b34d6c75cc764ce42","66aac2857eee73b1f5f715214bb50a03c0dc052d4bb3e64d6b0b492f2c85f374","a97ff41736299857a3cae7c1917456eef5e0fcc703d0a1e475d0b9cfe42452c7","7a682be245a2e51f473ee1c60d537e57423ab2c3d9ae990445cdb6e43aeb5c76","ce6a7af556090b3ff762e27058be2327e6c5188d6ed54703d794089f577fd20c","b0b24ff78ab1c4322764bcb332254069504b168cb8aaca469bdf1d37f313d4d3","c2054617b8dcb619749c0402dc31eeb473386b3829f17176bc27b1447a8b6d92","60125159523c356d711ffa1076211359906e6283e25f75f4cf0f9dc8da6bf7b0","1ff6ee23b4cd9ac90ee569067b9e649c76dafac234761706724ae0c1943e4a75","d51f81ee026df39447143b67eaf16326c30e0c9477c0d50507f1fbfffe53abd6","e6bcdf375649a7cbf092fcab65a24d832d8725d833e422e28dfa634498b00928","f2ff4cbcd6d015af20e4e858b0f216c077ec6d146d3b2e0cbe68b56b3db7a0be")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("5a741df3e4a61b8632f62109a65afc0f297f4ed03cd7e208ffd2ea5e2badf318","3dd877835c04fde3f2d14ce96f23a1c00002fefa9d731e8c4ce3b656aac90063","7e0d097412ca8c3acdbaaa7c1f79c42cda3a4e50b52c0a8b34d6c75cc764ce42","66aac2857eee73b1f5f715214bb50a03c0dc052d4bb3e64d6b0b492f2c85f374","a97ff41736299857a3cae7c1917456eef5e0fcc703d0a1e475d0b9cfe42452c7","7a682be245a2e51f473ee1c60d537e57423ab2c3d9ae990445cdb6e43aeb5c76","ce6a7af556090b3ff762e27058be2327e6c5188d6ed54703d794089f577fd20c","b0b24ff78ab1c4322764bcb332254069504b168cb8aaca469bdf1d37f313d4d3","c2054617b8dcb619749c0402dc31eeb473386b3829f17176bc27b1447a8b6d92","60125159523c356d711ffa1076211359906e6283e25f75f4cf0f9dc8da6bf7b0","1ff6ee23b4cd9ac90ee569067b9e649c76dafac234761706724ae0c1943e4a75","d51f81ee026df39447143b67eaf16326c30e0c9477c0d50507f1fbfffe53abd6","e6bcdf375649a7cbf092fcab65a24d832d8725d833e422e28dfa634498b00928","f2ff4cbcd6d015af20e4e858b0f216c077ec6d146d3b2e0cbe68b56b3db7a0be")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring64 NOT NULL AND customstring64 IN ("5a741df3e4a61b8632f62109a65afc0f297f4ed03cd7e208ffd2ea5e2badf318","3dd877835c04fde3f2d14ce96f23a1c00002fefa9d731e8c4ce3b656aac90063","7e0d097412ca8c3acdbaaa7c1f79c42cda3a4e50b52c0a8b34d6c75cc764ce42","66aac2857eee73b1f5f715214bb50a03c0dc052d4bb3e64d6b0b492f2c85f374","a97ff41736299857a3cae7c1917456eef5e0fcc703d0a1e475d0b9cfe42452c7","7a682be245a2e51f473ee1c60d537e57423ab2c3d9ae990445cdb6e43aeb5c76","ce6a7af556090b3ff762e27058be2327e6c5188d6ed54703d794089f577fd20c","b0b24ff78ab1c4322764bcb332254069504b168cb8aaca469bdf1d37f313d4d3","c2054617b8dcb619749c0402dc31eeb473386b3829f17176bc27b1447a8b6d92","60125159523c356d711ffa1076211359906e6283e25f75f4cf0f9dc8da6bf7b0","1ff6ee23b4cd9ac90ee569067b9e649c76dafac234761706724ae0c1943e4a75","d51f81ee026df39447143b67eaf16326c30e0c9477c0d50507f1fbfffe53abd6","e6bcdf375649a7cbf092fcab65a24d832d8725d833e422e28dfa634498b00928","f2ff4cbcd6d015af20e4e858b0f216c077ec6d146d3b2e0cbe68b56b3db7a0be")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("5a741df3e4a61b8632f62109a65afc0f297f4ed03cd7e208ffd2ea5e2badf318","3dd877835c04fde3f2d14ce96f23a1c00002fefa9d731e8c4ce3b656aac90063","7e0d097412ca8c3acdbaaa7c1f79c42cda3a4e50b52c0a8b34d6c75cc764ce42","66aac2857eee73b1f5f715214bb50a03c0dc052d4bb3e64d6b0b492f2c85f374","a97ff41736299857a3cae7c1917456eef5e0fcc703d0a1e475d0b9cfe42452c7","7a682be245a2e51f473ee1c60d537e57423ab2c3d9ae990445cdb6e43aeb5c76","ce6a7af556090b3ff762e27058be2327e6c5188d6ed54703d794089f577fd20c","b0b24ff78ab1c4322764bcb332254069504b168cb8aaca469bdf1d37f313d4d3","c2054617b8dcb619749c0402dc31eeb473386b3829f17176bc27b1447a8b6d92","60125159523c356d711ffa1076211359906e6283e25f75f4cf0f9dc8da6bf7b0","1ff6ee23b4cd9ac90ee569067b9e649c76dafac234761706724ae0c1943e4a75","d51f81ee026df39447143b67eaf16326c30e0c9477c0d50507f1fbfffe53abd6","e6bcdf375649a7cbf092fcab65a24d832d8725d833e422e28dfa634498b00928","f2ff4cbcd6d015af20e4e858b0f216c077ec6d146d3b2e0cbe68b56b3db7a0be")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("5a741df3e4a61b8632f62109a65afc0f297f4ed03cd7e208ffd2ea5e2badf318","3dd877835c04fde3f2d14ce96f23a1c00002fefa9d731e8c4ce3b656aac90063","7e0d097412ca8c3acdbaaa7c1f79c42cda3a4e50b52c0a8b34d6c75cc764ce42","66aac2857eee73b1f5f715214bb50a03c0dc052d4bb3e64d6b0b492f2c85f374","a97ff41736299857a3cae7c1917456eef5e0fcc703d0a1e475d0b9cfe42452c7","7a682be245a2e51f473ee1c60d537e57423ab2c3d9ae990445cdb6e43aeb5c76","ce6a7af556090b3ff762e27058be2327e6c5188d6ed54703d794089f577fd20c","b0b24ff78ab1c4322764bcb332254069504b168cb8aaca469bdf1d37f313d4d3","c2054617b8dcb619749c0402dc31eeb473386b3829f17176bc27b1447a8b6d92","60125159523c356d711ffa1076211359906e6283e25f75f4cf0f9dc8da6bf7b0","1ff6ee23b4cd9ac90ee569067b9e649c76dafac234761706724ae0c1943e4a75","d51f81ee026df39447143b67eaf16326c30e0c9477c0d50507f1fbfffe53abd6","e6bcdf375649a7cbf092fcab65a24d832d8725d833e422e28dfa634498b00928","f2ff4cbcd6d015af20e4e858b0f216c077ec6d146d3b2e0cbe68b56b3db7a0be")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("5a741df3e4a61b8632f62109a65afc0f297f4ed03cd7e208ffd2ea5e2badf318","3dd877835c04fde3f2d14ce96f23a1c00002fefa9d731e8c4ce3b656aac90063","7e0d097412ca8c3acdbaaa7c1f79c42cda3a4e50b52c0a8b34d6c75cc764ce42","66aac2857eee73b1f5f715214bb50a03c0dc052d4bb3e64d6b0b492f2c85f374","a97ff41736299857a3cae7c1917456eef5e0fcc703d0a1e475d0b9cfe42452c7","7a682be245a2e51f473ee1c60d537e57423ab2c3d9ae990445cdb6e43aeb5c76","ce6a7af556090b3ff762e27058be2327e6c5188d6ed54703d794089f577fd20c","b0b24ff78ab1c4322764bcb332254069504b168cb8aaca469bdf1d37f313d4d3","c2054617b8dcb619749c0402dc31eeb473386b3829f17176bc27b1447a8b6d92","60125159523c356d711ffa1076211359906e6283e25f75f4cf0f9dc8da6bf7b0","1ff6ee23b4cd9ac90ee569067b9e649c76dafac234761706724ae0c1943e4a75","d51f81ee026df39447143b67eaf16326c30e0c9477c0d50507f1fbfffe53abd6","e6bcdf375649a7cbf092fcab65a24d832d8725d833e422e28dfa634498b00928","f2ff4cbcd6d015af20e4e858b0f216c077ec6d146d3b2e0cbe68b56b3db7a0be")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring64 NOT NULL AND customstring64 IN ("5a741df3e4a61b8632f62109a65afc0f297f4ed03cd7e208ffd2ea5e2badf318","3dd877835c04fde3f2d14ce96f23a1c00002fefa9d731e8c4ce3b656aac90063","7e0d097412ca8c3acdbaaa7c1f79c42cda3a4e50b52c0a8b34d6c75cc764ce42","66aac2857eee73b1f5f715214bb50a03c0dc052d4bb3e64d6b0b492f2c85f374","a97ff41736299857a3cae7c1917456eef5e0fcc703d0a1e475d0b9cfe42452c7","7a682be245a2e51f473ee1c60d537e57423ab2c3d9ae990445cdb6e43aeb5c76","ce6a7af556090b3ff762e27058be2327e6c5188d6ed54703d794089f577fd20c","b0b24ff78ab1c4322764bcb332254069504b168cb8aaca469bdf1d37f313d4d3","c2054617b8dcb619749c0402dc31eeb473386b3829f17176bc27b1447a8b6d92","60125159523c356d711ffa1076211359906e6283e25f75f4cf0f9dc8da6bf7b0","1ff6ee23b4cd9ac90ee569067b9e649c76dafac234761706724ae0c1943e4a75","d51f81ee026df39447143b67eaf16326c30e0c9477c0d50507f1fbfffe53abd6","e6bcdf375649a7cbf092fcab65a24d832d8725d833e422e28dfa634498b00928","f2ff4cbcd6d015af20e4e858b0f216c077ec6d146d3b2e0cbe68b56b3db7a0be")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("5a741df3e4a61b8632f62109a65afc0f297f4ed03cd7e208ffd2ea5e2badf318","3dd877835c04fde3f2d14ce96f23a1c00002fefa9d731e8c4ce3b656aac90063","7e0d097412ca8c3acdbaaa7c1f79c42cda3a4e50b52c0a8b34d6c75cc764ce42","66aac2857eee73b1f5f715214bb50a03c0dc052d4bb3e64d6b0b492f2c85f374","a97ff41736299857a3cae7c1917456eef5e0fcc703d0a1e475d0b9cfe42452c7","7a682be245a2e51f473ee1c60d537e57423ab2c3d9ae990445cdb6e43aeb5c76","ce6a7af556090b3ff762e27058be2327e6c5188d6ed54703d794089f577fd20c","b0b24ff78ab1c4322764bcb332254069504b168cb8aaca469bdf1d37f313d4d3","c2054617b8dcb619749c0402dc31eeb473386b3829f17176bc27b1447a8b6d92","60125159523c356d711ffa1076211359906e6283e25f75f4cf0f9dc8da6bf7b0","1ff6ee23b4cd9ac90ee569067b9e649c76dafac234761706724ae0c1943e4a75","d51f81ee026df39447143b67eaf16326c30e0c9477c0d50507f1fbfffe53abd6","e6bcdf375649a7cbf092fcab65a24d832d8725d833e422e28dfa634498b00928","f2ff4cbcd6d015af20e4e858b0f216c077ec6d146d3b2e0cbe68b56b3db7a0be")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("5a741df3e4a61b8632f62109a65afc0f297f4ed03cd7e208ffd2ea5e2badf318","3dd877835c04fde3f2d14ce96f23a1c00002fefa9d731e8c4ce3b656aac90063","7e0d097412ca8c3acdbaaa7c1f79c42cda3a4e50b52c0a8b34d6c75cc764ce42","66aac2857eee73b1f5f715214bb50a03c0dc052d4bb3e64d6b0b492f2c85f374","a97ff41736299857a3cae7c1917456eef5e0fcc703d0a1e475d0b9cfe42452c7","7a682be245a2e51f473ee1c60d537e57423ab2c3d9ae990445cdb6e43aeb5c76","ce6a7af556090b3ff762e27058be2327e6c5188d6ed54703d794089f577fd20c","b0b24ff78ab1c4322764bcb332254069504b168cb8aaca469bdf1d37f313d4d3","c2054617b8dcb619749c0402dc31eeb473386b3829f17176bc27b1447a8b6d92","60125159523c356d711ffa1076211359906e6283e25f75f4cf0f9dc8da6bf7b0","1ff6ee23b4cd9ac90ee569067b9e649c76dafac234761706724ae0c1943e4a75","d51f81ee026df39447143b67eaf16326c30e0c9477c0d50507f1fbfffe53abd6","e6bcdf375649a7cbf092fcab65a24d832d8725d833e422e28dfa634498b00928","f2ff4cbcd6d015af20e4e858b0f216c077ec6d146d3b2e0cbe68b56b3db7a0be")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("5a741df3e4a61b8632f62109a65afc0f297f4ed03cd7e208ffd2ea5e2badf318","3dd877835c04fde3f2d14ce96f23a1c00002fefa9d731e8c4ce3b656aac90063","7e0d097412ca8c3acdbaaa7c1f79c42cda3a4e50b52c0a8b34d6c75cc764ce42","66aac2857eee73b1f5f715214bb50a03c0dc052d4bb3e64d6b0b492f2c85f374","a97ff41736299857a3cae7c1917456eef5e0fcc703d0a1e475d0b9cfe42452c7","7a682be245a2e51f473ee1c60d537e57423ab2c3d9ae990445cdb6e43aeb5c76","ce6a7af556090b3ff762e27058be2327e6c5188d6ed54703d794089f577fd20c","b0b24ff78ab1c4322764bcb332254069504b168cb8aaca469bdf1d37f313d4d3","c2054617b8dcb619749c0402dc31eeb473386b3829f17176bc27b1447a8b6d92","60125159523c356d711ffa1076211359906e6283e25f75f4cf0f9dc8da6bf7b0","1ff6ee23b4cd9ac90ee569067b9e649c76dafac234761706724ae0c1943e4a75","d51f81ee026df39447143b67eaf16326c30e0c9477c0d50507f1fbfffe53abd6","e6bcdf375649a7cbf092fcab65a24d832d8725d833e422e28dfa634498b00928","f2ff4cbcd6d015af20e4e858b0f216c077ec6d146d3b2e0cbe68b56b3db7a0be")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring64 NOT NULL AND customstring64 IN ("5a741df3e4a61b8632f62109a65afc0f297f4ed03cd7e208ffd2ea5e2badf318","3dd877835c04fde3f2d14ce96f23a1c00002fefa9d731e8c4ce3b656aac90063","7e0d097412ca8c3acdbaaa7c1f79c42cda3a4e50b52c0a8b34d6c75cc764ce42","66aac2857eee73b1f5f715214bb50a03c0dc052d4bb3e64d6b0b492f2c85f374","a97ff41736299857a3cae7c1917456eef5e0fcc703d0a1e475d0b9cfe42452c7","7a682be245a2e51f473ee1c60d537e57423ab2c3d9ae990445cdb6e43aeb5c76","ce6a7af556090b3ff762e27058be2327e6c5188d6ed54703d794089f577fd20c","b0b24ff78ab1c4322764bcb332254069504b168cb8aaca469bdf1d37f313d4d3","c2054617b8dcb619749c0402dc31eeb473386b3829f17176bc27b1447a8b6d92","60125159523c356d711ffa1076211359906e6283e25f75f4cf0f9dc8da6bf7b0","1ff6ee23b4cd9ac90ee569067b9e649c76dafac234761706724ae0c1943e4a75","d51f81ee026df39447143b67eaf16326c30e0c9477c0d50507f1fbfffe53abd6","e6bcdf375649a7cbf092fcab65a24d832d8725d833e422e28dfa634498b00928","f2ff4cbcd6d015af20e4e858b0f216c077ec6d146d3b2e0cbe68b56b3db7a0be")
index=activity AND rg_functionality="O365 General" AND filehash NOT NULL AND filehash IN ("5a741df3e4a61b8632f62109a65afc0f297f4ed03cd7e208ffd2ea5e2badf318","3dd877835c04fde3f2d14ce96f23a1c00002fefa9d731e8c4ce3b656aac90063","7e0d097412ca8c3acdbaaa7c1f79c42cda3a4e50b52c0a8b34d6c75cc764ce42","66aac2857eee73b1f5f715214bb50a03c0dc052d4bb3e64d6b0b492f2c85f374","a97ff41736299857a3cae7c1917456eef5e0fcc703d0a1e475d0b9cfe42452c7","7a682be245a2e51f473ee1c60d537e57423ab2c3d9ae990445cdb6e43aeb5c76","ce6a7af556090b3ff762e27058be2327e6c5188d6ed54703d794089f577fd20c","b0b24ff78ab1c4322764bcb332254069504b168cb8aaca469bdf1d37f313d4d3","c2054617b8dcb619749c0402dc31eeb473386b3829f17176bc27b1447a8b6d92","60125159523c356d711ffa1076211359906e6283e25f75f4cf0f9dc8da6bf7b0","1ff6ee23b4cd9ac90ee569067b9e649c76dafac234761706724ae0c1943e4a75","d51f81ee026df39447143b67eaf16326c30e0c9477c0d50507f1fbfffe53abd6","e6bcdf375649a7cbf092fcab65a24d832d8725d833e422e28dfa634498b00928","f2ff4cbcd6d015af20e4e858b0f216c077ec6d146d3b2e0cbe68b56b3db7a0be")
index=activity AND rg_functionality="O365 General" AND oldfilehash NOT NULL AND oldfilehash IN ("5a741df3e4a61b8632f62109a65afc0f297f4ed03cd7e208ffd2ea5e2badf318","3dd877835c04fde3f2d14ce96f23a1c00002fefa9d731e8c4ce3b656aac90063","7e0d097412ca8c3acdbaaa7c1f79c42cda3a4e50b52c0a8b34d6c75cc764ce42","66aac2857eee73b1f5f715214bb50a03c0dc052d4bb3e64d6b0b492f2c85f374","a97ff41736299857a3cae7c1917456eef5e0fcc703d0a1e475d0b9cfe42452c7","7a682be245a2e51f473ee1c60d537e57423ab2c3d9ae990445cdb6e43aeb5c76","ce6a7af556090b3ff762e27058be2327e6c5188d6ed54703d794089f577fd20c","b0b24ff78ab1c4322764bcb332254069504b168cb8aaca469bdf1d37f313d4d3","c2054617b8dcb619749c0402dc31eeb473386b3829f17176bc27b1447a8b6d92","60125159523c356d711ffa1076211359906e6283e25f75f4cf0f9dc8da6bf7b0","1ff6ee23b4cd9ac90ee569067b9e649c76dafac234761706724ae0c1943e4a75","d51f81ee026df39447143b67eaf16326c30e0c9477c0d50507f1fbfffe53abd6","e6bcdf375649a7cbf092fcab65a24d832d8725d833e422e28dfa634498b00928","f2ff4cbcd6d015af20e4e858b0f216c077ec6d146d3b2e0cbe68b56b3db7a0be")
index=activity AND rg_functionality="O365 General" AND customstring3 NOT NULL AND customstring3 IN ("5a741df3e4a61b8632f62109a65afc0f297f4ed03cd7e208ffd2ea5e2badf318","3dd877835c04fde3f2d14ce96f23a1c00002fefa9d731e8c4ce3b656aac90063","7e0d097412ca8c3acdbaaa7c1f79c42cda3a4e50b52c0a8b34d6c75cc764ce42","66aac2857eee73b1f5f715214bb50a03c0dc052d4bb3e64d6b0b492f2c85f374","a97ff41736299857a3cae7c1917456eef5e0fcc703d0a1e475d0b9cfe42452c7","7a682be245a2e51f473ee1c60d537e57423ab2c3d9ae990445cdb6e43aeb5c76","ce6a7af556090b3ff762e27058be2327e6c5188d6ed54703d794089f577fd20c","b0b24ff78ab1c4322764bcb332254069504b168cb8aaca469bdf1d37f313d4d3","c2054617b8dcb619749c0402dc31eeb473386b3829f17176bc27b1447a8b6d92","60125159523c356d711ffa1076211359906e6283e25f75f4cf0f9dc8da6bf7b0","1ff6ee23b4cd9ac90ee569067b9e649c76dafac234761706724ae0c1943e4a75","d51f81ee026df39447143b67eaf16326c30e0c9477c0d50507f1fbfffe53abd6","e6bcdf375649a7cbf092fcab65a24d832d8725d833e422e28dfa634498b00928","f2ff4cbcd6d015af20e4e858b0f216c077ec6d146d3b2e0cbe68b56b3db7a0be")
index=activity AND rg_functionality="O365 General" AND customstring64 NOT NULL AND customstring64 IN ("5a741df3e4a61b8632f62109a65afc0f297f4ed03cd7e208ffd2ea5e2badf318","3dd877835c04fde3f2d14ce96f23a1c00002fefa9d731e8c4ce3b656aac90063","7e0d097412ca8c3acdbaaa7c1f79c42cda3a4e50b52c0a8b34d6c75cc764ce42","66aac2857eee73b1f5f715214bb50a03c0dc052d4bb3e64d6b0b492f2c85f374","a97ff41736299857a3cae7c1917456eef5e0fcc703d0a1e475d0b9cfe42452c7","7a682be245a2e51f473ee1c60d537e57423ab2c3d9ae990445cdb6e43aeb5c76","ce6a7af556090b3ff762e27058be2327e6c5188d6ed54703d794089f577fd20c","b0b24ff78ab1c4322764bcb332254069504b168cb8aaca469bdf1d37f313d4d3","c2054617b8dcb619749c0402dc31eeb473386b3829f17176bc27b1447a8b6d92","60125159523c356d711ffa1076211359906e6283e25f75f4cf0f9dc8da6bf7b0","1ff6ee23b4cd9ac90ee569067b9e649c76dafac234761706724ae0c1943e4a75","d51f81ee026df39447143b67eaf16326c30e0c9477c0d50507f1fbfffe53abd6","e6bcdf375649a7cbf092fcab65a24d832d8725d833e422e28dfa634498b00928","f2ff4cbcd6d015af20e4e858b0f216c077ec6d146d3b2e0cbe68b56b3db7a0be")
