index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("1e074d9dca6ef0edd24afb2d13ca4429def5fc5486cd4170c989ef60efd0bbb0","77962a384d251f0aa8e3008a88f206d6cb1f7401c759c4614e3bfe865e3e985c","44c54d9d0b8d4862ad7424c677a6645edb711a6d0f36d6e87d7bae7a2cb14d68","c9694483c9fc15b2649359dfbd8322f0f6dd7a0a7da75499e03dbc4de2b23cad","080f56cea7acfd9c20fc931e53ea1225eb6b00cf2f05a76943e6cf0770504c64","a583bdf46f901364ed8e60f6aadd2b31be12a27ffccecc962872bc73a9ffd46c","a364ec51aa9314f831bc498ddaf82738766ca83b51401f77dbd857ba4e32a53b","a6307aad70195369e7ca5575f1ab81c2fd82de2fe561179e38933f9da28c4850","c39184aeb42616d7bf6daaddb9792549eb354076b4559e5d85392ade2e41763e","719082b1e5c0d18cc0283e537215b53a864857ac936a0c7d3ddbaf7c7944cf79")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("1e074d9dca6ef0edd24afb2d13ca4429def5fc5486cd4170c989ef60efd0bbb0","77962a384d251f0aa8e3008a88f206d6cb1f7401c759c4614e3bfe865e3e985c","44c54d9d0b8d4862ad7424c677a6645edb711a6d0f36d6e87d7bae7a2cb14d68","c9694483c9fc15b2649359dfbd8322f0f6dd7a0a7da75499e03dbc4de2b23cad","080f56cea7acfd9c20fc931e53ea1225eb6b00cf2f05a76943e6cf0770504c64","a583bdf46f901364ed8e60f6aadd2b31be12a27ffccecc962872bc73a9ffd46c","a364ec51aa9314f831bc498ddaf82738766ca83b51401f77dbd857ba4e32a53b","a6307aad70195369e7ca5575f1ab81c2fd82de2fe561179e38933f9da28c4850","c39184aeb42616d7bf6daaddb9792549eb354076b4559e5d85392ade2e41763e","719082b1e5c0d18cc0283e537215b53a864857ac936a0c7d3ddbaf7c7944cf79")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("1e074d9dca6ef0edd24afb2d13ca4429def5fc5486cd4170c989ef60efd0bbb0","77962a384d251f0aa8e3008a88f206d6cb1f7401c759c4614e3bfe865e3e985c","44c54d9d0b8d4862ad7424c677a6645edb711a6d0f36d6e87d7bae7a2cb14d68","c9694483c9fc15b2649359dfbd8322f0f6dd7a0a7da75499e03dbc4de2b23cad","080f56cea7acfd9c20fc931e53ea1225eb6b00cf2f05a76943e6cf0770504c64","a583bdf46f901364ed8e60f6aadd2b31be12a27ffccecc962872bc73a9ffd46c","a364ec51aa9314f831bc498ddaf82738766ca83b51401f77dbd857ba4e32a53b","a6307aad70195369e7ca5575f1ab81c2fd82de2fe561179e38933f9da28c4850","c39184aeb42616d7bf6daaddb9792549eb354076b4559e5d85392ade2e41763e","719082b1e5c0d18cc0283e537215b53a864857ac936a0c7d3ddbaf7c7944cf79")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring64 NOT NULL AND customstring64 IN ("1e074d9dca6ef0edd24afb2d13ca4429def5fc5486cd4170c989ef60efd0bbb0","77962a384d251f0aa8e3008a88f206d6cb1f7401c759c4614e3bfe865e3e985c","44c54d9d0b8d4862ad7424c677a6645edb711a6d0f36d6e87d7bae7a2cb14d68","c9694483c9fc15b2649359dfbd8322f0f6dd7a0a7da75499e03dbc4de2b23cad","080f56cea7acfd9c20fc931e53ea1225eb6b00cf2f05a76943e6cf0770504c64","a583bdf46f901364ed8e60f6aadd2b31be12a27ffccecc962872bc73a9ffd46c","a364ec51aa9314f831bc498ddaf82738766ca83b51401f77dbd857ba4e32a53b","a6307aad70195369e7ca5575f1ab81c2fd82de2fe561179e38933f9da28c4850","c39184aeb42616d7bf6daaddb9792549eb354076b4559e5d85392ade2e41763e","719082b1e5c0d18cc0283e537215b53a864857ac936a0c7d3ddbaf7c7944cf79")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("1e074d9dca6ef0edd24afb2d13ca4429def5fc5486cd4170c989ef60efd0bbb0","77962a384d251f0aa8e3008a88f206d6cb1f7401c759c4614e3bfe865e3e985c","44c54d9d0b8d4862ad7424c677a6645edb711a6d0f36d6e87d7bae7a2cb14d68","c9694483c9fc15b2649359dfbd8322f0f6dd7a0a7da75499e03dbc4de2b23cad","080f56cea7acfd9c20fc931e53ea1225eb6b00cf2f05a76943e6cf0770504c64","a583bdf46f901364ed8e60f6aadd2b31be12a27ffccecc962872bc73a9ffd46c","a364ec51aa9314f831bc498ddaf82738766ca83b51401f77dbd857ba4e32a53b","a6307aad70195369e7ca5575f1ab81c2fd82de2fe561179e38933f9da28c4850","c39184aeb42616d7bf6daaddb9792549eb354076b4559e5d85392ade2e41763e","719082b1e5c0d18cc0283e537215b53a864857ac936a0c7d3ddbaf7c7944cf79")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("1e074d9dca6ef0edd24afb2d13ca4429def5fc5486cd4170c989ef60efd0bbb0","77962a384d251f0aa8e3008a88f206d6cb1f7401c759c4614e3bfe865e3e985c","44c54d9d0b8d4862ad7424c677a6645edb711a6d0f36d6e87d7bae7a2cb14d68","c9694483c9fc15b2649359dfbd8322f0f6dd7a0a7da75499e03dbc4de2b23cad","080f56cea7acfd9c20fc931e53ea1225eb6b00cf2f05a76943e6cf0770504c64","a583bdf46f901364ed8e60f6aadd2b31be12a27ffccecc962872bc73a9ffd46c","a364ec51aa9314f831bc498ddaf82738766ca83b51401f77dbd857ba4e32a53b","a6307aad70195369e7ca5575f1ab81c2fd82de2fe561179e38933f9da28c4850","c39184aeb42616d7bf6daaddb9792549eb354076b4559e5d85392ade2e41763e","719082b1e5c0d18cc0283e537215b53a864857ac936a0c7d3ddbaf7c7944cf79")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("1e074d9dca6ef0edd24afb2d13ca4429def5fc5486cd4170c989ef60efd0bbb0","77962a384d251f0aa8e3008a88f206d6cb1f7401c759c4614e3bfe865e3e985c","44c54d9d0b8d4862ad7424c677a6645edb711a6d0f36d6e87d7bae7a2cb14d68","c9694483c9fc15b2649359dfbd8322f0f6dd7a0a7da75499e03dbc4de2b23cad","080f56cea7acfd9c20fc931e53ea1225eb6b00cf2f05a76943e6cf0770504c64","a583bdf46f901364ed8e60f6aadd2b31be12a27ffccecc962872bc73a9ffd46c","a364ec51aa9314f831bc498ddaf82738766ca83b51401f77dbd857ba4e32a53b","a6307aad70195369e7ca5575f1ab81c2fd82de2fe561179e38933f9da28c4850","c39184aeb42616d7bf6daaddb9792549eb354076b4559e5d85392ade2e41763e","719082b1e5c0d18cc0283e537215b53a864857ac936a0c7d3ddbaf7c7944cf79")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("1e074d9dca6ef0edd24afb2d13ca4429def5fc5486cd4170c989ef60efd0bbb0","77962a384d251f0aa8e3008a88f206d6cb1f7401c759c4614e3bfe865e3e985c","44c54d9d0b8d4862ad7424c677a6645edb711a6d0f36d6e87d7bae7a2cb14d68","c9694483c9fc15b2649359dfbd8322f0f6dd7a0a7da75499e03dbc4de2b23cad","080f56cea7acfd9c20fc931e53ea1225eb6b00cf2f05a76943e6cf0770504c64","a583bdf46f901364ed8e60f6aadd2b31be12a27ffccecc962872bc73a9ffd46c","a364ec51aa9314f831bc498ddaf82738766ca83b51401f77dbd857ba4e32a53b","a6307aad70195369e7ca5575f1ab81c2fd82de2fe561179e38933f9da28c4850","c39184aeb42616d7bf6daaddb9792549eb354076b4559e5d85392ade2e41763e","719082b1e5c0d18cc0283e537215b53a864857ac936a0c7d3ddbaf7c7944cf79")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("1e074d9dca6ef0edd24afb2d13ca4429def5fc5486cd4170c989ef60efd0bbb0","77962a384d251f0aa8e3008a88f206d6cb1f7401c759c4614e3bfe865e3e985c","44c54d9d0b8d4862ad7424c677a6645edb711a6d0f36d6e87d7bae7a2cb14d68","c9694483c9fc15b2649359dfbd8322f0f6dd7a0a7da75499e03dbc4de2b23cad","080f56cea7acfd9c20fc931e53ea1225eb6b00cf2f05a76943e6cf0770504c64","a583bdf46f901364ed8e60f6aadd2b31be12a27ffccecc962872bc73a9ffd46c","a364ec51aa9314f831bc498ddaf82738766ca83b51401f77dbd857ba4e32a53b","a6307aad70195369e7ca5575f1ab81c2fd82de2fe561179e38933f9da28c4850","c39184aeb42616d7bf6daaddb9792549eb354076b4559e5d85392ade2e41763e","719082b1e5c0d18cc0283e537215b53a864857ac936a0c7d3ddbaf7c7944cf79")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("1e074d9dca6ef0edd24afb2d13ca4429def5fc5486cd4170c989ef60efd0bbb0","77962a384d251f0aa8e3008a88f206d6cb1f7401c759c4614e3bfe865e3e985c","44c54d9d0b8d4862ad7424c677a6645edb711a6d0f36d6e87d7bae7a2cb14d68","c9694483c9fc15b2649359dfbd8322f0f6dd7a0a7da75499e03dbc4de2b23cad","080f56cea7acfd9c20fc931e53ea1225eb6b00cf2f05a76943e6cf0770504c64","a583bdf46f901364ed8e60f6aadd2b31be12a27ffccecc962872bc73a9ffd46c","a364ec51aa9314f831bc498ddaf82738766ca83b51401f77dbd857ba4e32a53b","a6307aad70195369e7ca5575f1ab81c2fd82de2fe561179e38933f9da28c4850","c39184aeb42616d7bf6daaddb9792549eb354076b4559e5d85392ade2e41763e","719082b1e5c0d18cc0283e537215b53a864857ac936a0c7d3ddbaf7c7944cf79")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("1e074d9dca6ef0edd24afb2d13ca4429def5fc5486cd4170c989ef60efd0bbb0","77962a384d251f0aa8e3008a88f206d6cb1f7401c759c4614e3bfe865e3e985c","44c54d9d0b8d4862ad7424c677a6645edb711a6d0f36d6e87d7bae7a2cb14d68","c9694483c9fc15b2649359dfbd8322f0f6dd7a0a7da75499e03dbc4de2b23cad","080f56cea7acfd9c20fc931e53ea1225eb6b00cf2f05a76943e6cf0770504c64","a583bdf46f901364ed8e60f6aadd2b31be12a27ffccecc962872bc73a9ffd46c","a364ec51aa9314f831bc498ddaf82738766ca83b51401f77dbd857ba4e32a53b","a6307aad70195369e7ca5575f1ab81c2fd82de2fe561179e38933f9da28c4850","c39184aeb42616d7bf6daaddb9792549eb354076b4559e5d85392ade2e41763e","719082b1e5c0d18cc0283e537215b53a864857ac936a0c7d3ddbaf7c7944cf79")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("1e074d9dca6ef0edd24afb2d13ca4429def5fc5486cd4170c989ef60efd0bbb0","77962a384d251f0aa8e3008a88f206d6cb1f7401c759c4614e3bfe865e3e985c","44c54d9d0b8d4862ad7424c677a6645edb711a6d0f36d6e87d7bae7a2cb14d68","c9694483c9fc15b2649359dfbd8322f0f6dd7a0a7da75499e03dbc4de2b23cad","080f56cea7acfd9c20fc931e53ea1225eb6b00cf2f05a76943e6cf0770504c64","a583bdf46f901364ed8e60f6aadd2b31be12a27ffccecc962872bc73a9ffd46c","a364ec51aa9314f831bc498ddaf82738766ca83b51401f77dbd857ba4e32a53b","a6307aad70195369e7ca5575f1ab81c2fd82de2fe561179e38933f9da28c4850","c39184aeb42616d7bf6daaddb9792549eb354076b4559e5d85392ade2e41763e","719082b1e5c0d18cc0283e537215b53a864857ac936a0c7d3ddbaf7c7944cf79")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("1e074d9dca6ef0edd24afb2d13ca4429def5fc5486cd4170c989ef60efd0bbb0","77962a384d251f0aa8e3008a88f206d6cb1f7401c759c4614e3bfe865e3e985c","44c54d9d0b8d4862ad7424c677a6645edb711a6d0f36d6e87d7bae7a2cb14d68","c9694483c9fc15b2649359dfbd8322f0f6dd7a0a7da75499e03dbc4de2b23cad","080f56cea7acfd9c20fc931e53ea1225eb6b00cf2f05a76943e6cf0770504c64","a583bdf46f901364ed8e60f6aadd2b31be12a27ffccecc962872bc73a9ffd46c","a364ec51aa9314f831bc498ddaf82738766ca83b51401f77dbd857ba4e32a53b","a6307aad70195369e7ca5575f1ab81c2fd82de2fe561179e38933f9da28c4850","c39184aeb42616d7bf6daaddb9792549eb354076b4559e5d85392ade2e41763e","719082b1e5c0d18cc0283e537215b53a864857ac936a0c7d3ddbaf7c7944cf79")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("1e074d9dca6ef0edd24afb2d13ca4429def5fc5486cd4170c989ef60efd0bbb0","77962a384d251f0aa8e3008a88f206d6cb1f7401c759c4614e3bfe865e3e985c","44c54d9d0b8d4862ad7424c677a6645edb711a6d0f36d6e87d7bae7a2cb14d68","c9694483c9fc15b2649359dfbd8322f0f6dd7a0a7da75499e03dbc4de2b23cad","080f56cea7acfd9c20fc931e53ea1225eb6b00cf2f05a76943e6cf0770504c64","a583bdf46f901364ed8e60f6aadd2b31be12a27ffccecc962872bc73a9ffd46c","a364ec51aa9314f831bc498ddaf82738766ca83b51401f77dbd857ba4e32a53b","a6307aad70195369e7ca5575f1ab81c2fd82de2fe561179e38933f9da28c4850","c39184aeb42616d7bf6daaddb9792549eb354076b4559e5d85392ade2e41763e","719082b1e5c0d18cc0283e537215b53a864857ac936a0c7d3ddbaf7c7944cf79")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("1e074d9dca6ef0edd24afb2d13ca4429def5fc5486cd4170c989ef60efd0bbb0","77962a384d251f0aa8e3008a88f206d6cb1f7401c759c4614e3bfe865e3e985c","44c54d9d0b8d4862ad7424c677a6645edb711a6d0f36d6e87d7bae7a2cb14d68","c9694483c9fc15b2649359dfbd8322f0f6dd7a0a7da75499e03dbc4de2b23cad","080f56cea7acfd9c20fc931e53ea1225eb6b00cf2f05a76943e6cf0770504c64","a583bdf46f901364ed8e60f6aadd2b31be12a27ffccecc962872bc73a9ffd46c","a364ec51aa9314f831bc498ddaf82738766ca83b51401f77dbd857ba4e32a53b","a6307aad70195369e7ca5575f1ab81c2fd82de2fe561179e38933f9da28c4850","c39184aeb42616d7bf6daaddb9792549eb354076b4559e5d85392ade2e41763e","719082b1e5c0d18cc0283e537215b53a864857ac936a0c7d3ddbaf7c7944cf79")
index=activity AND rg_functionality="Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("1e074d9dca6ef0edd24afb2d13ca4429def5fc5486cd4170c989ef60efd0bbb0","77962a384d251f0aa8e3008a88f206d6cb1f7401c759c4614e3bfe865e3e985c","44c54d9d0b8d4862ad7424c677a6645edb711a6d0f36d6e87d7bae7a2cb14d68","c9694483c9fc15b2649359dfbd8322f0f6dd7a0a7da75499e03dbc4de2b23cad","080f56cea7acfd9c20fc931e53ea1225eb6b00cf2f05a76943e6cf0770504c64","a583bdf46f901364ed8e60f6aadd2b31be12a27ffccecc962872bc73a9ffd46c","a364ec51aa9314f831bc498ddaf82738766ca83b51401f77dbd857ba4e32a53b","a6307aad70195369e7ca5575f1ab81c2fd82de2fe561179e38933f9da28c4850","c39184aeb42616d7bf6daaddb9792549eb354076b4559e5d85392ade2e41763e","719082b1e5c0d18cc0283e537215b53a864857ac936a0c7d3ddbaf7c7944cf79")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("1e074d9dca6ef0edd24afb2d13ca4429def5fc5486cd4170c989ef60efd0bbb0","77962a384d251f0aa8e3008a88f206d6cb1f7401c759c4614e3bfe865e3e985c","44c54d9d0b8d4862ad7424c677a6645edb711a6d0f36d6e87d7bae7a2cb14d68","c9694483c9fc15b2649359dfbd8322f0f6dd7a0a7da75499e03dbc4de2b23cad","080f56cea7acfd9c20fc931e53ea1225eb6b00cf2f05a76943e6cf0770504c64","a583bdf46f901364ed8e60f6aadd2b31be12a27ffccecc962872bc73a9ffd46c","a364ec51aa9314f831bc498ddaf82738766ca83b51401f77dbd857ba4e32a53b","a6307aad70195369e7ca5575f1ab81c2fd82de2fe561179e38933f9da28c4850","c39184aeb42616d7bf6daaddb9792549eb354076b4559e5d85392ade2e41763e","719082b1e5c0d18cc0283e537215b53a864857ac936a0c7d3ddbaf7c7944cf79")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("1e074d9dca6ef0edd24afb2d13ca4429def5fc5486cd4170c989ef60efd0bbb0","77962a384d251f0aa8e3008a88f206d6cb1f7401c759c4614e3bfe865e3e985c","44c54d9d0b8d4862ad7424c677a6645edb711a6d0f36d6e87d7bae7a2cb14d68","c9694483c9fc15b2649359dfbd8322f0f6dd7a0a7da75499e03dbc4de2b23cad","080f56cea7acfd9c20fc931e53ea1225eb6b00cf2f05a76943e6cf0770504c64","a583bdf46f901364ed8e60f6aadd2b31be12a27ffccecc962872bc73a9ffd46c","a364ec51aa9314f831bc498ddaf82738766ca83b51401f77dbd857ba4e32a53b","a6307aad70195369e7ca5575f1ab81c2fd82de2fe561179e38933f9da28c4850","c39184aeb42616d7bf6daaddb9792549eb354076b4559e5d85392ade2e41763e","719082b1e5c0d18cc0283e537215b53a864857ac936a0c7d3ddbaf7c7944cf79")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("1e074d9dca6ef0edd24afb2d13ca4429def5fc5486cd4170c989ef60efd0bbb0","77962a384d251f0aa8e3008a88f206d6cb1f7401c759c4614e3bfe865e3e985c","44c54d9d0b8d4862ad7424c677a6645edb711a6d0f36d6e87d7bae7a2cb14d68","c9694483c9fc15b2649359dfbd8322f0f6dd7a0a7da75499e03dbc4de2b23cad","080f56cea7acfd9c20fc931e53ea1225eb6b00cf2f05a76943e6cf0770504c64","a583bdf46f901364ed8e60f6aadd2b31be12a27ffccecc962872bc73a9ffd46c","a364ec51aa9314f831bc498ddaf82738766ca83b51401f77dbd857ba4e32a53b","a6307aad70195369e7ca5575f1ab81c2fd82de2fe561179e38933f9da28c4850","c39184aeb42616d7bf6daaddb9792549eb354076b4559e5d85392ade2e41763e","719082b1e5c0d18cc0283e537215b53a864857ac936a0c7d3ddbaf7c7944cf79")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("1e074d9dca6ef0edd24afb2d13ca4429def5fc5486cd4170c989ef60efd0bbb0","77962a384d251f0aa8e3008a88f206d6cb1f7401c759c4614e3bfe865e3e985c","44c54d9d0b8d4862ad7424c677a6645edb711a6d0f36d6e87d7bae7a2cb14d68","c9694483c9fc15b2649359dfbd8322f0f6dd7a0a7da75499e03dbc4de2b23cad","080f56cea7acfd9c20fc931e53ea1225eb6b00cf2f05a76943e6cf0770504c64","a583bdf46f901364ed8e60f6aadd2b31be12a27ffccecc962872bc73a9ffd46c","a364ec51aa9314f831bc498ddaf82738766ca83b51401f77dbd857ba4e32a53b","a6307aad70195369e7ca5575f1ab81c2fd82de2fe561179e38933f9da28c4850","c39184aeb42616d7bf6daaddb9792549eb354076b4559e5d85392ade2e41763e","719082b1e5c0d18cc0283e537215b53a864857ac936a0c7d3ddbaf7c7944cf79")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("1e074d9dca6ef0edd24afb2d13ca4429def5fc5486cd4170c989ef60efd0bbb0","77962a384d251f0aa8e3008a88f206d6cb1f7401c759c4614e3bfe865e3e985c","44c54d9d0b8d4862ad7424c677a6645edb711a6d0f36d6e87d7bae7a2cb14d68","c9694483c9fc15b2649359dfbd8322f0f6dd7a0a7da75499e03dbc4de2b23cad","080f56cea7acfd9c20fc931e53ea1225eb6b00cf2f05a76943e6cf0770504c64","a583bdf46f901364ed8e60f6aadd2b31be12a27ffccecc962872bc73a9ffd46c","a364ec51aa9314f831bc498ddaf82738766ca83b51401f77dbd857ba4e32a53b","a6307aad70195369e7ca5575f1ab81c2fd82de2fe561179e38933f9da28c4850","c39184aeb42616d7bf6daaddb9792549eb354076b4559e5d85392ade2e41763e","719082b1e5c0d18cc0283e537215b53a864857ac936a0c7d3ddbaf7c7944cf79")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("1e074d9dca6ef0edd24afb2d13ca4429def5fc5486cd4170c989ef60efd0bbb0","77962a384d251f0aa8e3008a88f206d6cb1f7401c759c4614e3bfe865e3e985c","44c54d9d0b8d4862ad7424c677a6645edb711a6d0f36d6e87d7bae7a2cb14d68","c9694483c9fc15b2649359dfbd8322f0f6dd7a0a7da75499e03dbc4de2b23cad","080f56cea7acfd9c20fc931e53ea1225eb6b00cf2f05a76943e6cf0770504c64","a583bdf46f901364ed8e60f6aadd2b31be12a27ffccecc962872bc73a9ffd46c","a364ec51aa9314f831bc498ddaf82738766ca83b51401f77dbd857ba4e32a53b","a6307aad70195369e7ca5575f1ab81c2fd82de2fe561179e38933f9da28c4850","c39184aeb42616d7bf6daaddb9792549eb354076b4559e5d85392ade2e41763e","719082b1e5c0d18cc0283e537215b53a864857ac936a0c7d3ddbaf7c7944cf79")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("1e074d9dca6ef0edd24afb2d13ca4429def5fc5486cd4170c989ef60efd0bbb0","77962a384d251f0aa8e3008a88f206d6cb1f7401c759c4614e3bfe865e3e985c","44c54d9d0b8d4862ad7424c677a6645edb711a6d0f36d6e87d7bae7a2cb14d68","c9694483c9fc15b2649359dfbd8322f0f6dd7a0a7da75499e03dbc4de2b23cad","080f56cea7acfd9c20fc931e53ea1225eb6b00cf2f05a76943e6cf0770504c64","a583bdf46f901364ed8e60f6aadd2b31be12a27ffccecc962872bc73a9ffd46c","a364ec51aa9314f831bc498ddaf82738766ca83b51401f77dbd857ba4e32a53b","a6307aad70195369e7ca5575f1ab81c2fd82de2fe561179e38933f9da28c4850","c39184aeb42616d7bf6daaddb9792549eb354076b4559e5d85392ade2e41763e","719082b1e5c0d18cc0283e537215b53a864857ac936a0c7d3ddbaf7c7944cf79")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring64 NOT NULL AND customstring64 IN ("1e074d9dca6ef0edd24afb2d13ca4429def5fc5486cd4170c989ef60efd0bbb0","77962a384d251f0aa8e3008a88f206d6cb1f7401c759c4614e3bfe865e3e985c","44c54d9d0b8d4862ad7424c677a6645edb711a6d0f36d6e87d7bae7a2cb14d68","c9694483c9fc15b2649359dfbd8322f0f6dd7a0a7da75499e03dbc4de2b23cad","080f56cea7acfd9c20fc931e53ea1225eb6b00cf2f05a76943e6cf0770504c64","a583bdf46f901364ed8e60f6aadd2b31be12a27ffccecc962872bc73a9ffd46c","a364ec51aa9314f831bc498ddaf82738766ca83b51401f77dbd857ba4e32a53b","a6307aad70195369e7ca5575f1ab81c2fd82de2fe561179e38933f9da28c4850","c39184aeb42616d7bf6daaddb9792549eb354076b4559e5d85392ade2e41763e","719082b1e5c0d18cc0283e537215b53a864857ac936a0c7d3ddbaf7c7944cf79")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("1e074d9dca6ef0edd24afb2d13ca4429def5fc5486cd4170c989ef60efd0bbb0","77962a384d251f0aa8e3008a88f206d6cb1f7401c759c4614e3bfe865e3e985c","44c54d9d0b8d4862ad7424c677a6645edb711a6d0f36d6e87d7bae7a2cb14d68","c9694483c9fc15b2649359dfbd8322f0f6dd7a0a7da75499e03dbc4de2b23cad","080f56cea7acfd9c20fc931e53ea1225eb6b00cf2f05a76943e6cf0770504c64","a583bdf46f901364ed8e60f6aadd2b31be12a27ffccecc962872bc73a9ffd46c","a364ec51aa9314f831bc498ddaf82738766ca83b51401f77dbd857ba4e32a53b","a6307aad70195369e7ca5575f1ab81c2fd82de2fe561179e38933f9da28c4850","c39184aeb42616d7bf6daaddb9792549eb354076b4559e5d85392ade2e41763e","719082b1e5c0d18cc0283e537215b53a864857ac936a0c7d3ddbaf7c7944cf79")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("1e074d9dca6ef0edd24afb2d13ca4429def5fc5486cd4170c989ef60efd0bbb0","77962a384d251f0aa8e3008a88f206d6cb1f7401c759c4614e3bfe865e3e985c","44c54d9d0b8d4862ad7424c677a6645edb711a6d0f36d6e87d7bae7a2cb14d68","c9694483c9fc15b2649359dfbd8322f0f6dd7a0a7da75499e03dbc4de2b23cad","080f56cea7acfd9c20fc931e53ea1225eb6b00cf2f05a76943e6cf0770504c64","a583bdf46f901364ed8e60f6aadd2b31be12a27ffccecc962872bc73a9ffd46c","a364ec51aa9314f831bc498ddaf82738766ca83b51401f77dbd857ba4e32a53b","a6307aad70195369e7ca5575f1ab81c2fd82de2fe561179e38933f9da28c4850","c39184aeb42616d7bf6daaddb9792549eb354076b4559e5d85392ade2e41763e","719082b1e5c0d18cc0283e537215b53a864857ac936a0c7d3ddbaf7c7944cf79")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("1e074d9dca6ef0edd24afb2d13ca4429def5fc5486cd4170c989ef60efd0bbb0","77962a384d251f0aa8e3008a88f206d6cb1f7401c759c4614e3bfe865e3e985c","44c54d9d0b8d4862ad7424c677a6645edb711a6d0f36d6e87d7bae7a2cb14d68","c9694483c9fc15b2649359dfbd8322f0f6dd7a0a7da75499e03dbc4de2b23cad","080f56cea7acfd9c20fc931e53ea1225eb6b00cf2f05a76943e6cf0770504c64","a583bdf46f901364ed8e60f6aadd2b31be12a27ffccecc962872bc73a9ffd46c","a364ec51aa9314f831bc498ddaf82738766ca83b51401f77dbd857ba4e32a53b","a6307aad70195369e7ca5575f1ab81c2fd82de2fe561179e38933f9da28c4850","c39184aeb42616d7bf6daaddb9792549eb354076b4559e5d85392ade2e41763e","719082b1e5c0d18cc0283e537215b53a864857ac936a0c7d3ddbaf7c7944cf79")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring64 NOT NULL AND customstring64 IN ("1e074d9dca6ef0edd24afb2d13ca4429def5fc5486cd4170c989ef60efd0bbb0","77962a384d251f0aa8e3008a88f206d6cb1f7401c759c4614e3bfe865e3e985c","44c54d9d0b8d4862ad7424c677a6645edb711a6d0f36d6e87d7bae7a2cb14d68","c9694483c9fc15b2649359dfbd8322f0f6dd7a0a7da75499e03dbc4de2b23cad","080f56cea7acfd9c20fc931e53ea1225eb6b00cf2f05a76943e6cf0770504c64","a583bdf46f901364ed8e60f6aadd2b31be12a27ffccecc962872bc73a9ffd46c","a364ec51aa9314f831bc498ddaf82738766ca83b51401f77dbd857ba4e32a53b","a6307aad70195369e7ca5575f1ab81c2fd82de2fe561179e38933f9da28c4850","c39184aeb42616d7bf6daaddb9792549eb354076b4559e5d85392ade2e41763e","719082b1e5c0d18cc0283e537215b53a864857ac936a0c7d3ddbaf7c7944cf79")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("1e074d9dca6ef0edd24afb2d13ca4429def5fc5486cd4170c989ef60efd0bbb0","77962a384d251f0aa8e3008a88f206d6cb1f7401c759c4614e3bfe865e3e985c","44c54d9d0b8d4862ad7424c677a6645edb711a6d0f36d6e87d7bae7a2cb14d68","c9694483c9fc15b2649359dfbd8322f0f6dd7a0a7da75499e03dbc4de2b23cad","080f56cea7acfd9c20fc931e53ea1225eb6b00cf2f05a76943e6cf0770504c64","a583bdf46f901364ed8e60f6aadd2b31be12a27ffccecc962872bc73a9ffd46c","a364ec51aa9314f831bc498ddaf82738766ca83b51401f77dbd857ba4e32a53b","a6307aad70195369e7ca5575f1ab81c2fd82de2fe561179e38933f9da28c4850","c39184aeb42616d7bf6daaddb9792549eb354076b4559e5d85392ade2e41763e","719082b1e5c0d18cc0283e537215b53a864857ac936a0c7d3ddbaf7c7944cf79")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("1e074d9dca6ef0edd24afb2d13ca4429def5fc5486cd4170c989ef60efd0bbb0","77962a384d251f0aa8e3008a88f206d6cb1f7401c759c4614e3bfe865e3e985c","44c54d9d0b8d4862ad7424c677a6645edb711a6d0f36d6e87d7bae7a2cb14d68","c9694483c9fc15b2649359dfbd8322f0f6dd7a0a7da75499e03dbc4de2b23cad","080f56cea7acfd9c20fc931e53ea1225eb6b00cf2f05a76943e6cf0770504c64","a583bdf46f901364ed8e60f6aadd2b31be12a27ffccecc962872bc73a9ffd46c","a364ec51aa9314f831bc498ddaf82738766ca83b51401f77dbd857ba4e32a53b","a6307aad70195369e7ca5575f1ab81c2fd82de2fe561179e38933f9da28c4850","c39184aeb42616d7bf6daaddb9792549eb354076b4559e5d85392ade2e41763e","719082b1e5c0d18cc0283e537215b53a864857ac936a0c7d3ddbaf7c7944cf79")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("1e074d9dca6ef0edd24afb2d13ca4429def5fc5486cd4170c989ef60efd0bbb0","77962a384d251f0aa8e3008a88f206d6cb1f7401c759c4614e3bfe865e3e985c","44c54d9d0b8d4862ad7424c677a6645edb711a6d0f36d6e87d7bae7a2cb14d68","c9694483c9fc15b2649359dfbd8322f0f6dd7a0a7da75499e03dbc4de2b23cad","080f56cea7acfd9c20fc931e53ea1225eb6b00cf2f05a76943e6cf0770504c64","a583bdf46f901364ed8e60f6aadd2b31be12a27ffccecc962872bc73a9ffd46c","a364ec51aa9314f831bc498ddaf82738766ca83b51401f77dbd857ba4e32a53b","a6307aad70195369e7ca5575f1ab81c2fd82de2fe561179e38933f9da28c4850","c39184aeb42616d7bf6daaddb9792549eb354076b4559e5d85392ade2e41763e","719082b1e5c0d18cc0283e537215b53a864857ac936a0c7d3ddbaf7c7944cf79")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring64 NOT NULL AND customstring64 IN ("1e074d9dca6ef0edd24afb2d13ca4429def5fc5486cd4170c989ef60efd0bbb0","77962a384d251f0aa8e3008a88f206d6cb1f7401c759c4614e3bfe865e3e985c","44c54d9d0b8d4862ad7424c677a6645edb711a6d0f36d6e87d7bae7a2cb14d68","c9694483c9fc15b2649359dfbd8322f0f6dd7a0a7da75499e03dbc4de2b23cad","080f56cea7acfd9c20fc931e53ea1225eb6b00cf2f05a76943e6cf0770504c64","a583bdf46f901364ed8e60f6aadd2b31be12a27ffccecc962872bc73a9ffd46c","a364ec51aa9314f831bc498ddaf82738766ca83b51401f77dbd857ba4e32a53b","a6307aad70195369e7ca5575f1ab81c2fd82de2fe561179e38933f9da28c4850","c39184aeb42616d7bf6daaddb9792549eb354076b4559e5d85392ade2e41763e","719082b1e5c0d18cc0283e537215b53a864857ac936a0c7d3ddbaf7c7944cf79")
index=activity AND rg_functionality="O365 General" AND filehash NOT NULL AND filehash IN ("1e074d9dca6ef0edd24afb2d13ca4429def5fc5486cd4170c989ef60efd0bbb0","77962a384d251f0aa8e3008a88f206d6cb1f7401c759c4614e3bfe865e3e985c","44c54d9d0b8d4862ad7424c677a6645edb711a6d0f36d6e87d7bae7a2cb14d68","c9694483c9fc15b2649359dfbd8322f0f6dd7a0a7da75499e03dbc4de2b23cad","080f56cea7acfd9c20fc931e53ea1225eb6b00cf2f05a76943e6cf0770504c64","a583bdf46f901364ed8e60f6aadd2b31be12a27ffccecc962872bc73a9ffd46c","a364ec51aa9314f831bc498ddaf82738766ca83b51401f77dbd857ba4e32a53b","a6307aad70195369e7ca5575f1ab81c2fd82de2fe561179e38933f9da28c4850","c39184aeb42616d7bf6daaddb9792549eb354076b4559e5d85392ade2e41763e","719082b1e5c0d18cc0283e537215b53a864857ac936a0c7d3ddbaf7c7944cf79")
index=activity AND rg_functionality="O365 General" AND oldfilehash NOT NULL AND oldfilehash IN ("1e074d9dca6ef0edd24afb2d13ca4429def5fc5486cd4170c989ef60efd0bbb0","77962a384d251f0aa8e3008a88f206d6cb1f7401c759c4614e3bfe865e3e985c","44c54d9d0b8d4862ad7424c677a6645edb711a6d0f36d6e87d7bae7a2cb14d68","c9694483c9fc15b2649359dfbd8322f0f6dd7a0a7da75499e03dbc4de2b23cad","080f56cea7acfd9c20fc931e53ea1225eb6b00cf2f05a76943e6cf0770504c64","a583bdf46f901364ed8e60f6aadd2b31be12a27ffccecc962872bc73a9ffd46c","a364ec51aa9314f831bc498ddaf82738766ca83b51401f77dbd857ba4e32a53b","a6307aad70195369e7ca5575f1ab81c2fd82de2fe561179e38933f9da28c4850","c39184aeb42616d7bf6daaddb9792549eb354076b4559e5d85392ade2e41763e","719082b1e5c0d18cc0283e537215b53a864857ac936a0c7d3ddbaf7c7944cf79")
index=activity AND rg_functionality="O365 General" AND customstring3 NOT NULL AND customstring3 IN ("1e074d9dca6ef0edd24afb2d13ca4429def5fc5486cd4170c989ef60efd0bbb0","77962a384d251f0aa8e3008a88f206d6cb1f7401c759c4614e3bfe865e3e985c","44c54d9d0b8d4862ad7424c677a6645edb711a6d0f36d6e87d7bae7a2cb14d68","c9694483c9fc15b2649359dfbd8322f0f6dd7a0a7da75499e03dbc4de2b23cad","080f56cea7acfd9c20fc931e53ea1225eb6b00cf2f05a76943e6cf0770504c64","a583bdf46f901364ed8e60f6aadd2b31be12a27ffccecc962872bc73a9ffd46c","a364ec51aa9314f831bc498ddaf82738766ca83b51401f77dbd857ba4e32a53b","a6307aad70195369e7ca5575f1ab81c2fd82de2fe561179e38933f9da28c4850","c39184aeb42616d7bf6daaddb9792549eb354076b4559e5d85392ade2e41763e","719082b1e5c0d18cc0283e537215b53a864857ac936a0c7d3ddbaf7c7944cf79")
index=activity AND rg_functionality="O365 General" AND customstring64 NOT NULL AND customstring64 IN ("1e074d9dca6ef0edd24afb2d13ca4429def5fc5486cd4170c989ef60efd0bbb0","77962a384d251f0aa8e3008a88f206d6cb1f7401c759c4614e3bfe865e3e985c","44c54d9d0b8d4862ad7424c677a6645edb711a6d0f36d6e87d7bae7a2cb14d68","c9694483c9fc15b2649359dfbd8322f0f6dd7a0a7da75499e03dbc4de2b23cad","080f56cea7acfd9c20fc931e53ea1225eb6b00cf2f05a76943e6cf0770504c64","a583bdf46f901364ed8e60f6aadd2b31be12a27ffccecc962872bc73a9ffd46c","a364ec51aa9314f831bc498ddaf82738766ca83b51401f77dbd857ba4e32a53b","a6307aad70195369e7ca5575f1ab81c2fd82de2fe561179e38933f9da28c4850","c39184aeb42616d7bf6daaddb9792549eb354076b4559e5d85392ade2e41763e","719082b1e5c0d18cc0283e537215b53a864857ac936a0c7d3ddbaf7c7944cf79")
