index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("0a88c3b4709287f70ca2549a29353a804681ca78","1c7df9b0023fb97000b71c7917556036a48657c5","f0f8f60429e3316c463f397e8e29e1cb2d925fc2","7a3fc280f79578414d71d70609fbdb49ec6ad648","70b743e60f952a1238a469f529e89b0eb71b5ef7","fa44028115912c95b5efb43218f3c7237d5c349f","5273b45c5eabe64edbd0b79f5d1b31e2e8582324","5e5274c7d931c1165aa592cdc3bfceb4649f1ff7","59aa9be378371183ed419a0b24c019ccf3da97ec","8591a7ee00fb1bb7cc5b0417479681290a51996e","82b99ad976429d0a6c545b64c520be4880e1e4b8","3eee78ede82f6319d094787f45afd9bfb600e971","2a96338bacce3bb687bdc274daad120f32668cf4","8a389afe1f85f83e340ca9dfc0005d904799d44c","944b69b5e225c7712604efc289e153210124505c","a942099338c946fc196c62e87942217bf07fc5b3","52fe3fd399ed15077106bae9ea475052fc8b4acc","57fd698ccb5cb4f90c014efc6754599e5b0fbe54","c0575af04850eb1911b000bf56e8d5e9362a61e4","7c3fd8ee5d660bbf43e423818c6a8c3231b03817","fa78e89ab95a0b49bc0663f7ab33aaf1a924c560","5748e11c87aeab3c19d13db899d3e2008be928ad")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("0a88c3b4709287f70ca2549a29353a804681ca78","1c7df9b0023fb97000b71c7917556036a48657c5","f0f8f60429e3316c463f397e8e29e1cb2d925fc2","7a3fc280f79578414d71d70609fbdb49ec6ad648","70b743e60f952a1238a469f529e89b0eb71b5ef7","fa44028115912c95b5efb43218f3c7237d5c349f","5273b45c5eabe64edbd0b79f5d1b31e2e8582324","5e5274c7d931c1165aa592cdc3bfceb4649f1ff7","59aa9be378371183ed419a0b24c019ccf3da97ec","8591a7ee00fb1bb7cc5b0417479681290a51996e","82b99ad976429d0a6c545b64c520be4880e1e4b8","3eee78ede82f6319d094787f45afd9bfb600e971","2a96338bacce3bb687bdc274daad120f32668cf4","8a389afe1f85f83e340ca9dfc0005d904799d44c","944b69b5e225c7712604efc289e153210124505c","a942099338c946fc196c62e87942217bf07fc5b3","52fe3fd399ed15077106bae9ea475052fc8b4acc","57fd698ccb5cb4f90c014efc6754599e5b0fbe54","c0575af04850eb1911b000bf56e8d5e9362a61e4","7c3fd8ee5d660bbf43e423818c6a8c3231b03817","fa78e89ab95a0b49bc0663f7ab33aaf1a924c560","5748e11c87aeab3c19d13db899d3e2008be928ad")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("0a88c3b4709287f70ca2549a29353a804681ca78","1c7df9b0023fb97000b71c7917556036a48657c5","f0f8f60429e3316c463f397e8e29e1cb2d925fc2","7a3fc280f79578414d71d70609fbdb49ec6ad648","70b743e60f952a1238a469f529e89b0eb71b5ef7","fa44028115912c95b5efb43218f3c7237d5c349f","5273b45c5eabe64edbd0b79f5d1b31e2e8582324","5e5274c7d931c1165aa592cdc3bfceb4649f1ff7","59aa9be378371183ed419a0b24c019ccf3da97ec","8591a7ee00fb1bb7cc5b0417479681290a51996e","82b99ad976429d0a6c545b64c520be4880e1e4b8","3eee78ede82f6319d094787f45afd9bfb600e971","2a96338bacce3bb687bdc274daad120f32668cf4","8a389afe1f85f83e340ca9dfc0005d904799d44c","944b69b5e225c7712604efc289e153210124505c","a942099338c946fc196c62e87942217bf07fc5b3","52fe3fd399ed15077106bae9ea475052fc8b4acc","57fd698ccb5cb4f90c014efc6754599e5b0fbe54","c0575af04850eb1911b000bf56e8d5e9362a61e4","7c3fd8ee5d660bbf43e423818c6a8c3231b03817","fa78e89ab95a0b49bc0663f7ab33aaf1a924c560","5748e11c87aeab3c19d13db899d3e2008be928ad")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring64 NOT NULL AND customstring64 IN ("0a88c3b4709287f70ca2549a29353a804681ca78","1c7df9b0023fb97000b71c7917556036a48657c5","f0f8f60429e3316c463f397e8e29e1cb2d925fc2","7a3fc280f79578414d71d70609fbdb49ec6ad648","70b743e60f952a1238a469f529e89b0eb71b5ef7","fa44028115912c95b5efb43218f3c7237d5c349f","5273b45c5eabe64edbd0b79f5d1b31e2e8582324","5e5274c7d931c1165aa592cdc3bfceb4649f1ff7","59aa9be378371183ed419a0b24c019ccf3da97ec","8591a7ee00fb1bb7cc5b0417479681290a51996e","82b99ad976429d0a6c545b64c520be4880e1e4b8","3eee78ede82f6319d094787f45afd9bfb600e971","2a96338bacce3bb687bdc274daad120f32668cf4","8a389afe1f85f83e340ca9dfc0005d904799d44c","944b69b5e225c7712604efc289e153210124505c","a942099338c946fc196c62e87942217bf07fc5b3","52fe3fd399ed15077106bae9ea475052fc8b4acc","57fd698ccb5cb4f90c014efc6754599e5b0fbe54","c0575af04850eb1911b000bf56e8d5e9362a61e4","7c3fd8ee5d660bbf43e423818c6a8c3231b03817","fa78e89ab95a0b49bc0663f7ab33aaf1a924c560","5748e11c87aeab3c19d13db899d3e2008be928ad")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("0a88c3b4709287f70ca2549a29353a804681ca78","1c7df9b0023fb97000b71c7917556036a48657c5","f0f8f60429e3316c463f397e8e29e1cb2d925fc2","7a3fc280f79578414d71d70609fbdb49ec6ad648","70b743e60f952a1238a469f529e89b0eb71b5ef7","fa44028115912c95b5efb43218f3c7237d5c349f","5273b45c5eabe64edbd0b79f5d1b31e2e8582324","5e5274c7d931c1165aa592cdc3bfceb4649f1ff7","59aa9be378371183ed419a0b24c019ccf3da97ec","8591a7ee00fb1bb7cc5b0417479681290a51996e","82b99ad976429d0a6c545b64c520be4880e1e4b8","3eee78ede82f6319d094787f45afd9bfb600e971","2a96338bacce3bb687bdc274daad120f32668cf4","8a389afe1f85f83e340ca9dfc0005d904799d44c","944b69b5e225c7712604efc289e153210124505c","a942099338c946fc196c62e87942217bf07fc5b3","52fe3fd399ed15077106bae9ea475052fc8b4acc","57fd698ccb5cb4f90c014efc6754599e5b0fbe54","c0575af04850eb1911b000bf56e8d5e9362a61e4","7c3fd8ee5d660bbf43e423818c6a8c3231b03817","fa78e89ab95a0b49bc0663f7ab33aaf1a924c560","5748e11c87aeab3c19d13db899d3e2008be928ad")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("0a88c3b4709287f70ca2549a29353a804681ca78","1c7df9b0023fb97000b71c7917556036a48657c5","f0f8f60429e3316c463f397e8e29e1cb2d925fc2","7a3fc280f79578414d71d70609fbdb49ec6ad648","70b743e60f952a1238a469f529e89b0eb71b5ef7","fa44028115912c95b5efb43218f3c7237d5c349f","5273b45c5eabe64edbd0b79f5d1b31e2e8582324","5e5274c7d931c1165aa592cdc3bfceb4649f1ff7","59aa9be378371183ed419a0b24c019ccf3da97ec","8591a7ee00fb1bb7cc5b0417479681290a51996e","82b99ad976429d0a6c545b64c520be4880e1e4b8","3eee78ede82f6319d094787f45afd9bfb600e971","2a96338bacce3bb687bdc274daad120f32668cf4","8a389afe1f85f83e340ca9dfc0005d904799d44c","944b69b5e225c7712604efc289e153210124505c","a942099338c946fc196c62e87942217bf07fc5b3","52fe3fd399ed15077106bae9ea475052fc8b4acc","57fd698ccb5cb4f90c014efc6754599e5b0fbe54","c0575af04850eb1911b000bf56e8d5e9362a61e4","7c3fd8ee5d660bbf43e423818c6a8c3231b03817","fa78e89ab95a0b49bc0663f7ab33aaf1a924c560","5748e11c87aeab3c19d13db899d3e2008be928ad")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("0a88c3b4709287f70ca2549a29353a804681ca78","1c7df9b0023fb97000b71c7917556036a48657c5","f0f8f60429e3316c463f397e8e29e1cb2d925fc2","7a3fc280f79578414d71d70609fbdb49ec6ad648","70b743e60f952a1238a469f529e89b0eb71b5ef7","fa44028115912c95b5efb43218f3c7237d5c349f","5273b45c5eabe64edbd0b79f5d1b31e2e8582324","5e5274c7d931c1165aa592cdc3bfceb4649f1ff7","59aa9be378371183ed419a0b24c019ccf3da97ec","8591a7ee00fb1bb7cc5b0417479681290a51996e","82b99ad976429d0a6c545b64c520be4880e1e4b8","3eee78ede82f6319d094787f45afd9bfb600e971","2a96338bacce3bb687bdc274daad120f32668cf4","8a389afe1f85f83e340ca9dfc0005d904799d44c","944b69b5e225c7712604efc289e153210124505c","a942099338c946fc196c62e87942217bf07fc5b3","52fe3fd399ed15077106bae9ea475052fc8b4acc","57fd698ccb5cb4f90c014efc6754599e5b0fbe54","c0575af04850eb1911b000bf56e8d5e9362a61e4","7c3fd8ee5d660bbf43e423818c6a8c3231b03817","fa78e89ab95a0b49bc0663f7ab33aaf1a924c560","5748e11c87aeab3c19d13db899d3e2008be928ad")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("0a88c3b4709287f70ca2549a29353a804681ca78","1c7df9b0023fb97000b71c7917556036a48657c5","f0f8f60429e3316c463f397e8e29e1cb2d925fc2","7a3fc280f79578414d71d70609fbdb49ec6ad648","70b743e60f952a1238a469f529e89b0eb71b5ef7","fa44028115912c95b5efb43218f3c7237d5c349f","5273b45c5eabe64edbd0b79f5d1b31e2e8582324","5e5274c7d931c1165aa592cdc3bfceb4649f1ff7","59aa9be378371183ed419a0b24c019ccf3da97ec","8591a7ee00fb1bb7cc5b0417479681290a51996e","82b99ad976429d0a6c545b64c520be4880e1e4b8","3eee78ede82f6319d094787f45afd9bfb600e971","2a96338bacce3bb687bdc274daad120f32668cf4","8a389afe1f85f83e340ca9dfc0005d904799d44c","944b69b5e225c7712604efc289e153210124505c","a942099338c946fc196c62e87942217bf07fc5b3","52fe3fd399ed15077106bae9ea475052fc8b4acc","57fd698ccb5cb4f90c014efc6754599e5b0fbe54","c0575af04850eb1911b000bf56e8d5e9362a61e4","7c3fd8ee5d660bbf43e423818c6a8c3231b03817","fa78e89ab95a0b49bc0663f7ab33aaf1a924c560","5748e11c87aeab3c19d13db899d3e2008be928ad")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("0a88c3b4709287f70ca2549a29353a804681ca78","1c7df9b0023fb97000b71c7917556036a48657c5","f0f8f60429e3316c463f397e8e29e1cb2d925fc2","7a3fc280f79578414d71d70609fbdb49ec6ad648","70b743e60f952a1238a469f529e89b0eb71b5ef7","fa44028115912c95b5efb43218f3c7237d5c349f","5273b45c5eabe64edbd0b79f5d1b31e2e8582324","5e5274c7d931c1165aa592cdc3bfceb4649f1ff7","59aa9be378371183ed419a0b24c019ccf3da97ec","8591a7ee00fb1bb7cc5b0417479681290a51996e","82b99ad976429d0a6c545b64c520be4880e1e4b8","3eee78ede82f6319d094787f45afd9bfb600e971","2a96338bacce3bb687bdc274daad120f32668cf4","8a389afe1f85f83e340ca9dfc0005d904799d44c","944b69b5e225c7712604efc289e153210124505c","a942099338c946fc196c62e87942217bf07fc5b3","52fe3fd399ed15077106bae9ea475052fc8b4acc","57fd698ccb5cb4f90c014efc6754599e5b0fbe54","c0575af04850eb1911b000bf56e8d5e9362a61e4","7c3fd8ee5d660bbf43e423818c6a8c3231b03817","fa78e89ab95a0b49bc0663f7ab33aaf1a924c560","5748e11c87aeab3c19d13db899d3e2008be928ad")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("0a88c3b4709287f70ca2549a29353a804681ca78","1c7df9b0023fb97000b71c7917556036a48657c5","f0f8f60429e3316c463f397e8e29e1cb2d925fc2","7a3fc280f79578414d71d70609fbdb49ec6ad648","70b743e60f952a1238a469f529e89b0eb71b5ef7","fa44028115912c95b5efb43218f3c7237d5c349f","5273b45c5eabe64edbd0b79f5d1b31e2e8582324","5e5274c7d931c1165aa592cdc3bfceb4649f1ff7","59aa9be378371183ed419a0b24c019ccf3da97ec","8591a7ee00fb1bb7cc5b0417479681290a51996e","82b99ad976429d0a6c545b64c520be4880e1e4b8","3eee78ede82f6319d094787f45afd9bfb600e971","2a96338bacce3bb687bdc274daad120f32668cf4","8a389afe1f85f83e340ca9dfc0005d904799d44c","944b69b5e225c7712604efc289e153210124505c","a942099338c946fc196c62e87942217bf07fc5b3","52fe3fd399ed15077106bae9ea475052fc8b4acc","57fd698ccb5cb4f90c014efc6754599e5b0fbe54","c0575af04850eb1911b000bf56e8d5e9362a61e4","7c3fd8ee5d660bbf43e423818c6a8c3231b03817","fa78e89ab95a0b49bc0663f7ab33aaf1a924c560","5748e11c87aeab3c19d13db899d3e2008be928ad")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("0a88c3b4709287f70ca2549a29353a804681ca78","1c7df9b0023fb97000b71c7917556036a48657c5","f0f8f60429e3316c463f397e8e29e1cb2d925fc2","7a3fc280f79578414d71d70609fbdb49ec6ad648","70b743e60f952a1238a469f529e89b0eb71b5ef7","fa44028115912c95b5efb43218f3c7237d5c349f","5273b45c5eabe64edbd0b79f5d1b31e2e8582324","5e5274c7d931c1165aa592cdc3bfceb4649f1ff7","59aa9be378371183ed419a0b24c019ccf3da97ec","8591a7ee00fb1bb7cc5b0417479681290a51996e","82b99ad976429d0a6c545b64c520be4880e1e4b8","3eee78ede82f6319d094787f45afd9bfb600e971","2a96338bacce3bb687bdc274daad120f32668cf4","8a389afe1f85f83e340ca9dfc0005d904799d44c","944b69b5e225c7712604efc289e153210124505c","a942099338c946fc196c62e87942217bf07fc5b3","52fe3fd399ed15077106bae9ea475052fc8b4acc","57fd698ccb5cb4f90c014efc6754599e5b0fbe54","c0575af04850eb1911b000bf56e8d5e9362a61e4","7c3fd8ee5d660bbf43e423818c6a8c3231b03817","fa78e89ab95a0b49bc0663f7ab33aaf1a924c560","5748e11c87aeab3c19d13db899d3e2008be928ad")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("0a88c3b4709287f70ca2549a29353a804681ca78","1c7df9b0023fb97000b71c7917556036a48657c5","f0f8f60429e3316c463f397e8e29e1cb2d925fc2","7a3fc280f79578414d71d70609fbdb49ec6ad648","70b743e60f952a1238a469f529e89b0eb71b5ef7","fa44028115912c95b5efb43218f3c7237d5c349f","5273b45c5eabe64edbd0b79f5d1b31e2e8582324","5e5274c7d931c1165aa592cdc3bfceb4649f1ff7","59aa9be378371183ed419a0b24c019ccf3da97ec","8591a7ee00fb1bb7cc5b0417479681290a51996e","82b99ad976429d0a6c545b64c520be4880e1e4b8","3eee78ede82f6319d094787f45afd9bfb600e971","2a96338bacce3bb687bdc274daad120f32668cf4","8a389afe1f85f83e340ca9dfc0005d904799d44c","944b69b5e225c7712604efc289e153210124505c","a942099338c946fc196c62e87942217bf07fc5b3","52fe3fd399ed15077106bae9ea475052fc8b4acc","57fd698ccb5cb4f90c014efc6754599e5b0fbe54","c0575af04850eb1911b000bf56e8d5e9362a61e4","7c3fd8ee5d660bbf43e423818c6a8c3231b03817","fa78e89ab95a0b49bc0663f7ab33aaf1a924c560","5748e11c87aeab3c19d13db899d3e2008be928ad")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("0a88c3b4709287f70ca2549a29353a804681ca78","1c7df9b0023fb97000b71c7917556036a48657c5","f0f8f60429e3316c463f397e8e29e1cb2d925fc2","7a3fc280f79578414d71d70609fbdb49ec6ad648","70b743e60f952a1238a469f529e89b0eb71b5ef7","fa44028115912c95b5efb43218f3c7237d5c349f","5273b45c5eabe64edbd0b79f5d1b31e2e8582324","5e5274c7d931c1165aa592cdc3bfceb4649f1ff7","59aa9be378371183ed419a0b24c019ccf3da97ec","8591a7ee00fb1bb7cc5b0417479681290a51996e","82b99ad976429d0a6c545b64c520be4880e1e4b8","3eee78ede82f6319d094787f45afd9bfb600e971","2a96338bacce3bb687bdc274daad120f32668cf4","8a389afe1f85f83e340ca9dfc0005d904799d44c","944b69b5e225c7712604efc289e153210124505c","a942099338c946fc196c62e87942217bf07fc5b3","52fe3fd399ed15077106bae9ea475052fc8b4acc","57fd698ccb5cb4f90c014efc6754599e5b0fbe54","c0575af04850eb1911b000bf56e8d5e9362a61e4","7c3fd8ee5d660bbf43e423818c6a8c3231b03817","fa78e89ab95a0b49bc0663f7ab33aaf1a924c560","5748e11c87aeab3c19d13db899d3e2008be928ad")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("0a88c3b4709287f70ca2549a29353a804681ca78","1c7df9b0023fb97000b71c7917556036a48657c5","f0f8f60429e3316c463f397e8e29e1cb2d925fc2","7a3fc280f79578414d71d70609fbdb49ec6ad648","70b743e60f952a1238a469f529e89b0eb71b5ef7","fa44028115912c95b5efb43218f3c7237d5c349f","5273b45c5eabe64edbd0b79f5d1b31e2e8582324","5e5274c7d931c1165aa592cdc3bfceb4649f1ff7","59aa9be378371183ed419a0b24c019ccf3da97ec","8591a7ee00fb1bb7cc5b0417479681290a51996e","82b99ad976429d0a6c545b64c520be4880e1e4b8","3eee78ede82f6319d094787f45afd9bfb600e971","2a96338bacce3bb687bdc274daad120f32668cf4","8a389afe1f85f83e340ca9dfc0005d904799d44c","944b69b5e225c7712604efc289e153210124505c","a942099338c946fc196c62e87942217bf07fc5b3","52fe3fd399ed15077106bae9ea475052fc8b4acc","57fd698ccb5cb4f90c014efc6754599e5b0fbe54","c0575af04850eb1911b000bf56e8d5e9362a61e4","7c3fd8ee5d660bbf43e423818c6a8c3231b03817","fa78e89ab95a0b49bc0663f7ab33aaf1a924c560","5748e11c87aeab3c19d13db899d3e2008be928ad")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("0a88c3b4709287f70ca2549a29353a804681ca78","1c7df9b0023fb97000b71c7917556036a48657c5","f0f8f60429e3316c463f397e8e29e1cb2d925fc2","7a3fc280f79578414d71d70609fbdb49ec6ad648","70b743e60f952a1238a469f529e89b0eb71b5ef7","fa44028115912c95b5efb43218f3c7237d5c349f","5273b45c5eabe64edbd0b79f5d1b31e2e8582324","5e5274c7d931c1165aa592cdc3bfceb4649f1ff7","59aa9be378371183ed419a0b24c019ccf3da97ec","8591a7ee00fb1bb7cc5b0417479681290a51996e","82b99ad976429d0a6c545b64c520be4880e1e4b8","3eee78ede82f6319d094787f45afd9bfb600e971","2a96338bacce3bb687bdc274daad120f32668cf4","8a389afe1f85f83e340ca9dfc0005d904799d44c","944b69b5e225c7712604efc289e153210124505c","a942099338c946fc196c62e87942217bf07fc5b3","52fe3fd399ed15077106bae9ea475052fc8b4acc","57fd698ccb5cb4f90c014efc6754599e5b0fbe54","c0575af04850eb1911b000bf56e8d5e9362a61e4","7c3fd8ee5d660bbf43e423818c6a8c3231b03817","fa78e89ab95a0b49bc0663f7ab33aaf1a924c560","5748e11c87aeab3c19d13db899d3e2008be928ad")
index=activity AND rg_functionality="Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("0a88c3b4709287f70ca2549a29353a804681ca78","1c7df9b0023fb97000b71c7917556036a48657c5","f0f8f60429e3316c463f397e8e29e1cb2d925fc2","7a3fc280f79578414d71d70609fbdb49ec6ad648","70b743e60f952a1238a469f529e89b0eb71b5ef7","fa44028115912c95b5efb43218f3c7237d5c349f","5273b45c5eabe64edbd0b79f5d1b31e2e8582324","5e5274c7d931c1165aa592cdc3bfceb4649f1ff7","59aa9be378371183ed419a0b24c019ccf3da97ec","8591a7ee00fb1bb7cc5b0417479681290a51996e","82b99ad976429d0a6c545b64c520be4880e1e4b8","3eee78ede82f6319d094787f45afd9bfb600e971","2a96338bacce3bb687bdc274daad120f32668cf4","8a389afe1f85f83e340ca9dfc0005d904799d44c","944b69b5e225c7712604efc289e153210124505c","a942099338c946fc196c62e87942217bf07fc5b3","52fe3fd399ed15077106bae9ea475052fc8b4acc","57fd698ccb5cb4f90c014efc6754599e5b0fbe54","c0575af04850eb1911b000bf56e8d5e9362a61e4","7c3fd8ee5d660bbf43e423818c6a8c3231b03817","fa78e89ab95a0b49bc0663f7ab33aaf1a924c560","5748e11c87aeab3c19d13db899d3e2008be928ad")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("0a88c3b4709287f70ca2549a29353a804681ca78","1c7df9b0023fb97000b71c7917556036a48657c5","f0f8f60429e3316c463f397e8e29e1cb2d925fc2","7a3fc280f79578414d71d70609fbdb49ec6ad648","70b743e60f952a1238a469f529e89b0eb71b5ef7","fa44028115912c95b5efb43218f3c7237d5c349f","5273b45c5eabe64edbd0b79f5d1b31e2e8582324","5e5274c7d931c1165aa592cdc3bfceb4649f1ff7","59aa9be378371183ed419a0b24c019ccf3da97ec","8591a7ee00fb1bb7cc5b0417479681290a51996e","82b99ad976429d0a6c545b64c520be4880e1e4b8","3eee78ede82f6319d094787f45afd9bfb600e971","2a96338bacce3bb687bdc274daad120f32668cf4","8a389afe1f85f83e340ca9dfc0005d904799d44c","944b69b5e225c7712604efc289e153210124505c","a942099338c946fc196c62e87942217bf07fc5b3","52fe3fd399ed15077106bae9ea475052fc8b4acc","57fd698ccb5cb4f90c014efc6754599e5b0fbe54","c0575af04850eb1911b000bf56e8d5e9362a61e4","7c3fd8ee5d660bbf43e423818c6a8c3231b03817","fa78e89ab95a0b49bc0663f7ab33aaf1a924c560","5748e11c87aeab3c19d13db899d3e2008be928ad")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("0a88c3b4709287f70ca2549a29353a804681ca78","1c7df9b0023fb97000b71c7917556036a48657c5","f0f8f60429e3316c463f397e8e29e1cb2d925fc2","7a3fc280f79578414d71d70609fbdb49ec6ad648","70b743e60f952a1238a469f529e89b0eb71b5ef7","fa44028115912c95b5efb43218f3c7237d5c349f","5273b45c5eabe64edbd0b79f5d1b31e2e8582324","5e5274c7d931c1165aa592cdc3bfceb4649f1ff7","59aa9be378371183ed419a0b24c019ccf3da97ec","8591a7ee00fb1bb7cc5b0417479681290a51996e","82b99ad976429d0a6c545b64c520be4880e1e4b8","3eee78ede82f6319d094787f45afd9bfb600e971","2a96338bacce3bb687bdc274daad120f32668cf4","8a389afe1f85f83e340ca9dfc0005d904799d44c","944b69b5e225c7712604efc289e153210124505c","a942099338c946fc196c62e87942217bf07fc5b3","52fe3fd399ed15077106bae9ea475052fc8b4acc","57fd698ccb5cb4f90c014efc6754599e5b0fbe54","c0575af04850eb1911b000bf56e8d5e9362a61e4","7c3fd8ee5d660bbf43e423818c6a8c3231b03817","fa78e89ab95a0b49bc0663f7ab33aaf1a924c560","5748e11c87aeab3c19d13db899d3e2008be928ad")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("0a88c3b4709287f70ca2549a29353a804681ca78","1c7df9b0023fb97000b71c7917556036a48657c5","f0f8f60429e3316c463f397e8e29e1cb2d925fc2","7a3fc280f79578414d71d70609fbdb49ec6ad648","70b743e60f952a1238a469f529e89b0eb71b5ef7","fa44028115912c95b5efb43218f3c7237d5c349f","5273b45c5eabe64edbd0b79f5d1b31e2e8582324","5e5274c7d931c1165aa592cdc3bfceb4649f1ff7","59aa9be378371183ed419a0b24c019ccf3da97ec","8591a7ee00fb1bb7cc5b0417479681290a51996e","82b99ad976429d0a6c545b64c520be4880e1e4b8","3eee78ede82f6319d094787f45afd9bfb600e971","2a96338bacce3bb687bdc274daad120f32668cf4","8a389afe1f85f83e340ca9dfc0005d904799d44c","944b69b5e225c7712604efc289e153210124505c","a942099338c946fc196c62e87942217bf07fc5b3","52fe3fd399ed15077106bae9ea475052fc8b4acc","57fd698ccb5cb4f90c014efc6754599e5b0fbe54","c0575af04850eb1911b000bf56e8d5e9362a61e4","7c3fd8ee5d660bbf43e423818c6a8c3231b03817","fa78e89ab95a0b49bc0663f7ab33aaf1a924c560","5748e11c87aeab3c19d13db899d3e2008be928ad")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("0a88c3b4709287f70ca2549a29353a804681ca78","1c7df9b0023fb97000b71c7917556036a48657c5","f0f8f60429e3316c463f397e8e29e1cb2d925fc2","7a3fc280f79578414d71d70609fbdb49ec6ad648","70b743e60f952a1238a469f529e89b0eb71b5ef7","fa44028115912c95b5efb43218f3c7237d5c349f","5273b45c5eabe64edbd0b79f5d1b31e2e8582324","5e5274c7d931c1165aa592cdc3bfceb4649f1ff7","59aa9be378371183ed419a0b24c019ccf3da97ec","8591a7ee00fb1bb7cc5b0417479681290a51996e","82b99ad976429d0a6c545b64c520be4880e1e4b8","3eee78ede82f6319d094787f45afd9bfb600e971","2a96338bacce3bb687bdc274daad120f32668cf4","8a389afe1f85f83e340ca9dfc0005d904799d44c","944b69b5e225c7712604efc289e153210124505c","a942099338c946fc196c62e87942217bf07fc5b3","52fe3fd399ed15077106bae9ea475052fc8b4acc","57fd698ccb5cb4f90c014efc6754599e5b0fbe54","c0575af04850eb1911b000bf56e8d5e9362a61e4","7c3fd8ee5d660bbf43e423818c6a8c3231b03817","fa78e89ab95a0b49bc0663f7ab33aaf1a924c560","5748e11c87aeab3c19d13db899d3e2008be928ad")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("0a88c3b4709287f70ca2549a29353a804681ca78","1c7df9b0023fb97000b71c7917556036a48657c5","f0f8f60429e3316c463f397e8e29e1cb2d925fc2","7a3fc280f79578414d71d70609fbdb49ec6ad648","70b743e60f952a1238a469f529e89b0eb71b5ef7","fa44028115912c95b5efb43218f3c7237d5c349f","5273b45c5eabe64edbd0b79f5d1b31e2e8582324","5e5274c7d931c1165aa592cdc3bfceb4649f1ff7","59aa9be378371183ed419a0b24c019ccf3da97ec","8591a7ee00fb1bb7cc5b0417479681290a51996e","82b99ad976429d0a6c545b64c520be4880e1e4b8","3eee78ede82f6319d094787f45afd9bfb600e971","2a96338bacce3bb687bdc274daad120f32668cf4","8a389afe1f85f83e340ca9dfc0005d904799d44c","944b69b5e225c7712604efc289e153210124505c","a942099338c946fc196c62e87942217bf07fc5b3","52fe3fd399ed15077106bae9ea475052fc8b4acc","57fd698ccb5cb4f90c014efc6754599e5b0fbe54","c0575af04850eb1911b000bf56e8d5e9362a61e4","7c3fd8ee5d660bbf43e423818c6a8c3231b03817","fa78e89ab95a0b49bc0663f7ab33aaf1a924c560","5748e11c87aeab3c19d13db899d3e2008be928ad")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("0a88c3b4709287f70ca2549a29353a804681ca78","1c7df9b0023fb97000b71c7917556036a48657c5","f0f8f60429e3316c463f397e8e29e1cb2d925fc2","7a3fc280f79578414d71d70609fbdb49ec6ad648","70b743e60f952a1238a469f529e89b0eb71b5ef7","fa44028115912c95b5efb43218f3c7237d5c349f","5273b45c5eabe64edbd0b79f5d1b31e2e8582324","5e5274c7d931c1165aa592cdc3bfceb4649f1ff7","59aa9be378371183ed419a0b24c019ccf3da97ec","8591a7ee00fb1bb7cc5b0417479681290a51996e","82b99ad976429d0a6c545b64c520be4880e1e4b8","3eee78ede82f6319d094787f45afd9bfb600e971","2a96338bacce3bb687bdc274daad120f32668cf4","8a389afe1f85f83e340ca9dfc0005d904799d44c","944b69b5e225c7712604efc289e153210124505c","a942099338c946fc196c62e87942217bf07fc5b3","52fe3fd399ed15077106bae9ea475052fc8b4acc","57fd698ccb5cb4f90c014efc6754599e5b0fbe54","c0575af04850eb1911b000bf56e8d5e9362a61e4","7c3fd8ee5d660bbf43e423818c6a8c3231b03817","fa78e89ab95a0b49bc0663f7ab33aaf1a924c560","5748e11c87aeab3c19d13db899d3e2008be928ad")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("0a88c3b4709287f70ca2549a29353a804681ca78","1c7df9b0023fb97000b71c7917556036a48657c5","f0f8f60429e3316c463f397e8e29e1cb2d925fc2","7a3fc280f79578414d71d70609fbdb49ec6ad648","70b743e60f952a1238a469f529e89b0eb71b5ef7","fa44028115912c95b5efb43218f3c7237d5c349f","5273b45c5eabe64edbd0b79f5d1b31e2e8582324","5e5274c7d931c1165aa592cdc3bfceb4649f1ff7","59aa9be378371183ed419a0b24c019ccf3da97ec","8591a7ee00fb1bb7cc5b0417479681290a51996e","82b99ad976429d0a6c545b64c520be4880e1e4b8","3eee78ede82f6319d094787f45afd9bfb600e971","2a96338bacce3bb687bdc274daad120f32668cf4","8a389afe1f85f83e340ca9dfc0005d904799d44c","944b69b5e225c7712604efc289e153210124505c","a942099338c946fc196c62e87942217bf07fc5b3","52fe3fd399ed15077106bae9ea475052fc8b4acc","57fd698ccb5cb4f90c014efc6754599e5b0fbe54","c0575af04850eb1911b000bf56e8d5e9362a61e4","7c3fd8ee5d660bbf43e423818c6a8c3231b03817","fa78e89ab95a0b49bc0663f7ab33aaf1a924c560","5748e11c87aeab3c19d13db899d3e2008be928ad")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring64 NOT NULL AND customstring64 IN ("0a88c3b4709287f70ca2549a29353a804681ca78","1c7df9b0023fb97000b71c7917556036a48657c5","f0f8f60429e3316c463f397e8e29e1cb2d925fc2","7a3fc280f79578414d71d70609fbdb49ec6ad648","70b743e60f952a1238a469f529e89b0eb71b5ef7","fa44028115912c95b5efb43218f3c7237d5c349f","5273b45c5eabe64edbd0b79f5d1b31e2e8582324","5e5274c7d931c1165aa592cdc3bfceb4649f1ff7","59aa9be378371183ed419a0b24c019ccf3da97ec","8591a7ee00fb1bb7cc5b0417479681290a51996e","82b99ad976429d0a6c545b64c520be4880e1e4b8","3eee78ede82f6319d094787f45afd9bfb600e971","2a96338bacce3bb687bdc274daad120f32668cf4","8a389afe1f85f83e340ca9dfc0005d904799d44c","944b69b5e225c7712604efc289e153210124505c","a942099338c946fc196c62e87942217bf07fc5b3","52fe3fd399ed15077106bae9ea475052fc8b4acc","57fd698ccb5cb4f90c014efc6754599e5b0fbe54","c0575af04850eb1911b000bf56e8d5e9362a61e4","7c3fd8ee5d660bbf43e423818c6a8c3231b03817","fa78e89ab95a0b49bc0663f7ab33aaf1a924c560","5748e11c87aeab3c19d13db899d3e2008be928ad")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("0a88c3b4709287f70ca2549a29353a804681ca78","1c7df9b0023fb97000b71c7917556036a48657c5","f0f8f60429e3316c463f397e8e29e1cb2d925fc2","7a3fc280f79578414d71d70609fbdb49ec6ad648","70b743e60f952a1238a469f529e89b0eb71b5ef7","fa44028115912c95b5efb43218f3c7237d5c349f","5273b45c5eabe64edbd0b79f5d1b31e2e8582324","5e5274c7d931c1165aa592cdc3bfceb4649f1ff7","59aa9be378371183ed419a0b24c019ccf3da97ec","8591a7ee00fb1bb7cc5b0417479681290a51996e","82b99ad976429d0a6c545b64c520be4880e1e4b8","3eee78ede82f6319d094787f45afd9bfb600e971","2a96338bacce3bb687bdc274daad120f32668cf4","8a389afe1f85f83e340ca9dfc0005d904799d44c","944b69b5e225c7712604efc289e153210124505c","a942099338c946fc196c62e87942217bf07fc5b3","52fe3fd399ed15077106bae9ea475052fc8b4acc","57fd698ccb5cb4f90c014efc6754599e5b0fbe54","c0575af04850eb1911b000bf56e8d5e9362a61e4","7c3fd8ee5d660bbf43e423818c6a8c3231b03817","fa78e89ab95a0b49bc0663f7ab33aaf1a924c560","5748e11c87aeab3c19d13db899d3e2008be928ad")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("0a88c3b4709287f70ca2549a29353a804681ca78","1c7df9b0023fb97000b71c7917556036a48657c5","f0f8f60429e3316c463f397e8e29e1cb2d925fc2","7a3fc280f79578414d71d70609fbdb49ec6ad648","70b743e60f952a1238a469f529e89b0eb71b5ef7","fa44028115912c95b5efb43218f3c7237d5c349f","5273b45c5eabe64edbd0b79f5d1b31e2e8582324","5e5274c7d931c1165aa592cdc3bfceb4649f1ff7","59aa9be378371183ed419a0b24c019ccf3da97ec","8591a7ee00fb1bb7cc5b0417479681290a51996e","82b99ad976429d0a6c545b64c520be4880e1e4b8","3eee78ede82f6319d094787f45afd9bfb600e971","2a96338bacce3bb687bdc274daad120f32668cf4","8a389afe1f85f83e340ca9dfc0005d904799d44c","944b69b5e225c7712604efc289e153210124505c","a942099338c946fc196c62e87942217bf07fc5b3","52fe3fd399ed15077106bae9ea475052fc8b4acc","57fd698ccb5cb4f90c014efc6754599e5b0fbe54","c0575af04850eb1911b000bf56e8d5e9362a61e4","7c3fd8ee5d660bbf43e423818c6a8c3231b03817","fa78e89ab95a0b49bc0663f7ab33aaf1a924c560","5748e11c87aeab3c19d13db899d3e2008be928ad")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("0a88c3b4709287f70ca2549a29353a804681ca78","1c7df9b0023fb97000b71c7917556036a48657c5","f0f8f60429e3316c463f397e8e29e1cb2d925fc2","7a3fc280f79578414d71d70609fbdb49ec6ad648","70b743e60f952a1238a469f529e89b0eb71b5ef7","fa44028115912c95b5efb43218f3c7237d5c349f","5273b45c5eabe64edbd0b79f5d1b31e2e8582324","5e5274c7d931c1165aa592cdc3bfceb4649f1ff7","59aa9be378371183ed419a0b24c019ccf3da97ec","8591a7ee00fb1bb7cc5b0417479681290a51996e","82b99ad976429d0a6c545b64c520be4880e1e4b8","3eee78ede82f6319d094787f45afd9bfb600e971","2a96338bacce3bb687bdc274daad120f32668cf4","8a389afe1f85f83e340ca9dfc0005d904799d44c","944b69b5e225c7712604efc289e153210124505c","a942099338c946fc196c62e87942217bf07fc5b3","52fe3fd399ed15077106bae9ea475052fc8b4acc","57fd698ccb5cb4f90c014efc6754599e5b0fbe54","c0575af04850eb1911b000bf56e8d5e9362a61e4","7c3fd8ee5d660bbf43e423818c6a8c3231b03817","fa78e89ab95a0b49bc0663f7ab33aaf1a924c560","5748e11c87aeab3c19d13db899d3e2008be928ad")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring64 NOT NULL AND customstring64 IN ("0a88c3b4709287f70ca2549a29353a804681ca78","1c7df9b0023fb97000b71c7917556036a48657c5","f0f8f60429e3316c463f397e8e29e1cb2d925fc2","7a3fc280f79578414d71d70609fbdb49ec6ad648","70b743e60f952a1238a469f529e89b0eb71b5ef7","fa44028115912c95b5efb43218f3c7237d5c349f","5273b45c5eabe64edbd0b79f5d1b31e2e8582324","5e5274c7d931c1165aa592cdc3bfceb4649f1ff7","59aa9be378371183ed419a0b24c019ccf3da97ec","8591a7ee00fb1bb7cc5b0417479681290a51996e","82b99ad976429d0a6c545b64c520be4880e1e4b8","3eee78ede82f6319d094787f45afd9bfb600e971","2a96338bacce3bb687bdc274daad120f32668cf4","8a389afe1f85f83e340ca9dfc0005d904799d44c","944b69b5e225c7712604efc289e153210124505c","a942099338c946fc196c62e87942217bf07fc5b3","52fe3fd399ed15077106bae9ea475052fc8b4acc","57fd698ccb5cb4f90c014efc6754599e5b0fbe54","c0575af04850eb1911b000bf56e8d5e9362a61e4","7c3fd8ee5d660bbf43e423818c6a8c3231b03817","fa78e89ab95a0b49bc0663f7ab33aaf1a924c560","5748e11c87aeab3c19d13db899d3e2008be928ad")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("0a88c3b4709287f70ca2549a29353a804681ca78","1c7df9b0023fb97000b71c7917556036a48657c5","f0f8f60429e3316c463f397e8e29e1cb2d925fc2","7a3fc280f79578414d71d70609fbdb49ec6ad648","70b743e60f952a1238a469f529e89b0eb71b5ef7","fa44028115912c95b5efb43218f3c7237d5c349f","5273b45c5eabe64edbd0b79f5d1b31e2e8582324","5e5274c7d931c1165aa592cdc3bfceb4649f1ff7","59aa9be378371183ed419a0b24c019ccf3da97ec","8591a7ee00fb1bb7cc5b0417479681290a51996e","82b99ad976429d0a6c545b64c520be4880e1e4b8","3eee78ede82f6319d094787f45afd9bfb600e971","2a96338bacce3bb687bdc274daad120f32668cf4","8a389afe1f85f83e340ca9dfc0005d904799d44c","944b69b5e225c7712604efc289e153210124505c","a942099338c946fc196c62e87942217bf07fc5b3","52fe3fd399ed15077106bae9ea475052fc8b4acc","57fd698ccb5cb4f90c014efc6754599e5b0fbe54","c0575af04850eb1911b000bf56e8d5e9362a61e4","7c3fd8ee5d660bbf43e423818c6a8c3231b03817","fa78e89ab95a0b49bc0663f7ab33aaf1a924c560","5748e11c87aeab3c19d13db899d3e2008be928ad")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("0a88c3b4709287f70ca2549a29353a804681ca78","1c7df9b0023fb97000b71c7917556036a48657c5","f0f8f60429e3316c463f397e8e29e1cb2d925fc2","7a3fc280f79578414d71d70609fbdb49ec6ad648","70b743e60f952a1238a469f529e89b0eb71b5ef7","fa44028115912c95b5efb43218f3c7237d5c349f","5273b45c5eabe64edbd0b79f5d1b31e2e8582324","5e5274c7d931c1165aa592cdc3bfceb4649f1ff7","59aa9be378371183ed419a0b24c019ccf3da97ec","8591a7ee00fb1bb7cc5b0417479681290a51996e","82b99ad976429d0a6c545b64c520be4880e1e4b8","3eee78ede82f6319d094787f45afd9bfb600e971","2a96338bacce3bb687bdc274daad120f32668cf4","8a389afe1f85f83e340ca9dfc0005d904799d44c","944b69b5e225c7712604efc289e153210124505c","a942099338c946fc196c62e87942217bf07fc5b3","52fe3fd399ed15077106bae9ea475052fc8b4acc","57fd698ccb5cb4f90c014efc6754599e5b0fbe54","c0575af04850eb1911b000bf56e8d5e9362a61e4","7c3fd8ee5d660bbf43e423818c6a8c3231b03817","fa78e89ab95a0b49bc0663f7ab33aaf1a924c560","5748e11c87aeab3c19d13db899d3e2008be928ad")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("0a88c3b4709287f70ca2549a29353a804681ca78","1c7df9b0023fb97000b71c7917556036a48657c5","f0f8f60429e3316c463f397e8e29e1cb2d925fc2","7a3fc280f79578414d71d70609fbdb49ec6ad648","70b743e60f952a1238a469f529e89b0eb71b5ef7","fa44028115912c95b5efb43218f3c7237d5c349f","5273b45c5eabe64edbd0b79f5d1b31e2e8582324","5e5274c7d931c1165aa592cdc3bfceb4649f1ff7","59aa9be378371183ed419a0b24c019ccf3da97ec","8591a7ee00fb1bb7cc5b0417479681290a51996e","82b99ad976429d0a6c545b64c520be4880e1e4b8","3eee78ede82f6319d094787f45afd9bfb600e971","2a96338bacce3bb687bdc274daad120f32668cf4","8a389afe1f85f83e340ca9dfc0005d904799d44c","944b69b5e225c7712604efc289e153210124505c","a942099338c946fc196c62e87942217bf07fc5b3","52fe3fd399ed15077106bae9ea475052fc8b4acc","57fd698ccb5cb4f90c014efc6754599e5b0fbe54","c0575af04850eb1911b000bf56e8d5e9362a61e4","7c3fd8ee5d660bbf43e423818c6a8c3231b03817","fa78e89ab95a0b49bc0663f7ab33aaf1a924c560","5748e11c87aeab3c19d13db899d3e2008be928ad")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring64 NOT NULL AND customstring64 IN ("0a88c3b4709287f70ca2549a29353a804681ca78","1c7df9b0023fb97000b71c7917556036a48657c5","f0f8f60429e3316c463f397e8e29e1cb2d925fc2","7a3fc280f79578414d71d70609fbdb49ec6ad648","70b743e60f952a1238a469f529e89b0eb71b5ef7","fa44028115912c95b5efb43218f3c7237d5c349f","5273b45c5eabe64edbd0b79f5d1b31e2e8582324","5e5274c7d931c1165aa592cdc3bfceb4649f1ff7","59aa9be378371183ed419a0b24c019ccf3da97ec","8591a7ee00fb1bb7cc5b0417479681290a51996e","82b99ad976429d0a6c545b64c520be4880e1e4b8","3eee78ede82f6319d094787f45afd9bfb600e971","2a96338bacce3bb687bdc274daad120f32668cf4","8a389afe1f85f83e340ca9dfc0005d904799d44c","944b69b5e225c7712604efc289e153210124505c","a942099338c946fc196c62e87942217bf07fc5b3","52fe3fd399ed15077106bae9ea475052fc8b4acc","57fd698ccb5cb4f90c014efc6754599e5b0fbe54","c0575af04850eb1911b000bf56e8d5e9362a61e4","7c3fd8ee5d660bbf43e423818c6a8c3231b03817","fa78e89ab95a0b49bc0663f7ab33aaf1a924c560","5748e11c87aeab3c19d13db899d3e2008be928ad")
