index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("438448fdc7521ed034f6dabdf814b6ba","f08e7343a94897adeae78138cc3f9142ed160a03","1e2e25a996f72089f12755f931e7fca9b64dd85b03a56a9871fd6bb8f2cf1dbb","d7addb5b6f55eab1686410a17b3c867b","a54af16b2702fe0e5c569f6d8f17574a9fdaf197","498ba0afa5d3b390f852af66bd6e763945bf9b6bff2087015ed8612a18372155","9d495530a421a7c7e113b7afc3a50504","02d291e2ff5799a13eacc72ad0758f2c5e69d414","594f2f8ab05f88f765d05eb1cf24e4c697746905a61ed04a6fc2b744dd6febb0","3bd63b2962d41d2e29e570238d28ec0e","9537e1c4e5ddd7fb9b98c532ca89a9db08262ab4","7aa8e510b9c3b5d39f84e4c2fa68c81da888e091436fdb7fee276ee7ff87f016")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("438448fdc7521ed034f6dabdf814b6ba","f08e7343a94897adeae78138cc3f9142ed160a03","1e2e25a996f72089f12755f931e7fca9b64dd85b03a56a9871fd6bb8f2cf1dbb","d7addb5b6f55eab1686410a17b3c867b","a54af16b2702fe0e5c569f6d8f17574a9fdaf197","498ba0afa5d3b390f852af66bd6e763945bf9b6bff2087015ed8612a18372155","9d495530a421a7c7e113b7afc3a50504","02d291e2ff5799a13eacc72ad0758f2c5e69d414","594f2f8ab05f88f765d05eb1cf24e4c697746905a61ed04a6fc2b744dd6febb0","3bd63b2962d41d2e29e570238d28ec0e","9537e1c4e5ddd7fb9b98c532ca89a9db08262ab4","7aa8e510b9c3b5d39f84e4c2fa68c81da888e091436fdb7fee276ee7ff87f016")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("438448fdc7521ed034f6dabdf814b6ba","f08e7343a94897adeae78138cc3f9142ed160a03","1e2e25a996f72089f12755f931e7fca9b64dd85b03a56a9871fd6bb8f2cf1dbb","d7addb5b6f55eab1686410a17b3c867b","a54af16b2702fe0e5c569f6d8f17574a9fdaf197","498ba0afa5d3b390f852af66bd6e763945bf9b6bff2087015ed8612a18372155","9d495530a421a7c7e113b7afc3a50504","02d291e2ff5799a13eacc72ad0758f2c5e69d414","594f2f8ab05f88f765d05eb1cf24e4c697746905a61ed04a6fc2b744dd6febb0","3bd63b2962d41d2e29e570238d28ec0e","9537e1c4e5ddd7fb9b98c532ca89a9db08262ab4","7aa8e510b9c3b5d39f84e4c2fa68c81da888e091436fdb7fee276ee7ff87f016")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring64 NOT NULL AND customstring64 IN ("438448fdc7521ed034f6dabdf814b6ba","f08e7343a94897adeae78138cc3f9142ed160a03","1e2e25a996f72089f12755f931e7fca9b64dd85b03a56a9871fd6bb8f2cf1dbb","d7addb5b6f55eab1686410a17b3c867b","a54af16b2702fe0e5c569f6d8f17574a9fdaf197","498ba0afa5d3b390f852af66bd6e763945bf9b6bff2087015ed8612a18372155","9d495530a421a7c7e113b7afc3a50504","02d291e2ff5799a13eacc72ad0758f2c5e69d414","594f2f8ab05f88f765d05eb1cf24e4c697746905a61ed04a6fc2b744dd6febb0","3bd63b2962d41d2e29e570238d28ec0e","9537e1c4e5ddd7fb9b98c532ca89a9db08262ab4","7aa8e510b9c3b5d39f84e4c2fa68c81da888e091436fdb7fee276ee7ff87f016")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("438448fdc7521ed034f6dabdf814b6ba","f08e7343a94897adeae78138cc3f9142ed160a03","1e2e25a996f72089f12755f931e7fca9b64dd85b03a56a9871fd6bb8f2cf1dbb","d7addb5b6f55eab1686410a17b3c867b","a54af16b2702fe0e5c569f6d8f17574a9fdaf197","498ba0afa5d3b390f852af66bd6e763945bf9b6bff2087015ed8612a18372155","9d495530a421a7c7e113b7afc3a50504","02d291e2ff5799a13eacc72ad0758f2c5e69d414","594f2f8ab05f88f765d05eb1cf24e4c697746905a61ed04a6fc2b744dd6febb0","3bd63b2962d41d2e29e570238d28ec0e","9537e1c4e5ddd7fb9b98c532ca89a9db08262ab4","7aa8e510b9c3b5d39f84e4c2fa68c81da888e091436fdb7fee276ee7ff87f016")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("438448fdc7521ed034f6dabdf814b6ba","f08e7343a94897adeae78138cc3f9142ed160a03","1e2e25a996f72089f12755f931e7fca9b64dd85b03a56a9871fd6bb8f2cf1dbb","d7addb5b6f55eab1686410a17b3c867b","a54af16b2702fe0e5c569f6d8f17574a9fdaf197","498ba0afa5d3b390f852af66bd6e763945bf9b6bff2087015ed8612a18372155","9d495530a421a7c7e113b7afc3a50504","02d291e2ff5799a13eacc72ad0758f2c5e69d414","594f2f8ab05f88f765d05eb1cf24e4c697746905a61ed04a6fc2b744dd6febb0","3bd63b2962d41d2e29e570238d28ec0e","9537e1c4e5ddd7fb9b98c532ca89a9db08262ab4","7aa8e510b9c3b5d39f84e4c2fa68c81da888e091436fdb7fee276ee7ff87f016")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("438448fdc7521ed034f6dabdf814b6ba","f08e7343a94897adeae78138cc3f9142ed160a03","1e2e25a996f72089f12755f931e7fca9b64dd85b03a56a9871fd6bb8f2cf1dbb","d7addb5b6f55eab1686410a17b3c867b","a54af16b2702fe0e5c569f6d8f17574a9fdaf197","498ba0afa5d3b390f852af66bd6e763945bf9b6bff2087015ed8612a18372155","9d495530a421a7c7e113b7afc3a50504","02d291e2ff5799a13eacc72ad0758f2c5e69d414","594f2f8ab05f88f765d05eb1cf24e4c697746905a61ed04a6fc2b744dd6febb0","3bd63b2962d41d2e29e570238d28ec0e","9537e1c4e5ddd7fb9b98c532ca89a9db08262ab4","7aa8e510b9c3b5d39f84e4c2fa68c81da888e091436fdb7fee276ee7ff87f016")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("438448fdc7521ed034f6dabdf814b6ba","f08e7343a94897adeae78138cc3f9142ed160a03","1e2e25a996f72089f12755f931e7fca9b64dd85b03a56a9871fd6bb8f2cf1dbb","d7addb5b6f55eab1686410a17b3c867b","a54af16b2702fe0e5c569f6d8f17574a9fdaf197","498ba0afa5d3b390f852af66bd6e763945bf9b6bff2087015ed8612a18372155","9d495530a421a7c7e113b7afc3a50504","02d291e2ff5799a13eacc72ad0758f2c5e69d414","594f2f8ab05f88f765d05eb1cf24e4c697746905a61ed04a6fc2b744dd6febb0","3bd63b2962d41d2e29e570238d28ec0e","9537e1c4e5ddd7fb9b98c532ca89a9db08262ab4","7aa8e510b9c3b5d39f84e4c2fa68c81da888e091436fdb7fee276ee7ff87f016")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("438448fdc7521ed034f6dabdf814b6ba","f08e7343a94897adeae78138cc3f9142ed160a03","1e2e25a996f72089f12755f931e7fca9b64dd85b03a56a9871fd6bb8f2cf1dbb","d7addb5b6f55eab1686410a17b3c867b","a54af16b2702fe0e5c569f6d8f17574a9fdaf197","498ba0afa5d3b390f852af66bd6e763945bf9b6bff2087015ed8612a18372155","9d495530a421a7c7e113b7afc3a50504","02d291e2ff5799a13eacc72ad0758f2c5e69d414","594f2f8ab05f88f765d05eb1cf24e4c697746905a61ed04a6fc2b744dd6febb0","3bd63b2962d41d2e29e570238d28ec0e","9537e1c4e5ddd7fb9b98c532ca89a9db08262ab4","7aa8e510b9c3b5d39f84e4c2fa68c81da888e091436fdb7fee276ee7ff87f016")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("438448fdc7521ed034f6dabdf814b6ba","f08e7343a94897adeae78138cc3f9142ed160a03","1e2e25a996f72089f12755f931e7fca9b64dd85b03a56a9871fd6bb8f2cf1dbb","d7addb5b6f55eab1686410a17b3c867b","a54af16b2702fe0e5c569f6d8f17574a9fdaf197","498ba0afa5d3b390f852af66bd6e763945bf9b6bff2087015ed8612a18372155","9d495530a421a7c7e113b7afc3a50504","02d291e2ff5799a13eacc72ad0758f2c5e69d414","594f2f8ab05f88f765d05eb1cf24e4c697746905a61ed04a6fc2b744dd6febb0","3bd63b2962d41d2e29e570238d28ec0e","9537e1c4e5ddd7fb9b98c532ca89a9db08262ab4","7aa8e510b9c3b5d39f84e4c2fa68c81da888e091436fdb7fee276ee7ff87f016")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("438448fdc7521ed034f6dabdf814b6ba","f08e7343a94897adeae78138cc3f9142ed160a03","1e2e25a996f72089f12755f931e7fca9b64dd85b03a56a9871fd6bb8f2cf1dbb","d7addb5b6f55eab1686410a17b3c867b","a54af16b2702fe0e5c569f6d8f17574a9fdaf197","498ba0afa5d3b390f852af66bd6e763945bf9b6bff2087015ed8612a18372155","9d495530a421a7c7e113b7afc3a50504","02d291e2ff5799a13eacc72ad0758f2c5e69d414","594f2f8ab05f88f765d05eb1cf24e4c697746905a61ed04a6fc2b744dd6febb0","3bd63b2962d41d2e29e570238d28ec0e","9537e1c4e5ddd7fb9b98c532ca89a9db08262ab4","7aa8e510b9c3b5d39f84e4c2fa68c81da888e091436fdb7fee276ee7ff87f016")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("438448fdc7521ed034f6dabdf814b6ba","f08e7343a94897adeae78138cc3f9142ed160a03","1e2e25a996f72089f12755f931e7fca9b64dd85b03a56a9871fd6bb8f2cf1dbb","d7addb5b6f55eab1686410a17b3c867b","a54af16b2702fe0e5c569f6d8f17574a9fdaf197","498ba0afa5d3b390f852af66bd6e763945bf9b6bff2087015ed8612a18372155","9d495530a421a7c7e113b7afc3a50504","02d291e2ff5799a13eacc72ad0758f2c5e69d414","594f2f8ab05f88f765d05eb1cf24e4c697746905a61ed04a6fc2b744dd6febb0","3bd63b2962d41d2e29e570238d28ec0e","9537e1c4e5ddd7fb9b98c532ca89a9db08262ab4","7aa8e510b9c3b5d39f84e4c2fa68c81da888e091436fdb7fee276ee7ff87f016")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("438448fdc7521ed034f6dabdf814b6ba","f08e7343a94897adeae78138cc3f9142ed160a03","1e2e25a996f72089f12755f931e7fca9b64dd85b03a56a9871fd6bb8f2cf1dbb","d7addb5b6f55eab1686410a17b3c867b","a54af16b2702fe0e5c569f6d8f17574a9fdaf197","498ba0afa5d3b390f852af66bd6e763945bf9b6bff2087015ed8612a18372155","9d495530a421a7c7e113b7afc3a50504","02d291e2ff5799a13eacc72ad0758f2c5e69d414","594f2f8ab05f88f765d05eb1cf24e4c697746905a61ed04a6fc2b744dd6febb0","3bd63b2962d41d2e29e570238d28ec0e","9537e1c4e5ddd7fb9b98c532ca89a9db08262ab4","7aa8e510b9c3b5d39f84e4c2fa68c81da888e091436fdb7fee276ee7ff87f016")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("438448fdc7521ed034f6dabdf814b6ba","f08e7343a94897adeae78138cc3f9142ed160a03","1e2e25a996f72089f12755f931e7fca9b64dd85b03a56a9871fd6bb8f2cf1dbb","d7addb5b6f55eab1686410a17b3c867b","a54af16b2702fe0e5c569f6d8f17574a9fdaf197","498ba0afa5d3b390f852af66bd6e763945bf9b6bff2087015ed8612a18372155","9d495530a421a7c7e113b7afc3a50504","02d291e2ff5799a13eacc72ad0758f2c5e69d414","594f2f8ab05f88f765d05eb1cf24e4c697746905a61ed04a6fc2b744dd6febb0","3bd63b2962d41d2e29e570238d28ec0e","9537e1c4e5ddd7fb9b98c532ca89a9db08262ab4","7aa8e510b9c3b5d39f84e4c2fa68c81da888e091436fdb7fee276ee7ff87f016")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("438448fdc7521ed034f6dabdf814b6ba","f08e7343a94897adeae78138cc3f9142ed160a03","1e2e25a996f72089f12755f931e7fca9b64dd85b03a56a9871fd6bb8f2cf1dbb","d7addb5b6f55eab1686410a17b3c867b","a54af16b2702fe0e5c569f6d8f17574a9fdaf197","498ba0afa5d3b390f852af66bd6e763945bf9b6bff2087015ed8612a18372155","9d495530a421a7c7e113b7afc3a50504","02d291e2ff5799a13eacc72ad0758f2c5e69d414","594f2f8ab05f88f765d05eb1cf24e4c697746905a61ed04a6fc2b744dd6febb0","3bd63b2962d41d2e29e570238d28ec0e","9537e1c4e5ddd7fb9b98c532ca89a9db08262ab4","7aa8e510b9c3b5d39f84e4c2fa68c81da888e091436fdb7fee276ee7ff87f016")
index=activity AND rg_functionality="Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("438448fdc7521ed034f6dabdf814b6ba","f08e7343a94897adeae78138cc3f9142ed160a03","1e2e25a996f72089f12755f931e7fca9b64dd85b03a56a9871fd6bb8f2cf1dbb","d7addb5b6f55eab1686410a17b3c867b","a54af16b2702fe0e5c569f6d8f17574a9fdaf197","498ba0afa5d3b390f852af66bd6e763945bf9b6bff2087015ed8612a18372155","9d495530a421a7c7e113b7afc3a50504","02d291e2ff5799a13eacc72ad0758f2c5e69d414","594f2f8ab05f88f765d05eb1cf24e4c697746905a61ed04a6fc2b744dd6febb0","3bd63b2962d41d2e29e570238d28ec0e","9537e1c4e5ddd7fb9b98c532ca89a9db08262ab4","7aa8e510b9c3b5d39f84e4c2fa68c81da888e091436fdb7fee276ee7ff87f016")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("438448fdc7521ed034f6dabdf814b6ba","f08e7343a94897adeae78138cc3f9142ed160a03","1e2e25a996f72089f12755f931e7fca9b64dd85b03a56a9871fd6bb8f2cf1dbb","d7addb5b6f55eab1686410a17b3c867b","a54af16b2702fe0e5c569f6d8f17574a9fdaf197","498ba0afa5d3b390f852af66bd6e763945bf9b6bff2087015ed8612a18372155","9d495530a421a7c7e113b7afc3a50504","02d291e2ff5799a13eacc72ad0758f2c5e69d414","594f2f8ab05f88f765d05eb1cf24e4c697746905a61ed04a6fc2b744dd6febb0","3bd63b2962d41d2e29e570238d28ec0e","9537e1c4e5ddd7fb9b98c532ca89a9db08262ab4","7aa8e510b9c3b5d39f84e4c2fa68c81da888e091436fdb7fee276ee7ff87f016")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("438448fdc7521ed034f6dabdf814b6ba","f08e7343a94897adeae78138cc3f9142ed160a03","1e2e25a996f72089f12755f931e7fca9b64dd85b03a56a9871fd6bb8f2cf1dbb","d7addb5b6f55eab1686410a17b3c867b","a54af16b2702fe0e5c569f6d8f17574a9fdaf197","498ba0afa5d3b390f852af66bd6e763945bf9b6bff2087015ed8612a18372155","9d495530a421a7c7e113b7afc3a50504","02d291e2ff5799a13eacc72ad0758f2c5e69d414","594f2f8ab05f88f765d05eb1cf24e4c697746905a61ed04a6fc2b744dd6febb0","3bd63b2962d41d2e29e570238d28ec0e","9537e1c4e5ddd7fb9b98c532ca89a9db08262ab4","7aa8e510b9c3b5d39f84e4c2fa68c81da888e091436fdb7fee276ee7ff87f016")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("438448fdc7521ed034f6dabdf814b6ba","f08e7343a94897adeae78138cc3f9142ed160a03","1e2e25a996f72089f12755f931e7fca9b64dd85b03a56a9871fd6bb8f2cf1dbb","d7addb5b6f55eab1686410a17b3c867b","a54af16b2702fe0e5c569f6d8f17574a9fdaf197","498ba0afa5d3b390f852af66bd6e763945bf9b6bff2087015ed8612a18372155","9d495530a421a7c7e113b7afc3a50504","02d291e2ff5799a13eacc72ad0758f2c5e69d414","594f2f8ab05f88f765d05eb1cf24e4c697746905a61ed04a6fc2b744dd6febb0","3bd63b2962d41d2e29e570238d28ec0e","9537e1c4e5ddd7fb9b98c532ca89a9db08262ab4","7aa8e510b9c3b5d39f84e4c2fa68c81da888e091436fdb7fee276ee7ff87f016")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("438448fdc7521ed034f6dabdf814b6ba","f08e7343a94897adeae78138cc3f9142ed160a03","1e2e25a996f72089f12755f931e7fca9b64dd85b03a56a9871fd6bb8f2cf1dbb","d7addb5b6f55eab1686410a17b3c867b","a54af16b2702fe0e5c569f6d8f17574a9fdaf197","498ba0afa5d3b390f852af66bd6e763945bf9b6bff2087015ed8612a18372155","9d495530a421a7c7e113b7afc3a50504","02d291e2ff5799a13eacc72ad0758f2c5e69d414","594f2f8ab05f88f765d05eb1cf24e4c697746905a61ed04a6fc2b744dd6febb0","3bd63b2962d41d2e29e570238d28ec0e","9537e1c4e5ddd7fb9b98c532ca89a9db08262ab4","7aa8e510b9c3b5d39f84e4c2fa68c81da888e091436fdb7fee276ee7ff87f016")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("438448fdc7521ed034f6dabdf814b6ba","f08e7343a94897adeae78138cc3f9142ed160a03","1e2e25a996f72089f12755f931e7fca9b64dd85b03a56a9871fd6bb8f2cf1dbb","d7addb5b6f55eab1686410a17b3c867b","a54af16b2702fe0e5c569f6d8f17574a9fdaf197","498ba0afa5d3b390f852af66bd6e763945bf9b6bff2087015ed8612a18372155","9d495530a421a7c7e113b7afc3a50504","02d291e2ff5799a13eacc72ad0758f2c5e69d414","594f2f8ab05f88f765d05eb1cf24e4c697746905a61ed04a6fc2b744dd6febb0","3bd63b2962d41d2e29e570238d28ec0e","9537e1c4e5ddd7fb9b98c532ca89a9db08262ab4","7aa8e510b9c3b5d39f84e4c2fa68c81da888e091436fdb7fee276ee7ff87f016")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("438448fdc7521ed034f6dabdf814b6ba","f08e7343a94897adeae78138cc3f9142ed160a03","1e2e25a996f72089f12755f931e7fca9b64dd85b03a56a9871fd6bb8f2cf1dbb","d7addb5b6f55eab1686410a17b3c867b","a54af16b2702fe0e5c569f6d8f17574a9fdaf197","498ba0afa5d3b390f852af66bd6e763945bf9b6bff2087015ed8612a18372155","9d495530a421a7c7e113b7afc3a50504","02d291e2ff5799a13eacc72ad0758f2c5e69d414","594f2f8ab05f88f765d05eb1cf24e4c697746905a61ed04a6fc2b744dd6febb0","3bd63b2962d41d2e29e570238d28ec0e","9537e1c4e5ddd7fb9b98c532ca89a9db08262ab4","7aa8e510b9c3b5d39f84e4c2fa68c81da888e091436fdb7fee276ee7ff87f016")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("438448fdc7521ed034f6dabdf814b6ba","f08e7343a94897adeae78138cc3f9142ed160a03","1e2e25a996f72089f12755f931e7fca9b64dd85b03a56a9871fd6bb8f2cf1dbb","d7addb5b6f55eab1686410a17b3c867b","a54af16b2702fe0e5c569f6d8f17574a9fdaf197","498ba0afa5d3b390f852af66bd6e763945bf9b6bff2087015ed8612a18372155","9d495530a421a7c7e113b7afc3a50504","02d291e2ff5799a13eacc72ad0758f2c5e69d414","594f2f8ab05f88f765d05eb1cf24e4c697746905a61ed04a6fc2b744dd6febb0","3bd63b2962d41d2e29e570238d28ec0e","9537e1c4e5ddd7fb9b98c532ca89a9db08262ab4","7aa8e510b9c3b5d39f84e4c2fa68c81da888e091436fdb7fee276ee7ff87f016")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring64 NOT NULL AND customstring64 IN ("438448fdc7521ed034f6dabdf814b6ba","f08e7343a94897adeae78138cc3f9142ed160a03","1e2e25a996f72089f12755f931e7fca9b64dd85b03a56a9871fd6bb8f2cf1dbb","d7addb5b6f55eab1686410a17b3c867b","a54af16b2702fe0e5c569f6d8f17574a9fdaf197","498ba0afa5d3b390f852af66bd6e763945bf9b6bff2087015ed8612a18372155","9d495530a421a7c7e113b7afc3a50504","02d291e2ff5799a13eacc72ad0758f2c5e69d414","594f2f8ab05f88f765d05eb1cf24e4c697746905a61ed04a6fc2b744dd6febb0","3bd63b2962d41d2e29e570238d28ec0e","9537e1c4e5ddd7fb9b98c532ca89a9db08262ab4","7aa8e510b9c3b5d39f84e4c2fa68c81da888e091436fdb7fee276ee7ff87f016")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("438448fdc7521ed034f6dabdf814b6ba","f08e7343a94897adeae78138cc3f9142ed160a03","1e2e25a996f72089f12755f931e7fca9b64dd85b03a56a9871fd6bb8f2cf1dbb","d7addb5b6f55eab1686410a17b3c867b","a54af16b2702fe0e5c569f6d8f17574a9fdaf197","498ba0afa5d3b390f852af66bd6e763945bf9b6bff2087015ed8612a18372155","9d495530a421a7c7e113b7afc3a50504","02d291e2ff5799a13eacc72ad0758f2c5e69d414","594f2f8ab05f88f765d05eb1cf24e4c697746905a61ed04a6fc2b744dd6febb0","3bd63b2962d41d2e29e570238d28ec0e","9537e1c4e5ddd7fb9b98c532ca89a9db08262ab4","7aa8e510b9c3b5d39f84e4c2fa68c81da888e091436fdb7fee276ee7ff87f016")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("438448fdc7521ed034f6dabdf814b6ba","f08e7343a94897adeae78138cc3f9142ed160a03","1e2e25a996f72089f12755f931e7fca9b64dd85b03a56a9871fd6bb8f2cf1dbb","d7addb5b6f55eab1686410a17b3c867b","a54af16b2702fe0e5c569f6d8f17574a9fdaf197","498ba0afa5d3b390f852af66bd6e763945bf9b6bff2087015ed8612a18372155","9d495530a421a7c7e113b7afc3a50504","02d291e2ff5799a13eacc72ad0758f2c5e69d414","594f2f8ab05f88f765d05eb1cf24e4c697746905a61ed04a6fc2b744dd6febb0","3bd63b2962d41d2e29e570238d28ec0e","9537e1c4e5ddd7fb9b98c532ca89a9db08262ab4","7aa8e510b9c3b5d39f84e4c2fa68c81da888e091436fdb7fee276ee7ff87f016")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("438448fdc7521ed034f6dabdf814b6ba","f08e7343a94897adeae78138cc3f9142ed160a03","1e2e25a996f72089f12755f931e7fca9b64dd85b03a56a9871fd6bb8f2cf1dbb","d7addb5b6f55eab1686410a17b3c867b","a54af16b2702fe0e5c569f6d8f17574a9fdaf197","498ba0afa5d3b390f852af66bd6e763945bf9b6bff2087015ed8612a18372155","9d495530a421a7c7e113b7afc3a50504","02d291e2ff5799a13eacc72ad0758f2c5e69d414","594f2f8ab05f88f765d05eb1cf24e4c697746905a61ed04a6fc2b744dd6febb0","3bd63b2962d41d2e29e570238d28ec0e","9537e1c4e5ddd7fb9b98c532ca89a9db08262ab4","7aa8e510b9c3b5d39f84e4c2fa68c81da888e091436fdb7fee276ee7ff87f016")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring64 NOT NULL AND customstring64 IN ("438448fdc7521ed034f6dabdf814b6ba","f08e7343a94897adeae78138cc3f9142ed160a03","1e2e25a996f72089f12755f931e7fca9b64dd85b03a56a9871fd6bb8f2cf1dbb","d7addb5b6f55eab1686410a17b3c867b","a54af16b2702fe0e5c569f6d8f17574a9fdaf197","498ba0afa5d3b390f852af66bd6e763945bf9b6bff2087015ed8612a18372155","9d495530a421a7c7e113b7afc3a50504","02d291e2ff5799a13eacc72ad0758f2c5e69d414","594f2f8ab05f88f765d05eb1cf24e4c697746905a61ed04a6fc2b744dd6febb0","3bd63b2962d41d2e29e570238d28ec0e","9537e1c4e5ddd7fb9b98c532ca89a9db08262ab4","7aa8e510b9c3b5d39f84e4c2fa68c81da888e091436fdb7fee276ee7ff87f016")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("438448fdc7521ed034f6dabdf814b6ba","f08e7343a94897adeae78138cc3f9142ed160a03","1e2e25a996f72089f12755f931e7fca9b64dd85b03a56a9871fd6bb8f2cf1dbb","d7addb5b6f55eab1686410a17b3c867b","a54af16b2702fe0e5c569f6d8f17574a9fdaf197","498ba0afa5d3b390f852af66bd6e763945bf9b6bff2087015ed8612a18372155","9d495530a421a7c7e113b7afc3a50504","02d291e2ff5799a13eacc72ad0758f2c5e69d414","594f2f8ab05f88f765d05eb1cf24e4c697746905a61ed04a6fc2b744dd6febb0","3bd63b2962d41d2e29e570238d28ec0e","9537e1c4e5ddd7fb9b98c532ca89a9db08262ab4","7aa8e510b9c3b5d39f84e4c2fa68c81da888e091436fdb7fee276ee7ff87f016")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("438448fdc7521ed034f6dabdf814b6ba","f08e7343a94897adeae78138cc3f9142ed160a03","1e2e25a996f72089f12755f931e7fca9b64dd85b03a56a9871fd6bb8f2cf1dbb","d7addb5b6f55eab1686410a17b3c867b","a54af16b2702fe0e5c569f6d8f17574a9fdaf197","498ba0afa5d3b390f852af66bd6e763945bf9b6bff2087015ed8612a18372155","9d495530a421a7c7e113b7afc3a50504","02d291e2ff5799a13eacc72ad0758f2c5e69d414","594f2f8ab05f88f765d05eb1cf24e4c697746905a61ed04a6fc2b744dd6febb0","3bd63b2962d41d2e29e570238d28ec0e","9537e1c4e5ddd7fb9b98c532ca89a9db08262ab4","7aa8e510b9c3b5d39f84e4c2fa68c81da888e091436fdb7fee276ee7ff87f016")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("438448fdc7521ed034f6dabdf814b6ba","f08e7343a94897adeae78138cc3f9142ed160a03","1e2e25a996f72089f12755f931e7fca9b64dd85b03a56a9871fd6bb8f2cf1dbb","d7addb5b6f55eab1686410a17b3c867b","a54af16b2702fe0e5c569f6d8f17574a9fdaf197","498ba0afa5d3b390f852af66bd6e763945bf9b6bff2087015ed8612a18372155","9d495530a421a7c7e113b7afc3a50504","02d291e2ff5799a13eacc72ad0758f2c5e69d414","594f2f8ab05f88f765d05eb1cf24e4c697746905a61ed04a6fc2b744dd6febb0","3bd63b2962d41d2e29e570238d28ec0e","9537e1c4e5ddd7fb9b98c532ca89a9db08262ab4","7aa8e510b9c3b5d39f84e4c2fa68c81da888e091436fdb7fee276ee7ff87f016")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring64 NOT NULL AND customstring64 IN ("438448fdc7521ed034f6dabdf814b6ba","f08e7343a94897adeae78138cc3f9142ed160a03","1e2e25a996f72089f12755f931e7fca9b64dd85b03a56a9871fd6bb8f2cf1dbb","d7addb5b6f55eab1686410a17b3c867b","a54af16b2702fe0e5c569f6d8f17574a9fdaf197","498ba0afa5d3b390f852af66bd6e763945bf9b6bff2087015ed8612a18372155","9d495530a421a7c7e113b7afc3a50504","02d291e2ff5799a13eacc72ad0758f2c5e69d414","594f2f8ab05f88f765d05eb1cf24e4c697746905a61ed04a6fc2b744dd6febb0","3bd63b2962d41d2e29e570238d28ec0e","9537e1c4e5ddd7fb9b98c532ca89a9db08262ab4","7aa8e510b9c3b5d39f84e4c2fa68c81da888e091436fdb7fee276ee7ff87f016")
index=activity AND rg_functionality="O365 General" AND filehash NOT NULL AND filehash IN ("438448fdc7521ed034f6dabdf814b6ba","f08e7343a94897adeae78138cc3f9142ed160a03","1e2e25a996f72089f12755f931e7fca9b64dd85b03a56a9871fd6bb8f2cf1dbb","d7addb5b6f55eab1686410a17b3c867b","a54af16b2702fe0e5c569f6d8f17574a9fdaf197","498ba0afa5d3b390f852af66bd6e763945bf9b6bff2087015ed8612a18372155","9d495530a421a7c7e113b7afc3a50504","02d291e2ff5799a13eacc72ad0758f2c5e69d414","594f2f8ab05f88f765d05eb1cf24e4c697746905a61ed04a6fc2b744dd6febb0","3bd63b2962d41d2e29e570238d28ec0e","9537e1c4e5ddd7fb9b98c532ca89a9db08262ab4","7aa8e510b9c3b5d39f84e4c2fa68c81da888e091436fdb7fee276ee7ff87f016")
index=activity AND rg_functionality="O365 General" AND oldfilehash NOT NULL AND oldfilehash IN ("438448fdc7521ed034f6dabdf814b6ba","f08e7343a94897adeae78138cc3f9142ed160a03","1e2e25a996f72089f12755f931e7fca9b64dd85b03a56a9871fd6bb8f2cf1dbb","d7addb5b6f55eab1686410a17b3c867b","a54af16b2702fe0e5c569f6d8f17574a9fdaf197","498ba0afa5d3b390f852af66bd6e763945bf9b6bff2087015ed8612a18372155","9d495530a421a7c7e113b7afc3a50504","02d291e2ff5799a13eacc72ad0758f2c5e69d414","594f2f8ab05f88f765d05eb1cf24e4c697746905a61ed04a6fc2b744dd6febb0","3bd63b2962d41d2e29e570238d28ec0e","9537e1c4e5ddd7fb9b98c532ca89a9db08262ab4","7aa8e510b9c3b5d39f84e4c2fa68c81da888e091436fdb7fee276ee7ff87f016")
index=activity AND rg_functionality="O365 General" AND customstring3 NOT NULL AND customstring3 IN ("438448fdc7521ed034f6dabdf814b6ba","f08e7343a94897adeae78138cc3f9142ed160a03","1e2e25a996f72089f12755f931e7fca9b64dd85b03a56a9871fd6bb8f2cf1dbb","d7addb5b6f55eab1686410a17b3c867b","a54af16b2702fe0e5c569f6d8f17574a9fdaf197","498ba0afa5d3b390f852af66bd6e763945bf9b6bff2087015ed8612a18372155","9d495530a421a7c7e113b7afc3a50504","02d291e2ff5799a13eacc72ad0758f2c5e69d414","594f2f8ab05f88f765d05eb1cf24e4c697746905a61ed04a6fc2b744dd6febb0","3bd63b2962d41d2e29e570238d28ec0e","9537e1c4e5ddd7fb9b98c532ca89a9db08262ab4","7aa8e510b9c3b5d39f84e4c2fa68c81da888e091436fdb7fee276ee7ff87f016")
index=activity AND rg_functionality="O365 General" AND customstring64 NOT NULL AND customstring64 IN ("438448fdc7521ed034f6dabdf814b6ba","f08e7343a94897adeae78138cc3f9142ed160a03","1e2e25a996f72089f12755f931e7fca9b64dd85b03a56a9871fd6bb8f2cf1dbb","d7addb5b6f55eab1686410a17b3c867b","a54af16b2702fe0e5c569f6d8f17574a9fdaf197","498ba0afa5d3b390f852af66bd6e763945bf9b6bff2087015ed8612a18372155","9d495530a421a7c7e113b7afc3a50504","02d291e2ff5799a13eacc72ad0758f2c5e69d414","594f2f8ab05f88f765d05eb1cf24e4c697746905a61ed04a6fc2b744dd6febb0","3bd63b2962d41d2e29e570238d28ec0e","9537e1c4e5ddd7fb9b98c532ca89a9db08262ab4","7aa8e510b9c3b5d39f84e4c2fa68c81da888e091436fdb7fee276ee7ff87f016")
