index=activity AND rg_functionality="Next Generation Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "dataupload.store" OR destinationhostname CONTAINS "firstfromsep.online" OR destinationhostname CONTAINS "safeup.store" OR destinationhostname CONTAINS "support.us05web-zoom.pro" OR destinationhostname CONTAINS "writeup.live")
index=activity AND rg_functionality="Next Generation Firewall" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "dataupload.store" OR sourcentdomain CONTAINS "firstfromsep.online" OR sourcentdomain CONTAINS "safeup.store" OR sourcentdomain CONTAINS "support.us05web-zoom.pro" OR sourcentdomain CONTAINS "writeup.live")
index=activity AND rg_functionality="Next Generation Firewall" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "dataupload.store" OR sourcehostname CONTAINS "firstfromsep.online" OR sourcehostname CONTAINS "safeup.store" OR sourcehostname CONTAINS "support.us05web-zoom.pro" OR sourcehostname CONTAINS "writeup.live")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "dataupload.store" OR destinationntdomain CONTAINS "firstfromsep.online" OR destinationntdomain CONTAINS "safeup.store" OR destinationntdomain CONTAINS "support.us05web-zoom.pro" OR destinationntdomain CONTAINS "writeup.live")
index=activity AND rg_functionality="Next Generation Firewall" AND requesturl NOT NULL AND (requesturl CONTAINS "dataupload.store" OR requesturl CONTAINS "firstfromsep.online" OR requesturl CONTAINS "safeup.store" OR requesturl CONTAINS "support.us05web-zoom.pro" OR requesturl CONTAINS "writeup.live")
index=activity AND rg_functionality="Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "dataupload.store" OR destinationhostname CONTAINS "firstfromsep.online" OR destinationhostname CONTAINS "safeup.store" OR destinationhostname CONTAINS "support.us05web-zoom.pro" OR destinationhostname CONTAINS "writeup.live")
index=activity AND rg_functionality="Firewall" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "dataupload.store" OR sourcentdomain CONTAINS "firstfromsep.online" OR sourcentdomain CONTAINS "safeup.store" OR sourcentdomain CONTAINS "support.us05web-zoom.pro" OR sourcentdomain CONTAINS "writeup.live")
index=activity AND rg_functionality="Firewall" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "dataupload.store" OR sourcehostname CONTAINS "firstfromsep.online" OR sourcehostname CONTAINS "safeup.store" OR sourcehostname CONTAINS "support.us05web-zoom.pro" OR sourcehostname CONTAINS "writeup.live")
index=activity AND rg_functionality="Firewall" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "dataupload.store" OR destinationntdomain CONTAINS "firstfromsep.online" OR destinationntdomain CONTAINS "safeup.store" OR destinationntdomain CONTAINS "support.us05web-zoom.pro" OR destinationntdomain CONTAINS "writeup.live")
index=activity AND rg_functionality="Firewall" AND requesturl NOT NULL AND (requesturl CONTAINS "dataupload.store" OR requesturl CONTAINS "firstfromsep.online" OR requesturl CONTAINS "safeup.store" OR requesturl CONTAINS "support.us05web-zoom.pro" OR requesturl CONTAINS "writeup.live")
index=activity AND rg_functionality="Web Proxy" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "dataupload.store" OR destinationhostname CONTAINS "firstfromsep.online" OR destinationhostname CONTAINS "safeup.store" OR destinationhostname CONTAINS "support.us05web-zoom.pro" OR destinationhostname CONTAINS "writeup.live")
index=activity AND rg_functionality="Web Proxy" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "dataupload.store" OR sourcentdomain CONTAINS "firstfromsep.online" OR sourcentdomain CONTAINS "safeup.store" OR sourcentdomain CONTAINS "support.us05web-zoom.pro" OR sourcentdomain CONTAINS "writeup.live")
index=activity AND rg_functionality="Web Proxy" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "dataupload.store" OR sourcehostname CONTAINS "firstfromsep.online" OR sourcehostname CONTAINS "safeup.store" OR sourcehostname CONTAINS "support.us05web-zoom.pro" OR sourcehostname CONTAINS "writeup.live")
index=activity AND rg_functionality="Web Proxy" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "dataupload.store" OR destinationntdomain CONTAINS "firstfromsep.online" OR destinationntdomain CONTAINS "safeup.store" OR destinationntdomain CONTAINS "support.us05web-zoom.pro" OR destinationntdomain CONTAINS "writeup.live")
index=activity AND rg_functionality="Web Proxy" AND requesturl NOT NULL AND (requesturl CONTAINS "dataupload.store" OR requesturl CONTAINS "firstfromsep.online" OR requesturl CONTAINS "safeup.store" OR requesturl CONTAINS "support.us05web-zoom.pro" OR requesturl CONTAINS "writeup.live")
index=activity AND rg_functionality="Flow" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "dataupload.store" OR destinationhostname CONTAINS "firstfromsep.online" OR destinationhostname CONTAINS "safeup.store" OR destinationhostname CONTAINS "support.us05web-zoom.pro" OR destinationhostname CONTAINS "writeup.live")
index=activity AND rg_functionality="Flow" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "dataupload.store" OR sourcentdomain CONTAINS "firstfromsep.online" OR sourcentdomain CONTAINS "safeup.store" OR sourcentdomain CONTAINS "support.us05web-zoom.pro" OR sourcentdomain CONTAINS "writeup.live")
index=activity AND rg_functionality="Flow" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "dataupload.store" OR sourcehostname CONTAINS "firstfromsep.online" OR sourcehostname CONTAINS "safeup.store" OR sourcehostname CONTAINS "support.us05web-zoom.pro" OR sourcehostname CONTAINS "writeup.live")
index=activity AND rg_functionality="Flow" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "dataupload.store" OR destinationntdomain CONTAINS "firstfromsep.online" OR destinationntdomain CONTAINS "safeup.store" OR destinationntdomain CONTAINS "support.us05web-zoom.pro" OR destinationntdomain CONTAINS "writeup.live")
index=activity AND rg_functionality="Flow" AND requesturl NOT NULL AND (requesturl CONTAINS "dataupload.store" OR requesturl CONTAINS "firstfromsep.online" OR requesturl CONTAINS "safeup.store" OR requesturl CONTAINS "support.us05web-zoom.pro" OR requesturl CONTAINS "writeup.live")
index=activity AND rg_functionality="Web Server" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "dataupload.store" OR destinationhostname CONTAINS "firstfromsep.online" OR destinationhostname CONTAINS "safeup.store" OR destinationhostname CONTAINS "support.us05web-zoom.pro" OR destinationhostname CONTAINS "writeup.live")
index=activity AND rg_functionality="Web Server" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "dataupload.store" OR sourcentdomain CONTAINS "firstfromsep.online" OR sourcentdomain CONTAINS "safeup.store" OR sourcentdomain CONTAINS "support.us05web-zoom.pro" OR sourcentdomain CONTAINS "writeup.live")
index=activity AND rg_functionality="Web Server" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "dataupload.store" OR sourcehostname CONTAINS "firstfromsep.online" OR sourcehostname CONTAINS "safeup.store" OR sourcehostname CONTAINS "support.us05web-zoom.pro" OR sourcehostname CONTAINS "writeup.live")
index=activity AND rg_functionality="Web Server" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "dataupload.store" OR destinationntdomain CONTAINS "firstfromsep.online" OR destinationntdomain CONTAINS "safeup.store" OR destinationntdomain CONTAINS "support.us05web-zoom.pro" OR destinationntdomain CONTAINS "writeup.live")
index=activity AND rg_functionality="Web Server" AND requesturl NOT NULL AND (requesturl CONTAINS "dataupload.store" OR requesturl CONTAINS "firstfromsep.online" OR requesturl CONTAINS "safeup.store" OR requesturl CONTAINS "support.us05web-zoom.pro" OR requesturl CONTAINS "writeup.live")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "dataupload.store" OR destinationhostname CONTAINS "firstfromsep.online" OR destinationhostname CONTAINS "safeup.store" OR destinationhostname CONTAINS "support.us05web-zoom.pro" OR destinationhostname CONTAINS "writeup.live")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "dataupload.store" OR sourcentdomain CONTAINS "firstfromsep.online" OR sourcentdomain CONTAINS "safeup.store" OR sourcentdomain CONTAINS "support.us05web-zoom.pro" OR sourcentdomain CONTAINS "writeup.live")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "dataupload.store" OR sourcehostname CONTAINS "firstfromsep.online" OR sourcehostname CONTAINS "safeup.store" OR sourcehostname CONTAINS "support.us05web-zoom.pro" OR sourcehostname CONTAINS "writeup.live")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "dataupload.store" OR destinationntdomain CONTAINS "firstfromsep.online" OR destinationntdomain CONTAINS "safeup.store" OR destinationntdomain CONTAINS "support.us05web-zoom.pro" OR destinationntdomain CONTAINS "writeup.live")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND requesturl NOT NULL AND (requesturl CONTAINS "dataupload.store" OR requesturl CONTAINS "firstfromsep.online" OR requesturl CONTAINS "safeup.store" OR requesturl CONTAINS "support.us05web-zoom.pro" OR requesturl CONTAINS "writeup.live")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "dataupload.store" OR destinationhostname CONTAINS "firstfromsep.online" OR destinationhostname CONTAINS "safeup.store" OR destinationhostname CONTAINS "support.us05web-zoom.pro" OR destinationhostname CONTAINS "writeup.live")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "dataupload.store" OR sourcentdomain CONTAINS "firstfromsep.online" OR sourcentdomain CONTAINS "safeup.store" OR sourcentdomain CONTAINS "support.us05web-zoom.pro" OR sourcentdomain CONTAINS "writeup.live")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "dataupload.store" OR sourcehostname CONTAINS "firstfromsep.online" OR sourcehostname CONTAINS "safeup.store" OR sourcehostname CONTAINS "support.us05web-zoom.pro" OR sourcehostname CONTAINS "writeup.live")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "dataupload.store" OR destinationntdomain CONTAINS "firstfromsep.online" OR destinationntdomain CONTAINS "safeup.store" OR destinationntdomain CONTAINS "support.us05web-zoom.pro" OR destinationntdomain CONTAINS "writeup.live")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND requesturl NOT NULL AND (requesturl CONTAINS "dataupload.store" OR requesturl CONTAINS "firstfromsep.online" OR requesturl CONTAINS "safeup.store" OR requesturl CONTAINS "support.us05web-zoom.pro" OR requesturl CONTAINS "writeup.live")
index=activity AND rg_functionality="Web Application Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "dataupload.store" OR destinationhostname CONTAINS "firstfromsep.online" OR destinationhostname CONTAINS "safeup.store" OR destinationhostname CONTAINS "support.us05web-zoom.pro" OR destinationhostname CONTAINS "writeup.live")
index=activity AND rg_functionality="Web Application Firewall" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "dataupload.store" OR sourcentdomain CONTAINS "firstfromsep.online" OR sourcentdomain CONTAINS "safeup.store" OR sourcentdomain CONTAINS "support.us05web-zoom.pro" OR sourcentdomain CONTAINS "writeup.live")
index=activity AND rg_functionality="Web Application Firewall" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "dataupload.store" OR sourcehostname CONTAINS "firstfromsep.online" OR sourcehostname CONTAINS "safeup.store" OR sourcehostname CONTAINS "support.us05web-zoom.pro" OR sourcehostname CONTAINS "writeup.live")
index=activity AND rg_functionality="Web Application Firewall" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "dataupload.store" OR destinationntdomain CONTAINS "firstfromsep.online" OR destinationntdomain CONTAINS "safeup.store" OR destinationntdomain CONTAINS "support.us05web-zoom.pro" OR destinationntdomain CONTAINS "writeup.live")
index=activity AND rg_functionality="Web Application Firewall" AND requesturl NOT NULL AND (requesturl CONTAINS "dataupload.store" OR requesturl CONTAINS "firstfromsep.online" OR requesturl CONTAINS "safeup.store" OR requesturl CONTAINS "support.us05web-zoom.pro" OR requesturl CONTAINS "writeup.live")
index=activity AND rg_functionality="Endpoint management systems" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "dataupload.store" OR destinationhostname CONTAINS "firstfromsep.online" OR destinationhostname CONTAINS "safeup.store" OR destinationhostname CONTAINS "support.us05web-zoom.pro" OR destinationhostname CONTAINS "writeup.live")
index=activity AND rg_functionality="Endpoint management systems" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "dataupload.store" OR sourcentdomain CONTAINS "firstfromsep.online" OR sourcentdomain CONTAINS "safeup.store" OR sourcentdomain CONTAINS "support.us05web-zoom.pro" OR sourcentdomain CONTAINS "writeup.live")
index=activity AND rg_functionality="Endpoint management systems" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "dataupload.store" OR sourcehostname CONTAINS "firstfromsep.online" OR sourcehostname CONTAINS "safeup.store" OR sourcehostname CONTAINS "support.us05web-zoom.pro" OR sourcehostname CONTAINS "writeup.live")
index=activity AND rg_functionality="Endpoint management systems" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "dataupload.store" OR destinationntdomain CONTAINS "firstfromsep.online" OR destinationntdomain CONTAINS "safeup.store" OR destinationntdomain CONTAINS "support.us05web-zoom.pro" OR destinationntdomain CONTAINS "writeup.live")
index=activity AND rg_functionality="Endpoint management systems" AND requesturl NOT NULL AND (requesturl CONTAINS "dataupload.store" OR requesturl CONTAINS "firstfromsep.online" OR requesturl CONTAINS "safeup.store" OR requesturl CONTAINS "support.us05web-zoom.pro" OR requesturl CONTAINS "writeup.live")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "dataupload.store" OR destinationhostname CONTAINS "firstfromsep.online" OR destinationhostname CONTAINS "safeup.store" OR destinationhostname CONTAINS "support.us05web-zoom.pro" OR destinationhostname CONTAINS "writeup.live")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "dataupload.store" OR sourcentdomain CONTAINS "firstfromsep.online" OR sourcentdomain CONTAINS "safeup.store" OR sourcentdomain CONTAINS "support.us05web-zoom.pro" OR sourcentdomain CONTAINS "writeup.live")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "dataupload.store" OR sourcehostname CONTAINS "firstfromsep.online" OR sourcehostname CONTAINS "safeup.store" OR sourcehostname CONTAINS "support.us05web-zoom.pro" OR sourcehostname CONTAINS "writeup.live")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "dataupload.store" OR destinationntdomain CONTAINS "firstfromsep.online" OR destinationntdomain CONTAINS "safeup.store" OR destinationntdomain CONTAINS "support.us05web-zoom.pro" OR destinationntdomain CONTAINS "writeup.live")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND requesturl NOT NULL AND (requesturl CONTAINS "dataupload.store" OR requesturl CONTAINS "firstfromsep.online" OR requesturl CONTAINS "safeup.store" OR requesturl CONTAINS "support.us05web-zoom.pro" OR requesturl CONTAINS "writeup.live")
index=activity AND rg_functionality="Cloud Application Audit" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "dataupload.store" OR destinationhostname CONTAINS "firstfromsep.online" OR destinationhostname CONTAINS "safeup.store" OR destinationhostname CONTAINS "support.us05web-zoom.pro" OR destinationhostname CONTAINS "writeup.live")
index=activity AND rg_functionality="Cloud Application Audit" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "dataupload.store" OR sourcentdomain CONTAINS "firstfromsep.online" OR sourcentdomain CONTAINS "safeup.store" OR sourcentdomain CONTAINS "support.us05web-zoom.pro" OR sourcentdomain CONTAINS "writeup.live")
index=activity AND rg_functionality="Cloud Application Audit" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "dataupload.store" OR sourcehostname CONTAINS "firstfromsep.online" OR sourcehostname CONTAINS "safeup.store" OR sourcehostname CONTAINS "support.us05web-zoom.pro" OR sourcehostname CONTAINS "writeup.live")
index=activity AND rg_functionality="Cloud Application Audit" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "dataupload.store" OR destinationntdomain CONTAINS "firstfromsep.online" OR destinationntdomain CONTAINS "safeup.store" OR destinationntdomain CONTAINS "support.us05web-zoom.pro" OR destinationntdomain CONTAINS "writeup.live")
index=activity AND rg_functionality="Cloud Application Audit" AND requesturl NOT NULL AND (requesturl CONTAINS "dataupload.store" OR requesturl CONTAINS "firstfromsep.online" OR requesturl CONTAINS "safeup.store" OR requesturl CONTAINS "support.us05web-zoom.pro" OR requesturl CONTAINS "writeup.live")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "dataupload.store" OR destinationhostname CONTAINS "firstfromsep.online" OR destinationhostname CONTAINS "safeup.store" OR destinationhostname CONTAINS "support.us05web-zoom.pro" OR destinationhostname CONTAINS "writeup.live")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "dataupload.store" OR sourcentdomain CONTAINS "firstfromsep.online" OR sourcentdomain CONTAINS "safeup.store" OR sourcentdomain CONTAINS "support.us05web-zoom.pro" OR sourcentdomain CONTAINS "writeup.live")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "dataupload.store" OR sourcehostname CONTAINS "firstfromsep.online" OR sourcehostname CONTAINS "safeup.store" OR sourcehostname CONTAINS "support.us05web-zoom.pro" OR sourcehostname CONTAINS "writeup.live")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "dataupload.store" OR destinationntdomain CONTAINS "firstfromsep.online" OR destinationntdomain CONTAINS "safeup.store" OR destinationntdomain CONTAINS "support.us05web-zoom.pro" OR destinationntdomain CONTAINS "writeup.live")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND requesturl NOT NULL AND (requesturl CONTAINS "dataupload.store" OR requesturl CONTAINS "firstfromsep.online" OR requesturl CONTAINS "safeup.store" OR requesturl CONTAINS "support.us05web-zoom.pro" OR requesturl CONTAINS "writeup.live")
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "dataupload.store" OR destinationhostname CONTAINS "firstfromsep.online" OR destinationhostname CONTAINS "safeup.store" OR destinationhostname CONTAINS "support.us05web-zoom.pro" OR destinationhostname CONTAINS "writeup.live")
index=activity AND rg_functionality="Unix / Linux / AIX" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "dataupload.store" OR sourcentdomain CONTAINS "firstfromsep.online" OR sourcentdomain CONTAINS "safeup.store" OR sourcentdomain CONTAINS "support.us05web-zoom.pro" OR sourcentdomain CONTAINS "writeup.live")
index=activity AND rg_functionality="Unix / Linux / AIX" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "dataupload.store" OR sourcehostname CONTAINS "firstfromsep.online" OR sourcehostname CONTAINS "safeup.store" OR sourcehostname CONTAINS "support.us05web-zoom.pro" OR sourcehostname CONTAINS "writeup.live")
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "dataupload.store" OR destinationntdomain CONTAINS "firstfromsep.online" OR destinationntdomain CONTAINS "safeup.store" OR destinationntdomain CONTAINS "support.us05web-zoom.pro" OR destinationntdomain CONTAINS "writeup.live")
index=activity AND rg_functionality="Unix / Linux / AIX" AND requesturl NOT NULL AND (requesturl CONTAINS "dataupload.store" OR requesturl CONTAINS "firstfromsep.online" OR requesturl CONTAINS "safeup.store" OR requesturl CONTAINS "support.us05web-zoom.pro" OR requesturl CONTAINS "writeup.live")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "dataupload.store" OR destinationhostname CONTAINS "firstfromsep.online" OR destinationhostname CONTAINS "safeup.store" OR destinationhostname CONTAINS "support.us05web-zoom.pro" OR destinationhostname CONTAINS "writeup.live")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "dataupload.store" OR sourcentdomain CONTAINS "firstfromsep.online" OR sourcentdomain CONTAINS "safeup.store" OR sourcentdomain CONTAINS "support.us05web-zoom.pro" OR sourcentdomain CONTAINS "writeup.live")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "dataupload.store" OR sourcehostname CONTAINS "firstfromsep.online" OR sourcehostname CONTAINS "safeup.store" OR sourcehostname CONTAINS "support.us05web-zoom.pro" OR sourcehostname CONTAINS "writeup.live")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "dataupload.store" OR destinationntdomain CONTAINS "firstfromsep.online" OR destinationntdomain CONTAINS "safeup.store" OR destinationntdomain CONTAINS "support.us05web-zoom.pro" OR destinationntdomain CONTAINS "writeup.live")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND requesturl NOT NULL AND (requesturl CONTAINS "dataupload.store" OR requesturl CONTAINS "firstfromsep.online" OR requesturl CONTAINS "safeup.store" OR requesturl CONTAINS "support.us05web-zoom.pro" OR requesturl CONTAINS "writeup.live")
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "dataupload.store" OR destinationhostname CONTAINS "firstfromsep.online" OR destinationhostname CONTAINS "safeup.store" OR destinationhostname CONTAINS "support.us05web-zoom.pro" OR destinationhostname CONTAINS "writeup.live")
index=activity AND rg_functionality="Cloud Application Security Broker" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "dataupload.store" OR sourcentdomain CONTAINS "firstfromsep.online" OR sourcentdomain CONTAINS "safeup.store" OR sourcentdomain CONTAINS "support.us05web-zoom.pro" OR sourcentdomain CONTAINS "writeup.live")
index=activity AND rg_functionality="Cloud Application Security Broker" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "dataupload.store" OR sourcehostname CONTAINS "firstfromsep.online" OR sourcehostname CONTAINS "safeup.store" OR sourcehostname CONTAINS "support.us05web-zoom.pro" OR sourcehostname CONTAINS "writeup.live")
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "dataupload.store" OR destinationntdomain CONTAINS "firstfromsep.online" OR destinationntdomain CONTAINS "safeup.store" OR destinationntdomain CONTAINS "support.us05web-zoom.pro" OR destinationntdomain CONTAINS "writeup.live")
index=activity AND rg_functionality="Cloud Application Security Broker" AND requesturl NOT NULL AND (requesturl CONTAINS "dataupload.store" OR requesturl CONTAINS "firstfromsep.online" OR requesturl CONTAINS "safeup.store" OR requesturl CONTAINS "support.us05web-zoom.pro" OR requesturl CONTAINS "writeup.live")
index=activity AND rg_functionality="Source Code Repository" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "dataupload.store" OR destinationhostname CONTAINS "firstfromsep.online" OR destinationhostname CONTAINS "safeup.store" OR destinationhostname CONTAINS "support.us05web-zoom.pro" OR destinationhostname CONTAINS "writeup.live")
index=activity AND rg_functionality="Source Code Repository" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "dataupload.store" OR sourcentdomain CONTAINS "firstfromsep.online" OR sourcentdomain CONTAINS "safeup.store" OR sourcentdomain CONTAINS "support.us05web-zoom.pro" OR sourcentdomain CONTAINS "writeup.live")
index=activity AND rg_functionality="Source Code Repository" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "dataupload.store" OR sourcehostname CONTAINS "firstfromsep.online" OR sourcehostname CONTAINS "safeup.store" OR sourcehostname CONTAINS "support.us05web-zoom.pro" OR sourcehostname CONTAINS "writeup.live")
index=activity AND rg_functionality="Source Code Repository" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "dataupload.store" OR destinationntdomain CONTAINS "firstfromsep.online" OR destinationntdomain CONTAINS "safeup.store" OR destinationntdomain CONTAINS "support.us05web-zoom.pro" OR destinationntdomain CONTAINS "writeup.live")
index=activity AND rg_functionality="Source Code Repository" AND requesturl NOT NULL AND (requesturl CONTAINS "dataupload.store" OR requesturl CONTAINS "firstfromsep.online" OR requesturl CONTAINS "safeup.store" OR requesturl CONTAINS "support.us05web-zoom.pro" OR requesturl CONTAINS "writeup.live")
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "dataupload.store" OR destinationhostname CONTAINS "firstfromsep.online" OR destinationhostname CONTAINS "safeup.store" OR destinationhostname CONTAINS "support.us05web-zoom.pro" OR destinationhostname CONTAINS "writeup.live")
index=activity AND rg_functionality="Cloud Email / Email Security" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "dataupload.store" OR sourcentdomain CONTAINS "firstfromsep.online" OR sourcentdomain CONTAINS "safeup.store" OR sourcentdomain CONTAINS "support.us05web-zoom.pro" OR sourcentdomain CONTAINS "writeup.live")
index=activity AND rg_functionality="Cloud Email / Email Security" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "dataupload.store" OR sourcehostname CONTAINS "firstfromsep.online" OR sourcehostname CONTAINS "safeup.store" OR sourcehostname CONTAINS "support.us05web-zoom.pro" OR sourcehostname CONTAINS "writeup.live")
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "dataupload.store" OR destinationntdomain CONTAINS "firstfromsep.online" OR destinationntdomain CONTAINS "safeup.store" OR destinationntdomain CONTAINS "support.us05web-zoom.pro" OR destinationntdomain CONTAINS "writeup.live")
index=activity AND rg_functionality="Cloud Email / Email Security" AND requesturl NOT NULL AND (requesturl CONTAINS "dataupload.store" OR requesturl CONTAINS "firstfromsep.online" OR requesturl CONTAINS "safeup.store" OR requesturl CONTAINS "support.us05web-zoom.pro" OR requesturl CONTAINS "writeup.live")
index=activity AND rg_functionality="DNS / DHCP" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "dataupload.store" OR destinationhostname CONTAINS "firstfromsep.online" OR destinationhostname CONTAINS "safeup.store" OR destinationhostname CONTAINS "support.us05web-zoom.pro" OR destinationhostname CONTAINS "writeup.live")
index=activity AND rg_functionality="DNS / DHCP" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "dataupload.store" OR sourcentdomain CONTAINS "firstfromsep.online" OR sourcentdomain CONTAINS "safeup.store" OR sourcentdomain CONTAINS "support.us05web-zoom.pro" OR sourcentdomain CONTAINS "writeup.live")
index=activity AND rg_functionality="DNS / DHCP" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "dataupload.store" OR sourcehostname CONTAINS "firstfromsep.online" OR sourcehostname CONTAINS "safeup.store" OR sourcehostname CONTAINS "support.us05web-zoom.pro" OR sourcehostname CONTAINS "writeup.live")
index=activity AND rg_functionality="DNS / DHCP" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "dataupload.store" OR destinationntdomain CONTAINS "firstfromsep.online" OR destinationntdomain CONTAINS "safeup.store" OR destinationntdomain CONTAINS "support.us05web-zoom.pro" OR destinationntdomain CONTAINS "writeup.live")
index=activity AND rg_functionality="DNS / DHCP" AND requesturl NOT NULL AND (requesturl CONTAINS "dataupload.store" OR requesturl CONTAINS "firstfromsep.online" OR requesturl CONTAINS "safeup.store" OR requesturl CONTAINS "support.us05web-zoom.pro" OR requesturl CONTAINS "writeup.live")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "dataupload.store" OR destinationhostname CONTAINS "firstfromsep.online" OR destinationhostname CONTAINS "safeup.store" OR destinationhostname CONTAINS "support.us05web-zoom.pro" OR destinationhostname CONTAINS "writeup.live")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "dataupload.store" OR sourcentdomain CONTAINS "firstfromsep.online" OR sourcentdomain CONTAINS "safeup.store" OR sourcentdomain CONTAINS "support.us05web-zoom.pro" OR sourcentdomain CONTAINS "writeup.live")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "dataupload.store" OR sourcehostname CONTAINS "firstfromsep.online" OR sourcehostname CONTAINS "safeup.store" OR sourcehostname CONTAINS "support.us05web-zoom.pro" OR sourcehostname CONTAINS "writeup.live")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "dataupload.store" OR destinationntdomain CONTAINS "firstfromsep.online" OR destinationntdomain CONTAINS "safeup.store" OR destinationntdomain CONTAINS "support.us05web-zoom.pro" OR destinationntdomain CONTAINS "writeup.live")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND requesturl NOT NULL AND (requesturl CONTAINS "dataupload.store" OR requesturl CONTAINS "firstfromsep.online" OR requesturl CONTAINS "safeup.store" OR requesturl CONTAINS "support.us05web-zoom.pro" OR requesturl CONTAINS "writeup.live")
index=activity AND rg_functionality="Next Generation Firewall" AND filehash NOT NULL AND filehash IN ("027d4020f2dd1eb473636bc112a84f0a90b6651c","06566eabf54caafe36ebe94430d392b9cf3426ba","08af4c21cd0a165695c756b6fda37016197b01e7","2ed2edec8ccc44292410042c730c190027b87930","a25c06e8545666d6d2a88c8da300cf3383149d5a","ee3795f6418fc0cacbe884a8eb803498c2b5776f","bb72ca0e19a95c48a9ee4fd658958a0ae2af44b6","4743d5202dbe565721d75f7fb1eca43266a652d4","e6a7c54c01227adcb2a180e62f0082de1c13d61ae913cda379dd0f44a0d0567b","64c9347d794243be26e811b5eb90fb11c8e74e8aff504bf98481e5ccf9d72fe9","469fd8a280e89a6edd0d704d0be4c7e0e0d8d753e314e9ce205d7006b573865f","41660a23e5db77597994e17f9f773d02976f767276faf3b5bac0510807a9a36f","69a012ff46565169534ccefb175f87b3cc331b4f94cc5d223c29a036ed771f4e","74cbec210ba601caeb063d44e510fc012075b65a0482d3fa2d2d08837649356a","ea8a58bbb6d5614855a470b2d3630197e34fc372760b2b7fa27af8f3456525a6","7ffc83877389ebb86d201749d73b5e3706490070015522805696c9b94fa95ccb","d5f41ea8dbf1ed159a0a4cfce563a917c1df32bb8ac8d321b4d3dcf67271dd25","ebaaf177e746f9f0e16c906f1ffea95af771252b07136ca6a13995508fce34aa")
index=activity AND rg_functionality="Next Generation Firewall" AND oldfilehash NOT NULL AND oldfilehash IN ("027d4020f2dd1eb473636bc112a84f0a90b6651c","06566eabf54caafe36ebe94430d392b9cf3426ba","08af4c21cd0a165695c756b6fda37016197b01e7","2ed2edec8ccc44292410042c730c190027b87930","a25c06e8545666d6d2a88c8da300cf3383149d5a","ee3795f6418fc0cacbe884a8eb803498c2b5776f","bb72ca0e19a95c48a9ee4fd658958a0ae2af44b6","4743d5202dbe565721d75f7fb1eca43266a652d4","e6a7c54c01227adcb2a180e62f0082de1c13d61ae913cda379dd0f44a0d0567b","64c9347d794243be26e811b5eb90fb11c8e74e8aff504bf98481e5ccf9d72fe9","469fd8a280e89a6edd0d704d0be4c7e0e0d8d753e314e9ce205d7006b573865f","41660a23e5db77597994e17f9f773d02976f767276faf3b5bac0510807a9a36f","69a012ff46565169534ccefb175f87b3cc331b4f94cc5d223c29a036ed771f4e","74cbec210ba601caeb063d44e510fc012075b65a0482d3fa2d2d08837649356a","ea8a58bbb6d5614855a470b2d3630197e34fc372760b2b7fa27af8f3456525a6","7ffc83877389ebb86d201749d73b5e3706490070015522805696c9b94fa95ccb","d5f41ea8dbf1ed159a0a4cfce563a917c1df32bb8ac8d321b4d3dcf67271dd25","ebaaf177e746f9f0e16c906f1ffea95af771252b07136ca6a13995508fce34aa")
index=activity AND rg_functionality="Next Generation Firewall" AND customstring3 NOT NULL AND customstring3 IN ("027d4020f2dd1eb473636bc112a84f0a90b6651c","06566eabf54caafe36ebe94430d392b9cf3426ba","08af4c21cd0a165695c756b6fda37016197b01e7","2ed2edec8ccc44292410042c730c190027b87930","a25c06e8545666d6d2a88c8da300cf3383149d5a","ee3795f6418fc0cacbe884a8eb803498c2b5776f","bb72ca0e19a95c48a9ee4fd658958a0ae2af44b6","4743d5202dbe565721d75f7fb1eca43266a652d4","e6a7c54c01227adcb2a180e62f0082de1c13d61ae913cda379dd0f44a0d0567b","64c9347d794243be26e811b5eb90fb11c8e74e8aff504bf98481e5ccf9d72fe9","469fd8a280e89a6edd0d704d0be4c7e0e0d8d753e314e9ce205d7006b573865f","41660a23e5db77597994e17f9f773d02976f767276faf3b5bac0510807a9a36f","69a012ff46565169534ccefb175f87b3cc331b4f94cc5d223c29a036ed771f4e","74cbec210ba601caeb063d44e510fc012075b65a0482d3fa2d2d08837649356a","ea8a58bbb6d5614855a470b2d3630197e34fc372760b2b7fa27af8f3456525a6","7ffc83877389ebb86d201749d73b5e3706490070015522805696c9b94fa95ccb","d5f41ea8dbf1ed159a0a4cfce563a917c1df32bb8ac8d321b4d3dcf67271dd25","ebaaf177e746f9f0e16c906f1ffea95af771252b07136ca6a13995508fce34aa")
index=activity AND rg_functionality="Next Generation Firewall" AND customstring64 NOT NULL AND customstring64 IN ("027d4020f2dd1eb473636bc112a84f0a90b6651c","06566eabf54caafe36ebe94430d392b9cf3426ba","08af4c21cd0a165695c756b6fda37016197b01e7","2ed2edec8ccc44292410042c730c190027b87930","a25c06e8545666d6d2a88c8da300cf3383149d5a","ee3795f6418fc0cacbe884a8eb803498c2b5776f","bb72ca0e19a95c48a9ee4fd658958a0ae2af44b6","4743d5202dbe565721d75f7fb1eca43266a652d4","e6a7c54c01227adcb2a180e62f0082de1c13d61ae913cda379dd0f44a0d0567b","64c9347d794243be26e811b5eb90fb11c8e74e8aff504bf98481e5ccf9d72fe9","469fd8a280e89a6edd0d704d0be4c7e0e0d8d753e314e9ce205d7006b573865f","41660a23e5db77597994e17f9f773d02976f767276faf3b5bac0510807a9a36f","69a012ff46565169534ccefb175f87b3cc331b4f94cc5d223c29a036ed771f4e","74cbec210ba601caeb063d44e510fc012075b65a0482d3fa2d2d08837649356a","ea8a58bbb6d5614855a470b2d3630197e34fc372760b2b7fa27af8f3456525a6","7ffc83877389ebb86d201749d73b5e3706490070015522805696c9b94fa95ccb","d5f41ea8dbf1ed159a0a4cfce563a917c1df32bb8ac8d321b4d3dcf67271dd25","ebaaf177e746f9f0e16c906f1ffea95af771252b07136ca6a13995508fce34aa")
index=activity AND rg_functionality="Firewall" AND filehash NOT NULL AND filehash IN ("027d4020f2dd1eb473636bc112a84f0a90b6651c","06566eabf54caafe36ebe94430d392b9cf3426ba","08af4c21cd0a165695c756b6fda37016197b01e7","2ed2edec8ccc44292410042c730c190027b87930","a25c06e8545666d6d2a88c8da300cf3383149d5a","ee3795f6418fc0cacbe884a8eb803498c2b5776f","bb72ca0e19a95c48a9ee4fd658958a0ae2af44b6","4743d5202dbe565721d75f7fb1eca43266a652d4","e6a7c54c01227adcb2a180e62f0082de1c13d61ae913cda379dd0f44a0d0567b","64c9347d794243be26e811b5eb90fb11c8e74e8aff504bf98481e5ccf9d72fe9","469fd8a280e89a6edd0d704d0be4c7e0e0d8d753e314e9ce205d7006b573865f","41660a23e5db77597994e17f9f773d02976f767276faf3b5bac0510807a9a36f","69a012ff46565169534ccefb175f87b3cc331b4f94cc5d223c29a036ed771f4e","74cbec210ba601caeb063d44e510fc012075b65a0482d3fa2d2d08837649356a","ea8a58bbb6d5614855a470b2d3630197e34fc372760b2b7fa27af8f3456525a6","7ffc83877389ebb86d201749d73b5e3706490070015522805696c9b94fa95ccb","d5f41ea8dbf1ed159a0a4cfce563a917c1df32bb8ac8d321b4d3dcf67271dd25","ebaaf177e746f9f0e16c906f1ffea95af771252b07136ca6a13995508fce34aa")
index=activity AND rg_functionality="Firewall" AND oldfilehash NOT NULL AND oldfilehash IN ("027d4020f2dd1eb473636bc112a84f0a90b6651c","06566eabf54caafe36ebe94430d392b9cf3426ba","08af4c21cd0a165695c756b6fda37016197b01e7","2ed2edec8ccc44292410042c730c190027b87930","a25c06e8545666d6d2a88c8da300cf3383149d5a","ee3795f6418fc0cacbe884a8eb803498c2b5776f","bb72ca0e19a95c48a9ee4fd658958a0ae2af44b6","4743d5202dbe565721d75f7fb1eca43266a652d4","e6a7c54c01227adcb2a180e62f0082de1c13d61ae913cda379dd0f44a0d0567b","64c9347d794243be26e811b5eb90fb11c8e74e8aff504bf98481e5ccf9d72fe9","469fd8a280e89a6edd0d704d0be4c7e0e0d8d753e314e9ce205d7006b573865f","41660a23e5db77597994e17f9f773d02976f767276faf3b5bac0510807a9a36f","69a012ff46565169534ccefb175f87b3cc331b4f94cc5d223c29a036ed771f4e","74cbec210ba601caeb063d44e510fc012075b65a0482d3fa2d2d08837649356a","ea8a58bbb6d5614855a470b2d3630197e34fc372760b2b7fa27af8f3456525a6","7ffc83877389ebb86d201749d73b5e3706490070015522805696c9b94fa95ccb","d5f41ea8dbf1ed159a0a4cfce563a917c1df32bb8ac8d321b4d3dcf67271dd25","ebaaf177e746f9f0e16c906f1ffea95af771252b07136ca6a13995508fce34aa")
index=activity AND rg_functionality="Firewall" AND customstring3 NOT NULL AND customstring3 IN ("027d4020f2dd1eb473636bc112a84f0a90b6651c","06566eabf54caafe36ebe94430d392b9cf3426ba","08af4c21cd0a165695c756b6fda37016197b01e7","2ed2edec8ccc44292410042c730c190027b87930","a25c06e8545666d6d2a88c8da300cf3383149d5a","ee3795f6418fc0cacbe884a8eb803498c2b5776f","bb72ca0e19a95c48a9ee4fd658958a0ae2af44b6","4743d5202dbe565721d75f7fb1eca43266a652d4","e6a7c54c01227adcb2a180e62f0082de1c13d61ae913cda379dd0f44a0d0567b","64c9347d794243be26e811b5eb90fb11c8e74e8aff504bf98481e5ccf9d72fe9","469fd8a280e89a6edd0d704d0be4c7e0e0d8d753e314e9ce205d7006b573865f","41660a23e5db77597994e17f9f773d02976f767276faf3b5bac0510807a9a36f","69a012ff46565169534ccefb175f87b3cc331b4f94cc5d223c29a036ed771f4e","74cbec210ba601caeb063d44e510fc012075b65a0482d3fa2d2d08837649356a","ea8a58bbb6d5614855a470b2d3630197e34fc372760b2b7fa27af8f3456525a6","7ffc83877389ebb86d201749d73b5e3706490070015522805696c9b94fa95ccb","d5f41ea8dbf1ed159a0a4cfce563a917c1df32bb8ac8d321b4d3dcf67271dd25","ebaaf177e746f9f0e16c906f1ffea95af771252b07136ca6a13995508fce34aa")
index=activity AND rg_functionality="Firewall" AND customstring64 NOT NULL AND customstring64 IN ("027d4020f2dd1eb473636bc112a84f0a90b6651c","06566eabf54caafe36ebe94430d392b9cf3426ba","08af4c21cd0a165695c756b6fda37016197b01e7","2ed2edec8ccc44292410042c730c190027b87930","a25c06e8545666d6d2a88c8da300cf3383149d5a","ee3795f6418fc0cacbe884a8eb803498c2b5776f","bb72ca0e19a95c48a9ee4fd658958a0ae2af44b6","4743d5202dbe565721d75f7fb1eca43266a652d4","e6a7c54c01227adcb2a180e62f0082de1c13d61ae913cda379dd0f44a0d0567b","64c9347d794243be26e811b5eb90fb11c8e74e8aff504bf98481e5ccf9d72fe9","469fd8a280e89a6edd0d704d0be4c7e0e0d8d753e314e9ce205d7006b573865f","41660a23e5db77597994e17f9f773d02976f767276faf3b5bac0510807a9a36f","69a012ff46565169534ccefb175f87b3cc331b4f94cc5d223c29a036ed771f4e","74cbec210ba601caeb063d44e510fc012075b65a0482d3fa2d2d08837649356a","ea8a58bbb6d5614855a470b2d3630197e34fc372760b2b7fa27af8f3456525a6","7ffc83877389ebb86d201749d73b5e3706490070015522805696c9b94fa95ccb","d5f41ea8dbf1ed159a0a4cfce563a917c1df32bb8ac8d321b4d3dcf67271dd25","ebaaf177e746f9f0e16c906f1ffea95af771252b07136ca6a13995508fce34aa")
index=activity AND rg_functionality="Web Proxy" AND filehash NOT NULL AND filehash IN ("027d4020f2dd1eb473636bc112a84f0a90b6651c","06566eabf54caafe36ebe94430d392b9cf3426ba","08af4c21cd0a165695c756b6fda37016197b01e7","2ed2edec8ccc44292410042c730c190027b87930","a25c06e8545666d6d2a88c8da300cf3383149d5a","ee3795f6418fc0cacbe884a8eb803498c2b5776f","bb72ca0e19a95c48a9ee4fd658958a0ae2af44b6","4743d5202dbe565721d75f7fb1eca43266a652d4","e6a7c54c01227adcb2a180e62f0082de1c13d61ae913cda379dd0f44a0d0567b","64c9347d794243be26e811b5eb90fb11c8e74e8aff504bf98481e5ccf9d72fe9","469fd8a280e89a6edd0d704d0be4c7e0e0d8d753e314e9ce205d7006b573865f","41660a23e5db77597994e17f9f773d02976f767276faf3b5bac0510807a9a36f","69a012ff46565169534ccefb175f87b3cc331b4f94cc5d223c29a036ed771f4e","74cbec210ba601caeb063d44e510fc012075b65a0482d3fa2d2d08837649356a","ea8a58bbb6d5614855a470b2d3630197e34fc372760b2b7fa27af8f3456525a6","7ffc83877389ebb86d201749d73b5e3706490070015522805696c9b94fa95ccb","d5f41ea8dbf1ed159a0a4cfce563a917c1df32bb8ac8d321b4d3dcf67271dd25","ebaaf177e746f9f0e16c906f1ffea95af771252b07136ca6a13995508fce34aa")
index=activity AND rg_functionality="Web Proxy" AND oldfilehash NOT NULL AND oldfilehash IN ("027d4020f2dd1eb473636bc112a84f0a90b6651c","06566eabf54caafe36ebe94430d392b9cf3426ba","08af4c21cd0a165695c756b6fda37016197b01e7","2ed2edec8ccc44292410042c730c190027b87930","a25c06e8545666d6d2a88c8da300cf3383149d5a","ee3795f6418fc0cacbe884a8eb803498c2b5776f","bb72ca0e19a95c48a9ee4fd658958a0ae2af44b6","4743d5202dbe565721d75f7fb1eca43266a652d4","e6a7c54c01227adcb2a180e62f0082de1c13d61ae913cda379dd0f44a0d0567b","64c9347d794243be26e811b5eb90fb11c8e74e8aff504bf98481e5ccf9d72fe9","469fd8a280e89a6edd0d704d0be4c7e0e0d8d753e314e9ce205d7006b573865f","41660a23e5db77597994e17f9f773d02976f767276faf3b5bac0510807a9a36f","69a012ff46565169534ccefb175f87b3cc331b4f94cc5d223c29a036ed771f4e","74cbec210ba601caeb063d44e510fc012075b65a0482d3fa2d2d08837649356a","ea8a58bbb6d5614855a470b2d3630197e34fc372760b2b7fa27af8f3456525a6","7ffc83877389ebb86d201749d73b5e3706490070015522805696c9b94fa95ccb","d5f41ea8dbf1ed159a0a4cfce563a917c1df32bb8ac8d321b4d3dcf67271dd25","ebaaf177e746f9f0e16c906f1ffea95af771252b07136ca6a13995508fce34aa")
index=activity AND rg_functionality="Web Proxy" AND customstring3 NOT NULL AND customstring3 IN ("027d4020f2dd1eb473636bc112a84f0a90b6651c","06566eabf54caafe36ebe94430d392b9cf3426ba","08af4c21cd0a165695c756b6fda37016197b01e7","2ed2edec8ccc44292410042c730c190027b87930","a25c06e8545666d6d2a88c8da300cf3383149d5a","ee3795f6418fc0cacbe884a8eb803498c2b5776f","bb72ca0e19a95c48a9ee4fd658958a0ae2af44b6","4743d5202dbe565721d75f7fb1eca43266a652d4","e6a7c54c01227adcb2a180e62f0082de1c13d61ae913cda379dd0f44a0d0567b","64c9347d794243be26e811b5eb90fb11c8e74e8aff504bf98481e5ccf9d72fe9","469fd8a280e89a6edd0d704d0be4c7e0e0d8d753e314e9ce205d7006b573865f","41660a23e5db77597994e17f9f773d02976f767276faf3b5bac0510807a9a36f","69a012ff46565169534ccefb175f87b3cc331b4f94cc5d223c29a036ed771f4e","74cbec210ba601caeb063d44e510fc012075b65a0482d3fa2d2d08837649356a","ea8a58bbb6d5614855a470b2d3630197e34fc372760b2b7fa27af8f3456525a6","7ffc83877389ebb86d201749d73b5e3706490070015522805696c9b94fa95ccb","d5f41ea8dbf1ed159a0a4cfce563a917c1df32bb8ac8d321b4d3dcf67271dd25","ebaaf177e746f9f0e16c906f1ffea95af771252b07136ca6a13995508fce34aa")
index=activity AND rg_functionality="Web Proxy" AND customstring64 NOT NULL AND customstring64 IN ("027d4020f2dd1eb473636bc112a84f0a90b6651c","06566eabf54caafe36ebe94430d392b9cf3426ba","08af4c21cd0a165695c756b6fda37016197b01e7","2ed2edec8ccc44292410042c730c190027b87930","a25c06e8545666d6d2a88c8da300cf3383149d5a","ee3795f6418fc0cacbe884a8eb803498c2b5776f","bb72ca0e19a95c48a9ee4fd658958a0ae2af44b6","4743d5202dbe565721d75f7fb1eca43266a652d4","e6a7c54c01227adcb2a180e62f0082de1c13d61ae913cda379dd0f44a0d0567b","64c9347d794243be26e811b5eb90fb11c8e74e8aff504bf98481e5ccf9d72fe9","469fd8a280e89a6edd0d704d0be4c7e0e0d8d753e314e9ce205d7006b573865f","41660a23e5db77597994e17f9f773d02976f767276faf3b5bac0510807a9a36f","69a012ff46565169534ccefb175f87b3cc331b4f94cc5d223c29a036ed771f4e","74cbec210ba601caeb063d44e510fc012075b65a0482d3fa2d2d08837649356a","ea8a58bbb6d5614855a470b2d3630197e34fc372760b2b7fa27af8f3456525a6","7ffc83877389ebb86d201749d73b5e3706490070015522805696c9b94fa95ccb","d5f41ea8dbf1ed159a0a4cfce563a917c1df32bb8ac8d321b4d3dcf67271dd25","ebaaf177e746f9f0e16c906f1ffea95af771252b07136ca6a13995508fce34aa")
index=activity AND rg_functionality="Flow" AND filehash NOT NULL AND filehash IN ("027d4020f2dd1eb473636bc112a84f0a90b6651c","06566eabf54caafe36ebe94430d392b9cf3426ba","08af4c21cd0a165695c756b6fda37016197b01e7","2ed2edec8ccc44292410042c730c190027b87930","a25c06e8545666d6d2a88c8da300cf3383149d5a","ee3795f6418fc0cacbe884a8eb803498c2b5776f","bb72ca0e19a95c48a9ee4fd658958a0ae2af44b6","4743d5202dbe565721d75f7fb1eca43266a652d4","e6a7c54c01227adcb2a180e62f0082de1c13d61ae913cda379dd0f44a0d0567b","64c9347d794243be26e811b5eb90fb11c8e74e8aff504bf98481e5ccf9d72fe9","469fd8a280e89a6edd0d704d0be4c7e0e0d8d753e314e9ce205d7006b573865f","41660a23e5db77597994e17f9f773d02976f767276faf3b5bac0510807a9a36f","69a012ff46565169534ccefb175f87b3cc331b4f94cc5d223c29a036ed771f4e","74cbec210ba601caeb063d44e510fc012075b65a0482d3fa2d2d08837649356a","ea8a58bbb6d5614855a470b2d3630197e34fc372760b2b7fa27af8f3456525a6","7ffc83877389ebb86d201749d73b5e3706490070015522805696c9b94fa95ccb","d5f41ea8dbf1ed159a0a4cfce563a917c1df32bb8ac8d321b4d3dcf67271dd25","ebaaf177e746f9f0e16c906f1ffea95af771252b07136ca6a13995508fce34aa")
index=activity AND rg_functionality="Flow" AND oldfilehash NOT NULL AND oldfilehash IN ("027d4020f2dd1eb473636bc112a84f0a90b6651c","06566eabf54caafe36ebe94430d392b9cf3426ba","08af4c21cd0a165695c756b6fda37016197b01e7","2ed2edec8ccc44292410042c730c190027b87930","a25c06e8545666d6d2a88c8da300cf3383149d5a","ee3795f6418fc0cacbe884a8eb803498c2b5776f","bb72ca0e19a95c48a9ee4fd658958a0ae2af44b6","4743d5202dbe565721d75f7fb1eca43266a652d4","e6a7c54c01227adcb2a180e62f0082de1c13d61ae913cda379dd0f44a0d0567b","64c9347d794243be26e811b5eb90fb11c8e74e8aff504bf98481e5ccf9d72fe9","469fd8a280e89a6edd0d704d0be4c7e0e0d8d753e314e9ce205d7006b573865f","41660a23e5db77597994e17f9f773d02976f767276faf3b5bac0510807a9a36f","69a012ff46565169534ccefb175f87b3cc331b4f94cc5d223c29a036ed771f4e","74cbec210ba601caeb063d44e510fc012075b65a0482d3fa2d2d08837649356a","ea8a58bbb6d5614855a470b2d3630197e34fc372760b2b7fa27af8f3456525a6","7ffc83877389ebb86d201749d73b5e3706490070015522805696c9b94fa95ccb","d5f41ea8dbf1ed159a0a4cfce563a917c1df32bb8ac8d321b4d3dcf67271dd25","ebaaf177e746f9f0e16c906f1ffea95af771252b07136ca6a13995508fce34aa")
index=activity AND rg_functionality="Flow" AND customstring3 NOT NULL AND customstring3 IN ("027d4020f2dd1eb473636bc112a84f0a90b6651c","06566eabf54caafe36ebe94430d392b9cf3426ba","08af4c21cd0a165695c756b6fda37016197b01e7","2ed2edec8ccc44292410042c730c190027b87930","a25c06e8545666d6d2a88c8da300cf3383149d5a","ee3795f6418fc0cacbe884a8eb803498c2b5776f","bb72ca0e19a95c48a9ee4fd658958a0ae2af44b6","4743d5202dbe565721d75f7fb1eca43266a652d4","e6a7c54c01227adcb2a180e62f0082de1c13d61ae913cda379dd0f44a0d0567b","64c9347d794243be26e811b5eb90fb11c8e74e8aff504bf98481e5ccf9d72fe9","469fd8a280e89a6edd0d704d0be4c7e0e0d8d753e314e9ce205d7006b573865f","41660a23e5db77597994e17f9f773d02976f767276faf3b5bac0510807a9a36f","69a012ff46565169534ccefb175f87b3cc331b4f94cc5d223c29a036ed771f4e","74cbec210ba601caeb063d44e510fc012075b65a0482d3fa2d2d08837649356a","ea8a58bbb6d5614855a470b2d3630197e34fc372760b2b7fa27af8f3456525a6","7ffc83877389ebb86d201749d73b5e3706490070015522805696c9b94fa95ccb","d5f41ea8dbf1ed159a0a4cfce563a917c1df32bb8ac8d321b4d3dcf67271dd25","ebaaf177e746f9f0e16c906f1ffea95af771252b07136ca6a13995508fce34aa")
index=activity AND rg_functionality="Flow" AND customstring64 NOT NULL AND customstring64 IN ("027d4020f2dd1eb473636bc112a84f0a90b6651c","06566eabf54caafe36ebe94430d392b9cf3426ba","08af4c21cd0a165695c756b6fda37016197b01e7","2ed2edec8ccc44292410042c730c190027b87930","a25c06e8545666d6d2a88c8da300cf3383149d5a","ee3795f6418fc0cacbe884a8eb803498c2b5776f","bb72ca0e19a95c48a9ee4fd658958a0ae2af44b6","4743d5202dbe565721d75f7fb1eca43266a652d4","e6a7c54c01227adcb2a180e62f0082de1c13d61ae913cda379dd0f44a0d0567b","64c9347d794243be26e811b5eb90fb11c8e74e8aff504bf98481e5ccf9d72fe9","469fd8a280e89a6edd0d704d0be4c7e0e0d8d753e314e9ce205d7006b573865f","41660a23e5db77597994e17f9f773d02976f767276faf3b5bac0510807a9a36f","69a012ff46565169534ccefb175f87b3cc331b4f94cc5d223c29a036ed771f4e","74cbec210ba601caeb063d44e510fc012075b65a0482d3fa2d2d08837649356a","ea8a58bbb6d5614855a470b2d3630197e34fc372760b2b7fa27af8f3456525a6","7ffc83877389ebb86d201749d73b5e3706490070015522805696c9b94fa95ccb","d5f41ea8dbf1ed159a0a4cfce563a917c1df32bb8ac8d321b4d3dcf67271dd25","ebaaf177e746f9f0e16c906f1ffea95af771252b07136ca6a13995508fce34aa")
index=activity AND rg_functionality="Web Server" AND filehash NOT NULL AND filehash IN ("027d4020f2dd1eb473636bc112a84f0a90b6651c","06566eabf54caafe36ebe94430d392b9cf3426ba","08af4c21cd0a165695c756b6fda37016197b01e7","2ed2edec8ccc44292410042c730c190027b87930","a25c06e8545666d6d2a88c8da300cf3383149d5a","ee3795f6418fc0cacbe884a8eb803498c2b5776f","bb72ca0e19a95c48a9ee4fd658958a0ae2af44b6","4743d5202dbe565721d75f7fb1eca43266a652d4","e6a7c54c01227adcb2a180e62f0082de1c13d61ae913cda379dd0f44a0d0567b","64c9347d794243be26e811b5eb90fb11c8e74e8aff504bf98481e5ccf9d72fe9","469fd8a280e89a6edd0d704d0be4c7e0e0d8d753e314e9ce205d7006b573865f","41660a23e5db77597994e17f9f773d02976f767276faf3b5bac0510807a9a36f","69a012ff46565169534ccefb175f87b3cc331b4f94cc5d223c29a036ed771f4e","74cbec210ba601caeb063d44e510fc012075b65a0482d3fa2d2d08837649356a","ea8a58bbb6d5614855a470b2d3630197e34fc372760b2b7fa27af8f3456525a6","7ffc83877389ebb86d201749d73b5e3706490070015522805696c9b94fa95ccb","d5f41ea8dbf1ed159a0a4cfce563a917c1df32bb8ac8d321b4d3dcf67271dd25","ebaaf177e746f9f0e16c906f1ffea95af771252b07136ca6a13995508fce34aa")
index=activity AND rg_functionality="Web Server" AND oldfilehash NOT NULL AND oldfilehash IN ("027d4020f2dd1eb473636bc112a84f0a90b6651c","06566eabf54caafe36ebe94430d392b9cf3426ba","08af4c21cd0a165695c756b6fda37016197b01e7","2ed2edec8ccc44292410042c730c190027b87930","a25c06e8545666d6d2a88c8da300cf3383149d5a","ee3795f6418fc0cacbe884a8eb803498c2b5776f","bb72ca0e19a95c48a9ee4fd658958a0ae2af44b6","4743d5202dbe565721d75f7fb1eca43266a652d4","e6a7c54c01227adcb2a180e62f0082de1c13d61ae913cda379dd0f44a0d0567b","64c9347d794243be26e811b5eb90fb11c8e74e8aff504bf98481e5ccf9d72fe9","469fd8a280e89a6edd0d704d0be4c7e0e0d8d753e314e9ce205d7006b573865f","41660a23e5db77597994e17f9f773d02976f767276faf3b5bac0510807a9a36f","69a012ff46565169534ccefb175f87b3cc331b4f94cc5d223c29a036ed771f4e","74cbec210ba601caeb063d44e510fc012075b65a0482d3fa2d2d08837649356a","ea8a58bbb6d5614855a470b2d3630197e34fc372760b2b7fa27af8f3456525a6","7ffc83877389ebb86d201749d73b5e3706490070015522805696c9b94fa95ccb","d5f41ea8dbf1ed159a0a4cfce563a917c1df32bb8ac8d321b4d3dcf67271dd25","ebaaf177e746f9f0e16c906f1ffea95af771252b07136ca6a13995508fce34aa")
index=activity AND rg_functionality="Web Server" AND customstring3 NOT NULL AND customstring3 IN ("027d4020f2dd1eb473636bc112a84f0a90b6651c","06566eabf54caafe36ebe94430d392b9cf3426ba","08af4c21cd0a165695c756b6fda37016197b01e7","2ed2edec8ccc44292410042c730c190027b87930","a25c06e8545666d6d2a88c8da300cf3383149d5a","ee3795f6418fc0cacbe884a8eb803498c2b5776f","bb72ca0e19a95c48a9ee4fd658958a0ae2af44b6","4743d5202dbe565721d75f7fb1eca43266a652d4","e6a7c54c01227adcb2a180e62f0082de1c13d61ae913cda379dd0f44a0d0567b","64c9347d794243be26e811b5eb90fb11c8e74e8aff504bf98481e5ccf9d72fe9","469fd8a280e89a6edd0d704d0be4c7e0e0d8d753e314e9ce205d7006b573865f","41660a23e5db77597994e17f9f773d02976f767276faf3b5bac0510807a9a36f","69a012ff46565169534ccefb175f87b3cc331b4f94cc5d223c29a036ed771f4e","74cbec210ba601caeb063d44e510fc012075b65a0482d3fa2d2d08837649356a","ea8a58bbb6d5614855a470b2d3630197e34fc372760b2b7fa27af8f3456525a6","7ffc83877389ebb86d201749d73b5e3706490070015522805696c9b94fa95ccb","d5f41ea8dbf1ed159a0a4cfce563a917c1df32bb8ac8d321b4d3dcf67271dd25","ebaaf177e746f9f0e16c906f1ffea95af771252b07136ca6a13995508fce34aa")
index=activity AND rg_functionality="Web Server" AND customstring64 NOT NULL AND customstring64 IN ("027d4020f2dd1eb473636bc112a84f0a90b6651c","06566eabf54caafe36ebe94430d392b9cf3426ba","08af4c21cd0a165695c756b6fda37016197b01e7","2ed2edec8ccc44292410042c730c190027b87930","a25c06e8545666d6d2a88c8da300cf3383149d5a","ee3795f6418fc0cacbe884a8eb803498c2b5776f","bb72ca0e19a95c48a9ee4fd658958a0ae2af44b6","4743d5202dbe565721d75f7fb1eca43266a652d4","e6a7c54c01227adcb2a180e62f0082de1c13d61ae913cda379dd0f44a0d0567b","64c9347d794243be26e811b5eb90fb11c8e74e8aff504bf98481e5ccf9d72fe9","469fd8a280e89a6edd0d704d0be4c7e0e0d8d753e314e9ce205d7006b573865f","41660a23e5db77597994e17f9f773d02976f767276faf3b5bac0510807a9a36f","69a012ff46565169534ccefb175f87b3cc331b4f94cc5d223c29a036ed771f4e","74cbec210ba601caeb063d44e510fc012075b65a0482d3fa2d2d08837649356a","ea8a58bbb6d5614855a470b2d3630197e34fc372760b2b7fa27af8f3456525a6","7ffc83877389ebb86d201749d73b5e3706490070015522805696c9b94fa95ccb","d5f41ea8dbf1ed159a0a4cfce563a917c1df32bb8ac8d321b4d3dcf67271dd25","ebaaf177e746f9f0e16c906f1ffea95af771252b07136ca6a13995508fce34aa")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("027d4020f2dd1eb473636bc112a84f0a90b6651c","06566eabf54caafe36ebe94430d392b9cf3426ba","08af4c21cd0a165695c756b6fda37016197b01e7","2ed2edec8ccc44292410042c730c190027b87930","a25c06e8545666d6d2a88c8da300cf3383149d5a","ee3795f6418fc0cacbe884a8eb803498c2b5776f","bb72ca0e19a95c48a9ee4fd658958a0ae2af44b6","4743d5202dbe565721d75f7fb1eca43266a652d4","e6a7c54c01227adcb2a180e62f0082de1c13d61ae913cda379dd0f44a0d0567b","64c9347d794243be26e811b5eb90fb11c8e74e8aff504bf98481e5ccf9d72fe9","469fd8a280e89a6edd0d704d0be4c7e0e0d8d753e314e9ce205d7006b573865f","41660a23e5db77597994e17f9f773d02976f767276faf3b5bac0510807a9a36f","69a012ff46565169534ccefb175f87b3cc331b4f94cc5d223c29a036ed771f4e","74cbec210ba601caeb063d44e510fc012075b65a0482d3fa2d2d08837649356a","ea8a58bbb6d5614855a470b2d3630197e34fc372760b2b7fa27af8f3456525a6","7ffc83877389ebb86d201749d73b5e3706490070015522805696c9b94fa95ccb","d5f41ea8dbf1ed159a0a4cfce563a917c1df32bb8ac8d321b4d3dcf67271dd25","ebaaf177e746f9f0e16c906f1ffea95af771252b07136ca6a13995508fce34aa")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("027d4020f2dd1eb473636bc112a84f0a90b6651c","06566eabf54caafe36ebe94430d392b9cf3426ba","08af4c21cd0a165695c756b6fda37016197b01e7","2ed2edec8ccc44292410042c730c190027b87930","a25c06e8545666d6d2a88c8da300cf3383149d5a","ee3795f6418fc0cacbe884a8eb803498c2b5776f","bb72ca0e19a95c48a9ee4fd658958a0ae2af44b6","4743d5202dbe565721d75f7fb1eca43266a652d4","e6a7c54c01227adcb2a180e62f0082de1c13d61ae913cda379dd0f44a0d0567b","64c9347d794243be26e811b5eb90fb11c8e74e8aff504bf98481e5ccf9d72fe9","469fd8a280e89a6edd0d704d0be4c7e0e0d8d753e314e9ce205d7006b573865f","41660a23e5db77597994e17f9f773d02976f767276faf3b5bac0510807a9a36f","69a012ff46565169534ccefb175f87b3cc331b4f94cc5d223c29a036ed771f4e","74cbec210ba601caeb063d44e510fc012075b65a0482d3fa2d2d08837649356a","ea8a58bbb6d5614855a470b2d3630197e34fc372760b2b7fa27af8f3456525a6","7ffc83877389ebb86d201749d73b5e3706490070015522805696c9b94fa95ccb","d5f41ea8dbf1ed159a0a4cfce563a917c1df32bb8ac8d321b4d3dcf67271dd25","ebaaf177e746f9f0e16c906f1ffea95af771252b07136ca6a13995508fce34aa")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("027d4020f2dd1eb473636bc112a84f0a90b6651c","06566eabf54caafe36ebe94430d392b9cf3426ba","08af4c21cd0a165695c756b6fda37016197b01e7","2ed2edec8ccc44292410042c730c190027b87930","a25c06e8545666d6d2a88c8da300cf3383149d5a","ee3795f6418fc0cacbe884a8eb803498c2b5776f","bb72ca0e19a95c48a9ee4fd658958a0ae2af44b6","4743d5202dbe565721d75f7fb1eca43266a652d4","e6a7c54c01227adcb2a180e62f0082de1c13d61ae913cda379dd0f44a0d0567b","64c9347d794243be26e811b5eb90fb11c8e74e8aff504bf98481e5ccf9d72fe9","469fd8a280e89a6edd0d704d0be4c7e0e0d8d753e314e9ce205d7006b573865f","41660a23e5db77597994e17f9f773d02976f767276faf3b5bac0510807a9a36f","69a012ff46565169534ccefb175f87b3cc331b4f94cc5d223c29a036ed771f4e","74cbec210ba601caeb063d44e510fc012075b65a0482d3fa2d2d08837649356a","ea8a58bbb6d5614855a470b2d3630197e34fc372760b2b7fa27af8f3456525a6","7ffc83877389ebb86d201749d73b5e3706490070015522805696c9b94fa95ccb","d5f41ea8dbf1ed159a0a4cfce563a917c1df32bb8ac8d321b4d3dcf67271dd25","ebaaf177e746f9f0e16c906f1ffea95af771252b07136ca6a13995508fce34aa")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring64 NOT NULL AND customstring64 IN ("027d4020f2dd1eb473636bc112a84f0a90b6651c","06566eabf54caafe36ebe94430d392b9cf3426ba","08af4c21cd0a165695c756b6fda37016197b01e7","2ed2edec8ccc44292410042c730c190027b87930","a25c06e8545666d6d2a88c8da300cf3383149d5a","ee3795f6418fc0cacbe884a8eb803498c2b5776f","bb72ca0e19a95c48a9ee4fd658958a0ae2af44b6","4743d5202dbe565721d75f7fb1eca43266a652d4","e6a7c54c01227adcb2a180e62f0082de1c13d61ae913cda379dd0f44a0d0567b","64c9347d794243be26e811b5eb90fb11c8e74e8aff504bf98481e5ccf9d72fe9","469fd8a280e89a6edd0d704d0be4c7e0e0d8d753e314e9ce205d7006b573865f","41660a23e5db77597994e17f9f773d02976f767276faf3b5bac0510807a9a36f","69a012ff46565169534ccefb175f87b3cc331b4f94cc5d223c29a036ed771f4e","74cbec210ba601caeb063d44e510fc012075b65a0482d3fa2d2d08837649356a","ea8a58bbb6d5614855a470b2d3630197e34fc372760b2b7fa27af8f3456525a6","7ffc83877389ebb86d201749d73b5e3706490070015522805696c9b94fa95ccb","d5f41ea8dbf1ed159a0a4cfce563a917c1df32bb8ac8d321b4d3dcf67271dd25","ebaaf177e746f9f0e16c906f1ffea95af771252b07136ca6a13995508fce34aa")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("027d4020f2dd1eb473636bc112a84f0a90b6651c","06566eabf54caafe36ebe94430d392b9cf3426ba","08af4c21cd0a165695c756b6fda37016197b01e7","2ed2edec8ccc44292410042c730c190027b87930","a25c06e8545666d6d2a88c8da300cf3383149d5a","ee3795f6418fc0cacbe884a8eb803498c2b5776f","bb72ca0e19a95c48a9ee4fd658958a0ae2af44b6","4743d5202dbe565721d75f7fb1eca43266a652d4","e6a7c54c01227adcb2a180e62f0082de1c13d61ae913cda379dd0f44a0d0567b","64c9347d794243be26e811b5eb90fb11c8e74e8aff504bf98481e5ccf9d72fe9","469fd8a280e89a6edd0d704d0be4c7e0e0d8d753e314e9ce205d7006b573865f","41660a23e5db77597994e17f9f773d02976f767276faf3b5bac0510807a9a36f","69a012ff46565169534ccefb175f87b3cc331b4f94cc5d223c29a036ed771f4e","74cbec210ba601caeb063d44e510fc012075b65a0482d3fa2d2d08837649356a","ea8a58bbb6d5614855a470b2d3630197e34fc372760b2b7fa27af8f3456525a6","7ffc83877389ebb86d201749d73b5e3706490070015522805696c9b94fa95ccb","d5f41ea8dbf1ed159a0a4cfce563a917c1df32bb8ac8d321b4d3dcf67271dd25","ebaaf177e746f9f0e16c906f1ffea95af771252b07136ca6a13995508fce34aa")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("027d4020f2dd1eb473636bc112a84f0a90b6651c","06566eabf54caafe36ebe94430d392b9cf3426ba","08af4c21cd0a165695c756b6fda37016197b01e7","2ed2edec8ccc44292410042c730c190027b87930","a25c06e8545666d6d2a88c8da300cf3383149d5a","ee3795f6418fc0cacbe884a8eb803498c2b5776f","bb72ca0e19a95c48a9ee4fd658958a0ae2af44b6","4743d5202dbe565721d75f7fb1eca43266a652d4","e6a7c54c01227adcb2a180e62f0082de1c13d61ae913cda379dd0f44a0d0567b","64c9347d794243be26e811b5eb90fb11c8e74e8aff504bf98481e5ccf9d72fe9","469fd8a280e89a6edd0d704d0be4c7e0e0d8d753e314e9ce205d7006b573865f","41660a23e5db77597994e17f9f773d02976f767276faf3b5bac0510807a9a36f","69a012ff46565169534ccefb175f87b3cc331b4f94cc5d223c29a036ed771f4e","74cbec210ba601caeb063d44e510fc012075b65a0482d3fa2d2d08837649356a","ea8a58bbb6d5614855a470b2d3630197e34fc372760b2b7fa27af8f3456525a6","7ffc83877389ebb86d201749d73b5e3706490070015522805696c9b94fa95ccb","d5f41ea8dbf1ed159a0a4cfce563a917c1df32bb8ac8d321b4d3dcf67271dd25","ebaaf177e746f9f0e16c906f1ffea95af771252b07136ca6a13995508fce34aa")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("027d4020f2dd1eb473636bc112a84f0a90b6651c","06566eabf54caafe36ebe94430d392b9cf3426ba","08af4c21cd0a165695c756b6fda37016197b01e7","2ed2edec8ccc44292410042c730c190027b87930","a25c06e8545666d6d2a88c8da300cf3383149d5a","ee3795f6418fc0cacbe884a8eb803498c2b5776f","bb72ca0e19a95c48a9ee4fd658958a0ae2af44b6","4743d5202dbe565721d75f7fb1eca43266a652d4","e6a7c54c01227adcb2a180e62f0082de1c13d61ae913cda379dd0f44a0d0567b","64c9347d794243be26e811b5eb90fb11c8e74e8aff504bf98481e5ccf9d72fe9","469fd8a280e89a6edd0d704d0be4c7e0e0d8d753e314e9ce205d7006b573865f","41660a23e5db77597994e17f9f773d02976f767276faf3b5bac0510807a9a36f","69a012ff46565169534ccefb175f87b3cc331b4f94cc5d223c29a036ed771f4e","74cbec210ba601caeb063d44e510fc012075b65a0482d3fa2d2d08837649356a","ea8a58bbb6d5614855a470b2d3630197e34fc372760b2b7fa27af8f3456525a6","7ffc83877389ebb86d201749d73b5e3706490070015522805696c9b94fa95ccb","d5f41ea8dbf1ed159a0a4cfce563a917c1df32bb8ac8d321b4d3dcf67271dd25","ebaaf177e746f9f0e16c906f1ffea95af771252b07136ca6a13995508fce34aa")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring64 NOT NULL AND customstring64 IN ("027d4020f2dd1eb473636bc112a84f0a90b6651c","06566eabf54caafe36ebe94430d392b9cf3426ba","08af4c21cd0a165695c756b6fda37016197b01e7","2ed2edec8ccc44292410042c730c190027b87930","a25c06e8545666d6d2a88c8da300cf3383149d5a","ee3795f6418fc0cacbe884a8eb803498c2b5776f","bb72ca0e19a95c48a9ee4fd658958a0ae2af44b6","4743d5202dbe565721d75f7fb1eca43266a652d4","e6a7c54c01227adcb2a180e62f0082de1c13d61ae913cda379dd0f44a0d0567b","64c9347d794243be26e811b5eb90fb11c8e74e8aff504bf98481e5ccf9d72fe9","469fd8a280e89a6edd0d704d0be4c7e0e0d8d753e314e9ce205d7006b573865f","41660a23e5db77597994e17f9f773d02976f767276faf3b5bac0510807a9a36f","69a012ff46565169534ccefb175f87b3cc331b4f94cc5d223c29a036ed771f4e","74cbec210ba601caeb063d44e510fc012075b65a0482d3fa2d2d08837649356a","ea8a58bbb6d5614855a470b2d3630197e34fc372760b2b7fa27af8f3456525a6","7ffc83877389ebb86d201749d73b5e3706490070015522805696c9b94fa95ccb","d5f41ea8dbf1ed159a0a4cfce563a917c1df32bb8ac8d321b4d3dcf67271dd25","ebaaf177e746f9f0e16c906f1ffea95af771252b07136ca6a13995508fce34aa")
index=activity AND rg_functionality="Web Application Firewall" AND filehash NOT NULL AND filehash IN ("027d4020f2dd1eb473636bc112a84f0a90b6651c","06566eabf54caafe36ebe94430d392b9cf3426ba","08af4c21cd0a165695c756b6fda37016197b01e7","2ed2edec8ccc44292410042c730c190027b87930","a25c06e8545666d6d2a88c8da300cf3383149d5a","ee3795f6418fc0cacbe884a8eb803498c2b5776f","bb72ca0e19a95c48a9ee4fd658958a0ae2af44b6","4743d5202dbe565721d75f7fb1eca43266a652d4","e6a7c54c01227adcb2a180e62f0082de1c13d61ae913cda379dd0f44a0d0567b","64c9347d794243be26e811b5eb90fb11c8e74e8aff504bf98481e5ccf9d72fe9","469fd8a280e89a6edd0d704d0be4c7e0e0d8d753e314e9ce205d7006b573865f","41660a23e5db77597994e17f9f773d02976f767276faf3b5bac0510807a9a36f","69a012ff46565169534ccefb175f87b3cc331b4f94cc5d223c29a036ed771f4e","74cbec210ba601caeb063d44e510fc012075b65a0482d3fa2d2d08837649356a","ea8a58bbb6d5614855a470b2d3630197e34fc372760b2b7fa27af8f3456525a6","7ffc83877389ebb86d201749d73b5e3706490070015522805696c9b94fa95ccb","d5f41ea8dbf1ed159a0a4cfce563a917c1df32bb8ac8d321b4d3dcf67271dd25","ebaaf177e746f9f0e16c906f1ffea95af771252b07136ca6a13995508fce34aa")
index=activity AND rg_functionality="Web Application Firewall" AND oldfilehash NOT NULL AND oldfilehash IN ("027d4020f2dd1eb473636bc112a84f0a90b6651c","06566eabf54caafe36ebe94430d392b9cf3426ba","08af4c21cd0a165695c756b6fda37016197b01e7","2ed2edec8ccc44292410042c730c190027b87930","a25c06e8545666d6d2a88c8da300cf3383149d5a","ee3795f6418fc0cacbe884a8eb803498c2b5776f","bb72ca0e19a95c48a9ee4fd658958a0ae2af44b6","4743d5202dbe565721d75f7fb1eca43266a652d4","e6a7c54c01227adcb2a180e62f0082de1c13d61ae913cda379dd0f44a0d0567b","64c9347d794243be26e811b5eb90fb11c8e74e8aff504bf98481e5ccf9d72fe9","469fd8a280e89a6edd0d704d0be4c7e0e0d8d753e314e9ce205d7006b573865f","41660a23e5db77597994e17f9f773d02976f767276faf3b5bac0510807a9a36f","69a012ff46565169534ccefb175f87b3cc331b4f94cc5d223c29a036ed771f4e","74cbec210ba601caeb063d44e510fc012075b65a0482d3fa2d2d08837649356a","ea8a58bbb6d5614855a470b2d3630197e34fc372760b2b7fa27af8f3456525a6","7ffc83877389ebb86d201749d73b5e3706490070015522805696c9b94fa95ccb","d5f41ea8dbf1ed159a0a4cfce563a917c1df32bb8ac8d321b4d3dcf67271dd25","ebaaf177e746f9f0e16c906f1ffea95af771252b07136ca6a13995508fce34aa")
index=activity AND rg_functionality="Web Application Firewall" AND customstring3 NOT NULL AND customstring3 IN ("027d4020f2dd1eb473636bc112a84f0a90b6651c","06566eabf54caafe36ebe94430d392b9cf3426ba","08af4c21cd0a165695c756b6fda37016197b01e7","2ed2edec8ccc44292410042c730c190027b87930","a25c06e8545666d6d2a88c8da300cf3383149d5a","ee3795f6418fc0cacbe884a8eb803498c2b5776f","bb72ca0e19a95c48a9ee4fd658958a0ae2af44b6","4743d5202dbe565721d75f7fb1eca43266a652d4","e6a7c54c01227adcb2a180e62f0082de1c13d61ae913cda379dd0f44a0d0567b","64c9347d794243be26e811b5eb90fb11c8e74e8aff504bf98481e5ccf9d72fe9","469fd8a280e89a6edd0d704d0be4c7e0e0d8d753e314e9ce205d7006b573865f","41660a23e5db77597994e17f9f773d02976f767276faf3b5bac0510807a9a36f","69a012ff46565169534ccefb175f87b3cc331b4f94cc5d223c29a036ed771f4e","74cbec210ba601caeb063d44e510fc012075b65a0482d3fa2d2d08837649356a","ea8a58bbb6d5614855a470b2d3630197e34fc372760b2b7fa27af8f3456525a6","7ffc83877389ebb86d201749d73b5e3706490070015522805696c9b94fa95ccb","d5f41ea8dbf1ed159a0a4cfce563a917c1df32bb8ac8d321b4d3dcf67271dd25","ebaaf177e746f9f0e16c906f1ffea95af771252b07136ca6a13995508fce34aa")
index=activity AND rg_functionality="Web Application Firewall" AND customstring64 NOT NULL AND customstring64 IN ("027d4020f2dd1eb473636bc112a84f0a90b6651c","06566eabf54caafe36ebe94430d392b9cf3426ba","08af4c21cd0a165695c756b6fda37016197b01e7","2ed2edec8ccc44292410042c730c190027b87930","a25c06e8545666d6d2a88c8da300cf3383149d5a","ee3795f6418fc0cacbe884a8eb803498c2b5776f","bb72ca0e19a95c48a9ee4fd658958a0ae2af44b6","4743d5202dbe565721d75f7fb1eca43266a652d4","e6a7c54c01227adcb2a180e62f0082de1c13d61ae913cda379dd0f44a0d0567b","64c9347d794243be26e811b5eb90fb11c8e74e8aff504bf98481e5ccf9d72fe9","469fd8a280e89a6edd0d704d0be4c7e0e0d8d753e314e9ce205d7006b573865f","41660a23e5db77597994e17f9f773d02976f767276faf3b5bac0510807a9a36f","69a012ff46565169534ccefb175f87b3cc331b4f94cc5d223c29a036ed771f4e","74cbec210ba601caeb063d44e510fc012075b65a0482d3fa2d2d08837649356a","ea8a58bbb6d5614855a470b2d3630197e34fc372760b2b7fa27af8f3456525a6","7ffc83877389ebb86d201749d73b5e3706490070015522805696c9b94fa95ccb","d5f41ea8dbf1ed159a0a4cfce563a917c1df32bb8ac8d321b4d3dcf67271dd25","ebaaf177e746f9f0e16c906f1ffea95af771252b07136ca6a13995508fce34aa")
index=activity AND rg_functionality="Endpoint management systems" AND filehash NOT NULL AND filehash IN ("027d4020f2dd1eb473636bc112a84f0a90b6651c","06566eabf54caafe36ebe94430d392b9cf3426ba","08af4c21cd0a165695c756b6fda37016197b01e7","2ed2edec8ccc44292410042c730c190027b87930","a25c06e8545666d6d2a88c8da300cf3383149d5a","ee3795f6418fc0cacbe884a8eb803498c2b5776f","bb72ca0e19a95c48a9ee4fd658958a0ae2af44b6","4743d5202dbe565721d75f7fb1eca43266a652d4","e6a7c54c01227adcb2a180e62f0082de1c13d61ae913cda379dd0f44a0d0567b","64c9347d794243be26e811b5eb90fb11c8e74e8aff504bf98481e5ccf9d72fe9","469fd8a280e89a6edd0d704d0be4c7e0e0d8d753e314e9ce205d7006b573865f","41660a23e5db77597994e17f9f773d02976f767276faf3b5bac0510807a9a36f","69a012ff46565169534ccefb175f87b3cc331b4f94cc5d223c29a036ed771f4e","74cbec210ba601caeb063d44e510fc012075b65a0482d3fa2d2d08837649356a","ea8a58bbb6d5614855a470b2d3630197e34fc372760b2b7fa27af8f3456525a6","7ffc83877389ebb86d201749d73b5e3706490070015522805696c9b94fa95ccb","d5f41ea8dbf1ed159a0a4cfce563a917c1df32bb8ac8d321b4d3dcf67271dd25","ebaaf177e746f9f0e16c906f1ffea95af771252b07136ca6a13995508fce34aa")
index=activity AND rg_functionality="Endpoint management systems" AND oldfilehash NOT NULL AND oldfilehash IN ("027d4020f2dd1eb473636bc112a84f0a90b6651c","06566eabf54caafe36ebe94430d392b9cf3426ba","08af4c21cd0a165695c756b6fda37016197b01e7","2ed2edec8ccc44292410042c730c190027b87930","a25c06e8545666d6d2a88c8da300cf3383149d5a","ee3795f6418fc0cacbe884a8eb803498c2b5776f","bb72ca0e19a95c48a9ee4fd658958a0ae2af44b6","4743d5202dbe565721d75f7fb1eca43266a652d4","e6a7c54c01227adcb2a180e62f0082de1c13d61ae913cda379dd0f44a0d0567b","64c9347d794243be26e811b5eb90fb11c8e74e8aff504bf98481e5ccf9d72fe9","469fd8a280e89a6edd0d704d0be4c7e0e0d8d753e314e9ce205d7006b573865f","41660a23e5db77597994e17f9f773d02976f767276faf3b5bac0510807a9a36f","69a012ff46565169534ccefb175f87b3cc331b4f94cc5d223c29a036ed771f4e","74cbec210ba601caeb063d44e510fc012075b65a0482d3fa2d2d08837649356a","ea8a58bbb6d5614855a470b2d3630197e34fc372760b2b7fa27af8f3456525a6","7ffc83877389ebb86d201749d73b5e3706490070015522805696c9b94fa95ccb","d5f41ea8dbf1ed159a0a4cfce563a917c1df32bb8ac8d321b4d3dcf67271dd25","ebaaf177e746f9f0e16c906f1ffea95af771252b07136ca6a13995508fce34aa")
index=activity AND rg_functionality="Endpoint management systems" AND customstring3 NOT NULL AND customstring3 IN ("027d4020f2dd1eb473636bc112a84f0a90b6651c","06566eabf54caafe36ebe94430d392b9cf3426ba","08af4c21cd0a165695c756b6fda37016197b01e7","2ed2edec8ccc44292410042c730c190027b87930","a25c06e8545666d6d2a88c8da300cf3383149d5a","ee3795f6418fc0cacbe884a8eb803498c2b5776f","bb72ca0e19a95c48a9ee4fd658958a0ae2af44b6","4743d5202dbe565721d75f7fb1eca43266a652d4","e6a7c54c01227adcb2a180e62f0082de1c13d61ae913cda379dd0f44a0d0567b","64c9347d794243be26e811b5eb90fb11c8e74e8aff504bf98481e5ccf9d72fe9","469fd8a280e89a6edd0d704d0be4c7e0e0d8d753e314e9ce205d7006b573865f","41660a23e5db77597994e17f9f773d02976f767276faf3b5bac0510807a9a36f","69a012ff46565169534ccefb175f87b3cc331b4f94cc5d223c29a036ed771f4e","74cbec210ba601caeb063d44e510fc012075b65a0482d3fa2d2d08837649356a","ea8a58bbb6d5614855a470b2d3630197e34fc372760b2b7fa27af8f3456525a6","7ffc83877389ebb86d201749d73b5e3706490070015522805696c9b94fa95ccb","d5f41ea8dbf1ed159a0a4cfce563a917c1df32bb8ac8d321b4d3dcf67271dd25","ebaaf177e746f9f0e16c906f1ffea95af771252b07136ca6a13995508fce34aa")
index=activity AND rg_functionality="Endpoint management systems" AND customstring64 NOT NULL AND customstring64 IN ("027d4020f2dd1eb473636bc112a84f0a90b6651c","06566eabf54caafe36ebe94430d392b9cf3426ba","08af4c21cd0a165695c756b6fda37016197b01e7","2ed2edec8ccc44292410042c730c190027b87930","a25c06e8545666d6d2a88c8da300cf3383149d5a","ee3795f6418fc0cacbe884a8eb803498c2b5776f","bb72ca0e19a95c48a9ee4fd658958a0ae2af44b6","4743d5202dbe565721d75f7fb1eca43266a652d4","e6a7c54c01227adcb2a180e62f0082de1c13d61ae913cda379dd0f44a0d0567b","64c9347d794243be26e811b5eb90fb11c8e74e8aff504bf98481e5ccf9d72fe9","469fd8a280e89a6edd0d704d0be4c7e0e0d8d753e314e9ce205d7006b573865f","41660a23e5db77597994e17f9f773d02976f767276faf3b5bac0510807a9a36f","69a012ff46565169534ccefb175f87b3cc331b4f94cc5d223c29a036ed771f4e","74cbec210ba601caeb063d44e510fc012075b65a0482d3fa2d2d08837649356a","ea8a58bbb6d5614855a470b2d3630197e34fc372760b2b7fa27af8f3456525a6","7ffc83877389ebb86d201749d73b5e3706490070015522805696c9b94fa95ccb","d5f41ea8dbf1ed159a0a4cfce563a917c1df32bb8ac8d321b4d3dcf67271dd25","ebaaf177e746f9f0e16c906f1ffea95af771252b07136ca6a13995508fce34aa")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("027d4020f2dd1eb473636bc112a84f0a90b6651c","06566eabf54caafe36ebe94430d392b9cf3426ba","08af4c21cd0a165695c756b6fda37016197b01e7","2ed2edec8ccc44292410042c730c190027b87930","a25c06e8545666d6d2a88c8da300cf3383149d5a","ee3795f6418fc0cacbe884a8eb803498c2b5776f","bb72ca0e19a95c48a9ee4fd658958a0ae2af44b6","4743d5202dbe565721d75f7fb1eca43266a652d4","e6a7c54c01227adcb2a180e62f0082de1c13d61ae913cda379dd0f44a0d0567b","64c9347d794243be26e811b5eb90fb11c8e74e8aff504bf98481e5ccf9d72fe9","469fd8a280e89a6edd0d704d0be4c7e0e0d8d753e314e9ce205d7006b573865f","41660a23e5db77597994e17f9f773d02976f767276faf3b5bac0510807a9a36f","69a012ff46565169534ccefb175f87b3cc331b4f94cc5d223c29a036ed771f4e","74cbec210ba601caeb063d44e510fc012075b65a0482d3fa2d2d08837649356a","ea8a58bbb6d5614855a470b2d3630197e34fc372760b2b7fa27af8f3456525a6","7ffc83877389ebb86d201749d73b5e3706490070015522805696c9b94fa95ccb","d5f41ea8dbf1ed159a0a4cfce563a917c1df32bb8ac8d321b4d3dcf67271dd25","ebaaf177e746f9f0e16c906f1ffea95af771252b07136ca6a13995508fce34aa")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("027d4020f2dd1eb473636bc112a84f0a90b6651c","06566eabf54caafe36ebe94430d392b9cf3426ba","08af4c21cd0a165695c756b6fda37016197b01e7","2ed2edec8ccc44292410042c730c190027b87930","a25c06e8545666d6d2a88c8da300cf3383149d5a","ee3795f6418fc0cacbe884a8eb803498c2b5776f","bb72ca0e19a95c48a9ee4fd658958a0ae2af44b6","4743d5202dbe565721d75f7fb1eca43266a652d4","e6a7c54c01227adcb2a180e62f0082de1c13d61ae913cda379dd0f44a0d0567b","64c9347d794243be26e811b5eb90fb11c8e74e8aff504bf98481e5ccf9d72fe9","469fd8a280e89a6edd0d704d0be4c7e0e0d8d753e314e9ce205d7006b573865f","41660a23e5db77597994e17f9f773d02976f767276faf3b5bac0510807a9a36f","69a012ff46565169534ccefb175f87b3cc331b4f94cc5d223c29a036ed771f4e","74cbec210ba601caeb063d44e510fc012075b65a0482d3fa2d2d08837649356a","ea8a58bbb6d5614855a470b2d3630197e34fc372760b2b7fa27af8f3456525a6","7ffc83877389ebb86d201749d73b5e3706490070015522805696c9b94fa95ccb","d5f41ea8dbf1ed159a0a4cfce563a917c1df32bb8ac8d321b4d3dcf67271dd25","ebaaf177e746f9f0e16c906f1ffea95af771252b07136ca6a13995508fce34aa")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("027d4020f2dd1eb473636bc112a84f0a90b6651c","06566eabf54caafe36ebe94430d392b9cf3426ba","08af4c21cd0a165695c756b6fda37016197b01e7","2ed2edec8ccc44292410042c730c190027b87930","a25c06e8545666d6d2a88c8da300cf3383149d5a","ee3795f6418fc0cacbe884a8eb803498c2b5776f","bb72ca0e19a95c48a9ee4fd658958a0ae2af44b6","4743d5202dbe565721d75f7fb1eca43266a652d4","e6a7c54c01227adcb2a180e62f0082de1c13d61ae913cda379dd0f44a0d0567b","64c9347d794243be26e811b5eb90fb11c8e74e8aff504bf98481e5ccf9d72fe9","469fd8a280e89a6edd0d704d0be4c7e0e0d8d753e314e9ce205d7006b573865f","41660a23e5db77597994e17f9f773d02976f767276faf3b5bac0510807a9a36f","69a012ff46565169534ccefb175f87b3cc331b4f94cc5d223c29a036ed771f4e","74cbec210ba601caeb063d44e510fc012075b65a0482d3fa2d2d08837649356a","ea8a58bbb6d5614855a470b2d3630197e34fc372760b2b7fa27af8f3456525a6","7ffc83877389ebb86d201749d73b5e3706490070015522805696c9b94fa95ccb","d5f41ea8dbf1ed159a0a4cfce563a917c1df32bb8ac8d321b4d3dcf67271dd25","ebaaf177e746f9f0e16c906f1ffea95af771252b07136ca6a13995508fce34aa")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring64 NOT NULL AND customstring64 IN ("027d4020f2dd1eb473636bc112a84f0a90b6651c","06566eabf54caafe36ebe94430d392b9cf3426ba","08af4c21cd0a165695c756b6fda37016197b01e7","2ed2edec8ccc44292410042c730c190027b87930","a25c06e8545666d6d2a88c8da300cf3383149d5a","ee3795f6418fc0cacbe884a8eb803498c2b5776f","bb72ca0e19a95c48a9ee4fd658958a0ae2af44b6","4743d5202dbe565721d75f7fb1eca43266a652d4","e6a7c54c01227adcb2a180e62f0082de1c13d61ae913cda379dd0f44a0d0567b","64c9347d794243be26e811b5eb90fb11c8e74e8aff504bf98481e5ccf9d72fe9","469fd8a280e89a6edd0d704d0be4c7e0e0d8d753e314e9ce205d7006b573865f","41660a23e5db77597994e17f9f773d02976f767276faf3b5bac0510807a9a36f","69a012ff46565169534ccefb175f87b3cc331b4f94cc5d223c29a036ed771f4e","74cbec210ba601caeb063d44e510fc012075b65a0482d3fa2d2d08837649356a","ea8a58bbb6d5614855a470b2d3630197e34fc372760b2b7fa27af8f3456525a6","7ffc83877389ebb86d201749d73b5e3706490070015522805696c9b94fa95ccb","d5f41ea8dbf1ed159a0a4cfce563a917c1df32bb8ac8d321b4d3dcf67271dd25","ebaaf177e746f9f0e16c906f1ffea95af771252b07136ca6a13995508fce34aa")
index=activity AND rg_functionality="Cloud Application Audit" AND filehash NOT NULL AND filehash IN ("027d4020f2dd1eb473636bc112a84f0a90b6651c","06566eabf54caafe36ebe94430d392b9cf3426ba","08af4c21cd0a165695c756b6fda37016197b01e7","2ed2edec8ccc44292410042c730c190027b87930","a25c06e8545666d6d2a88c8da300cf3383149d5a","ee3795f6418fc0cacbe884a8eb803498c2b5776f","bb72ca0e19a95c48a9ee4fd658958a0ae2af44b6","4743d5202dbe565721d75f7fb1eca43266a652d4","e6a7c54c01227adcb2a180e62f0082de1c13d61ae913cda379dd0f44a0d0567b","64c9347d794243be26e811b5eb90fb11c8e74e8aff504bf98481e5ccf9d72fe9","469fd8a280e89a6edd0d704d0be4c7e0e0d8d753e314e9ce205d7006b573865f","41660a23e5db77597994e17f9f773d02976f767276faf3b5bac0510807a9a36f","69a012ff46565169534ccefb175f87b3cc331b4f94cc5d223c29a036ed771f4e","74cbec210ba601caeb063d44e510fc012075b65a0482d3fa2d2d08837649356a","ea8a58bbb6d5614855a470b2d3630197e34fc372760b2b7fa27af8f3456525a6","7ffc83877389ebb86d201749d73b5e3706490070015522805696c9b94fa95ccb","d5f41ea8dbf1ed159a0a4cfce563a917c1df32bb8ac8d321b4d3dcf67271dd25","ebaaf177e746f9f0e16c906f1ffea95af771252b07136ca6a13995508fce34aa")
index=activity AND rg_functionality="Cloud Application Audit" AND oldfilehash NOT NULL AND oldfilehash IN ("027d4020f2dd1eb473636bc112a84f0a90b6651c","06566eabf54caafe36ebe94430d392b9cf3426ba","08af4c21cd0a165695c756b6fda37016197b01e7","2ed2edec8ccc44292410042c730c190027b87930","a25c06e8545666d6d2a88c8da300cf3383149d5a","ee3795f6418fc0cacbe884a8eb803498c2b5776f","bb72ca0e19a95c48a9ee4fd658958a0ae2af44b6","4743d5202dbe565721d75f7fb1eca43266a652d4","e6a7c54c01227adcb2a180e62f0082de1c13d61ae913cda379dd0f44a0d0567b","64c9347d794243be26e811b5eb90fb11c8e74e8aff504bf98481e5ccf9d72fe9","469fd8a280e89a6edd0d704d0be4c7e0e0d8d753e314e9ce205d7006b573865f","41660a23e5db77597994e17f9f773d02976f767276faf3b5bac0510807a9a36f","69a012ff46565169534ccefb175f87b3cc331b4f94cc5d223c29a036ed771f4e","74cbec210ba601caeb063d44e510fc012075b65a0482d3fa2d2d08837649356a","ea8a58bbb6d5614855a470b2d3630197e34fc372760b2b7fa27af8f3456525a6","7ffc83877389ebb86d201749d73b5e3706490070015522805696c9b94fa95ccb","d5f41ea8dbf1ed159a0a4cfce563a917c1df32bb8ac8d321b4d3dcf67271dd25","ebaaf177e746f9f0e16c906f1ffea95af771252b07136ca6a13995508fce34aa")
index=activity AND rg_functionality="Cloud Application Audit" AND customstring3 NOT NULL AND customstring3 IN ("027d4020f2dd1eb473636bc112a84f0a90b6651c","06566eabf54caafe36ebe94430d392b9cf3426ba","08af4c21cd0a165695c756b6fda37016197b01e7","2ed2edec8ccc44292410042c730c190027b87930","a25c06e8545666d6d2a88c8da300cf3383149d5a","ee3795f6418fc0cacbe884a8eb803498c2b5776f","bb72ca0e19a95c48a9ee4fd658958a0ae2af44b6","4743d5202dbe565721d75f7fb1eca43266a652d4","e6a7c54c01227adcb2a180e62f0082de1c13d61ae913cda379dd0f44a0d0567b","64c9347d794243be26e811b5eb90fb11c8e74e8aff504bf98481e5ccf9d72fe9","469fd8a280e89a6edd0d704d0be4c7e0e0d8d753e314e9ce205d7006b573865f","41660a23e5db77597994e17f9f773d02976f767276faf3b5bac0510807a9a36f","69a012ff46565169534ccefb175f87b3cc331b4f94cc5d223c29a036ed771f4e","74cbec210ba601caeb063d44e510fc012075b65a0482d3fa2d2d08837649356a","ea8a58bbb6d5614855a470b2d3630197e34fc372760b2b7fa27af8f3456525a6","7ffc83877389ebb86d201749d73b5e3706490070015522805696c9b94fa95ccb","d5f41ea8dbf1ed159a0a4cfce563a917c1df32bb8ac8d321b4d3dcf67271dd25","ebaaf177e746f9f0e16c906f1ffea95af771252b07136ca6a13995508fce34aa")
index=activity AND rg_functionality="Cloud Application Audit" AND customstring64 NOT NULL AND customstring64 IN ("027d4020f2dd1eb473636bc112a84f0a90b6651c","06566eabf54caafe36ebe94430d392b9cf3426ba","08af4c21cd0a165695c756b6fda37016197b01e7","2ed2edec8ccc44292410042c730c190027b87930","a25c06e8545666d6d2a88c8da300cf3383149d5a","ee3795f6418fc0cacbe884a8eb803498c2b5776f","bb72ca0e19a95c48a9ee4fd658958a0ae2af44b6","4743d5202dbe565721d75f7fb1eca43266a652d4","e6a7c54c01227adcb2a180e62f0082de1c13d61ae913cda379dd0f44a0d0567b","64c9347d794243be26e811b5eb90fb11c8e74e8aff504bf98481e5ccf9d72fe9","469fd8a280e89a6edd0d704d0be4c7e0e0d8d753e314e9ce205d7006b573865f","41660a23e5db77597994e17f9f773d02976f767276faf3b5bac0510807a9a36f","69a012ff46565169534ccefb175f87b3cc331b4f94cc5d223c29a036ed771f4e","74cbec210ba601caeb063d44e510fc012075b65a0482d3fa2d2d08837649356a","ea8a58bbb6d5614855a470b2d3630197e34fc372760b2b7fa27af8f3456525a6","7ffc83877389ebb86d201749d73b5e3706490070015522805696c9b94fa95ccb","d5f41ea8dbf1ed159a0a4cfce563a917c1df32bb8ac8d321b4d3dcf67271dd25","ebaaf177e746f9f0e16c906f1ffea95af771252b07136ca6a13995508fce34aa")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND filehash NOT NULL AND filehash IN ("027d4020f2dd1eb473636bc112a84f0a90b6651c","06566eabf54caafe36ebe94430d392b9cf3426ba","08af4c21cd0a165695c756b6fda37016197b01e7","2ed2edec8ccc44292410042c730c190027b87930","a25c06e8545666d6d2a88c8da300cf3383149d5a","ee3795f6418fc0cacbe884a8eb803498c2b5776f","bb72ca0e19a95c48a9ee4fd658958a0ae2af44b6","4743d5202dbe565721d75f7fb1eca43266a652d4","e6a7c54c01227adcb2a180e62f0082de1c13d61ae913cda379dd0f44a0d0567b","64c9347d794243be26e811b5eb90fb11c8e74e8aff504bf98481e5ccf9d72fe9","469fd8a280e89a6edd0d704d0be4c7e0e0d8d753e314e9ce205d7006b573865f","41660a23e5db77597994e17f9f773d02976f767276faf3b5bac0510807a9a36f","69a012ff46565169534ccefb175f87b3cc331b4f94cc5d223c29a036ed771f4e","74cbec210ba601caeb063d44e510fc012075b65a0482d3fa2d2d08837649356a","ea8a58bbb6d5614855a470b2d3630197e34fc372760b2b7fa27af8f3456525a6","7ffc83877389ebb86d201749d73b5e3706490070015522805696c9b94fa95ccb","d5f41ea8dbf1ed159a0a4cfce563a917c1df32bb8ac8d321b4d3dcf67271dd25","ebaaf177e746f9f0e16c906f1ffea95af771252b07136ca6a13995508fce34aa")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND oldfilehash NOT NULL AND oldfilehash IN ("027d4020f2dd1eb473636bc112a84f0a90b6651c","06566eabf54caafe36ebe94430d392b9cf3426ba","08af4c21cd0a165695c756b6fda37016197b01e7","2ed2edec8ccc44292410042c730c190027b87930","a25c06e8545666d6d2a88c8da300cf3383149d5a","ee3795f6418fc0cacbe884a8eb803498c2b5776f","bb72ca0e19a95c48a9ee4fd658958a0ae2af44b6","4743d5202dbe565721d75f7fb1eca43266a652d4","e6a7c54c01227adcb2a180e62f0082de1c13d61ae913cda379dd0f44a0d0567b","64c9347d794243be26e811b5eb90fb11c8e74e8aff504bf98481e5ccf9d72fe9","469fd8a280e89a6edd0d704d0be4c7e0e0d8d753e314e9ce205d7006b573865f","41660a23e5db77597994e17f9f773d02976f767276faf3b5bac0510807a9a36f","69a012ff46565169534ccefb175f87b3cc331b4f94cc5d223c29a036ed771f4e","74cbec210ba601caeb063d44e510fc012075b65a0482d3fa2d2d08837649356a","ea8a58bbb6d5614855a470b2d3630197e34fc372760b2b7fa27af8f3456525a6","7ffc83877389ebb86d201749d73b5e3706490070015522805696c9b94fa95ccb","d5f41ea8dbf1ed159a0a4cfce563a917c1df32bb8ac8d321b4d3dcf67271dd25","ebaaf177e746f9f0e16c906f1ffea95af771252b07136ca6a13995508fce34aa")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND customstring3 NOT NULL AND customstring3 IN ("027d4020f2dd1eb473636bc112a84f0a90b6651c","06566eabf54caafe36ebe94430d392b9cf3426ba","08af4c21cd0a165695c756b6fda37016197b01e7","2ed2edec8ccc44292410042c730c190027b87930","a25c06e8545666d6d2a88c8da300cf3383149d5a","ee3795f6418fc0cacbe884a8eb803498c2b5776f","bb72ca0e19a95c48a9ee4fd658958a0ae2af44b6","4743d5202dbe565721d75f7fb1eca43266a652d4","e6a7c54c01227adcb2a180e62f0082de1c13d61ae913cda379dd0f44a0d0567b","64c9347d794243be26e811b5eb90fb11c8e74e8aff504bf98481e5ccf9d72fe9","469fd8a280e89a6edd0d704d0be4c7e0e0d8d753e314e9ce205d7006b573865f","41660a23e5db77597994e17f9f773d02976f767276faf3b5bac0510807a9a36f","69a012ff46565169534ccefb175f87b3cc331b4f94cc5d223c29a036ed771f4e","74cbec210ba601caeb063d44e510fc012075b65a0482d3fa2d2d08837649356a","ea8a58bbb6d5614855a470b2d3630197e34fc372760b2b7fa27af8f3456525a6","7ffc83877389ebb86d201749d73b5e3706490070015522805696c9b94fa95ccb","d5f41ea8dbf1ed159a0a4cfce563a917c1df32bb8ac8d321b4d3dcf67271dd25","ebaaf177e746f9f0e16c906f1ffea95af771252b07136ca6a13995508fce34aa")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND customstring64 NOT NULL AND customstring64 IN ("027d4020f2dd1eb473636bc112a84f0a90b6651c","06566eabf54caafe36ebe94430d392b9cf3426ba","08af4c21cd0a165695c756b6fda37016197b01e7","2ed2edec8ccc44292410042c730c190027b87930","a25c06e8545666d6d2a88c8da300cf3383149d5a","ee3795f6418fc0cacbe884a8eb803498c2b5776f","bb72ca0e19a95c48a9ee4fd658958a0ae2af44b6","4743d5202dbe565721d75f7fb1eca43266a652d4","e6a7c54c01227adcb2a180e62f0082de1c13d61ae913cda379dd0f44a0d0567b","64c9347d794243be26e811b5eb90fb11c8e74e8aff504bf98481e5ccf9d72fe9","469fd8a280e89a6edd0d704d0be4c7e0e0d8d753e314e9ce205d7006b573865f","41660a23e5db77597994e17f9f773d02976f767276faf3b5bac0510807a9a36f","69a012ff46565169534ccefb175f87b3cc331b4f94cc5d223c29a036ed771f4e","74cbec210ba601caeb063d44e510fc012075b65a0482d3fa2d2d08837649356a","ea8a58bbb6d5614855a470b2d3630197e34fc372760b2b7fa27af8f3456525a6","7ffc83877389ebb86d201749d73b5e3706490070015522805696c9b94fa95ccb","d5f41ea8dbf1ed159a0a4cfce563a917c1df32bb8ac8d321b4d3dcf67271dd25","ebaaf177e746f9f0e16c906f1ffea95af771252b07136ca6a13995508fce34aa")
index=activity AND rg_functionality="Unix / Linux / AIX" AND filehash NOT NULL AND filehash IN ("027d4020f2dd1eb473636bc112a84f0a90b6651c","06566eabf54caafe36ebe94430d392b9cf3426ba","08af4c21cd0a165695c756b6fda37016197b01e7","2ed2edec8ccc44292410042c730c190027b87930","a25c06e8545666d6d2a88c8da300cf3383149d5a","ee3795f6418fc0cacbe884a8eb803498c2b5776f","bb72ca0e19a95c48a9ee4fd658958a0ae2af44b6","4743d5202dbe565721d75f7fb1eca43266a652d4","e6a7c54c01227adcb2a180e62f0082de1c13d61ae913cda379dd0f44a0d0567b","64c9347d794243be26e811b5eb90fb11c8e74e8aff504bf98481e5ccf9d72fe9","469fd8a280e89a6edd0d704d0be4c7e0e0d8d753e314e9ce205d7006b573865f","41660a23e5db77597994e17f9f773d02976f767276faf3b5bac0510807a9a36f","69a012ff46565169534ccefb175f87b3cc331b4f94cc5d223c29a036ed771f4e","74cbec210ba601caeb063d44e510fc012075b65a0482d3fa2d2d08837649356a","ea8a58bbb6d5614855a470b2d3630197e34fc372760b2b7fa27af8f3456525a6","7ffc83877389ebb86d201749d73b5e3706490070015522805696c9b94fa95ccb","d5f41ea8dbf1ed159a0a4cfce563a917c1df32bb8ac8d321b4d3dcf67271dd25","ebaaf177e746f9f0e16c906f1ffea95af771252b07136ca6a13995508fce34aa")
index=activity AND rg_functionality="Unix / Linux / AIX" AND oldfilehash NOT NULL AND oldfilehash IN ("027d4020f2dd1eb473636bc112a84f0a90b6651c","06566eabf54caafe36ebe94430d392b9cf3426ba","08af4c21cd0a165695c756b6fda37016197b01e7","2ed2edec8ccc44292410042c730c190027b87930","a25c06e8545666d6d2a88c8da300cf3383149d5a","ee3795f6418fc0cacbe884a8eb803498c2b5776f","bb72ca0e19a95c48a9ee4fd658958a0ae2af44b6","4743d5202dbe565721d75f7fb1eca43266a652d4","e6a7c54c01227adcb2a180e62f0082de1c13d61ae913cda379dd0f44a0d0567b","64c9347d794243be26e811b5eb90fb11c8e74e8aff504bf98481e5ccf9d72fe9","469fd8a280e89a6edd0d704d0be4c7e0e0d8d753e314e9ce205d7006b573865f","41660a23e5db77597994e17f9f773d02976f767276faf3b5bac0510807a9a36f","69a012ff46565169534ccefb175f87b3cc331b4f94cc5d223c29a036ed771f4e","74cbec210ba601caeb063d44e510fc012075b65a0482d3fa2d2d08837649356a","ea8a58bbb6d5614855a470b2d3630197e34fc372760b2b7fa27af8f3456525a6","7ffc83877389ebb86d201749d73b5e3706490070015522805696c9b94fa95ccb","d5f41ea8dbf1ed159a0a4cfce563a917c1df32bb8ac8d321b4d3dcf67271dd25","ebaaf177e746f9f0e16c906f1ffea95af771252b07136ca6a13995508fce34aa")
index=activity AND rg_functionality="Unix / Linux / AIX" AND customstring3 NOT NULL AND customstring3 IN ("027d4020f2dd1eb473636bc112a84f0a90b6651c","06566eabf54caafe36ebe94430d392b9cf3426ba","08af4c21cd0a165695c756b6fda37016197b01e7","2ed2edec8ccc44292410042c730c190027b87930","a25c06e8545666d6d2a88c8da300cf3383149d5a","ee3795f6418fc0cacbe884a8eb803498c2b5776f","bb72ca0e19a95c48a9ee4fd658958a0ae2af44b6","4743d5202dbe565721d75f7fb1eca43266a652d4","e6a7c54c01227adcb2a180e62f0082de1c13d61ae913cda379dd0f44a0d0567b","64c9347d794243be26e811b5eb90fb11c8e74e8aff504bf98481e5ccf9d72fe9","469fd8a280e89a6edd0d704d0be4c7e0e0d8d753e314e9ce205d7006b573865f","41660a23e5db77597994e17f9f773d02976f767276faf3b5bac0510807a9a36f","69a012ff46565169534ccefb175f87b3cc331b4f94cc5d223c29a036ed771f4e","74cbec210ba601caeb063d44e510fc012075b65a0482d3fa2d2d08837649356a","ea8a58bbb6d5614855a470b2d3630197e34fc372760b2b7fa27af8f3456525a6","7ffc83877389ebb86d201749d73b5e3706490070015522805696c9b94fa95ccb","d5f41ea8dbf1ed159a0a4cfce563a917c1df32bb8ac8d321b4d3dcf67271dd25","ebaaf177e746f9f0e16c906f1ffea95af771252b07136ca6a13995508fce34aa")
index=activity AND rg_functionality="Unix / Linux / AIX" AND customstring64 NOT NULL AND customstring64 IN ("027d4020f2dd1eb473636bc112a84f0a90b6651c","06566eabf54caafe36ebe94430d392b9cf3426ba","08af4c21cd0a165695c756b6fda37016197b01e7","2ed2edec8ccc44292410042c730c190027b87930","a25c06e8545666d6d2a88c8da300cf3383149d5a","ee3795f6418fc0cacbe884a8eb803498c2b5776f","bb72ca0e19a95c48a9ee4fd658958a0ae2af44b6","4743d5202dbe565721d75f7fb1eca43266a652d4","e6a7c54c01227adcb2a180e62f0082de1c13d61ae913cda379dd0f44a0d0567b","64c9347d794243be26e811b5eb90fb11c8e74e8aff504bf98481e5ccf9d72fe9","469fd8a280e89a6edd0d704d0be4c7e0e0d8d753e314e9ce205d7006b573865f","41660a23e5db77597994e17f9f773d02976f767276faf3b5bac0510807a9a36f","69a012ff46565169534ccefb175f87b3cc331b4f94cc5d223c29a036ed771f4e","74cbec210ba601caeb063d44e510fc012075b65a0482d3fa2d2d08837649356a","ea8a58bbb6d5614855a470b2d3630197e34fc372760b2b7fa27af8f3456525a6","7ffc83877389ebb86d201749d73b5e3706490070015522805696c9b94fa95ccb","d5f41ea8dbf1ed159a0a4cfce563a917c1df32bb8ac8d321b4d3dcf67271dd25","ebaaf177e746f9f0e16c906f1ffea95af771252b07136ca6a13995508fce34aa")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND filehash NOT NULL AND filehash IN ("027d4020f2dd1eb473636bc112a84f0a90b6651c","06566eabf54caafe36ebe94430d392b9cf3426ba","08af4c21cd0a165695c756b6fda37016197b01e7","2ed2edec8ccc44292410042c730c190027b87930","a25c06e8545666d6d2a88c8da300cf3383149d5a","ee3795f6418fc0cacbe884a8eb803498c2b5776f","bb72ca0e19a95c48a9ee4fd658958a0ae2af44b6","4743d5202dbe565721d75f7fb1eca43266a652d4","e6a7c54c01227adcb2a180e62f0082de1c13d61ae913cda379dd0f44a0d0567b","64c9347d794243be26e811b5eb90fb11c8e74e8aff504bf98481e5ccf9d72fe9","469fd8a280e89a6edd0d704d0be4c7e0e0d8d753e314e9ce205d7006b573865f","41660a23e5db77597994e17f9f773d02976f767276faf3b5bac0510807a9a36f","69a012ff46565169534ccefb175f87b3cc331b4f94cc5d223c29a036ed771f4e","74cbec210ba601caeb063d44e510fc012075b65a0482d3fa2d2d08837649356a","ea8a58bbb6d5614855a470b2d3630197e34fc372760b2b7fa27af8f3456525a6","7ffc83877389ebb86d201749d73b5e3706490070015522805696c9b94fa95ccb","d5f41ea8dbf1ed159a0a4cfce563a917c1df32bb8ac8d321b4d3dcf67271dd25","ebaaf177e746f9f0e16c906f1ffea95af771252b07136ca6a13995508fce34aa")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND oldfilehash NOT NULL AND oldfilehash IN ("027d4020f2dd1eb473636bc112a84f0a90b6651c","06566eabf54caafe36ebe94430d392b9cf3426ba","08af4c21cd0a165695c756b6fda37016197b01e7","2ed2edec8ccc44292410042c730c190027b87930","a25c06e8545666d6d2a88c8da300cf3383149d5a","ee3795f6418fc0cacbe884a8eb803498c2b5776f","bb72ca0e19a95c48a9ee4fd658958a0ae2af44b6","4743d5202dbe565721d75f7fb1eca43266a652d4","e6a7c54c01227adcb2a180e62f0082de1c13d61ae913cda379dd0f44a0d0567b","64c9347d794243be26e811b5eb90fb11c8e74e8aff504bf98481e5ccf9d72fe9","469fd8a280e89a6edd0d704d0be4c7e0e0d8d753e314e9ce205d7006b573865f","41660a23e5db77597994e17f9f773d02976f767276faf3b5bac0510807a9a36f","69a012ff46565169534ccefb175f87b3cc331b4f94cc5d223c29a036ed771f4e","74cbec210ba601caeb063d44e510fc012075b65a0482d3fa2d2d08837649356a","ea8a58bbb6d5614855a470b2d3630197e34fc372760b2b7fa27af8f3456525a6","7ffc83877389ebb86d201749d73b5e3706490070015522805696c9b94fa95ccb","d5f41ea8dbf1ed159a0a4cfce563a917c1df32bb8ac8d321b4d3dcf67271dd25","ebaaf177e746f9f0e16c906f1ffea95af771252b07136ca6a13995508fce34aa")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND customstring3 NOT NULL AND customstring3 IN ("027d4020f2dd1eb473636bc112a84f0a90b6651c","06566eabf54caafe36ebe94430d392b9cf3426ba","08af4c21cd0a165695c756b6fda37016197b01e7","2ed2edec8ccc44292410042c730c190027b87930","a25c06e8545666d6d2a88c8da300cf3383149d5a","ee3795f6418fc0cacbe884a8eb803498c2b5776f","bb72ca0e19a95c48a9ee4fd658958a0ae2af44b6","4743d5202dbe565721d75f7fb1eca43266a652d4","e6a7c54c01227adcb2a180e62f0082de1c13d61ae913cda379dd0f44a0d0567b","64c9347d794243be26e811b5eb90fb11c8e74e8aff504bf98481e5ccf9d72fe9","469fd8a280e89a6edd0d704d0be4c7e0e0d8d753e314e9ce205d7006b573865f","41660a23e5db77597994e17f9f773d02976f767276faf3b5bac0510807a9a36f","69a012ff46565169534ccefb175f87b3cc331b4f94cc5d223c29a036ed771f4e","74cbec210ba601caeb063d44e510fc012075b65a0482d3fa2d2d08837649356a","ea8a58bbb6d5614855a470b2d3630197e34fc372760b2b7fa27af8f3456525a6","7ffc83877389ebb86d201749d73b5e3706490070015522805696c9b94fa95ccb","d5f41ea8dbf1ed159a0a4cfce563a917c1df32bb8ac8d321b4d3dcf67271dd25","ebaaf177e746f9f0e16c906f1ffea95af771252b07136ca6a13995508fce34aa")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND customstring64 NOT NULL AND customstring64 IN ("027d4020f2dd1eb473636bc112a84f0a90b6651c","06566eabf54caafe36ebe94430d392b9cf3426ba","08af4c21cd0a165695c756b6fda37016197b01e7","2ed2edec8ccc44292410042c730c190027b87930","a25c06e8545666d6d2a88c8da300cf3383149d5a","ee3795f6418fc0cacbe884a8eb803498c2b5776f","bb72ca0e19a95c48a9ee4fd658958a0ae2af44b6","4743d5202dbe565721d75f7fb1eca43266a652d4","e6a7c54c01227adcb2a180e62f0082de1c13d61ae913cda379dd0f44a0d0567b","64c9347d794243be26e811b5eb90fb11c8e74e8aff504bf98481e5ccf9d72fe9","469fd8a280e89a6edd0d704d0be4c7e0e0d8d753e314e9ce205d7006b573865f","41660a23e5db77597994e17f9f773d02976f767276faf3b5bac0510807a9a36f","69a012ff46565169534ccefb175f87b3cc331b4f94cc5d223c29a036ed771f4e","74cbec210ba601caeb063d44e510fc012075b65a0482d3fa2d2d08837649356a","ea8a58bbb6d5614855a470b2d3630197e34fc372760b2b7fa27af8f3456525a6","7ffc83877389ebb86d201749d73b5e3706490070015522805696c9b94fa95ccb","d5f41ea8dbf1ed159a0a4cfce563a917c1df32bb8ac8d321b4d3dcf67271dd25","ebaaf177e746f9f0e16c906f1ffea95af771252b07136ca6a13995508fce34aa")
index=activity AND rg_functionality="Cloud Application Security Broker" AND filehash NOT NULL AND filehash IN ("027d4020f2dd1eb473636bc112a84f0a90b6651c","06566eabf54caafe36ebe94430d392b9cf3426ba","08af4c21cd0a165695c756b6fda37016197b01e7","2ed2edec8ccc44292410042c730c190027b87930","a25c06e8545666d6d2a88c8da300cf3383149d5a","ee3795f6418fc0cacbe884a8eb803498c2b5776f","bb72ca0e19a95c48a9ee4fd658958a0ae2af44b6","4743d5202dbe565721d75f7fb1eca43266a652d4","e6a7c54c01227adcb2a180e62f0082de1c13d61ae913cda379dd0f44a0d0567b","64c9347d794243be26e811b5eb90fb11c8e74e8aff504bf98481e5ccf9d72fe9","469fd8a280e89a6edd0d704d0be4c7e0e0d8d753e314e9ce205d7006b573865f","41660a23e5db77597994e17f9f773d02976f767276faf3b5bac0510807a9a36f","69a012ff46565169534ccefb175f87b3cc331b4f94cc5d223c29a036ed771f4e","74cbec210ba601caeb063d44e510fc012075b65a0482d3fa2d2d08837649356a","ea8a58bbb6d5614855a470b2d3630197e34fc372760b2b7fa27af8f3456525a6","7ffc83877389ebb86d201749d73b5e3706490070015522805696c9b94fa95ccb","d5f41ea8dbf1ed159a0a4cfce563a917c1df32bb8ac8d321b4d3dcf67271dd25","ebaaf177e746f9f0e16c906f1ffea95af771252b07136ca6a13995508fce34aa")
index=activity AND rg_functionality="Cloud Application Security Broker" AND oldfilehash NOT NULL AND oldfilehash IN ("027d4020f2dd1eb473636bc112a84f0a90b6651c","06566eabf54caafe36ebe94430d392b9cf3426ba","08af4c21cd0a165695c756b6fda37016197b01e7","2ed2edec8ccc44292410042c730c190027b87930","a25c06e8545666d6d2a88c8da300cf3383149d5a","ee3795f6418fc0cacbe884a8eb803498c2b5776f","bb72ca0e19a95c48a9ee4fd658958a0ae2af44b6","4743d5202dbe565721d75f7fb1eca43266a652d4","e6a7c54c01227adcb2a180e62f0082de1c13d61ae913cda379dd0f44a0d0567b","64c9347d794243be26e811b5eb90fb11c8e74e8aff504bf98481e5ccf9d72fe9","469fd8a280e89a6edd0d704d0be4c7e0e0d8d753e314e9ce205d7006b573865f","41660a23e5db77597994e17f9f773d02976f767276faf3b5bac0510807a9a36f","69a012ff46565169534ccefb175f87b3cc331b4f94cc5d223c29a036ed771f4e","74cbec210ba601caeb063d44e510fc012075b65a0482d3fa2d2d08837649356a","ea8a58bbb6d5614855a470b2d3630197e34fc372760b2b7fa27af8f3456525a6","7ffc83877389ebb86d201749d73b5e3706490070015522805696c9b94fa95ccb","d5f41ea8dbf1ed159a0a4cfce563a917c1df32bb8ac8d321b4d3dcf67271dd25","ebaaf177e746f9f0e16c906f1ffea95af771252b07136ca6a13995508fce34aa")
index=activity AND rg_functionality="Cloud Application Security Broker" AND customstring3 NOT NULL AND customstring3 IN ("027d4020f2dd1eb473636bc112a84f0a90b6651c","06566eabf54caafe36ebe94430d392b9cf3426ba","08af4c21cd0a165695c756b6fda37016197b01e7","2ed2edec8ccc44292410042c730c190027b87930","a25c06e8545666d6d2a88c8da300cf3383149d5a","ee3795f6418fc0cacbe884a8eb803498c2b5776f","bb72ca0e19a95c48a9ee4fd658958a0ae2af44b6","4743d5202dbe565721d75f7fb1eca43266a652d4","e6a7c54c01227adcb2a180e62f0082de1c13d61ae913cda379dd0f44a0d0567b","64c9347d794243be26e811b5eb90fb11c8e74e8aff504bf98481e5ccf9d72fe9","469fd8a280e89a6edd0d704d0be4c7e0e0d8d753e314e9ce205d7006b573865f","41660a23e5db77597994e17f9f773d02976f767276faf3b5bac0510807a9a36f","69a012ff46565169534ccefb175f87b3cc331b4f94cc5d223c29a036ed771f4e","74cbec210ba601caeb063d44e510fc012075b65a0482d3fa2d2d08837649356a","ea8a58bbb6d5614855a470b2d3630197e34fc372760b2b7fa27af8f3456525a6","7ffc83877389ebb86d201749d73b5e3706490070015522805696c9b94fa95ccb","d5f41ea8dbf1ed159a0a4cfce563a917c1df32bb8ac8d321b4d3dcf67271dd25","ebaaf177e746f9f0e16c906f1ffea95af771252b07136ca6a13995508fce34aa")
index=activity AND rg_functionality="Cloud Application Security Broker" AND customstring64 NOT NULL AND customstring64 IN ("027d4020f2dd1eb473636bc112a84f0a90b6651c","06566eabf54caafe36ebe94430d392b9cf3426ba","08af4c21cd0a165695c756b6fda37016197b01e7","2ed2edec8ccc44292410042c730c190027b87930","a25c06e8545666d6d2a88c8da300cf3383149d5a","ee3795f6418fc0cacbe884a8eb803498c2b5776f","bb72ca0e19a95c48a9ee4fd658958a0ae2af44b6","4743d5202dbe565721d75f7fb1eca43266a652d4","e6a7c54c01227adcb2a180e62f0082de1c13d61ae913cda379dd0f44a0d0567b","64c9347d794243be26e811b5eb90fb11c8e74e8aff504bf98481e5ccf9d72fe9","469fd8a280e89a6edd0d704d0be4c7e0e0d8d753e314e9ce205d7006b573865f","41660a23e5db77597994e17f9f773d02976f767276faf3b5bac0510807a9a36f","69a012ff46565169534ccefb175f87b3cc331b4f94cc5d223c29a036ed771f4e","74cbec210ba601caeb063d44e510fc012075b65a0482d3fa2d2d08837649356a","ea8a58bbb6d5614855a470b2d3630197e34fc372760b2b7fa27af8f3456525a6","7ffc83877389ebb86d201749d73b5e3706490070015522805696c9b94fa95ccb","d5f41ea8dbf1ed159a0a4cfce563a917c1df32bb8ac8d321b4d3dcf67271dd25","ebaaf177e746f9f0e16c906f1ffea95af771252b07136ca6a13995508fce34aa")
index=activity AND rg_functionality="Source Code Repository" AND filehash NOT NULL AND filehash IN ("027d4020f2dd1eb473636bc112a84f0a90b6651c","06566eabf54caafe36ebe94430d392b9cf3426ba","08af4c21cd0a165695c756b6fda37016197b01e7","2ed2edec8ccc44292410042c730c190027b87930","a25c06e8545666d6d2a88c8da300cf3383149d5a","ee3795f6418fc0cacbe884a8eb803498c2b5776f","bb72ca0e19a95c48a9ee4fd658958a0ae2af44b6","4743d5202dbe565721d75f7fb1eca43266a652d4","e6a7c54c01227adcb2a180e62f0082de1c13d61ae913cda379dd0f44a0d0567b","64c9347d794243be26e811b5eb90fb11c8e74e8aff504bf98481e5ccf9d72fe9","469fd8a280e89a6edd0d704d0be4c7e0e0d8d753e314e9ce205d7006b573865f","41660a23e5db77597994e17f9f773d02976f767276faf3b5bac0510807a9a36f","69a012ff46565169534ccefb175f87b3cc331b4f94cc5d223c29a036ed771f4e","74cbec210ba601caeb063d44e510fc012075b65a0482d3fa2d2d08837649356a","ea8a58bbb6d5614855a470b2d3630197e34fc372760b2b7fa27af8f3456525a6","7ffc83877389ebb86d201749d73b5e3706490070015522805696c9b94fa95ccb","d5f41ea8dbf1ed159a0a4cfce563a917c1df32bb8ac8d321b4d3dcf67271dd25","ebaaf177e746f9f0e16c906f1ffea95af771252b07136ca6a13995508fce34aa")
index=activity AND rg_functionality="Source Code Repository" AND oldfilehash NOT NULL AND oldfilehash IN ("027d4020f2dd1eb473636bc112a84f0a90b6651c","06566eabf54caafe36ebe94430d392b9cf3426ba","08af4c21cd0a165695c756b6fda37016197b01e7","2ed2edec8ccc44292410042c730c190027b87930","a25c06e8545666d6d2a88c8da300cf3383149d5a","ee3795f6418fc0cacbe884a8eb803498c2b5776f","bb72ca0e19a95c48a9ee4fd658958a0ae2af44b6","4743d5202dbe565721d75f7fb1eca43266a652d4","e6a7c54c01227adcb2a180e62f0082de1c13d61ae913cda379dd0f44a0d0567b","64c9347d794243be26e811b5eb90fb11c8e74e8aff504bf98481e5ccf9d72fe9","469fd8a280e89a6edd0d704d0be4c7e0e0d8d753e314e9ce205d7006b573865f","41660a23e5db77597994e17f9f773d02976f767276faf3b5bac0510807a9a36f","69a012ff46565169534ccefb175f87b3cc331b4f94cc5d223c29a036ed771f4e","74cbec210ba601caeb063d44e510fc012075b65a0482d3fa2d2d08837649356a","ea8a58bbb6d5614855a470b2d3630197e34fc372760b2b7fa27af8f3456525a6","7ffc83877389ebb86d201749d73b5e3706490070015522805696c9b94fa95ccb","d5f41ea8dbf1ed159a0a4cfce563a917c1df32bb8ac8d321b4d3dcf67271dd25","ebaaf177e746f9f0e16c906f1ffea95af771252b07136ca6a13995508fce34aa")
index=activity AND rg_functionality="Source Code Repository" AND customstring3 NOT NULL AND customstring3 IN ("027d4020f2dd1eb473636bc112a84f0a90b6651c","06566eabf54caafe36ebe94430d392b9cf3426ba","08af4c21cd0a165695c756b6fda37016197b01e7","2ed2edec8ccc44292410042c730c190027b87930","a25c06e8545666d6d2a88c8da300cf3383149d5a","ee3795f6418fc0cacbe884a8eb803498c2b5776f","bb72ca0e19a95c48a9ee4fd658958a0ae2af44b6","4743d5202dbe565721d75f7fb1eca43266a652d4","e6a7c54c01227adcb2a180e62f0082de1c13d61ae913cda379dd0f44a0d0567b","64c9347d794243be26e811b5eb90fb11c8e74e8aff504bf98481e5ccf9d72fe9","469fd8a280e89a6edd0d704d0be4c7e0e0d8d753e314e9ce205d7006b573865f","41660a23e5db77597994e17f9f773d02976f767276faf3b5bac0510807a9a36f","69a012ff46565169534ccefb175f87b3cc331b4f94cc5d223c29a036ed771f4e","74cbec210ba601caeb063d44e510fc012075b65a0482d3fa2d2d08837649356a","ea8a58bbb6d5614855a470b2d3630197e34fc372760b2b7fa27af8f3456525a6","7ffc83877389ebb86d201749d73b5e3706490070015522805696c9b94fa95ccb","d5f41ea8dbf1ed159a0a4cfce563a917c1df32bb8ac8d321b4d3dcf67271dd25","ebaaf177e746f9f0e16c906f1ffea95af771252b07136ca6a13995508fce34aa")
index=activity AND rg_functionality="Source Code Repository" AND customstring64 NOT NULL AND customstring64 IN ("027d4020f2dd1eb473636bc112a84f0a90b6651c","06566eabf54caafe36ebe94430d392b9cf3426ba","08af4c21cd0a165695c756b6fda37016197b01e7","2ed2edec8ccc44292410042c730c190027b87930","a25c06e8545666d6d2a88c8da300cf3383149d5a","ee3795f6418fc0cacbe884a8eb803498c2b5776f","bb72ca0e19a95c48a9ee4fd658958a0ae2af44b6","4743d5202dbe565721d75f7fb1eca43266a652d4","e6a7c54c01227adcb2a180e62f0082de1c13d61ae913cda379dd0f44a0d0567b","64c9347d794243be26e811b5eb90fb11c8e74e8aff504bf98481e5ccf9d72fe9","469fd8a280e89a6edd0d704d0be4c7e0e0d8d753e314e9ce205d7006b573865f","41660a23e5db77597994e17f9f773d02976f767276faf3b5bac0510807a9a36f","69a012ff46565169534ccefb175f87b3cc331b4f94cc5d223c29a036ed771f4e","74cbec210ba601caeb063d44e510fc012075b65a0482d3fa2d2d08837649356a","ea8a58bbb6d5614855a470b2d3630197e34fc372760b2b7fa27af8f3456525a6","7ffc83877389ebb86d201749d73b5e3706490070015522805696c9b94fa95ccb","d5f41ea8dbf1ed159a0a4cfce563a917c1df32bb8ac8d321b4d3dcf67271dd25","ebaaf177e746f9f0e16c906f1ffea95af771252b07136ca6a13995508fce34aa")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("027d4020f2dd1eb473636bc112a84f0a90b6651c","06566eabf54caafe36ebe94430d392b9cf3426ba","08af4c21cd0a165695c756b6fda37016197b01e7","2ed2edec8ccc44292410042c730c190027b87930","a25c06e8545666d6d2a88c8da300cf3383149d5a","ee3795f6418fc0cacbe884a8eb803498c2b5776f","bb72ca0e19a95c48a9ee4fd658958a0ae2af44b6","4743d5202dbe565721d75f7fb1eca43266a652d4","e6a7c54c01227adcb2a180e62f0082de1c13d61ae913cda379dd0f44a0d0567b","64c9347d794243be26e811b5eb90fb11c8e74e8aff504bf98481e5ccf9d72fe9","469fd8a280e89a6edd0d704d0be4c7e0e0d8d753e314e9ce205d7006b573865f","41660a23e5db77597994e17f9f773d02976f767276faf3b5bac0510807a9a36f","69a012ff46565169534ccefb175f87b3cc331b4f94cc5d223c29a036ed771f4e","74cbec210ba601caeb063d44e510fc012075b65a0482d3fa2d2d08837649356a","ea8a58bbb6d5614855a470b2d3630197e34fc372760b2b7fa27af8f3456525a6","7ffc83877389ebb86d201749d73b5e3706490070015522805696c9b94fa95ccb","d5f41ea8dbf1ed159a0a4cfce563a917c1df32bb8ac8d321b4d3dcf67271dd25","ebaaf177e746f9f0e16c906f1ffea95af771252b07136ca6a13995508fce34aa")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("027d4020f2dd1eb473636bc112a84f0a90b6651c","06566eabf54caafe36ebe94430d392b9cf3426ba","08af4c21cd0a165695c756b6fda37016197b01e7","2ed2edec8ccc44292410042c730c190027b87930","a25c06e8545666d6d2a88c8da300cf3383149d5a","ee3795f6418fc0cacbe884a8eb803498c2b5776f","bb72ca0e19a95c48a9ee4fd658958a0ae2af44b6","4743d5202dbe565721d75f7fb1eca43266a652d4","e6a7c54c01227adcb2a180e62f0082de1c13d61ae913cda379dd0f44a0d0567b","64c9347d794243be26e811b5eb90fb11c8e74e8aff504bf98481e5ccf9d72fe9","469fd8a280e89a6edd0d704d0be4c7e0e0d8d753e314e9ce205d7006b573865f","41660a23e5db77597994e17f9f773d02976f767276faf3b5bac0510807a9a36f","69a012ff46565169534ccefb175f87b3cc331b4f94cc5d223c29a036ed771f4e","74cbec210ba601caeb063d44e510fc012075b65a0482d3fa2d2d08837649356a","ea8a58bbb6d5614855a470b2d3630197e34fc372760b2b7fa27af8f3456525a6","7ffc83877389ebb86d201749d73b5e3706490070015522805696c9b94fa95ccb","d5f41ea8dbf1ed159a0a4cfce563a917c1df32bb8ac8d321b4d3dcf67271dd25","ebaaf177e746f9f0e16c906f1ffea95af771252b07136ca6a13995508fce34aa")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("027d4020f2dd1eb473636bc112a84f0a90b6651c","06566eabf54caafe36ebe94430d392b9cf3426ba","08af4c21cd0a165695c756b6fda37016197b01e7","2ed2edec8ccc44292410042c730c190027b87930","a25c06e8545666d6d2a88c8da300cf3383149d5a","ee3795f6418fc0cacbe884a8eb803498c2b5776f","bb72ca0e19a95c48a9ee4fd658958a0ae2af44b6","4743d5202dbe565721d75f7fb1eca43266a652d4","e6a7c54c01227adcb2a180e62f0082de1c13d61ae913cda379dd0f44a0d0567b","64c9347d794243be26e811b5eb90fb11c8e74e8aff504bf98481e5ccf9d72fe9","469fd8a280e89a6edd0d704d0be4c7e0e0d8d753e314e9ce205d7006b573865f","41660a23e5db77597994e17f9f773d02976f767276faf3b5bac0510807a9a36f","69a012ff46565169534ccefb175f87b3cc331b4f94cc5d223c29a036ed771f4e","74cbec210ba601caeb063d44e510fc012075b65a0482d3fa2d2d08837649356a","ea8a58bbb6d5614855a470b2d3630197e34fc372760b2b7fa27af8f3456525a6","7ffc83877389ebb86d201749d73b5e3706490070015522805696c9b94fa95ccb","d5f41ea8dbf1ed159a0a4cfce563a917c1df32bb8ac8d321b4d3dcf67271dd25","ebaaf177e746f9f0e16c906f1ffea95af771252b07136ca6a13995508fce34aa")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("027d4020f2dd1eb473636bc112a84f0a90b6651c","06566eabf54caafe36ebe94430d392b9cf3426ba","08af4c21cd0a165695c756b6fda37016197b01e7","2ed2edec8ccc44292410042c730c190027b87930","a25c06e8545666d6d2a88c8da300cf3383149d5a","ee3795f6418fc0cacbe884a8eb803498c2b5776f","bb72ca0e19a95c48a9ee4fd658958a0ae2af44b6","4743d5202dbe565721d75f7fb1eca43266a652d4","e6a7c54c01227adcb2a180e62f0082de1c13d61ae913cda379dd0f44a0d0567b","64c9347d794243be26e811b5eb90fb11c8e74e8aff504bf98481e5ccf9d72fe9","469fd8a280e89a6edd0d704d0be4c7e0e0d8d753e314e9ce205d7006b573865f","41660a23e5db77597994e17f9f773d02976f767276faf3b5bac0510807a9a36f","69a012ff46565169534ccefb175f87b3cc331b4f94cc5d223c29a036ed771f4e","74cbec210ba601caeb063d44e510fc012075b65a0482d3fa2d2d08837649356a","ea8a58bbb6d5614855a470b2d3630197e34fc372760b2b7fa27af8f3456525a6","7ffc83877389ebb86d201749d73b5e3706490070015522805696c9b94fa95ccb","d5f41ea8dbf1ed159a0a4cfce563a917c1df32bb8ac8d321b4d3dcf67271dd25","ebaaf177e746f9f0e16c906f1ffea95af771252b07136ca6a13995508fce34aa")
index=activity AND rg_functionality="DNS / DHCP" AND filehash NOT NULL AND filehash IN ("027d4020f2dd1eb473636bc112a84f0a90b6651c","06566eabf54caafe36ebe94430d392b9cf3426ba","08af4c21cd0a165695c756b6fda37016197b01e7","2ed2edec8ccc44292410042c730c190027b87930","a25c06e8545666d6d2a88c8da300cf3383149d5a","ee3795f6418fc0cacbe884a8eb803498c2b5776f","bb72ca0e19a95c48a9ee4fd658958a0ae2af44b6","4743d5202dbe565721d75f7fb1eca43266a652d4","e6a7c54c01227adcb2a180e62f0082de1c13d61ae913cda379dd0f44a0d0567b","64c9347d794243be26e811b5eb90fb11c8e74e8aff504bf98481e5ccf9d72fe9","469fd8a280e89a6edd0d704d0be4c7e0e0d8d753e314e9ce205d7006b573865f","41660a23e5db77597994e17f9f773d02976f767276faf3b5bac0510807a9a36f","69a012ff46565169534ccefb175f87b3cc331b4f94cc5d223c29a036ed771f4e","74cbec210ba601caeb063d44e510fc012075b65a0482d3fa2d2d08837649356a","ea8a58bbb6d5614855a470b2d3630197e34fc372760b2b7fa27af8f3456525a6","7ffc83877389ebb86d201749d73b5e3706490070015522805696c9b94fa95ccb","d5f41ea8dbf1ed159a0a4cfce563a917c1df32bb8ac8d321b4d3dcf67271dd25","ebaaf177e746f9f0e16c906f1ffea95af771252b07136ca6a13995508fce34aa")
index=activity AND rg_functionality="DNS / DHCP" AND oldfilehash NOT NULL AND oldfilehash IN ("027d4020f2dd1eb473636bc112a84f0a90b6651c","06566eabf54caafe36ebe94430d392b9cf3426ba","08af4c21cd0a165695c756b6fda37016197b01e7","2ed2edec8ccc44292410042c730c190027b87930","a25c06e8545666d6d2a88c8da300cf3383149d5a","ee3795f6418fc0cacbe884a8eb803498c2b5776f","bb72ca0e19a95c48a9ee4fd658958a0ae2af44b6","4743d5202dbe565721d75f7fb1eca43266a652d4","e6a7c54c01227adcb2a180e62f0082de1c13d61ae913cda379dd0f44a0d0567b","64c9347d794243be26e811b5eb90fb11c8e74e8aff504bf98481e5ccf9d72fe9","469fd8a280e89a6edd0d704d0be4c7e0e0d8d753e314e9ce205d7006b573865f","41660a23e5db77597994e17f9f773d02976f767276faf3b5bac0510807a9a36f","69a012ff46565169534ccefb175f87b3cc331b4f94cc5d223c29a036ed771f4e","74cbec210ba601caeb063d44e510fc012075b65a0482d3fa2d2d08837649356a","ea8a58bbb6d5614855a470b2d3630197e34fc372760b2b7fa27af8f3456525a6","7ffc83877389ebb86d201749d73b5e3706490070015522805696c9b94fa95ccb","d5f41ea8dbf1ed159a0a4cfce563a917c1df32bb8ac8d321b4d3dcf67271dd25","ebaaf177e746f9f0e16c906f1ffea95af771252b07136ca6a13995508fce34aa")
index=activity AND rg_functionality="DNS / DHCP" AND customstring3 NOT NULL AND customstring3 IN ("027d4020f2dd1eb473636bc112a84f0a90b6651c","06566eabf54caafe36ebe94430d392b9cf3426ba","08af4c21cd0a165695c756b6fda37016197b01e7","2ed2edec8ccc44292410042c730c190027b87930","a25c06e8545666d6d2a88c8da300cf3383149d5a","ee3795f6418fc0cacbe884a8eb803498c2b5776f","bb72ca0e19a95c48a9ee4fd658958a0ae2af44b6","4743d5202dbe565721d75f7fb1eca43266a652d4","e6a7c54c01227adcb2a180e62f0082de1c13d61ae913cda379dd0f44a0d0567b","64c9347d794243be26e811b5eb90fb11c8e74e8aff504bf98481e5ccf9d72fe9","469fd8a280e89a6edd0d704d0be4c7e0e0d8d753e314e9ce205d7006b573865f","41660a23e5db77597994e17f9f773d02976f767276faf3b5bac0510807a9a36f","69a012ff46565169534ccefb175f87b3cc331b4f94cc5d223c29a036ed771f4e","74cbec210ba601caeb063d44e510fc012075b65a0482d3fa2d2d08837649356a","ea8a58bbb6d5614855a470b2d3630197e34fc372760b2b7fa27af8f3456525a6","7ffc83877389ebb86d201749d73b5e3706490070015522805696c9b94fa95ccb","d5f41ea8dbf1ed159a0a4cfce563a917c1df32bb8ac8d321b4d3dcf67271dd25","ebaaf177e746f9f0e16c906f1ffea95af771252b07136ca6a13995508fce34aa")
index=activity AND rg_functionality="DNS / DHCP" AND customstring64 NOT NULL AND customstring64 IN ("027d4020f2dd1eb473636bc112a84f0a90b6651c","06566eabf54caafe36ebe94430d392b9cf3426ba","08af4c21cd0a165695c756b6fda37016197b01e7","2ed2edec8ccc44292410042c730c190027b87930","a25c06e8545666d6d2a88c8da300cf3383149d5a","ee3795f6418fc0cacbe884a8eb803498c2b5776f","bb72ca0e19a95c48a9ee4fd658958a0ae2af44b6","4743d5202dbe565721d75f7fb1eca43266a652d4","e6a7c54c01227adcb2a180e62f0082de1c13d61ae913cda379dd0f44a0d0567b","64c9347d794243be26e811b5eb90fb11c8e74e8aff504bf98481e5ccf9d72fe9","469fd8a280e89a6edd0d704d0be4c7e0e0d8d753e314e9ce205d7006b573865f","41660a23e5db77597994e17f9f773d02976f767276faf3b5bac0510807a9a36f","69a012ff46565169534ccefb175f87b3cc331b4f94cc5d223c29a036ed771f4e","74cbec210ba601caeb063d44e510fc012075b65a0482d3fa2d2d08837649356a","ea8a58bbb6d5614855a470b2d3630197e34fc372760b2b7fa27af8f3456525a6","7ffc83877389ebb86d201749d73b5e3706490070015522805696c9b94fa95ccb","d5f41ea8dbf1ed159a0a4cfce563a917c1df32bb8ac8d321b4d3dcf67271dd25","ebaaf177e746f9f0e16c906f1ffea95af771252b07136ca6a13995508fce34aa")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND filehash NOT NULL AND filehash IN ("027d4020f2dd1eb473636bc112a84f0a90b6651c","06566eabf54caafe36ebe94430d392b9cf3426ba","08af4c21cd0a165695c756b6fda37016197b01e7","2ed2edec8ccc44292410042c730c190027b87930","a25c06e8545666d6d2a88c8da300cf3383149d5a","ee3795f6418fc0cacbe884a8eb803498c2b5776f","bb72ca0e19a95c48a9ee4fd658958a0ae2af44b6","4743d5202dbe565721d75f7fb1eca43266a652d4","e6a7c54c01227adcb2a180e62f0082de1c13d61ae913cda379dd0f44a0d0567b","64c9347d794243be26e811b5eb90fb11c8e74e8aff504bf98481e5ccf9d72fe9","469fd8a280e89a6edd0d704d0be4c7e0e0d8d753e314e9ce205d7006b573865f","41660a23e5db77597994e17f9f773d02976f767276faf3b5bac0510807a9a36f","69a012ff46565169534ccefb175f87b3cc331b4f94cc5d223c29a036ed771f4e","74cbec210ba601caeb063d44e510fc012075b65a0482d3fa2d2d08837649356a","ea8a58bbb6d5614855a470b2d3630197e34fc372760b2b7fa27af8f3456525a6","7ffc83877389ebb86d201749d73b5e3706490070015522805696c9b94fa95ccb","d5f41ea8dbf1ed159a0a4cfce563a917c1df32bb8ac8d321b4d3dcf67271dd25","ebaaf177e746f9f0e16c906f1ffea95af771252b07136ca6a13995508fce34aa")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND oldfilehash NOT NULL AND oldfilehash IN ("027d4020f2dd1eb473636bc112a84f0a90b6651c","06566eabf54caafe36ebe94430d392b9cf3426ba","08af4c21cd0a165695c756b6fda37016197b01e7","2ed2edec8ccc44292410042c730c190027b87930","a25c06e8545666d6d2a88c8da300cf3383149d5a","ee3795f6418fc0cacbe884a8eb803498c2b5776f","bb72ca0e19a95c48a9ee4fd658958a0ae2af44b6","4743d5202dbe565721d75f7fb1eca43266a652d4","e6a7c54c01227adcb2a180e62f0082de1c13d61ae913cda379dd0f44a0d0567b","64c9347d794243be26e811b5eb90fb11c8e74e8aff504bf98481e5ccf9d72fe9","469fd8a280e89a6edd0d704d0be4c7e0e0d8d753e314e9ce205d7006b573865f","41660a23e5db77597994e17f9f773d02976f767276faf3b5bac0510807a9a36f","69a012ff46565169534ccefb175f87b3cc331b4f94cc5d223c29a036ed771f4e","74cbec210ba601caeb063d44e510fc012075b65a0482d3fa2d2d08837649356a","ea8a58bbb6d5614855a470b2d3630197e34fc372760b2b7fa27af8f3456525a6","7ffc83877389ebb86d201749d73b5e3706490070015522805696c9b94fa95ccb","d5f41ea8dbf1ed159a0a4cfce563a917c1df32bb8ac8d321b4d3dcf67271dd25","ebaaf177e746f9f0e16c906f1ffea95af771252b07136ca6a13995508fce34aa")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND customstring3 NOT NULL AND customstring3 IN ("027d4020f2dd1eb473636bc112a84f0a90b6651c","06566eabf54caafe36ebe94430d392b9cf3426ba","08af4c21cd0a165695c756b6fda37016197b01e7","2ed2edec8ccc44292410042c730c190027b87930","a25c06e8545666d6d2a88c8da300cf3383149d5a","ee3795f6418fc0cacbe884a8eb803498c2b5776f","bb72ca0e19a95c48a9ee4fd658958a0ae2af44b6","4743d5202dbe565721d75f7fb1eca43266a652d4","e6a7c54c01227adcb2a180e62f0082de1c13d61ae913cda379dd0f44a0d0567b","64c9347d794243be26e811b5eb90fb11c8e74e8aff504bf98481e5ccf9d72fe9","469fd8a280e89a6edd0d704d0be4c7e0e0d8d753e314e9ce205d7006b573865f","41660a23e5db77597994e17f9f773d02976f767276faf3b5bac0510807a9a36f","69a012ff46565169534ccefb175f87b3cc331b4f94cc5d223c29a036ed771f4e","74cbec210ba601caeb063d44e510fc012075b65a0482d3fa2d2d08837649356a","ea8a58bbb6d5614855a470b2d3630197e34fc372760b2b7fa27af8f3456525a6","7ffc83877389ebb86d201749d73b5e3706490070015522805696c9b94fa95ccb","d5f41ea8dbf1ed159a0a4cfce563a917c1df32bb8ac8d321b4d3dcf67271dd25","ebaaf177e746f9f0e16c906f1ffea95af771252b07136ca6a13995508fce34aa")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND customstring64 NOT NULL AND customstring64 IN ("027d4020f2dd1eb473636bc112a84f0a90b6651c","06566eabf54caafe36ebe94430d392b9cf3426ba","08af4c21cd0a165695c756b6fda37016197b01e7","2ed2edec8ccc44292410042c730c190027b87930","a25c06e8545666d6d2a88c8da300cf3383149d5a","ee3795f6418fc0cacbe884a8eb803498c2b5776f","bb72ca0e19a95c48a9ee4fd658958a0ae2af44b6","4743d5202dbe565721d75f7fb1eca43266a652d4","e6a7c54c01227adcb2a180e62f0082de1c13d61ae913cda379dd0f44a0d0567b","64c9347d794243be26e811b5eb90fb11c8e74e8aff504bf98481e5ccf9d72fe9","469fd8a280e89a6edd0d704d0be4c7e0e0d8d753e314e9ce205d7006b573865f","41660a23e5db77597994e17f9f773d02976f767276faf3b5bac0510807a9a36f","69a012ff46565169534ccefb175f87b3cc331b4f94cc5d223c29a036ed771f4e","74cbec210ba601caeb063d44e510fc012075b65a0482d3fa2d2d08837649356a","ea8a58bbb6d5614855a470b2d3630197e34fc372760b2b7fa27af8f3456525a6","7ffc83877389ebb86d201749d73b5e3706490070015522805696c9b94fa95ccb","d5f41ea8dbf1ed159a0a4cfce563a917c1df32bb8ac8d321b4d3dcf67271dd25","ebaaf177e746f9f0e16c906f1ffea95af771252b07136ca6a13995508fce34aa")
index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("027d4020f2dd1eb473636bc112a84f0a90b6651c","06566eabf54caafe36ebe94430d392b9cf3426ba","08af4c21cd0a165695c756b6fda37016197b01e7","2ed2edec8ccc44292410042c730c190027b87930","a25c06e8545666d6d2a88c8da300cf3383149d5a","ee3795f6418fc0cacbe884a8eb803498c2b5776f","bb72ca0e19a95c48a9ee4fd658958a0ae2af44b6","4743d5202dbe565721d75f7fb1eca43266a652d4","e6a7c54c01227adcb2a180e62f0082de1c13d61ae913cda379dd0f44a0d0567b","64c9347d794243be26e811b5eb90fb11c8e74e8aff504bf98481e5ccf9d72fe9","469fd8a280e89a6edd0d704d0be4c7e0e0d8d753e314e9ce205d7006b573865f","41660a23e5db77597994e17f9f773d02976f767276faf3b5bac0510807a9a36f","69a012ff46565169534ccefb175f87b3cc331b4f94cc5d223c29a036ed771f4e","74cbec210ba601caeb063d44e510fc012075b65a0482d3fa2d2d08837649356a","ea8a58bbb6d5614855a470b2d3630197e34fc372760b2b7fa27af8f3456525a6","7ffc83877389ebb86d201749d73b5e3706490070015522805696c9b94fa95ccb","d5f41ea8dbf1ed159a0a4cfce563a917c1df32bb8ac8d321b4d3dcf67271dd25","ebaaf177e746f9f0e16c906f1ffea95af771252b07136ca6a13995508fce34aa")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("027d4020f2dd1eb473636bc112a84f0a90b6651c","06566eabf54caafe36ebe94430d392b9cf3426ba","08af4c21cd0a165695c756b6fda37016197b01e7","2ed2edec8ccc44292410042c730c190027b87930","a25c06e8545666d6d2a88c8da300cf3383149d5a","ee3795f6418fc0cacbe884a8eb803498c2b5776f","bb72ca0e19a95c48a9ee4fd658958a0ae2af44b6","4743d5202dbe565721d75f7fb1eca43266a652d4","e6a7c54c01227adcb2a180e62f0082de1c13d61ae913cda379dd0f44a0d0567b","64c9347d794243be26e811b5eb90fb11c8e74e8aff504bf98481e5ccf9d72fe9","469fd8a280e89a6edd0d704d0be4c7e0e0d8d753e314e9ce205d7006b573865f","41660a23e5db77597994e17f9f773d02976f767276faf3b5bac0510807a9a36f","69a012ff46565169534ccefb175f87b3cc331b4f94cc5d223c29a036ed771f4e","74cbec210ba601caeb063d44e510fc012075b65a0482d3fa2d2d08837649356a","ea8a58bbb6d5614855a470b2d3630197e34fc372760b2b7fa27af8f3456525a6","7ffc83877389ebb86d201749d73b5e3706490070015522805696c9b94fa95ccb","d5f41ea8dbf1ed159a0a4cfce563a917c1df32bb8ac8d321b4d3dcf67271dd25","ebaaf177e746f9f0e16c906f1ffea95af771252b07136ca6a13995508fce34aa")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("027d4020f2dd1eb473636bc112a84f0a90b6651c","06566eabf54caafe36ebe94430d392b9cf3426ba","08af4c21cd0a165695c756b6fda37016197b01e7","2ed2edec8ccc44292410042c730c190027b87930","a25c06e8545666d6d2a88c8da300cf3383149d5a","ee3795f6418fc0cacbe884a8eb803498c2b5776f","bb72ca0e19a95c48a9ee4fd658958a0ae2af44b6","4743d5202dbe565721d75f7fb1eca43266a652d4","e6a7c54c01227adcb2a180e62f0082de1c13d61ae913cda379dd0f44a0d0567b","64c9347d794243be26e811b5eb90fb11c8e74e8aff504bf98481e5ccf9d72fe9","469fd8a280e89a6edd0d704d0be4c7e0e0d8d753e314e9ce205d7006b573865f","41660a23e5db77597994e17f9f773d02976f767276faf3b5bac0510807a9a36f","69a012ff46565169534ccefb175f87b3cc331b4f94cc5d223c29a036ed771f4e","74cbec210ba601caeb063d44e510fc012075b65a0482d3fa2d2d08837649356a","ea8a58bbb6d5614855a470b2d3630197e34fc372760b2b7fa27af8f3456525a6","7ffc83877389ebb86d201749d73b5e3706490070015522805696c9b94fa95ccb","d5f41ea8dbf1ed159a0a4cfce563a917c1df32bb8ac8d321b4d3dcf67271dd25","ebaaf177e746f9f0e16c906f1ffea95af771252b07136ca6a13995508fce34aa")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring64 NOT NULL AND customstring64 IN ("027d4020f2dd1eb473636bc112a84f0a90b6651c","06566eabf54caafe36ebe94430d392b9cf3426ba","08af4c21cd0a165695c756b6fda37016197b01e7","2ed2edec8ccc44292410042c730c190027b87930","a25c06e8545666d6d2a88c8da300cf3383149d5a","ee3795f6418fc0cacbe884a8eb803498c2b5776f","bb72ca0e19a95c48a9ee4fd658958a0ae2af44b6","4743d5202dbe565721d75f7fb1eca43266a652d4","e6a7c54c01227adcb2a180e62f0082de1c13d61ae913cda379dd0f44a0d0567b","64c9347d794243be26e811b5eb90fb11c8e74e8aff504bf98481e5ccf9d72fe9","469fd8a280e89a6edd0d704d0be4c7e0e0d8d753e314e9ce205d7006b573865f","41660a23e5db77597994e17f9f773d02976f767276faf3b5bac0510807a9a36f","69a012ff46565169534ccefb175f87b3cc331b4f94cc5d223c29a036ed771f4e","74cbec210ba601caeb063d44e510fc012075b65a0482d3fa2d2d08837649356a","ea8a58bbb6d5614855a470b2d3630197e34fc372760b2b7fa27af8f3456525a6","7ffc83877389ebb86d201749d73b5e3706490070015522805696c9b94fa95ccb","d5f41ea8dbf1ed159a0a4cfce563a917c1df32bb8ac8d321b4d3dcf67271dd25","ebaaf177e746f9f0e16c906f1ffea95af771252b07136ca6a13995508fce34aa")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("027d4020f2dd1eb473636bc112a84f0a90b6651c","06566eabf54caafe36ebe94430d392b9cf3426ba","08af4c21cd0a165695c756b6fda37016197b01e7","2ed2edec8ccc44292410042c730c190027b87930","a25c06e8545666d6d2a88c8da300cf3383149d5a","ee3795f6418fc0cacbe884a8eb803498c2b5776f","bb72ca0e19a95c48a9ee4fd658958a0ae2af44b6","4743d5202dbe565721d75f7fb1eca43266a652d4","e6a7c54c01227adcb2a180e62f0082de1c13d61ae913cda379dd0f44a0d0567b","64c9347d794243be26e811b5eb90fb11c8e74e8aff504bf98481e5ccf9d72fe9","469fd8a280e89a6edd0d704d0be4c7e0e0d8d753e314e9ce205d7006b573865f","41660a23e5db77597994e17f9f773d02976f767276faf3b5bac0510807a9a36f","69a012ff46565169534ccefb175f87b3cc331b4f94cc5d223c29a036ed771f4e","74cbec210ba601caeb063d44e510fc012075b65a0482d3fa2d2d08837649356a","ea8a58bbb6d5614855a470b2d3630197e34fc372760b2b7fa27af8f3456525a6","7ffc83877389ebb86d201749d73b5e3706490070015522805696c9b94fa95ccb","d5f41ea8dbf1ed159a0a4cfce563a917c1df32bb8ac8d321b4d3dcf67271dd25","ebaaf177e746f9f0e16c906f1ffea95af771252b07136ca6a13995508fce34aa")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("027d4020f2dd1eb473636bc112a84f0a90b6651c","06566eabf54caafe36ebe94430d392b9cf3426ba","08af4c21cd0a165695c756b6fda37016197b01e7","2ed2edec8ccc44292410042c730c190027b87930","a25c06e8545666d6d2a88c8da300cf3383149d5a","ee3795f6418fc0cacbe884a8eb803498c2b5776f","bb72ca0e19a95c48a9ee4fd658958a0ae2af44b6","4743d5202dbe565721d75f7fb1eca43266a652d4","e6a7c54c01227adcb2a180e62f0082de1c13d61ae913cda379dd0f44a0d0567b","64c9347d794243be26e811b5eb90fb11c8e74e8aff504bf98481e5ccf9d72fe9","469fd8a280e89a6edd0d704d0be4c7e0e0d8d753e314e9ce205d7006b573865f","41660a23e5db77597994e17f9f773d02976f767276faf3b5bac0510807a9a36f","69a012ff46565169534ccefb175f87b3cc331b4f94cc5d223c29a036ed771f4e","74cbec210ba601caeb063d44e510fc012075b65a0482d3fa2d2d08837649356a","ea8a58bbb6d5614855a470b2d3630197e34fc372760b2b7fa27af8f3456525a6","7ffc83877389ebb86d201749d73b5e3706490070015522805696c9b94fa95ccb","d5f41ea8dbf1ed159a0a4cfce563a917c1df32bb8ac8d321b4d3dcf67271dd25","ebaaf177e746f9f0e16c906f1ffea95af771252b07136ca6a13995508fce34aa")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("027d4020f2dd1eb473636bc112a84f0a90b6651c","06566eabf54caafe36ebe94430d392b9cf3426ba","08af4c21cd0a165695c756b6fda37016197b01e7","2ed2edec8ccc44292410042c730c190027b87930","a25c06e8545666d6d2a88c8da300cf3383149d5a","ee3795f6418fc0cacbe884a8eb803498c2b5776f","bb72ca0e19a95c48a9ee4fd658958a0ae2af44b6","4743d5202dbe565721d75f7fb1eca43266a652d4","e6a7c54c01227adcb2a180e62f0082de1c13d61ae913cda379dd0f44a0d0567b","64c9347d794243be26e811b5eb90fb11c8e74e8aff504bf98481e5ccf9d72fe9","469fd8a280e89a6edd0d704d0be4c7e0e0d8d753e314e9ce205d7006b573865f","41660a23e5db77597994e17f9f773d02976f767276faf3b5bac0510807a9a36f","69a012ff46565169534ccefb175f87b3cc331b4f94cc5d223c29a036ed771f4e","74cbec210ba601caeb063d44e510fc012075b65a0482d3fa2d2d08837649356a","ea8a58bbb6d5614855a470b2d3630197e34fc372760b2b7fa27af8f3456525a6","7ffc83877389ebb86d201749d73b5e3706490070015522805696c9b94fa95ccb","d5f41ea8dbf1ed159a0a4cfce563a917c1df32bb8ac8d321b4d3dcf67271dd25","ebaaf177e746f9f0e16c906f1ffea95af771252b07136ca6a13995508fce34aa")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("027d4020f2dd1eb473636bc112a84f0a90b6651c","06566eabf54caafe36ebe94430d392b9cf3426ba","08af4c21cd0a165695c756b6fda37016197b01e7","2ed2edec8ccc44292410042c730c190027b87930","a25c06e8545666d6d2a88c8da300cf3383149d5a","ee3795f6418fc0cacbe884a8eb803498c2b5776f","bb72ca0e19a95c48a9ee4fd658958a0ae2af44b6","4743d5202dbe565721d75f7fb1eca43266a652d4","e6a7c54c01227adcb2a180e62f0082de1c13d61ae913cda379dd0f44a0d0567b","64c9347d794243be26e811b5eb90fb11c8e74e8aff504bf98481e5ccf9d72fe9","469fd8a280e89a6edd0d704d0be4c7e0e0d8d753e314e9ce205d7006b573865f","41660a23e5db77597994e17f9f773d02976f767276faf3b5bac0510807a9a36f","69a012ff46565169534ccefb175f87b3cc331b4f94cc5d223c29a036ed771f4e","74cbec210ba601caeb063d44e510fc012075b65a0482d3fa2d2d08837649356a","ea8a58bbb6d5614855a470b2d3630197e34fc372760b2b7fa27af8f3456525a6","7ffc83877389ebb86d201749d73b5e3706490070015522805696c9b94fa95ccb","d5f41ea8dbf1ed159a0a4cfce563a917c1df32bb8ac8d321b4d3dcf67271dd25","ebaaf177e746f9f0e16c906f1ffea95af771252b07136ca6a13995508fce34aa")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("027d4020f2dd1eb473636bc112a84f0a90b6651c","06566eabf54caafe36ebe94430d392b9cf3426ba","08af4c21cd0a165695c756b6fda37016197b01e7","2ed2edec8ccc44292410042c730c190027b87930","a25c06e8545666d6d2a88c8da300cf3383149d5a","ee3795f6418fc0cacbe884a8eb803498c2b5776f","bb72ca0e19a95c48a9ee4fd658958a0ae2af44b6","4743d5202dbe565721d75f7fb1eca43266a652d4","e6a7c54c01227adcb2a180e62f0082de1c13d61ae913cda379dd0f44a0d0567b","64c9347d794243be26e811b5eb90fb11c8e74e8aff504bf98481e5ccf9d72fe9","469fd8a280e89a6edd0d704d0be4c7e0e0d8d753e314e9ce205d7006b573865f","41660a23e5db77597994e17f9f773d02976f767276faf3b5bac0510807a9a36f","69a012ff46565169534ccefb175f87b3cc331b4f94cc5d223c29a036ed771f4e","74cbec210ba601caeb063d44e510fc012075b65a0482d3fa2d2d08837649356a","ea8a58bbb6d5614855a470b2d3630197e34fc372760b2b7fa27af8f3456525a6","7ffc83877389ebb86d201749d73b5e3706490070015522805696c9b94fa95ccb","d5f41ea8dbf1ed159a0a4cfce563a917c1df32bb8ac8d321b4d3dcf67271dd25","ebaaf177e746f9f0e16c906f1ffea95af771252b07136ca6a13995508fce34aa")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("027d4020f2dd1eb473636bc112a84f0a90b6651c","06566eabf54caafe36ebe94430d392b9cf3426ba","08af4c21cd0a165695c756b6fda37016197b01e7","2ed2edec8ccc44292410042c730c190027b87930","a25c06e8545666d6d2a88c8da300cf3383149d5a","ee3795f6418fc0cacbe884a8eb803498c2b5776f","bb72ca0e19a95c48a9ee4fd658958a0ae2af44b6","4743d5202dbe565721d75f7fb1eca43266a652d4","e6a7c54c01227adcb2a180e62f0082de1c13d61ae913cda379dd0f44a0d0567b","64c9347d794243be26e811b5eb90fb11c8e74e8aff504bf98481e5ccf9d72fe9","469fd8a280e89a6edd0d704d0be4c7e0e0d8d753e314e9ce205d7006b573865f","41660a23e5db77597994e17f9f773d02976f767276faf3b5bac0510807a9a36f","69a012ff46565169534ccefb175f87b3cc331b4f94cc5d223c29a036ed771f4e","74cbec210ba601caeb063d44e510fc012075b65a0482d3fa2d2d08837649356a","ea8a58bbb6d5614855a470b2d3630197e34fc372760b2b7fa27af8f3456525a6","7ffc83877389ebb86d201749d73b5e3706490070015522805696c9b94fa95ccb","d5f41ea8dbf1ed159a0a4cfce563a917c1df32bb8ac8d321b4d3dcf67271dd25","ebaaf177e746f9f0e16c906f1ffea95af771252b07136ca6a13995508fce34aa")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("027d4020f2dd1eb473636bc112a84f0a90b6651c","06566eabf54caafe36ebe94430d392b9cf3426ba","08af4c21cd0a165695c756b6fda37016197b01e7","2ed2edec8ccc44292410042c730c190027b87930","a25c06e8545666d6d2a88c8da300cf3383149d5a","ee3795f6418fc0cacbe884a8eb803498c2b5776f","bb72ca0e19a95c48a9ee4fd658958a0ae2af44b6","4743d5202dbe565721d75f7fb1eca43266a652d4","e6a7c54c01227adcb2a180e62f0082de1c13d61ae913cda379dd0f44a0d0567b","64c9347d794243be26e811b5eb90fb11c8e74e8aff504bf98481e5ccf9d72fe9","469fd8a280e89a6edd0d704d0be4c7e0e0d8d753e314e9ce205d7006b573865f","41660a23e5db77597994e17f9f773d02976f767276faf3b5bac0510807a9a36f","69a012ff46565169534ccefb175f87b3cc331b4f94cc5d223c29a036ed771f4e","74cbec210ba601caeb063d44e510fc012075b65a0482d3fa2d2d08837649356a","ea8a58bbb6d5614855a470b2d3630197e34fc372760b2b7fa27af8f3456525a6","7ffc83877389ebb86d201749d73b5e3706490070015522805696c9b94fa95ccb","d5f41ea8dbf1ed159a0a4cfce563a917c1df32bb8ac8d321b4d3dcf67271dd25","ebaaf177e746f9f0e16c906f1ffea95af771252b07136ca6a13995508fce34aa")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("027d4020f2dd1eb473636bc112a84f0a90b6651c","06566eabf54caafe36ebe94430d392b9cf3426ba","08af4c21cd0a165695c756b6fda37016197b01e7","2ed2edec8ccc44292410042c730c190027b87930","a25c06e8545666d6d2a88c8da300cf3383149d5a","ee3795f6418fc0cacbe884a8eb803498c2b5776f","bb72ca0e19a95c48a9ee4fd658958a0ae2af44b6","4743d5202dbe565721d75f7fb1eca43266a652d4","e6a7c54c01227adcb2a180e62f0082de1c13d61ae913cda379dd0f44a0d0567b","64c9347d794243be26e811b5eb90fb11c8e74e8aff504bf98481e5ccf9d72fe9","469fd8a280e89a6edd0d704d0be4c7e0e0d8d753e314e9ce205d7006b573865f","41660a23e5db77597994e17f9f773d02976f767276faf3b5bac0510807a9a36f","69a012ff46565169534ccefb175f87b3cc331b4f94cc5d223c29a036ed771f4e","74cbec210ba601caeb063d44e510fc012075b65a0482d3fa2d2d08837649356a","ea8a58bbb6d5614855a470b2d3630197e34fc372760b2b7fa27af8f3456525a6","7ffc83877389ebb86d201749d73b5e3706490070015522805696c9b94fa95ccb","d5f41ea8dbf1ed159a0a4cfce563a917c1df32bb8ac8d321b4d3dcf67271dd25","ebaaf177e746f9f0e16c906f1ffea95af771252b07136ca6a13995508fce34aa")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("027d4020f2dd1eb473636bc112a84f0a90b6651c","06566eabf54caafe36ebe94430d392b9cf3426ba","08af4c21cd0a165695c756b6fda37016197b01e7","2ed2edec8ccc44292410042c730c190027b87930","a25c06e8545666d6d2a88c8da300cf3383149d5a","ee3795f6418fc0cacbe884a8eb803498c2b5776f","bb72ca0e19a95c48a9ee4fd658958a0ae2af44b6","4743d5202dbe565721d75f7fb1eca43266a652d4","e6a7c54c01227adcb2a180e62f0082de1c13d61ae913cda379dd0f44a0d0567b","64c9347d794243be26e811b5eb90fb11c8e74e8aff504bf98481e5ccf9d72fe9","469fd8a280e89a6edd0d704d0be4c7e0e0d8d753e314e9ce205d7006b573865f","41660a23e5db77597994e17f9f773d02976f767276faf3b5bac0510807a9a36f","69a012ff46565169534ccefb175f87b3cc331b4f94cc5d223c29a036ed771f4e","74cbec210ba601caeb063d44e510fc012075b65a0482d3fa2d2d08837649356a","ea8a58bbb6d5614855a470b2d3630197e34fc372760b2b7fa27af8f3456525a6","7ffc83877389ebb86d201749d73b5e3706490070015522805696c9b94fa95ccb","d5f41ea8dbf1ed159a0a4cfce563a917c1df32bb8ac8d321b4d3dcf67271dd25","ebaaf177e746f9f0e16c906f1ffea95af771252b07136ca6a13995508fce34aa")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("027d4020f2dd1eb473636bc112a84f0a90b6651c","06566eabf54caafe36ebe94430d392b9cf3426ba","08af4c21cd0a165695c756b6fda37016197b01e7","2ed2edec8ccc44292410042c730c190027b87930","a25c06e8545666d6d2a88c8da300cf3383149d5a","ee3795f6418fc0cacbe884a8eb803498c2b5776f","bb72ca0e19a95c48a9ee4fd658958a0ae2af44b6","4743d5202dbe565721d75f7fb1eca43266a652d4","e6a7c54c01227adcb2a180e62f0082de1c13d61ae913cda379dd0f44a0d0567b","64c9347d794243be26e811b5eb90fb11c8e74e8aff504bf98481e5ccf9d72fe9","469fd8a280e89a6edd0d704d0be4c7e0e0d8d753e314e9ce205d7006b573865f","41660a23e5db77597994e17f9f773d02976f767276faf3b5bac0510807a9a36f","69a012ff46565169534ccefb175f87b3cc331b4f94cc5d223c29a036ed771f4e","74cbec210ba601caeb063d44e510fc012075b65a0482d3fa2d2d08837649356a","ea8a58bbb6d5614855a470b2d3630197e34fc372760b2b7fa27af8f3456525a6","7ffc83877389ebb86d201749d73b5e3706490070015522805696c9b94fa95ccb","d5f41ea8dbf1ed159a0a4cfce563a917c1df32bb8ac8d321b4d3dcf67271dd25","ebaaf177e746f9f0e16c906f1ffea95af771252b07136ca6a13995508fce34aa")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("027d4020f2dd1eb473636bc112a84f0a90b6651c","06566eabf54caafe36ebe94430d392b9cf3426ba","08af4c21cd0a165695c756b6fda37016197b01e7","2ed2edec8ccc44292410042c730c190027b87930","a25c06e8545666d6d2a88c8da300cf3383149d5a","ee3795f6418fc0cacbe884a8eb803498c2b5776f","bb72ca0e19a95c48a9ee4fd658958a0ae2af44b6","4743d5202dbe565721d75f7fb1eca43266a652d4","e6a7c54c01227adcb2a180e62f0082de1c13d61ae913cda379dd0f44a0d0567b","64c9347d794243be26e811b5eb90fb11c8e74e8aff504bf98481e5ccf9d72fe9","469fd8a280e89a6edd0d704d0be4c7e0e0d8d753e314e9ce205d7006b573865f","41660a23e5db77597994e17f9f773d02976f767276faf3b5bac0510807a9a36f","69a012ff46565169534ccefb175f87b3cc331b4f94cc5d223c29a036ed771f4e","74cbec210ba601caeb063d44e510fc012075b65a0482d3fa2d2d08837649356a","ea8a58bbb6d5614855a470b2d3630197e34fc372760b2b7fa27af8f3456525a6","7ffc83877389ebb86d201749d73b5e3706490070015522805696c9b94fa95ccb","d5f41ea8dbf1ed159a0a4cfce563a917c1df32bb8ac8d321b4d3dcf67271dd25","ebaaf177e746f9f0e16c906f1ffea95af771252b07136ca6a13995508fce34aa")
index=activity AND rg_functionality="Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("027d4020f2dd1eb473636bc112a84f0a90b6651c","06566eabf54caafe36ebe94430d392b9cf3426ba","08af4c21cd0a165695c756b6fda37016197b01e7","2ed2edec8ccc44292410042c730c190027b87930","a25c06e8545666d6d2a88c8da300cf3383149d5a","ee3795f6418fc0cacbe884a8eb803498c2b5776f","bb72ca0e19a95c48a9ee4fd658958a0ae2af44b6","4743d5202dbe565721d75f7fb1eca43266a652d4","e6a7c54c01227adcb2a180e62f0082de1c13d61ae913cda379dd0f44a0d0567b","64c9347d794243be26e811b5eb90fb11c8e74e8aff504bf98481e5ccf9d72fe9","469fd8a280e89a6edd0d704d0be4c7e0e0d8d753e314e9ce205d7006b573865f","41660a23e5db77597994e17f9f773d02976f767276faf3b5bac0510807a9a36f","69a012ff46565169534ccefb175f87b3cc331b4f94cc5d223c29a036ed771f4e","74cbec210ba601caeb063d44e510fc012075b65a0482d3fa2d2d08837649356a","ea8a58bbb6d5614855a470b2d3630197e34fc372760b2b7fa27af8f3456525a6","7ffc83877389ebb86d201749d73b5e3706490070015522805696c9b94fa95ccb","d5f41ea8dbf1ed159a0a4cfce563a917c1df32bb8ac8d321b4d3dcf67271dd25","ebaaf177e746f9f0e16c906f1ffea95af771252b07136ca6a13995508fce34aa")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("027d4020f2dd1eb473636bc112a84f0a90b6651c","06566eabf54caafe36ebe94430d392b9cf3426ba","08af4c21cd0a165695c756b6fda37016197b01e7","2ed2edec8ccc44292410042c730c190027b87930","a25c06e8545666d6d2a88c8da300cf3383149d5a","ee3795f6418fc0cacbe884a8eb803498c2b5776f","bb72ca0e19a95c48a9ee4fd658958a0ae2af44b6","4743d5202dbe565721d75f7fb1eca43266a652d4","e6a7c54c01227adcb2a180e62f0082de1c13d61ae913cda379dd0f44a0d0567b","64c9347d794243be26e811b5eb90fb11c8e74e8aff504bf98481e5ccf9d72fe9","469fd8a280e89a6edd0d704d0be4c7e0e0d8d753e314e9ce205d7006b573865f","41660a23e5db77597994e17f9f773d02976f767276faf3b5bac0510807a9a36f","69a012ff46565169534ccefb175f87b3cc331b4f94cc5d223c29a036ed771f4e","74cbec210ba601caeb063d44e510fc012075b65a0482d3fa2d2d08837649356a","ea8a58bbb6d5614855a470b2d3630197e34fc372760b2b7fa27af8f3456525a6","7ffc83877389ebb86d201749d73b5e3706490070015522805696c9b94fa95ccb","d5f41ea8dbf1ed159a0a4cfce563a917c1df32bb8ac8d321b4d3dcf67271dd25","ebaaf177e746f9f0e16c906f1ffea95af771252b07136ca6a13995508fce34aa")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("027d4020f2dd1eb473636bc112a84f0a90b6651c","06566eabf54caafe36ebe94430d392b9cf3426ba","08af4c21cd0a165695c756b6fda37016197b01e7","2ed2edec8ccc44292410042c730c190027b87930","a25c06e8545666d6d2a88c8da300cf3383149d5a","ee3795f6418fc0cacbe884a8eb803498c2b5776f","bb72ca0e19a95c48a9ee4fd658958a0ae2af44b6","4743d5202dbe565721d75f7fb1eca43266a652d4","e6a7c54c01227adcb2a180e62f0082de1c13d61ae913cda379dd0f44a0d0567b","64c9347d794243be26e811b5eb90fb11c8e74e8aff504bf98481e5ccf9d72fe9","469fd8a280e89a6edd0d704d0be4c7e0e0d8d753e314e9ce205d7006b573865f","41660a23e5db77597994e17f9f773d02976f767276faf3b5bac0510807a9a36f","69a012ff46565169534ccefb175f87b3cc331b4f94cc5d223c29a036ed771f4e","74cbec210ba601caeb063d44e510fc012075b65a0482d3fa2d2d08837649356a","ea8a58bbb6d5614855a470b2d3630197e34fc372760b2b7fa27af8f3456525a6","7ffc83877389ebb86d201749d73b5e3706490070015522805696c9b94fa95ccb","d5f41ea8dbf1ed159a0a4cfce563a917c1df32bb8ac8d321b4d3dcf67271dd25","ebaaf177e746f9f0e16c906f1ffea95af771252b07136ca6a13995508fce34aa")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("027d4020f2dd1eb473636bc112a84f0a90b6651c","06566eabf54caafe36ebe94430d392b9cf3426ba","08af4c21cd0a165695c756b6fda37016197b01e7","2ed2edec8ccc44292410042c730c190027b87930","a25c06e8545666d6d2a88c8da300cf3383149d5a","ee3795f6418fc0cacbe884a8eb803498c2b5776f","bb72ca0e19a95c48a9ee4fd658958a0ae2af44b6","4743d5202dbe565721d75f7fb1eca43266a652d4","e6a7c54c01227adcb2a180e62f0082de1c13d61ae913cda379dd0f44a0d0567b","64c9347d794243be26e811b5eb90fb11c8e74e8aff504bf98481e5ccf9d72fe9","469fd8a280e89a6edd0d704d0be4c7e0e0d8d753e314e9ce205d7006b573865f","41660a23e5db77597994e17f9f773d02976f767276faf3b5bac0510807a9a36f","69a012ff46565169534ccefb175f87b3cc331b4f94cc5d223c29a036ed771f4e","74cbec210ba601caeb063d44e510fc012075b65a0482d3fa2d2d08837649356a","ea8a58bbb6d5614855a470b2d3630197e34fc372760b2b7fa27af8f3456525a6","7ffc83877389ebb86d201749d73b5e3706490070015522805696c9b94fa95ccb","d5f41ea8dbf1ed159a0a4cfce563a917c1df32bb8ac8d321b4d3dcf67271dd25","ebaaf177e746f9f0e16c906f1ffea95af771252b07136ca6a13995508fce34aa")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("027d4020f2dd1eb473636bc112a84f0a90b6651c","06566eabf54caafe36ebe94430d392b9cf3426ba","08af4c21cd0a165695c756b6fda37016197b01e7","2ed2edec8ccc44292410042c730c190027b87930","a25c06e8545666d6d2a88c8da300cf3383149d5a","ee3795f6418fc0cacbe884a8eb803498c2b5776f","bb72ca0e19a95c48a9ee4fd658958a0ae2af44b6","4743d5202dbe565721d75f7fb1eca43266a652d4","e6a7c54c01227adcb2a180e62f0082de1c13d61ae913cda379dd0f44a0d0567b","64c9347d794243be26e811b5eb90fb11c8e74e8aff504bf98481e5ccf9d72fe9","469fd8a280e89a6edd0d704d0be4c7e0e0d8d753e314e9ce205d7006b573865f","41660a23e5db77597994e17f9f773d02976f767276faf3b5bac0510807a9a36f","69a012ff46565169534ccefb175f87b3cc331b4f94cc5d223c29a036ed771f4e","74cbec210ba601caeb063d44e510fc012075b65a0482d3fa2d2d08837649356a","ea8a58bbb6d5614855a470b2d3630197e34fc372760b2b7fa27af8f3456525a6","7ffc83877389ebb86d201749d73b5e3706490070015522805696c9b94fa95ccb","d5f41ea8dbf1ed159a0a4cfce563a917c1df32bb8ac8d321b4d3dcf67271dd25","ebaaf177e746f9f0e16c906f1ffea95af771252b07136ca6a13995508fce34aa")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("027d4020f2dd1eb473636bc112a84f0a90b6651c","06566eabf54caafe36ebe94430d392b9cf3426ba","08af4c21cd0a165695c756b6fda37016197b01e7","2ed2edec8ccc44292410042c730c190027b87930","a25c06e8545666d6d2a88c8da300cf3383149d5a","ee3795f6418fc0cacbe884a8eb803498c2b5776f","bb72ca0e19a95c48a9ee4fd658958a0ae2af44b6","4743d5202dbe565721d75f7fb1eca43266a652d4","e6a7c54c01227adcb2a180e62f0082de1c13d61ae913cda379dd0f44a0d0567b","64c9347d794243be26e811b5eb90fb11c8e74e8aff504bf98481e5ccf9d72fe9","469fd8a280e89a6edd0d704d0be4c7e0e0d8d753e314e9ce205d7006b573865f","41660a23e5db77597994e17f9f773d02976f767276faf3b5bac0510807a9a36f","69a012ff46565169534ccefb175f87b3cc331b4f94cc5d223c29a036ed771f4e","74cbec210ba601caeb063d44e510fc012075b65a0482d3fa2d2d08837649356a","ea8a58bbb6d5614855a470b2d3630197e34fc372760b2b7fa27af8f3456525a6","7ffc83877389ebb86d201749d73b5e3706490070015522805696c9b94fa95ccb","d5f41ea8dbf1ed159a0a4cfce563a917c1df32bb8ac8d321b4d3dcf67271dd25","ebaaf177e746f9f0e16c906f1ffea95af771252b07136ca6a13995508fce34aa")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("027d4020f2dd1eb473636bc112a84f0a90b6651c","06566eabf54caafe36ebe94430d392b9cf3426ba","08af4c21cd0a165695c756b6fda37016197b01e7","2ed2edec8ccc44292410042c730c190027b87930","a25c06e8545666d6d2a88c8da300cf3383149d5a","ee3795f6418fc0cacbe884a8eb803498c2b5776f","bb72ca0e19a95c48a9ee4fd658958a0ae2af44b6","4743d5202dbe565721d75f7fb1eca43266a652d4","e6a7c54c01227adcb2a180e62f0082de1c13d61ae913cda379dd0f44a0d0567b","64c9347d794243be26e811b5eb90fb11c8e74e8aff504bf98481e5ccf9d72fe9","469fd8a280e89a6edd0d704d0be4c7e0e0d8d753e314e9ce205d7006b573865f","41660a23e5db77597994e17f9f773d02976f767276faf3b5bac0510807a9a36f","69a012ff46565169534ccefb175f87b3cc331b4f94cc5d223c29a036ed771f4e","74cbec210ba601caeb063d44e510fc012075b65a0482d3fa2d2d08837649356a","ea8a58bbb6d5614855a470b2d3630197e34fc372760b2b7fa27af8f3456525a6","7ffc83877389ebb86d201749d73b5e3706490070015522805696c9b94fa95ccb","d5f41ea8dbf1ed159a0a4cfce563a917c1df32bb8ac8d321b4d3dcf67271dd25","ebaaf177e746f9f0e16c906f1ffea95af771252b07136ca6a13995508fce34aa")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("027d4020f2dd1eb473636bc112a84f0a90b6651c","06566eabf54caafe36ebe94430d392b9cf3426ba","08af4c21cd0a165695c756b6fda37016197b01e7","2ed2edec8ccc44292410042c730c190027b87930","a25c06e8545666d6d2a88c8da300cf3383149d5a","ee3795f6418fc0cacbe884a8eb803498c2b5776f","bb72ca0e19a95c48a9ee4fd658958a0ae2af44b6","4743d5202dbe565721d75f7fb1eca43266a652d4","e6a7c54c01227adcb2a180e62f0082de1c13d61ae913cda379dd0f44a0d0567b","64c9347d794243be26e811b5eb90fb11c8e74e8aff504bf98481e5ccf9d72fe9","469fd8a280e89a6edd0d704d0be4c7e0e0d8d753e314e9ce205d7006b573865f","41660a23e5db77597994e17f9f773d02976f767276faf3b5bac0510807a9a36f","69a012ff46565169534ccefb175f87b3cc331b4f94cc5d223c29a036ed771f4e","74cbec210ba601caeb063d44e510fc012075b65a0482d3fa2d2d08837649356a","ea8a58bbb6d5614855a470b2d3630197e34fc372760b2b7fa27af8f3456525a6","7ffc83877389ebb86d201749d73b5e3706490070015522805696c9b94fa95ccb","d5f41ea8dbf1ed159a0a4cfce563a917c1df32bb8ac8d321b4d3dcf67271dd25","ebaaf177e746f9f0e16c906f1ffea95af771252b07136ca6a13995508fce34aa")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring64 NOT NULL AND customstring64 IN ("027d4020f2dd1eb473636bc112a84f0a90b6651c","06566eabf54caafe36ebe94430d392b9cf3426ba","08af4c21cd0a165695c756b6fda37016197b01e7","2ed2edec8ccc44292410042c730c190027b87930","a25c06e8545666d6d2a88c8da300cf3383149d5a","ee3795f6418fc0cacbe884a8eb803498c2b5776f","bb72ca0e19a95c48a9ee4fd658958a0ae2af44b6","4743d5202dbe565721d75f7fb1eca43266a652d4","e6a7c54c01227adcb2a180e62f0082de1c13d61ae913cda379dd0f44a0d0567b","64c9347d794243be26e811b5eb90fb11c8e74e8aff504bf98481e5ccf9d72fe9","469fd8a280e89a6edd0d704d0be4c7e0e0d8d753e314e9ce205d7006b573865f","41660a23e5db77597994e17f9f773d02976f767276faf3b5bac0510807a9a36f","69a012ff46565169534ccefb175f87b3cc331b4f94cc5d223c29a036ed771f4e","74cbec210ba601caeb063d44e510fc012075b65a0482d3fa2d2d08837649356a","ea8a58bbb6d5614855a470b2d3630197e34fc372760b2b7fa27af8f3456525a6","7ffc83877389ebb86d201749d73b5e3706490070015522805696c9b94fa95ccb","d5f41ea8dbf1ed159a0a4cfce563a917c1df32bb8ac8d321b4d3dcf67271dd25","ebaaf177e746f9f0e16c906f1ffea95af771252b07136ca6a13995508fce34aa")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("027d4020f2dd1eb473636bc112a84f0a90b6651c","06566eabf54caafe36ebe94430d392b9cf3426ba","08af4c21cd0a165695c756b6fda37016197b01e7","2ed2edec8ccc44292410042c730c190027b87930","a25c06e8545666d6d2a88c8da300cf3383149d5a","ee3795f6418fc0cacbe884a8eb803498c2b5776f","bb72ca0e19a95c48a9ee4fd658958a0ae2af44b6","4743d5202dbe565721d75f7fb1eca43266a652d4","e6a7c54c01227adcb2a180e62f0082de1c13d61ae913cda379dd0f44a0d0567b","64c9347d794243be26e811b5eb90fb11c8e74e8aff504bf98481e5ccf9d72fe9","469fd8a280e89a6edd0d704d0be4c7e0e0d8d753e314e9ce205d7006b573865f","41660a23e5db77597994e17f9f773d02976f767276faf3b5bac0510807a9a36f","69a012ff46565169534ccefb175f87b3cc331b4f94cc5d223c29a036ed771f4e","74cbec210ba601caeb063d44e510fc012075b65a0482d3fa2d2d08837649356a","ea8a58bbb6d5614855a470b2d3630197e34fc372760b2b7fa27af8f3456525a6","7ffc83877389ebb86d201749d73b5e3706490070015522805696c9b94fa95ccb","d5f41ea8dbf1ed159a0a4cfce563a917c1df32bb8ac8d321b4d3dcf67271dd25","ebaaf177e746f9f0e16c906f1ffea95af771252b07136ca6a13995508fce34aa")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("027d4020f2dd1eb473636bc112a84f0a90b6651c","06566eabf54caafe36ebe94430d392b9cf3426ba","08af4c21cd0a165695c756b6fda37016197b01e7","2ed2edec8ccc44292410042c730c190027b87930","a25c06e8545666d6d2a88c8da300cf3383149d5a","ee3795f6418fc0cacbe884a8eb803498c2b5776f","bb72ca0e19a95c48a9ee4fd658958a0ae2af44b6","4743d5202dbe565721d75f7fb1eca43266a652d4","e6a7c54c01227adcb2a180e62f0082de1c13d61ae913cda379dd0f44a0d0567b","64c9347d794243be26e811b5eb90fb11c8e74e8aff504bf98481e5ccf9d72fe9","469fd8a280e89a6edd0d704d0be4c7e0e0d8d753e314e9ce205d7006b573865f","41660a23e5db77597994e17f9f773d02976f767276faf3b5bac0510807a9a36f","69a012ff46565169534ccefb175f87b3cc331b4f94cc5d223c29a036ed771f4e","74cbec210ba601caeb063d44e510fc012075b65a0482d3fa2d2d08837649356a","ea8a58bbb6d5614855a470b2d3630197e34fc372760b2b7fa27af8f3456525a6","7ffc83877389ebb86d201749d73b5e3706490070015522805696c9b94fa95ccb","d5f41ea8dbf1ed159a0a4cfce563a917c1df32bb8ac8d321b4d3dcf67271dd25","ebaaf177e746f9f0e16c906f1ffea95af771252b07136ca6a13995508fce34aa")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("027d4020f2dd1eb473636bc112a84f0a90b6651c","06566eabf54caafe36ebe94430d392b9cf3426ba","08af4c21cd0a165695c756b6fda37016197b01e7","2ed2edec8ccc44292410042c730c190027b87930","a25c06e8545666d6d2a88c8da300cf3383149d5a","ee3795f6418fc0cacbe884a8eb803498c2b5776f","bb72ca0e19a95c48a9ee4fd658958a0ae2af44b6","4743d5202dbe565721d75f7fb1eca43266a652d4","e6a7c54c01227adcb2a180e62f0082de1c13d61ae913cda379dd0f44a0d0567b","64c9347d794243be26e811b5eb90fb11c8e74e8aff504bf98481e5ccf9d72fe9","469fd8a280e89a6edd0d704d0be4c7e0e0d8d753e314e9ce205d7006b573865f","41660a23e5db77597994e17f9f773d02976f767276faf3b5bac0510807a9a36f","69a012ff46565169534ccefb175f87b3cc331b4f94cc5d223c29a036ed771f4e","74cbec210ba601caeb063d44e510fc012075b65a0482d3fa2d2d08837649356a","ea8a58bbb6d5614855a470b2d3630197e34fc372760b2b7fa27af8f3456525a6","7ffc83877389ebb86d201749d73b5e3706490070015522805696c9b94fa95ccb","d5f41ea8dbf1ed159a0a4cfce563a917c1df32bb8ac8d321b4d3dcf67271dd25","ebaaf177e746f9f0e16c906f1ffea95af771252b07136ca6a13995508fce34aa")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring64 NOT NULL AND customstring64 IN ("027d4020f2dd1eb473636bc112a84f0a90b6651c","06566eabf54caafe36ebe94430d392b9cf3426ba","08af4c21cd0a165695c756b6fda37016197b01e7","2ed2edec8ccc44292410042c730c190027b87930","a25c06e8545666d6d2a88c8da300cf3383149d5a","ee3795f6418fc0cacbe884a8eb803498c2b5776f","bb72ca0e19a95c48a9ee4fd658958a0ae2af44b6","4743d5202dbe565721d75f7fb1eca43266a652d4","e6a7c54c01227adcb2a180e62f0082de1c13d61ae913cda379dd0f44a0d0567b","64c9347d794243be26e811b5eb90fb11c8e74e8aff504bf98481e5ccf9d72fe9","469fd8a280e89a6edd0d704d0be4c7e0e0d8d753e314e9ce205d7006b573865f","41660a23e5db77597994e17f9f773d02976f767276faf3b5bac0510807a9a36f","69a012ff46565169534ccefb175f87b3cc331b4f94cc5d223c29a036ed771f4e","74cbec210ba601caeb063d44e510fc012075b65a0482d3fa2d2d08837649356a","ea8a58bbb6d5614855a470b2d3630197e34fc372760b2b7fa27af8f3456525a6","7ffc83877389ebb86d201749d73b5e3706490070015522805696c9b94fa95ccb","d5f41ea8dbf1ed159a0a4cfce563a917c1df32bb8ac8d321b4d3dcf67271dd25","ebaaf177e746f9f0e16c906f1ffea95af771252b07136ca6a13995508fce34aa")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("027d4020f2dd1eb473636bc112a84f0a90b6651c","06566eabf54caafe36ebe94430d392b9cf3426ba","08af4c21cd0a165695c756b6fda37016197b01e7","2ed2edec8ccc44292410042c730c190027b87930","a25c06e8545666d6d2a88c8da300cf3383149d5a","ee3795f6418fc0cacbe884a8eb803498c2b5776f","bb72ca0e19a95c48a9ee4fd658958a0ae2af44b6","4743d5202dbe565721d75f7fb1eca43266a652d4","e6a7c54c01227adcb2a180e62f0082de1c13d61ae913cda379dd0f44a0d0567b","64c9347d794243be26e811b5eb90fb11c8e74e8aff504bf98481e5ccf9d72fe9","469fd8a280e89a6edd0d704d0be4c7e0e0d8d753e314e9ce205d7006b573865f","41660a23e5db77597994e17f9f773d02976f767276faf3b5bac0510807a9a36f","69a012ff46565169534ccefb175f87b3cc331b4f94cc5d223c29a036ed771f4e","74cbec210ba601caeb063d44e510fc012075b65a0482d3fa2d2d08837649356a","ea8a58bbb6d5614855a470b2d3630197e34fc372760b2b7fa27af8f3456525a6","7ffc83877389ebb86d201749d73b5e3706490070015522805696c9b94fa95ccb","d5f41ea8dbf1ed159a0a4cfce563a917c1df32bb8ac8d321b4d3dcf67271dd25","ebaaf177e746f9f0e16c906f1ffea95af771252b07136ca6a13995508fce34aa")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("027d4020f2dd1eb473636bc112a84f0a90b6651c","06566eabf54caafe36ebe94430d392b9cf3426ba","08af4c21cd0a165695c756b6fda37016197b01e7","2ed2edec8ccc44292410042c730c190027b87930","a25c06e8545666d6d2a88c8da300cf3383149d5a","ee3795f6418fc0cacbe884a8eb803498c2b5776f","bb72ca0e19a95c48a9ee4fd658958a0ae2af44b6","4743d5202dbe565721d75f7fb1eca43266a652d4","e6a7c54c01227adcb2a180e62f0082de1c13d61ae913cda379dd0f44a0d0567b","64c9347d794243be26e811b5eb90fb11c8e74e8aff504bf98481e5ccf9d72fe9","469fd8a280e89a6edd0d704d0be4c7e0e0d8d753e314e9ce205d7006b573865f","41660a23e5db77597994e17f9f773d02976f767276faf3b5bac0510807a9a36f","69a012ff46565169534ccefb175f87b3cc331b4f94cc5d223c29a036ed771f4e","74cbec210ba601caeb063d44e510fc012075b65a0482d3fa2d2d08837649356a","ea8a58bbb6d5614855a470b2d3630197e34fc372760b2b7fa27af8f3456525a6","7ffc83877389ebb86d201749d73b5e3706490070015522805696c9b94fa95ccb","d5f41ea8dbf1ed159a0a4cfce563a917c1df32bb8ac8d321b4d3dcf67271dd25","ebaaf177e746f9f0e16c906f1ffea95af771252b07136ca6a13995508fce34aa")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("027d4020f2dd1eb473636bc112a84f0a90b6651c","06566eabf54caafe36ebe94430d392b9cf3426ba","08af4c21cd0a165695c756b6fda37016197b01e7","2ed2edec8ccc44292410042c730c190027b87930","a25c06e8545666d6d2a88c8da300cf3383149d5a","ee3795f6418fc0cacbe884a8eb803498c2b5776f","bb72ca0e19a95c48a9ee4fd658958a0ae2af44b6","4743d5202dbe565721d75f7fb1eca43266a652d4","e6a7c54c01227adcb2a180e62f0082de1c13d61ae913cda379dd0f44a0d0567b","64c9347d794243be26e811b5eb90fb11c8e74e8aff504bf98481e5ccf9d72fe9","469fd8a280e89a6edd0d704d0be4c7e0e0d8d753e314e9ce205d7006b573865f","41660a23e5db77597994e17f9f773d02976f767276faf3b5bac0510807a9a36f","69a012ff46565169534ccefb175f87b3cc331b4f94cc5d223c29a036ed771f4e","74cbec210ba601caeb063d44e510fc012075b65a0482d3fa2d2d08837649356a","ea8a58bbb6d5614855a470b2d3630197e34fc372760b2b7fa27af8f3456525a6","7ffc83877389ebb86d201749d73b5e3706490070015522805696c9b94fa95ccb","d5f41ea8dbf1ed159a0a4cfce563a917c1df32bb8ac8d321b4d3dcf67271dd25","ebaaf177e746f9f0e16c906f1ffea95af771252b07136ca6a13995508fce34aa")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring64 NOT NULL AND customstring64 IN ("027d4020f2dd1eb473636bc112a84f0a90b6651c","06566eabf54caafe36ebe94430d392b9cf3426ba","08af4c21cd0a165695c756b6fda37016197b01e7","2ed2edec8ccc44292410042c730c190027b87930","a25c06e8545666d6d2a88c8da300cf3383149d5a","ee3795f6418fc0cacbe884a8eb803498c2b5776f","bb72ca0e19a95c48a9ee4fd658958a0ae2af44b6","4743d5202dbe565721d75f7fb1eca43266a652d4","e6a7c54c01227adcb2a180e62f0082de1c13d61ae913cda379dd0f44a0d0567b","64c9347d794243be26e811b5eb90fb11c8e74e8aff504bf98481e5ccf9d72fe9","469fd8a280e89a6edd0d704d0be4c7e0e0d8d753e314e9ce205d7006b573865f","41660a23e5db77597994e17f9f773d02976f767276faf3b5bac0510807a9a36f","69a012ff46565169534ccefb175f87b3cc331b4f94cc5d223c29a036ed771f4e","74cbec210ba601caeb063d44e510fc012075b65a0482d3fa2d2d08837649356a","ea8a58bbb6d5614855a470b2d3630197e34fc372760b2b7fa27af8f3456525a6","7ffc83877389ebb86d201749d73b5e3706490070015522805696c9b94fa95ccb","d5f41ea8dbf1ed159a0a4cfce563a917c1df32bb8ac8d321b4d3dcf67271dd25","ebaaf177e746f9f0e16c906f1ffea95af771252b07136ca6a13995508fce34aa")
index=activity AND rg_functionality="O365 General" AND filehash NOT NULL AND filehash IN ("027d4020f2dd1eb473636bc112a84f0a90b6651c","06566eabf54caafe36ebe94430d392b9cf3426ba","08af4c21cd0a165695c756b6fda37016197b01e7","2ed2edec8ccc44292410042c730c190027b87930","a25c06e8545666d6d2a88c8da300cf3383149d5a","ee3795f6418fc0cacbe884a8eb803498c2b5776f","bb72ca0e19a95c48a9ee4fd658958a0ae2af44b6","4743d5202dbe565721d75f7fb1eca43266a652d4","e6a7c54c01227adcb2a180e62f0082de1c13d61ae913cda379dd0f44a0d0567b","64c9347d794243be26e811b5eb90fb11c8e74e8aff504bf98481e5ccf9d72fe9","469fd8a280e89a6edd0d704d0be4c7e0e0d8d753e314e9ce205d7006b573865f","41660a23e5db77597994e17f9f773d02976f767276faf3b5bac0510807a9a36f","69a012ff46565169534ccefb175f87b3cc331b4f94cc5d223c29a036ed771f4e","74cbec210ba601caeb063d44e510fc012075b65a0482d3fa2d2d08837649356a","ea8a58bbb6d5614855a470b2d3630197e34fc372760b2b7fa27af8f3456525a6","7ffc83877389ebb86d201749d73b5e3706490070015522805696c9b94fa95ccb","d5f41ea8dbf1ed159a0a4cfce563a917c1df32bb8ac8d321b4d3dcf67271dd25","ebaaf177e746f9f0e16c906f1ffea95af771252b07136ca6a13995508fce34aa")
index=activity AND rg_functionality="O365 General" AND oldfilehash NOT NULL AND oldfilehash IN ("027d4020f2dd1eb473636bc112a84f0a90b6651c","06566eabf54caafe36ebe94430d392b9cf3426ba","08af4c21cd0a165695c756b6fda37016197b01e7","2ed2edec8ccc44292410042c730c190027b87930","a25c06e8545666d6d2a88c8da300cf3383149d5a","ee3795f6418fc0cacbe884a8eb803498c2b5776f","bb72ca0e19a95c48a9ee4fd658958a0ae2af44b6","4743d5202dbe565721d75f7fb1eca43266a652d4","e6a7c54c01227adcb2a180e62f0082de1c13d61ae913cda379dd0f44a0d0567b","64c9347d794243be26e811b5eb90fb11c8e74e8aff504bf98481e5ccf9d72fe9","469fd8a280e89a6edd0d704d0be4c7e0e0d8d753e314e9ce205d7006b573865f","41660a23e5db77597994e17f9f773d02976f767276faf3b5bac0510807a9a36f","69a012ff46565169534ccefb175f87b3cc331b4f94cc5d223c29a036ed771f4e","74cbec210ba601caeb063d44e510fc012075b65a0482d3fa2d2d08837649356a","ea8a58bbb6d5614855a470b2d3630197e34fc372760b2b7fa27af8f3456525a6","7ffc83877389ebb86d201749d73b5e3706490070015522805696c9b94fa95ccb","d5f41ea8dbf1ed159a0a4cfce563a917c1df32bb8ac8d321b4d3dcf67271dd25","ebaaf177e746f9f0e16c906f1ffea95af771252b07136ca6a13995508fce34aa")
index=activity AND rg_functionality="O365 General" AND customstring3 NOT NULL AND customstring3 IN ("027d4020f2dd1eb473636bc112a84f0a90b6651c","06566eabf54caafe36ebe94430d392b9cf3426ba","08af4c21cd0a165695c756b6fda37016197b01e7","2ed2edec8ccc44292410042c730c190027b87930","a25c06e8545666d6d2a88c8da300cf3383149d5a","ee3795f6418fc0cacbe884a8eb803498c2b5776f","bb72ca0e19a95c48a9ee4fd658958a0ae2af44b6","4743d5202dbe565721d75f7fb1eca43266a652d4","e6a7c54c01227adcb2a180e62f0082de1c13d61ae913cda379dd0f44a0d0567b","64c9347d794243be26e811b5eb90fb11c8e74e8aff504bf98481e5ccf9d72fe9","469fd8a280e89a6edd0d704d0be4c7e0e0d8d753e314e9ce205d7006b573865f","41660a23e5db77597994e17f9f773d02976f767276faf3b5bac0510807a9a36f","69a012ff46565169534ccefb175f87b3cc331b4f94cc5d223c29a036ed771f4e","74cbec210ba601caeb063d44e510fc012075b65a0482d3fa2d2d08837649356a","ea8a58bbb6d5614855a470b2d3630197e34fc372760b2b7fa27af8f3456525a6","7ffc83877389ebb86d201749d73b5e3706490070015522805696c9b94fa95ccb","d5f41ea8dbf1ed159a0a4cfce563a917c1df32bb8ac8d321b4d3dcf67271dd25","ebaaf177e746f9f0e16c906f1ffea95af771252b07136ca6a13995508fce34aa")
index=activity AND rg_functionality="O365 General" AND customstring64 NOT NULL AND customstring64 IN ("027d4020f2dd1eb473636bc112a84f0a90b6651c","06566eabf54caafe36ebe94430d392b9cf3426ba","08af4c21cd0a165695c756b6fda37016197b01e7","2ed2edec8ccc44292410042c730c190027b87930","a25c06e8545666d6d2a88c8da300cf3383149d5a","ee3795f6418fc0cacbe884a8eb803498c2b5776f","bb72ca0e19a95c48a9ee4fd658958a0ae2af44b6","4743d5202dbe565721d75f7fb1eca43266a652d4","e6a7c54c01227adcb2a180e62f0082de1c13d61ae913cda379dd0f44a0d0567b","64c9347d794243be26e811b5eb90fb11c8e74e8aff504bf98481e5ccf9d72fe9","469fd8a280e89a6edd0d704d0be4c7e0e0d8d753e314e9ce205d7006b573865f","41660a23e5db77597994e17f9f773d02976f767276faf3b5bac0510807a9a36f","69a012ff46565169534ccefb175f87b3cc331b4f94cc5d223c29a036ed771f4e","74cbec210ba601caeb063d44e510fc012075b65a0482d3fa2d2d08837649356a","ea8a58bbb6d5614855a470b2d3630197e34fc372760b2b7fa27af8f3456525a6","7ffc83877389ebb86d201749d73b5e3706490070015522805696c9b94fa95ccb","d5f41ea8dbf1ed159a0a4cfce563a917c1df32bb8ac8d321b4d3dcf67271dd25","ebaaf177e746f9f0e16c906f1ffea95af771252b07136ca6a13995508fce34aa")
