index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("1533221ca97e88f5010b4a8b4d392232034dd07f154b13d4413c19693c0304c3","ca628638c20f6a67ac80782dc872e1e06b84cda68accf5e912ade6645c689f04","40be7be16cdaa414898db0014d26afd9cf516ba209f074a95c346227e690acd4","fab36431b9760b48eb84d671e7c10e16e0754ec86517d665c10811cd0670e06b","4f5f733c7ca71d514991ac3b369e34ce1c3744ff604c88481522edced14cc22c")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("1533221ca97e88f5010b4a8b4d392232034dd07f154b13d4413c19693c0304c3","ca628638c20f6a67ac80782dc872e1e06b84cda68accf5e912ade6645c689f04","40be7be16cdaa414898db0014d26afd9cf516ba209f074a95c346227e690acd4","fab36431b9760b48eb84d671e7c10e16e0754ec86517d665c10811cd0670e06b","4f5f733c7ca71d514991ac3b369e34ce1c3744ff604c88481522edced14cc22c")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("1533221ca97e88f5010b4a8b4d392232034dd07f154b13d4413c19693c0304c3","ca628638c20f6a67ac80782dc872e1e06b84cda68accf5e912ade6645c689f04","40be7be16cdaa414898db0014d26afd9cf516ba209f074a95c346227e690acd4","fab36431b9760b48eb84d671e7c10e16e0754ec86517d665c10811cd0670e06b","4f5f733c7ca71d514991ac3b369e34ce1c3744ff604c88481522edced14cc22c")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring64 NOT NULL AND customstring64 IN ("1533221ca97e88f5010b4a8b4d392232034dd07f154b13d4413c19693c0304c3","ca628638c20f6a67ac80782dc872e1e06b84cda68accf5e912ade6645c689f04","40be7be16cdaa414898db0014d26afd9cf516ba209f074a95c346227e690acd4","fab36431b9760b48eb84d671e7c10e16e0754ec86517d665c10811cd0670e06b","4f5f733c7ca71d514991ac3b369e34ce1c3744ff604c88481522edced14cc22c")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("1533221ca97e88f5010b4a8b4d392232034dd07f154b13d4413c19693c0304c3","ca628638c20f6a67ac80782dc872e1e06b84cda68accf5e912ade6645c689f04","40be7be16cdaa414898db0014d26afd9cf516ba209f074a95c346227e690acd4","fab36431b9760b48eb84d671e7c10e16e0754ec86517d665c10811cd0670e06b","4f5f733c7ca71d514991ac3b369e34ce1c3744ff604c88481522edced14cc22c")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("1533221ca97e88f5010b4a8b4d392232034dd07f154b13d4413c19693c0304c3","ca628638c20f6a67ac80782dc872e1e06b84cda68accf5e912ade6645c689f04","40be7be16cdaa414898db0014d26afd9cf516ba209f074a95c346227e690acd4","fab36431b9760b48eb84d671e7c10e16e0754ec86517d665c10811cd0670e06b","4f5f733c7ca71d514991ac3b369e34ce1c3744ff604c88481522edced14cc22c")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("1533221ca97e88f5010b4a8b4d392232034dd07f154b13d4413c19693c0304c3","ca628638c20f6a67ac80782dc872e1e06b84cda68accf5e912ade6645c689f04","40be7be16cdaa414898db0014d26afd9cf516ba209f074a95c346227e690acd4","fab36431b9760b48eb84d671e7c10e16e0754ec86517d665c10811cd0670e06b","4f5f733c7ca71d514991ac3b369e34ce1c3744ff604c88481522edced14cc22c")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("1533221ca97e88f5010b4a8b4d392232034dd07f154b13d4413c19693c0304c3","ca628638c20f6a67ac80782dc872e1e06b84cda68accf5e912ade6645c689f04","40be7be16cdaa414898db0014d26afd9cf516ba209f074a95c346227e690acd4","fab36431b9760b48eb84d671e7c10e16e0754ec86517d665c10811cd0670e06b","4f5f733c7ca71d514991ac3b369e34ce1c3744ff604c88481522edced14cc22c")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("1533221ca97e88f5010b4a8b4d392232034dd07f154b13d4413c19693c0304c3","ca628638c20f6a67ac80782dc872e1e06b84cda68accf5e912ade6645c689f04","40be7be16cdaa414898db0014d26afd9cf516ba209f074a95c346227e690acd4","fab36431b9760b48eb84d671e7c10e16e0754ec86517d665c10811cd0670e06b","4f5f733c7ca71d514991ac3b369e34ce1c3744ff604c88481522edced14cc22c")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("1533221ca97e88f5010b4a8b4d392232034dd07f154b13d4413c19693c0304c3","ca628638c20f6a67ac80782dc872e1e06b84cda68accf5e912ade6645c689f04","40be7be16cdaa414898db0014d26afd9cf516ba209f074a95c346227e690acd4","fab36431b9760b48eb84d671e7c10e16e0754ec86517d665c10811cd0670e06b","4f5f733c7ca71d514991ac3b369e34ce1c3744ff604c88481522edced14cc22c")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("1533221ca97e88f5010b4a8b4d392232034dd07f154b13d4413c19693c0304c3","ca628638c20f6a67ac80782dc872e1e06b84cda68accf5e912ade6645c689f04","40be7be16cdaa414898db0014d26afd9cf516ba209f074a95c346227e690acd4","fab36431b9760b48eb84d671e7c10e16e0754ec86517d665c10811cd0670e06b","4f5f733c7ca71d514991ac3b369e34ce1c3744ff604c88481522edced14cc22c")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("1533221ca97e88f5010b4a8b4d392232034dd07f154b13d4413c19693c0304c3","ca628638c20f6a67ac80782dc872e1e06b84cda68accf5e912ade6645c689f04","40be7be16cdaa414898db0014d26afd9cf516ba209f074a95c346227e690acd4","fab36431b9760b48eb84d671e7c10e16e0754ec86517d665c10811cd0670e06b","4f5f733c7ca71d514991ac3b369e34ce1c3744ff604c88481522edced14cc22c")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("1533221ca97e88f5010b4a8b4d392232034dd07f154b13d4413c19693c0304c3","ca628638c20f6a67ac80782dc872e1e06b84cda68accf5e912ade6645c689f04","40be7be16cdaa414898db0014d26afd9cf516ba209f074a95c346227e690acd4","fab36431b9760b48eb84d671e7c10e16e0754ec86517d665c10811cd0670e06b","4f5f733c7ca71d514991ac3b369e34ce1c3744ff604c88481522edced14cc22c")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("1533221ca97e88f5010b4a8b4d392232034dd07f154b13d4413c19693c0304c3","ca628638c20f6a67ac80782dc872e1e06b84cda68accf5e912ade6645c689f04","40be7be16cdaa414898db0014d26afd9cf516ba209f074a95c346227e690acd4","fab36431b9760b48eb84d671e7c10e16e0754ec86517d665c10811cd0670e06b","4f5f733c7ca71d514991ac3b369e34ce1c3744ff604c88481522edced14cc22c")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("1533221ca97e88f5010b4a8b4d392232034dd07f154b13d4413c19693c0304c3","ca628638c20f6a67ac80782dc872e1e06b84cda68accf5e912ade6645c689f04","40be7be16cdaa414898db0014d26afd9cf516ba209f074a95c346227e690acd4","fab36431b9760b48eb84d671e7c10e16e0754ec86517d665c10811cd0670e06b","4f5f733c7ca71d514991ac3b369e34ce1c3744ff604c88481522edced14cc22c")
index=activity AND rg_functionality="Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("1533221ca97e88f5010b4a8b4d392232034dd07f154b13d4413c19693c0304c3","ca628638c20f6a67ac80782dc872e1e06b84cda68accf5e912ade6645c689f04","40be7be16cdaa414898db0014d26afd9cf516ba209f074a95c346227e690acd4","fab36431b9760b48eb84d671e7c10e16e0754ec86517d665c10811cd0670e06b","4f5f733c7ca71d514991ac3b369e34ce1c3744ff604c88481522edced14cc22c")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("1533221ca97e88f5010b4a8b4d392232034dd07f154b13d4413c19693c0304c3","ca628638c20f6a67ac80782dc872e1e06b84cda68accf5e912ade6645c689f04","40be7be16cdaa414898db0014d26afd9cf516ba209f074a95c346227e690acd4","fab36431b9760b48eb84d671e7c10e16e0754ec86517d665c10811cd0670e06b","4f5f733c7ca71d514991ac3b369e34ce1c3744ff604c88481522edced14cc22c")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("1533221ca97e88f5010b4a8b4d392232034dd07f154b13d4413c19693c0304c3","ca628638c20f6a67ac80782dc872e1e06b84cda68accf5e912ade6645c689f04","40be7be16cdaa414898db0014d26afd9cf516ba209f074a95c346227e690acd4","fab36431b9760b48eb84d671e7c10e16e0754ec86517d665c10811cd0670e06b","4f5f733c7ca71d514991ac3b369e34ce1c3744ff604c88481522edced14cc22c")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("1533221ca97e88f5010b4a8b4d392232034dd07f154b13d4413c19693c0304c3","ca628638c20f6a67ac80782dc872e1e06b84cda68accf5e912ade6645c689f04","40be7be16cdaa414898db0014d26afd9cf516ba209f074a95c346227e690acd4","fab36431b9760b48eb84d671e7c10e16e0754ec86517d665c10811cd0670e06b","4f5f733c7ca71d514991ac3b369e34ce1c3744ff604c88481522edced14cc22c")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("1533221ca97e88f5010b4a8b4d392232034dd07f154b13d4413c19693c0304c3","ca628638c20f6a67ac80782dc872e1e06b84cda68accf5e912ade6645c689f04","40be7be16cdaa414898db0014d26afd9cf516ba209f074a95c346227e690acd4","fab36431b9760b48eb84d671e7c10e16e0754ec86517d665c10811cd0670e06b","4f5f733c7ca71d514991ac3b369e34ce1c3744ff604c88481522edced14cc22c")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("1533221ca97e88f5010b4a8b4d392232034dd07f154b13d4413c19693c0304c3","ca628638c20f6a67ac80782dc872e1e06b84cda68accf5e912ade6645c689f04","40be7be16cdaa414898db0014d26afd9cf516ba209f074a95c346227e690acd4","fab36431b9760b48eb84d671e7c10e16e0754ec86517d665c10811cd0670e06b","4f5f733c7ca71d514991ac3b369e34ce1c3744ff604c88481522edced14cc22c")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("1533221ca97e88f5010b4a8b4d392232034dd07f154b13d4413c19693c0304c3","ca628638c20f6a67ac80782dc872e1e06b84cda68accf5e912ade6645c689f04","40be7be16cdaa414898db0014d26afd9cf516ba209f074a95c346227e690acd4","fab36431b9760b48eb84d671e7c10e16e0754ec86517d665c10811cd0670e06b","4f5f733c7ca71d514991ac3b369e34ce1c3744ff604c88481522edced14cc22c")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("1533221ca97e88f5010b4a8b4d392232034dd07f154b13d4413c19693c0304c3","ca628638c20f6a67ac80782dc872e1e06b84cda68accf5e912ade6645c689f04","40be7be16cdaa414898db0014d26afd9cf516ba209f074a95c346227e690acd4","fab36431b9760b48eb84d671e7c10e16e0754ec86517d665c10811cd0670e06b","4f5f733c7ca71d514991ac3b369e34ce1c3744ff604c88481522edced14cc22c")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring64 NOT NULL AND customstring64 IN ("1533221ca97e88f5010b4a8b4d392232034dd07f154b13d4413c19693c0304c3","ca628638c20f6a67ac80782dc872e1e06b84cda68accf5e912ade6645c689f04","40be7be16cdaa414898db0014d26afd9cf516ba209f074a95c346227e690acd4","fab36431b9760b48eb84d671e7c10e16e0754ec86517d665c10811cd0670e06b","4f5f733c7ca71d514991ac3b369e34ce1c3744ff604c88481522edced14cc22c")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("1533221ca97e88f5010b4a8b4d392232034dd07f154b13d4413c19693c0304c3","ca628638c20f6a67ac80782dc872e1e06b84cda68accf5e912ade6645c689f04","40be7be16cdaa414898db0014d26afd9cf516ba209f074a95c346227e690acd4","fab36431b9760b48eb84d671e7c10e16e0754ec86517d665c10811cd0670e06b","4f5f733c7ca71d514991ac3b369e34ce1c3744ff604c88481522edced14cc22c")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("1533221ca97e88f5010b4a8b4d392232034dd07f154b13d4413c19693c0304c3","ca628638c20f6a67ac80782dc872e1e06b84cda68accf5e912ade6645c689f04","40be7be16cdaa414898db0014d26afd9cf516ba209f074a95c346227e690acd4","fab36431b9760b48eb84d671e7c10e16e0754ec86517d665c10811cd0670e06b","4f5f733c7ca71d514991ac3b369e34ce1c3744ff604c88481522edced14cc22c")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("1533221ca97e88f5010b4a8b4d392232034dd07f154b13d4413c19693c0304c3","ca628638c20f6a67ac80782dc872e1e06b84cda68accf5e912ade6645c689f04","40be7be16cdaa414898db0014d26afd9cf516ba209f074a95c346227e690acd4","fab36431b9760b48eb84d671e7c10e16e0754ec86517d665c10811cd0670e06b","4f5f733c7ca71d514991ac3b369e34ce1c3744ff604c88481522edced14cc22c")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring64 NOT NULL AND customstring64 IN ("1533221ca97e88f5010b4a8b4d392232034dd07f154b13d4413c19693c0304c3","ca628638c20f6a67ac80782dc872e1e06b84cda68accf5e912ade6645c689f04","40be7be16cdaa414898db0014d26afd9cf516ba209f074a95c346227e690acd4","fab36431b9760b48eb84d671e7c10e16e0754ec86517d665c10811cd0670e06b","4f5f733c7ca71d514991ac3b369e34ce1c3744ff604c88481522edced14cc22c")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("1533221ca97e88f5010b4a8b4d392232034dd07f154b13d4413c19693c0304c3","ca628638c20f6a67ac80782dc872e1e06b84cda68accf5e912ade6645c689f04","40be7be16cdaa414898db0014d26afd9cf516ba209f074a95c346227e690acd4","fab36431b9760b48eb84d671e7c10e16e0754ec86517d665c10811cd0670e06b","4f5f733c7ca71d514991ac3b369e34ce1c3744ff604c88481522edced14cc22c")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("1533221ca97e88f5010b4a8b4d392232034dd07f154b13d4413c19693c0304c3","ca628638c20f6a67ac80782dc872e1e06b84cda68accf5e912ade6645c689f04","40be7be16cdaa414898db0014d26afd9cf516ba209f074a95c346227e690acd4","fab36431b9760b48eb84d671e7c10e16e0754ec86517d665c10811cd0670e06b","4f5f733c7ca71d514991ac3b369e34ce1c3744ff604c88481522edced14cc22c")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("1533221ca97e88f5010b4a8b4d392232034dd07f154b13d4413c19693c0304c3","ca628638c20f6a67ac80782dc872e1e06b84cda68accf5e912ade6645c689f04","40be7be16cdaa414898db0014d26afd9cf516ba209f074a95c346227e690acd4","fab36431b9760b48eb84d671e7c10e16e0754ec86517d665c10811cd0670e06b","4f5f733c7ca71d514991ac3b369e34ce1c3744ff604c88481522edced14cc22c")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring64 NOT NULL AND customstring64 IN ("1533221ca97e88f5010b4a8b4d392232034dd07f154b13d4413c19693c0304c3","ca628638c20f6a67ac80782dc872e1e06b84cda68accf5e912ade6645c689f04","40be7be16cdaa414898db0014d26afd9cf516ba209f074a95c346227e690acd4","fab36431b9760b48eb84d671e7c10e16e0754ec86517d665c10811cd0670e06b","4f5f733c7ca71d514991ac3b369e34ce1c3744ff604c88481522edced14cc22c")
index=activity AND rg_functionality="O365 General" AND filehash NOT NULL AND filehash IN ("1533221ca97e88f5010b4a8b4d392232034dd07f154b13d4413c19693c0304c3","ca628638c20f6a67ac80782dc872e1e06b84cda68accf5e912ade6645c689f04","40be7be16cdaa414898db0014d26afd9cf516ba209f074a95c346227e690acd4","fab36431b9760b48eb84d671e7c10e16e0754ec86517d665c10811cd0670e06b","4f5f733c7ca71d514991ac3b369e34ce1c3744ff604c88481522edced14cc22c")
index=activity AND rg_functionality="O365 General" AND oldfilehash NOT NULL AND oldfilehash IN ("1533221ca97e88f5010b4a8b4d392232034dd07f154b13d4413c19693c0304c3","ca628638c20f6a67ac80782dc872e1e06b84cda68accf5e912ade6645c689f04","40be7be16cdaa414898db0014d26afd9cf516ba209f074a95c346227e690acd4","fab36431b9760b48eb84d671e7c10e16e0754ec86517d665c10811cd0670e06b","4f5f733c7ca71d514991ac3b369e34ce1c3744ff604c88481522edced14cc22c")
index=activity AND rg_functionality="O365 General" AND customstring3 NOT NULL AND customstring3 IN ("1533221ca97e88f5010b4a8b4d392232034dd07f154b13d4413c19693c0304c3","ca628638c20f6a67ac80782dc872e1e06b84cda68accf5e912ade6645c689f04","40be7be16cdaa414898db0014d26afd9cf516ba209f074a95c346227e690acd4","fab36431b9760b48eb84d671e7c10e16e0754ec86517d665c10811cd0670e06b","4f5f733c7ca71d514991ac3b369e34ce1c3744ff604c88481522edced14cc22c")
index=activity AND rg_functionality="O365 General" AND customstring64 NOT NULL AND customstring64 IN ("1533221ca97e88f5010b4a8b4d392232034dd07f154b13d4413c19693c0304c3","ca628638c20f6a67ac80782dc872e1e06b84cda68accf5e912ade6645c689f04","40be7be16cdaa414898db0014d26afd9cf516ba209f074a95c346227e690acd4","fab36431b9760b48eb84d671e7c10e16e0754ec86517d665c10811cd0670e06b","4f5f733c7ca71d514991ac3b369e34ce1c3744ff604c88481522edced14cc22c")
