index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("378b000edf3bfe114e1b7ba8045371080a256825f25faaea364cf57fa6d898d7","ba8f84fdc1678e133ad265e357e99dba7031872371d444e84d6a47a022914de9","a01672db8b14a2018f760258cf3ba80cda6a19febbff8db29555f46592aedea6","02acf78048776cd52064a0adf3f7a061afb7418b3da21b793960de8a258faf29","2384abde79fae57568039ae33014184626a54409e38dee3cfb97c58c7f159e32","4b45b01bedd0140ced78e879d1c9081cecc4dd124dcf10ffcd3e015454501503","08d606e87da9ec45d257fcfc1b5ea169b582d79376626672813b964574709cba","4b45b01bedd0140ced78e879d1c9081cecc4dd124dcf10ffcd3e015454501503","08d606e87da9ec45d257fcfc1b5ea169b582d79376626672813b964574709cba","585e52757fe9d54a97ec67f4b2d82d81a547ec1bd402d609749ba10a24c9af53","51f1d5d41e5f5f17084d390e026551bc4e9a001aeb04995aff1c3a8dbf2d2ff3","44a54797ca1ee9c896ce95d78b24d6b710c2d4bcb6f0bcdc80cd79ab95f1f096","b28473a7e5281f63fd25b3cb75f4e3346112af6ae5de44e978d6cf2aac1538c1","96e22fa78d6f5124722fe20850c63e9d1c1f38c658146715b4fb071112c7db13","f9d8b85fac10f088ebbccb7fe49274a263ca120486bceab6e6009ea072cb99c0","2e34908f60502ead6ad08af1554c305b88741d09e36b2c24d85fd9bac4a11d2f","9b2be97c2950391d9c16497d4362e0feb5e88bfe4994f6d31b4fda7769b1c780","9a2a855b4ce30678d06a97f7e9f4edbd607f286d2a6ea1dde0a1c55a4512bb29","51ab25a9a403547ec6ac5c095d904d6bc91856557049b5739457367d17e831a7","b4156c2cd85285a2cb12dd208fcecb5d88820816b6371501e53cb47b4fe376fd","897b0d0e64cf87ac7086241c86f757f3c94d6826f949a1f0fec9c40892c0cecb")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("378b000edf3bfe114e1b7ba8045371080a256825f25faaea364cf57fa6d898d7","ba8f84fdc1678e133ad265e357e99dba7031872371d444e84d6a47a022914de9","a01672db8b14a2018f760258cf3ba80cda6a19febbff8db29555f46592aedea6","02acf78048776cd52064a0adf3f7a061afb7418b3da21b793960de8a258faf29","2384abde79fae57568039ae33014184626a54409e38dee3cfb97c58c7f159e32","4b45b01bedd0140ced78e879d1c9081cecc4dd124dcf10ffcd3e015454501503","08d606e87da9ec45d257fcfc1b5ea169b582d79376626672813b964574709cba","4b45b01bedd0140ced78e879d1c9081cecc4dd124dcf10ffcd3e015454501503","08d606e87da9ec45d257fcfc1b5ea169b582d79376626672813b964574709cba","585e52757fe9d54a97ec67f4b2d82d81a547ec1bd402d609749ba10a24c9af53","51f1d5d41e5f5f17084d390e026551bc4e9a001aeb04995aff1c3a8dbf2d2ff3","44a54797ca1ee9c896ce95d78b24d6b710c2d4bcb6f0bcdc80cd79ab95f1f096","b28473a7e5281f63fd25b3cb75f4e3346112af6ae5de44e978d6cf2aac1538c1","96e22fa78d6f5124722fe20850c63e9d1c1f38c658146715b4fb071112c7db13","f9d8b85fac10f088ebbccb7fe49274a263ca120486bceab6e6009ea072cb99c0","2e34908f60502ead6ad08af1554c305b88741d09e36b2c24d85fd9bac4a11d2f","9b2be97c2950391d9c16497d4362e0feb5e88bfe4994f6d31b4fda7769b1c780","9a2a855b4ce30678d06a97f7e9f4edbd607f286d2a6ea1dde0a1c55a4512bb29","51ab25a9a403547ec6ac5c095d904d6bc91856557049b5739457367d17e831a7","b4156c2cd85285a2cb12dd208fcecb5d88820816b6371501e53cb47b4fe376fd","897b0d0e64cf87ac7086241c86f757f3c94d6826f949a1f0fec9c40892c0cecb")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("378b000edf3bfe114e1b7ba8045371080a256825f25faaea364cf57fa6d898d7","ba8f84fdc1678e133ad265e357e99dba7031872371d444e84d6a47a022914de9","a01672db8b14a2018f760258cf3ba80cda6a19febbff8db29555f46592aedea6","02acf78048776cd52064a0adf3f7a061afb7418b3da21b793960de8a258faf29","2384abde79fae57568039ae33014184626a54409e38dee3cfb97c58c7f159e32","4b45b01bedd0140ced78e879d1c9081cecc4dd124dcf10ffcd3e015454501503","08d606e87da9ec45d257fcfc1b5ea169b582d79376626672813b964574709cba","4b45b01bedd0140ced78e879d1c9081cecc4dd124dcf10ffcd3e015454501503","08d606e87da9ec45d257fcfc1b5ea169b582d79376626672813b964574709cba","585e52757fe9d54a97ec67f4b2d82d81a547ec1bd402d609749ba10a24c9af53","51f1d5d41e5f5f17084d390e026551bc4e9a001aeb04995aff1c3a8dbf2d2ff3","44a54797ca1ee9c896ce95d78b24d6b710c2d4bcb6f0bcdc80cd79ab95f1f096","b28473a7e5281f63fd25b3cb75f4e3346112af6ae5de44e978d6cf2aac1538c1","96e22fa78d6f5124722fe20850c63e9d1c1f38c658146715b4fb071112c7db13","f9d8b85fac10f088ebbccb7fe49274a263ca120486bceab6e6009ea072cb99c0","2e34908f60502ead6ad08af1554c305b88741d09e36b2c24d85fd9bac4a11d2f","9b2be97c2950391d9c16497d4362e0feb5e88bfe4994f6d31b4fda7769b1c780","9a2a855b4ce30678d06a97f7e9f4edbd607f286d2a6ea1dde0a1c55a4512bb29","51ab25a9a403547ec6ac5c095d904d6bc91856557049b5739457367d17e831a7","b4156c2cd85285a2cb12dd208fcecb5d88820816b6371501e53cb47b4fe376fd","897b0d0e64cf87ac7086241c86f757f3c94d6826f949a1f0fec9c40892c0cecb")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring64 NOT NULL AND customstring64 IN ("378b000edf3bfe114e1b7ba8045371080a256825f25faaea364cf57fa6d898d7","ba8f84fdc1678e133ad265e357e99dba7031872371d444e84d6a47a022914de9","a01672db8b14a2018f760258cf3ba80cda6a19febbff8db29555f46592aedea6","02acf78048776cd52064a0adf3f7a061afb7418b3da21b793960de8a258faf29","2384abde79fae57568039ae33014184626a54409e38dee3cfb97c58c7f159e32","4b45b01bedd0140ced78e879d1c9081cecc4dd124dcf10ffcd3e015454501503","08d606e87da9ec45d257fcfc1b5ea169b582d79376626672813b964574709cba","4b45b01bedd0140ced78e879d1c9081cecc4dd124dcf10ffcd3e015454501503","08d606e87da9ec45d257fcfc1b5ea169b582d79376626672813b964574709cba","585e52757fe9d54a97ec67f4b2d82d81a547ec1bd402d609749ba10a24c9af53","51f1d5d41e5f5f17084d390e026551bc4e9a001aeb04995aff1c3a8dbf2d2ff3","44a54797ca1ee9c896ce95d78b24d6b710c2d4bcb6f0bcdc80cd79ab95f1f096","b28473a7e5281f63fd25b3cb75f4e3346112af6ae5de44e978d6cf2aac1538c1","96e22fa78d6f5124722fe20850c63e9d1c1f38c658146715b4fb071112c7db13","f9d8b85fac10f088ebbccb7fe49274a263ca120486bceab6e6009ea072cb99c0","2e34908f60502ead6ad08af1554c305b88741d09e36b2c24d85fd9bac4a11d2f","9b2be97c2950391d9c16497d4362e0feb5e88bfe4994f6d31b4fda7769b1c780","9a2a855b4ce30678d06a97f7e9f4edbd607f286d2a6ea1dde0a1c55a4512bb29","51ab25a9a403547ec6ac5c095d904d6bc91856557049b5739457367d17e831a7","b4156c2cd85285a2cb12dd208fcecb5d88820816b6371501e53cb47b4fe376fd","897b0d0e64cf87ac7086241c86f757f3c94d6826f949a1f0fec9c40892c0cecb")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("378b000edf3bfe114e1b7ba8045371080a256825f25faaea364cf57fa6d898d7","ba8f84fdc1678e133ad265e357e99dba7031872371d444e84d6a47a022914de9","a01672db8b14a2018f760258cf3ba80cda6a19febbff8db29555f46592aedea6","02acf78048776cd52064a0adf3f7a061afb7418b3da21b793960de8a258faf29","2384abde79fae57568039ae33014184626a54409e38dee3cfb97c58c7f159e32","4b45b01bedd0140ced78e879d1c9081cecc4dd124dcf10ffcd3e015454501503","08d606e87da9ec45d257fcfc1b5ea169b582d79376626672813b964574709cba","4b45b01bedd0140ced78e879d1c9081cecc4dd124dcf10ffcd3e015454501503","08d606e87da9ec45d257fcfc1b5ea169b582d79376626672813b964574709cba","585e52757fe9d54a97ec67f4b2d82d81a547ec1bd402d609749ba10a24c9af53","51f1d5d41e5f5f17084d390e026551bc4e9a001aeb04995aff1c3a8dbf2d2ff3","44a54797ca1ee9c896ce95d78b24d6b710c2d4bcb6f0bcdc80cd79ab95f1f096","b28473a7e5281f63fd25b3cb75f4e3346112af6ae5de44e978d6cf2aac1538c1","96e22fa78d6f5124722fe20850c63e9d1c1f38c658146715b4fb071112c7db13","f9d8b85fac10f088ebbccb7fe49274a263ca120486bceab6e6009ea072cb99c0","2e34908f60502ead6ad08af1554c305b88741d09e36b2c24d85fd9bac4a11d2f","9b2be97c2950391d9c16497d4362e0feb5e88bfe4994f6d31b4fda7769b1c780","9a2a855b4ce30678d06a97f7e9f4edbd607f286d2a6ea1dde0a1c55a4512bb29","51ab25a9a403547ec6ac5c095d904d6bc91856557049b5739457367d17e831a7","b4156c2cd85285a2cb12dd208fcecb5d88820816b6371501e53cb47b4fe376fd","897b0d0e64cf87ac7086241c86f757f3c94d6826f949a1f0fec9c40892c0cecb")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("378b000edf3bfe114e1b7ba8045371080a256825f25faaea364cf57fa6d898d7","ba8f84fdc1678e133ad265e357e99dba7031872371d444e84d6a47a022914de9","a01672db8b14a2018f760258cf3ba80cda6a19febbff8db29555f46592aedea6","02acf78048776cd52064a0adf3f7a061afb7418b3da21b793960de8a258faf29","2384abde79fae57568039ae33014184626a54409e38dee3cfb97c58c7f159e32","4b45b01bedd0140ced78e879d1c9081cecc4dd124dcf10ffcd3e015454501503","08d606e87da9ec45d257fcfc1b5ea169b582d79376626672813b964574709cba","4b45b01bedd0140ced78e879d1c9081cecc4dd124dcf10ffcd3e015454501503","08d606e87da9ec45d257fcfc1b5ea169b582d79376626672813b964574709cba","585e52757fe9d54a97ec67f4b2d82d81a547ec1bd402d609749ba10a24c9af53","51f1d5d41e5f5f17084d390e026551bc4e9a001aeb04995aff1c3a8dbf2d2ff3","44a54797ca1ee9c896ce95d78b24d6b710c2d4bcb6f0bcdc80cd79ab95f1f096","b28473a7e5281f63fd25b3cb75f4e3346112af6ae5de44e978d6cf2aac1538c1","96e22fa78d6f5124722fe20850c63e9d1c1f38c658146715b4fb071112c7db13","f9d8b85fac10f088ebbccb7fe49274a263ca120486bceab6e6009ea072cb99c0","2e34908f60502ead6ad08af1554c305b88741d09e36b2c24d85fd9bac4a11d2f","9b2be97c2950391d9c16497d4362e0feb5e88bfe4994f6d31b4fda7769b1c780","9a2a855b4ce30678d06a97f7e9f4edbd607f286d2a6ea1dde0a1c55a4512bb29","51ab25a9a403547ec6ac5c095d904d6bc91856557049b5739457367d17e831a7","b4156c2cd85285a2cb12dd208fcecb5d88820816b6371501e53cb47b4fe376fd","897b0d0e64cf87ac7086241c86f757f3c94d6826f949a1f0fec9c40892c0cecb")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("378b000edf3bfe114e1b7ba8045371080a256825f25faaea364cf57fa6d898d7","ba8f84fdc1678e133ad265e357e99dba7031872371d444e84d6a47a022914de9","a01672db8b14a2018f760258cf3ba80cda6a19febbff8db29555f46592aedea6","02acf78048776cd52064a0adf3f7a061afb7418b3da21b793960de8a258faf29","2384abde79fae57568039ae33014184626a54409e38dee3cfb97c58c7f159e32","4b45b01bedd0140ced78e879d1c9081cecc4dd124dcf10ffcd3e015454501503","08d606e87da9ec45d257fcfc1b5ea169b582d79376626672813b964574709cba","4b45b01bedd0140ced78e879d1c9081cecc4dd124dcf10ffcd3e015454501503","08d606e87da9ec45d257fcfc1b5ea169b582d79376626672813b964574709cba","585e52757fe9d54a97ec67f4b2d82d81a547ec1bd402d609749ba10a24c9af53","51f1d5d41e5f5f17084d390e026551bc4e9a001aeb04995aff1c3a8dbf2d2ff3","44a54797ca1ee9c896ce95d78b24d6b710c2d4bcb6f0bcdc80cd79ab95f1f096","b28473a7e5281f63fd25b3cb75f4e3346112af6ae5de44e978d6cf2aac1538c1","96e22fa78d6f5124722fe20850c63e9d1c1f38c658146715b4fb071112c7db13","f9d8b85fac10f088ebbccb7fe49274a263ca120486bceab6e6009ea072cb99c0","2e34908f60502ead6ad08af1554c305b88741d09e36b2c24d85fd9bac4a11d2f","9b2be97c2950391d9c16497d4362e0feb5e88bfe4994f6d31b4fda7769b1c780","9a2a855b4ce30678d06a97f7e9f4edbd607f286d2a6ea1dde0a1c55a4512bb29","51ab25a9a403547ec6ac5c095d904d6bc91856557049b5739457367d17e831a7","b4156c2cd85285a2cb12dd208fcecb5d88820816b6371501e53cb47b4fe376fd","897b0d0e64cf87ac7086241c86f757f3c94d6826f949a1f0fec9c40892c0cecb")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("378b000edf3bfe114e1b7ba8045371080a256825f25faaea364cf57fa6d898d7","ba8f84fdc1678e133ad265e357e99dba7031872371d444e84d6a47a022914de9","a01672db8b14a2018f760258cf3ba80cda6a19febbff8db29555f46592aedea6","02acf78048776cd52064a0adf3f7a061afb7418b3da21b793960de8a258faf29","2384abde79fae57568039ae33014184626a54409e38dee3cfb97c58c7f159e32","4b45b01bedd0140ced78e879d1c9081cecc4dd124dcf10ffcd3e015454501503","08d606e87da9ec45d257fcfc1b5ea169b582d79376626672813b964574709cba","4b45b01bedd0140ced78e879d1c9081cecc4dd124dcf10ffcd3e015454501503","08d606e87da9ec45d257fcfc1b5ea169b582d79376626672813b964574709cba","585e52757fe9d54a97ec67f4b2d82d81a547ec1bd402d609749ba10a24c9af53","51f1d5d41e5f5f17084d390e026551bc4e9a001aeb04995aff1c3a8dbf2d2ff3","44a54797ca1ee9c896ce95d78b24d6b710c2d4bcb6f0bcdc80cd79ab95f1f096","b28473a7e5281f63fd25b3cb75f4e3346112af6ae5de44e978d6cf2aac1538c1","96e22fa78d6f5124722fe20850c63e9d1c1f38c658146715b4fb071112c7db13","f9d8b85fac10f088ebbccb7fe49274a263ca120486bceab6e6009ea072cb99c0","2e34908f60502ead6ad08af1554c305b88741d09e36b2c24d85fd9bac4a11d2f","9b2be97c2950391d9c16497d4362e0feb5e88bfe4994f6d31b4fda7769b1c780","9a2a855b4ce30678d06a97f7e9f4edbd607f286d2a6ea1dde0a1c55a4512bb29","51ab25a9a403547ec6ac5c095d904d6bc91856557049b5739457367d17e831a7","b4156c2cd85285a2cb12dd208fcecb5d88820816b6371501e53cb47b4fe376fd","897b0d0e64cf87ac7086241c86f757f3c94d6826f949a1f0fec9c40892c0cecb")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("378b000edf3bfe114e1b7ba8045371080a256825f25faaea364cf57fa6d898d7","ba8f84fdc1678e133ad265e357e99dba7031872371d444e84d6a47a022914de9","a01672db8b14a2018f760258cf3ba80cda6a19febbff8db29555f46592aedea6","02acf78048776cd52064a0adf3f7a061afb7418b3da21b793960de8a258faf29","2384abde79fae57568039ae33014184626a54409e38dee3cfb97c58c7f159e32","4b45b01bedd0140ced78e879d1c9081cecc4dd124dcf10ffcd3e015454501503","08d606e87da9ec45d257fcfc1b5ea169b582d79376626672813b964574709cba","4b45b01bedd0140ced78e879d1c9081cecc4dd124dcf10ffcd3e015454501503","08d606e87da9ec45d257fcfc1b5ea169b582d79376626672813b964574709cba","585e52757fe9d54a97ec67f4b2d82d81a547ec1bd402d609749ba10a24c9af53","51f1d5d41e5f5f17084d390e026551bc4e9a001aeb04995aff1c3a8dbf2d2ff3","44a54797ca1ee9c896ce95d78b24d6b710c2d4bcb6f0bcdc80cd79ab95f1f096","b28473a7e5281f63fd25b3cb75f4e3346112af6ae5de44e978d6cf2aac1538c1","96e22fa78d6f5124722fe20850c63e9d1c1f38c658146715b4fb071112c7db13","f9d8b85fac10f088ebbccb7fe49274a263ca120486bceab6e6009ea072cb99c0","2e34908f60502ead6ad08af1554c305b88741d09e36b2c24d85fd9bac4a11d2f","9b2be97c2950391d9c16497d4362e0feb5e88bfe4994f6d31b4fda7769b1c780","9a2a855b4ce30678d06a97f7e9f4edbd607f286d2a6ea1dde0a1c55a4512bb29","51ab25a9a403547ec6ac5c095d904d6bc91856557049b5739457367d17e831a7","b4156c2cd85285a2cb12dd208fcecb5d88820816b6371501e53cb47b4fe376fd","897b0d0e64cf87ac7086241c86f757f3c94d6826f949a1f0fec9c40892c0cecb")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("378b000edf3bfe114e1b7ba8045371080a256825f25faaea364cf57fa6d898d7","ba8f84fdc1678e133ad265e357e99dba7031872371d444e84d6a47a022914de9","a01672db8b14a2018f760258cf3ba80cda6a19febbff8db29555f46592aedea6","02acf78048776cd52064a0adf3f7a061afb7418b3da21b793960de8a258faf29","2384abde79fae57568039ae33014184626a54409e38dee3cfb97c58c7f159e32","4b45b01bedd0140ced78e879d1c9081cecc4dd124dcf10ffcd3e015454501503","08d606e87da9ec45d257fcfc1b5ea169b582d79376626672813b964574709cba","4b45b01bedd0140ced78e879d1c9081cecc4dd124dcf10ffcd3e015454501503","08d606e87da9ec45d257fcfc1b5ea169b582d79376626672813b964574709cba","585e52757fe9d54a97ec67f4b2d82d81a547ec1bd402d609749ba10a24c9af53","51f1d5d41e5f5f17084d390e026551bc4e9a001aeb04995aff1c3a8dbf2d2ff3","44a54797ca1ee9c896ce95d78b24d6b710c2d4bcb6f0bcdc80cd79ab95f1f096","b28473a7e5281f63fd25b3cb75f4e3346112af6ae5de44e978d6cf2aac1538c1","96e22fa78d6f5124722fe20850c63e9d1c1f38c658146715b4fb071112c7db13","f9d8b85fac10f088ebbccb7fe49274a263ca120486bceab6e6009ea072cb99c0","2e34908f60502ead6ad08af1554c305b88741d09e36b2c24d85fd9bac4a11d2f","9b2be97c2950391d9c16497d4362e0feb5e88bfe4994f6d31b4fda7769b1c780","9a2a855b4ce30678d06a97f7e9f4edbd607f286d2a6ea1dde0a1c55a4512bb29","51ab25a9a403547ec6ac5c095d904d6bc91856557049b5739457367d17e831a7","b4156c2cd85285a2cb12dd208fcecb5d88820816b6371501e53cb47b4fe376fd","897b0d0e64cf87ac7086241c86f757f3c94d6826f949a1f0fec9c40892c0cecb")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("378b000edf3bfe114e1b7ba8045371080a256825f25faaea364cf57fa6d898d7","ba8f84fdc1678e133ad265e357e99dba7031872371d444e84d6a47a022914de9","a01672db8b14a2018f760258cf3ba80cda6a19febbff8db29555f46592aedea6","02acf78048776cd52064a0adf3f7a061afb7418b3da21b793960de8a258faf29","2384abde79fae57568039ae33014184626a54409e38dee3cfb97c58c7f159e32","4b45b01bedd0140ced78e879d1c9081cecc4dd124dcf10ffcd3e015454501503","08d606e87da9ec45d257fcfc1b5ea169b582d79376626672813b964574709cba","4b45b01bedd0140ced78e879d1c9081cecc4dd124dcf10ffcd3e015454501503","08d606e87da9ec45d257fcfc1b5ea169b582d79376626672813b964574709cba","585e52757fe9d54a97ec67f4b2d82d81a547ec1bd402d609749ba10a24c9af53","51f1d5d41e5f5f17084d390e026551bc4e9a001aeb04995aff1c3a8dbf2d2ff3","44a54797ca1ee9c896ce95d78b24d6b710c2d4bcb6f0bcdc80cd79ab95f1f096","b28473a7e5281f63fd25b3cb75f4e3346112af6ae5de44e978d6cf2aac1538c1","96e22fa78d6f5124722fe20850c63e9d1c1f38c658146715b4fb071112c7db13","f9d8b85fac10f088ebbccb7fe49274a263ca120486bceab6e6009ea072cb99c0","2e34908f60502ead6ad08af1554c305b88741d09e36b2c24d85fd9bac4a11d2f","9b2be97c2950391d9c16497d4362e0feb5e88bfe4994f6d31b4fda7769b1c780","9a2a855b4ce30678d06a97f7e9f4edbd607f286d2a6ea1dde0a1c55a4512bb29","51ab25a9a403547ec6ac5c095d904d6bc91856557049b5739457367d17e831a7","b4156c2cd85285a2cb12dd208fcecb5d88820816b6371501e53cb47b4fe376fd","897b0d0e64cf87ac7086241c86f757f3c94d6826f949a1f0fec9c40892c0cecb")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("378b000edf3bfe114e1b7ba8045371080a256825f25faaea364cf57fa6d898d7","ba8f84fdc1678e133ad265e357e99dba7031872371d444e84d6a47a022914de9","a01672db8b14a2018f760258cf3ba80cda6a19febbff8db29555f46592aedea6","02acf78048776cd52064a0adf3f7a061afb7418b3da21b793960de8a258faf29","2384abde79fae57568039ae33014184626a54409e38dee3cfb97c58c7f159e32","4b45b01bedd0140ced78e879d1c9081cecc4dd124dcf10ffcd3e015454501503","08d606e87da9ec45d257fcfc1b5ea169b582d79376626672813b964574709cba","4b45b01bedd0140ced78e879d1c9081cecc4dd124dcf10ffcd3e015454501503","08d606e87da9ec45d257fcfc1b5ea169b582d79376626672813b964574709cba","585e52757fe9d54a97ec67f4b2d82d81a547ec1bd402d609749ba10a24c9af53","51f1d5d41e5f5f17084d390e026551bc4e9a001aeb04995aff1c3a8dbf2d2ff3","44a54797ca1ee9c896ce95d78b24d6b710c2d4bcb6f0bcdc80cd79ab95f1f096","b28473a7e5281f63fd25b3cb75f4e3346112af6ae5de44e978d6cf2aac1538c1","96e22fa78d6f5124722fe20850c63e9d1c1f38c658146715b4fb071112c7db13","f9d8b85fac10f088ebbccb7fe49274a263ca120486bceab6e6009ea072cb99c0","2e34908f60502ead6ad08af1554c305b88741d09e36b2c24d85fd9bac4a11d2f","9b2be97c2950391d9c16497d4362e0feb5e88bfe4994f6d31b4fda7769b1c780","9a2a855b4ce30678d06a97f7e9f4edbd607f286d2a6ea1dde0a1c55a4512bb29","51ab25a9a403547ec6ac5c095d904d6bc91856557049b5739457367d17e831a7","b4156c2cd85285a2cb12dd208fcecb5d88820816b6371501e53cb47b4fe376fd","897b0d0e64cf87ac7086241c86f757f3c94d6826f949a1f0fec9c40892c0cecb")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("378b000edf3bfe114e1b7ba8045371080a256825f25faaea364cf57fa6d898d7","ba8f84fdc1678e133ad265e357e99dba7031872371d444e84d6a47a022914de9","a01672db8b14a2018f760258cf3ba80cda6a19febbff8db29555f46592aedea6","02acf78048776cd52064a0adf3f7a061afb7418b3da21b793960de8a258faf29","2384abde79fae57568039ae33014184626a54409e38dee3cfb97c58c7f159e32","4b45b01bedd0140ced78e879d1c9081cecc4dd124dcf10ffcd3e015454501503","08d606e87da9ec45d257fcfc1b5ea169b582d79376626672813b964574709cba","4b45b01bedd0140ced78e879d1c9081cecc4dd124dcf10ffcd3e015454501503","08d606e87da9ec45d257fcfc1b5ea169b582d79376626672813b964574709cba","585e52757fe9d54a97ec67f4b2d82d81a547ec1bd402d609749ba10a24c9af53","51f1d5d41e5f5f17084d390e026551bc4e9a001aeb04995aff1c3a8dbf2d2ff3","44a54797ca1ee9c896ce95d78b24d6b710c2d4bcb6f0bcdc80cd79ab95f1f096","b28473a7e5281f63fd25b3cb75f4e3346112af6ae5de44e978d6cf2aac1538c1","96e22fa78d6f5124722fe20850c63e9d1c1f38c658146715b4fb071112c7db13","f9d8b85fac10f088ebbccb7fe49274a263ca120486bceab6e6009ea072cb99c0","2e34908f60502ead6ad08af1554c305b88741d09e36b2c24d85fd9bac4a11d2f","9b2be97c2950391d9c16497d4362e0feb5e88bfe4994f6d31b4fda7769b1c780","9a2a855b4ce30678d06a97f7e9f4edbd607f286d2a6ea1dde0a1c55a4512bb29","51ab25a9a403547ec6ac5c095d904d6bc91856557049b5739457367d17e831a7","b4156c2cd85285a2cb12dd208fcecb5d88820816b6371501e53cb47b4fe376fd","897b0d0e64cf87ac7086241c86f757f3c94d6826f949a1f0fec9c40892c0cecb")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("378b000edf3bfe114e1b7ba8045371080a256825f25faaea364cf57fa6d898d7","ba8f84fdc1678e133ad265e357e99dba7031872371d444e84d6a47a022914de9","a01672db8b14a2018f760258cf3ba80cda6a19febbff8db29555f46592aedea6","02acf78048776cd52064a0adf3f7a061afb7418b3da21b793960de8a258faf29","2384abde79fae57568039ae33014184626a54409e38dee3cfb97c58c7f159e32","4b45b01bedd0140ced78e879d1c9081cecc4dd124dcf10ffcd3e015454501503","08d606e87da9ec45d257fcfc1b5ea169b582d79376626672813b964574709cba","4b45b01bedd0140ced78e879d1c9081cecc4dd124dcf10ffcd3e015454501503","08d606e87da9ec45d257fcfc1b5ea169b582d79376626672813b964574709cba","585e52757fe9d54a97ec67f4b2d82d81a547ec1bd402d609749ba10a24c9af53","51f1d5d41e5f5f17084d390e026551bc4e9a001aeb04995aff1c3a8dbf2d2ff3","44a54797ca1ee9c896ce95d78b24d6b710c2d4bcb6f0bcdc80cd79ab95f1f096","b28473a7e5281f63fd25b3cb75f4e3346112af6ae5de44e978d6cf2aac1538c1","96e22fa78d6f5124722fe20850c63e9d1c1f38c658146715b4fb071112c7db13","f9d8b85fac10f088ebbccb7fe49274a263ca120486bceab6e6009ea072cb99c0","2e34908f60502ead6ad08af1554c305b88741d09e36b2c24d85fd9bac4a11d2f","9b2be97c2950391d9c16497d4362e0feb5e88bfe4994f6d31b4fda7769b1c780","9a2a855b4ce30678d06a97f7e9f4edbd607f286d2a6ea1dde0a1c55a4512bb29","51ab25a9a403547ec6ac5c095d904d6bc91856557049b5739457367d17e831a7","b4156c2cd85285a2cb12dd208fcecb5d88820816b6371501e53cb47b4fe376fd","897b0d0e64cf87ac7086241c86f757f3c94d6826f949a1f0fec9c40892c0cecb")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("378b000edf3bfe114e1b7ba8045371080a256825f25faaea364cf57fa6d898d7","ba8f84fdc1678e133ad265e357e99dba7031872371d444e84d6a47a022914de9","a01672db8b14a2018f760258cf3ba80cda6a19febbff8db29555f46592aedea6","02acf78048776cd52064a0adf3f7a061afb7418b3da21b793960de8a258faf29","2384abde79fae57568039ae33014184626a54409e38dee3cfb97c58c7f159e32","4b45b01bedd0140ced78e879d1c9081cecc4dd124dcf10ffcd3e015454501503","08d606e87da9ec45d257fcfc1b5ea169b582d79376626672813b964574709cba","4b45b01bedd0140ced78e879d1c9081cecc4dd124dcf10ffcd3e015454501503","08d606e87da9ec45d257fcfc1b5ea169b582d79376626672813b964574709cba","585e52757fe9d54a97ec67f4b2d82d81a547ec1bd402d609749ba10a24c9af53","51f1d5d41e5f5f17084d390e026551bc4e9a001aeb04995aff1c3a8dbf2d2ff3","44a54797ca1ee9c896ce95d78b24d6b710c2d4bcb6f0bcdc80cd79ab95f1f096","b28473a7e5281f63fd25b3cb75f4e3346112af6ae5de44e978d6cf2aac1538c1","96e22fa78d6f5124722fe20850c63e9d1c1f38c658146715b4fb071112c7db13","f9d8b85fac10f088ebbccb7fe49274a263ca120486bceab6e6009ea072cb99c0","2e34908f60502ead6ad08af1554c305b88741d09e36b2c24d85fd9bac4a11d2f","9b2be97c2950391d9c16497d4362e0feb5e88bfe4994f6d31b4fda7769b1c780","9a2a855b4ce30678d06a97f7e9f4edbd607f286d2a6ea1dde0a1c55a4512bb29","51ab25a9a403547ec6ac5c095d904d6bc91856557049b5739457367d17e831a7","b4156c2cd85285a2cb12dd208fcecb5d88820816b6371501e53cb47b4fe376fd","897b0d0e64cf87ac7086241c86f757f3c94d6826f949a1f0fec9c40892c0cecb")
index=activity AND rg_functionality="Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("378b000edf3bfe114e1b7ba8045371080a256825f25faaea364cf57fa6d898d7","ba8f84fdc1678e133ad265e357e99dba7031872371d444e84d6a47a022914de9","a01672db8b14a2018f760258cf3ba80cda6a19febbff8db29555f46592aedea6","02acf78048776cd52064a0adf3f7a061afb7418b3da21b793960de8a258faf29","2384abde79fae57568039ae33014184626a54409e38dee3cfb97c58c7f159e32","4b45b01bedd0140ced78e879d1c9081cecc4dd124dcf10ffcd3e015454501503","08d606e87da9ec45d257fcfc1b5ea169b582d79376626672813b964574709cba","4b45b01bedd0140ced78e879d1c9081cecc4dd124dcf10ffcd3e015454501503","08d606e87da9ec45d257fcfc1b5ea169b582d79376626672813b964574709cba","585e52757fe9d54a97ec67f4b2d82d81a547ec1bd402d609749ba10a24c9af53","51f1d5d41e5f5f17084d390e026551bc4e9a001aeb04995aff1c3a8dbf2d2ff3","44a54797ca1ee9c896ce95d78b24d6b710c2d4bcb6f0bcdc80cd79ab95f1f096","b28473a7e5281f63fd25b3cb75f4e3346112af6ae5de44e978d6cf2aac1538c1","96e22fa78d6f5124722fe20850c63e9d1c1f38c658146715b4fb071112c7db13","f9d8b85fac10f088ebbccb7fe49274a263ca120486bceab6e6009ea072cb99c0","2e34908f60502ead6ad08af1554c305b88741d09e36b2c24d85fd9bac4a11d2f","9b2be97c2950391d9c16497d4362e0feb5e88bfe4994f6d31b4fda7769b1c780","9a2a855b4ce30678d06a97f7e9f4edbd607f286d2a6ea1dde0a1c55a4512bb29","51ab25a9a403547ec6ac5c095d904d6bc91856557049b5739457367d17e831a7","b4156c2cd85285a2cb12dd208fcecb5d88820816b6371501e53cb47b4fe376fd","897b0d0e64cf87ac7086241c86f757f3c94d6826f949a1f0fec9c40892c0cecb")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("378b000edf3bfe114e1b7ba8045371080a256825f25faaea364cf57fa6d898d7","ba8f84fdc1678e133ad265e357e99dba7031872371d444e84d6a47a022914de9","a01672db8b14a2018f760258cf3ba80cda6a19febbff8db29555f46592aedea6","02acf78048776cd52064a0adf3f7a061afb7418b3da21b793960de8a258faf29","2384abde79fae57568039ae33014184626a54409e38dee3cfb97c58c7f159e32","4b45b01bedd0140ced78e879d1c9081cecc4dd124dcf10ffcd3e015454501503","08d606e87da9ec45d257fcfc1b5ea169b582d79376626672813b964574709cba","4b45b01bedd0140ced78e879d1c9081cecc4dd124dcf10ffcd3e015454501503","08d606e87da9ec45d257fcfc1b5ea169b582d79376626672813b964574709cba","585e52757fe9d54a97ec67f4b2d82d81a547ec1bd402d609749ba10a24c9af53","51f1d5d41e5f5f17084d390e026551bc4e9a001aeb04995aff1c3a8dbf2d2ff3","44a54797ca1ee9c896ce95d78b24d6b710c2d4bcb6f0bcdc80cd79ab95f1f096","b28473a7e5281f63fd25b3cb75f4e3346112af6ae5de44e978d6cf2aac1538c1","96e22fa78d6f5124722fe20850c63e9d1c1f38c658146715b4fb071112c7db13","f9d8b85fac10f088ebbccb7fe49274a263ca120486bceab6e6009ea072cb99c0","2e34908f60502ead6ad08af1554c305b88741d09e36b2c24d85fd9bac4a11d2f","9b2be97c2950391d9c16497d4362e0feb5e88bfe4994f6d31b4fda7769b1c780","9a2a855b4ce30678d06a97f7e9f4edbd607f286d2a6ea1dde0a1c55a4512bb29","51ab25a9a403547ec6ac5c095d904d6bc91856557049b5739457367d17e831a7","b4156c2cd85285a2cb12dd208fcecb5d88820816b6371501e53cb47b4fe376fd","897b0d0e64cf87ac7086241c86f757f3c94d6826f949a1f0fec9c40892c0cecb")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("378b000edf3bfe114e1b7ba8045371080a256825f25faaea364cf57fa6d898d7","ba8f84fdc1678e133ad265e357e99dba7031872371d444e84d6a47a022914de9","a01672db8b14a2018f760258cf3ba80cda6a19febbff8db29555f46592aedea6","02acf78048776cd52064a0adf3f7a061afb7418b3da21b793960de8a258faf29","2384abde79fae57568039ae33014184626a54409e38dee3cfb97c58c7f159e32","4b45b01bedd0140ced78e879d1c9081cecc4dd124dcf10ffcd3e015454501503","08d606e87da9ec45d257fcfc1b5ea169b582d79376626672813b964574709cba","4b45b01bedd0140ced78e879d1c9081cecc4dd124dcf10ffcd3e015454501503","08d606e87da9ec45d257fcfc1b5ea169b582d79376626672813b964574709cba","585e52757fe9d54a97ec67f4b2d82d81a547ec1bd402d609749ba10a24c9af53","51f1d5d41e5f5f17084d390e026551bc4e9a001aeb04995aff1c3a8dbf2d2ff3","44a54797ca1ee9c896ce95d78b24d6b710c2d4bcb6f0bcdc80cd79ab95f1f096","b28473a7e5281f63fd25b3cb75f4e3346112af6ae5de44e978d6cf2aac1538c1","96e22fa78d6f5124722fe20850c63e9d1c1f38c658146715b4fb071112c7db13","f9d8b85fac10f088ebbccb7fe49274a263ca120486bceab6e6009ea072cb99c0","2e34908f60502ead6ad08af1554c305b88741d09e36b2c24d85fd9bac4a11d2f","9b2be97c2950391d9c16497d4362e0feb5e88bfe4994f6d31b4fda7769b1c780","9a2a855b4ce30678d06a97f7e9f4edbd607f286d2a6ea1dde0a1c55a4512bb29","51ab25a9a403547ec6ac5c095d904d6bc91856557049b5739457367d17e831a7","b4156c2cd85285a2cb12dd208fcecb5d88820816b6371501e53cb47b4fe376fd","897b0d0e64cf87ac7086241c86f757f3c94d6826f949a1f0fec9c40892c0cecb")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("378b000edf3bfe114e1b7ba8045371080a256825f25faaea364cf57fa6d898d7","ba8f84fdc1678e133ad265e357e99dba7031872371d444e84d6a47a022914de9","a01672db8b14a2018f760258cf3ba80cda6a19febbff8db29555f46592aedea6","02acf78048776cd52064a0adf3f7a061afb7418b3da21b793960de8a258faf29","2384abde79fae57568039ae33014184626a54409e38dee3cfb97c58c7f159e32","4b45b01bedd0140ced78e879d1c9081cecc4dd124dcf10ffcd3e015454501503","08d606e87da9ec45d257fcfc1b5ea169b582d79376626672813b964574709cba","4b45b01bedd0140ced78e879d1c9081cecc4dd124dcf10ffcd3e015454501503","08d606e87da9ec45d257fcfc1b5ea169b582d79376626672813b964574709cba","585e52757fe9d54a97ec67f4b2d82d81a547ec1bd402d609749ba10a24c9af53","51f1d5d41e5f5f17084d390e026551bc4e9a001aeb04995aff1c3a8dbf2d2ff3","44a54797ca1ee9c896ce95d78b24d6b710c2d4bcb6f0bcdc80cd79ab95f1f096","b28473a7e5281f63fd25b3cb75f4e3346112af6ae5de44e978d6cf2aac1538c1","96e22fa78d6f5124722fe20850c63e9d1c1f38c658146715b4fb071112c7db13","f9d8b85fac10f088ebbccb7fe49274a263ca120486bceab6e6009ea072cb99c0","2e34908f60502ead6ad08af1554c305b88741d09e36b2c24d85fd9bac4a11d2f","9b2be97c2950391d9c16497d4362e0feb5e88bfe4994f6d31b4fda7769b1c780","9a2a855b4ce30678d06a97f7e9f4edbd607f286d2a6ea1dde0a1c55a4512bb29","51ab25a9a403547ec6ac5c095d904d6bc91856557049b5739457367d17e831a7","b4156c2cd85285a2cb12dd208fcecb5d88820816b6371501e53cb47b4fe376fd","897b0d0e64cf87ac7086241c86f757f3c94d6826f949a1f0fec9c40892c0cecb")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("378b000edf3bfe114e1b7ba8045371080a256825f25faaea364cf57fa6d898d7","ba8f84fdc1678e133ad265e357e99dba7031872371d444e84d6a47a022914de9","a01672db8b14a2018f760258cf3ba80cda6a19febbff8db29555f46592aedea6","02acf78048776cd52064a0adf3f7a061afb7418b3da21b793960de8a258faf29","2384abde79fae57568039ae33014184626a54409e38dee3cfb97c58c7f159e32","4b45b01bedd0140ced78e879d1c9081cecc4dd124dcf10ffcd3e015454501503","08d606e87da9ec45d257fcfc1b5ea169b582d79376626672813b964574709cba","4b45b01bedd0140ced78e879d1c9081cecc4dd124dcf10ffcd3e015454501503","08d606e87da9ec45d257fcfc1b5ea169b582d79376626672813b964574709cba","585e52757fe9d54a97ec67f4b2d82d81a547ec1bd402d609749ba10a24c9af53","51f1d5d41e5f5f17084d390e026551bc4e9a001aeb04995aff1c3a8dbf2d2ff3","44a54797ca1ee9c896ce95d78b24d6b710c2d4bcb6f0bcdc80cd79ab95f1f096","b28473a7e5281f63fd25b3cb75f4e3346112af6ae5de44e978d6cf2aac1538c1","96e22fa78d6f5124722fe20850c63e9d1c1f38c658146715b4fb071112c7db13","f9d8b85fac10f088ebbccb7fe49274a263ca120486bceab6e6009ea072cb99c0","2e34908f60502ead6ad08af1554c305b88741d09e36b2c24d85fd9bac4a11d2f","9b2be97c2950391d9c16497d4362e0feb5e88bfe4994f6d31b4fda7769b1c780","9a2a855b4ce30678d06a97f7e9f4edbd607f286d2a6ea1dde0a1c55a4512bb29","51ab25a9a403547ec6ac5c095d904d6bc91856557049b5739457367d17e831a7","b4156c2cd85285a2cb12dd208fcecb5d88820816b6371501e53cb47b4fe376fd","897b0d0e64cf87ac7086241c86f757f3c94d6826f949a1f0fec9c40892c0cecb")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("378b000edf3bfe114e1b7ba8045371080a256825f25faaea364cf57fa6d898d7","ba8f84fdc1678e133ad265e357e99dba7031872371d444e84d6a47a022914de9","a01672db8b14a2018f760258cf3ba80cda6a19febbff8db29555f46592aedea6","02acf78048776cd52064a0adf3f7a061afb7418b3da21b793960de8a258faf29","2384abde79fae57568039ae33014184626a54409e38dee3cfb97c58c7f159e32","4b45b01bedd0140ced78e879d1c9081cecc4dd124dcf10ffcd3e015454501503","08d606e87da9ec45d257fcfc1b5ea169b582d79376626672813b964574709cba","4b45b01bedd0140ced78e879d1c9081cecc4dd124dcf10ffcd3e015454501503","08d606e87da9ec45d257fcfc1b5ea169b582d79376626672813b964574709cba","585e52757fe9d54a97ec67f4b2d82d81a547ec1bd402d609749ba10a24c9af53","51f1d5d41e5f5f17084d390e026551bc4e9a001aeb04995aff1c3a8dbf2d2ff3","44a54797ca1ee9c896ce95d78b24d6b710c2d4bcb6f0bcdc80cd79ab95f1f096","b28473a7e5281f63fd25b3cb75f4e3346112af6ae5de44e978d6cf2aac1538c1","96e22fa78d6f5124722fe20850c63e9d1c1f38c658146715b4fb071112c7db13","f9d8b85fac10f088ebbccb7fe49274a263ca120486bceab6e6009ea072cb99c0","2e34908f60502ead6ad08af1554c305b88741d09e36b2c24d85fd9bac4a11d2f","9b2be97c2950391d9c16497d4362e0feb5e88bfe4994f6d31b4fda7769b1c780","9a2a855b4ce30678d06a97f7e9f4edbd607f286d2a6ea1dde0a1c55a4512bb29","51ab25a9a403547ec6ac5c095d904d6bc91856557049b5739457367d17e831a7","b4156c2cd85285a2cb12dd208fcecb5d88820816b6371501e53cb47b4fe376fd","897b0d0e64cf87ac7086241c86f757f3c94d6826f949a1f0fec9c40892c0cecb")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("378b000edf3bfe114e1b7ba8045371080a256825f25faaea364cf57fa6d898d7","ba8f84fdc1678e133ad265e357e99dba7031872371d444e84d6a47a022914de9","a01672db8b14a2018f760258cf3ba80cda6a19febbff8db29555f46592aedea6","02acf78048776cd52064a0adf3f7a061afb7418b3da21b793960de8a258faf29","2384abde79fae57568039ae33014184626a54409e38dee3cfb97c58c7f159e32","4b45b01bedd0140ced78e879d1c9081cecc4dd124dcf10ffcd3e015454501503","08d606e87da9ec45d257fcfc1b5ea169b582d79376626672813b964574709cba","4b45b01bedd0140ced78e879d1c9081cecc4dd124dcf10ffcd3e015454501503","08d606e87da9ec45d257fcfc1b5ea169b582d79376626672813b964574709cba","585e52757fe9d54a97ec67f4b2d82d81a547ec1bd402d609749ba10a24c9af53","51f1d5d41e5f5f17084d390e026551bc4e9a001aeb04995aff1c3a8dbf2d2ff3","44a54797ca1ee9c896ce95d78b24d6b710c2d4bcb6f0bcdc80cd79ab95f1f096","b28473a7e5281f63fd25b3cb75f4e3346112af6ae5de44e978d6cf2aac1538c1","96e22fa78d6f5124722fe20850c63e9d1c1f38c658146715b4fb071112c7db13","f9d8b85fac10f088ebbccb7fe49274a263ca120486bceab6e6009ea072cb99c0","2e34908f60502ead6ad08af1554c305b88741d09e36b2c24d85fd9bac4a11d2f","9b2be97c2950391d9c16497d4362e0feb5e88bfe4994f6d31b4fda7769b1c780","9a2a855b4ce30678d06a97f7e9f4edbd607f286d2a6ea1dde0a1c55a4512bb29","51ab25a9a403547ec6ac5c095d904d6bc91856557049b5739457367d17e831a7","b4156c2cd85285a2cb12dd208fcecb5d88820816b6371501e53cb47b4fe376fd","897b0d0e64cf87ac7086241c86f757f3c94d6826f949a1f0fec9c40892c0cecb")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("378b000edf3bfe114e1b7ba8045371080a256825f25faaea364cf57fa6d898d7","ba8f84fdc1678e133ad265e357e99dba7031872371d444e84d6a47a022914de9","a01672db8b14a2018f760258cf3ba80cda6a19febbff8db29555f46592aedea6","02acf78048776cd52064a0adf3f7a061afb7418b3da21b793960de8a258faf29","2384abde79fae57568039ae33014184626a54409e38dee3cfb97c58c7f159e32","4b45b01bedd0140ced78e879d1c9081cecc4dd124dcf10ffcd3e015454501503","08d606e87da9ec45d257fcfc1b5ea169b582d79376626672813b964574709cba","4b45b01bedd0140ced78e879d1c9081cecc4dd124dcf10ffcd3e015454501503","08d606e87da9ec45d257fcfc1b5ea169b582d79376626672813b964574709cba","585e52757fe9d54a97ec67f4b2d82d81a547ec1bd402d609749ba10a24c9af53","51f1d5d41e5f5f17084d390e026551bc4e9a001aeb04995aff1c3a8dbf2d2ff3","44a54797ca1ee9c896ce95d78b24d6b710c2d4bcb6f0bcdc80cd79ab95f1f096","b28473a7e5281f63fd25b3cb75f4e3346112af6ae5de44e978d6cf2aac1538c1","96e22fa78d6f5124722fe20850c63e9d1c1f38c658146715b4fb071112c7db13","f9d8b85fac10f088ebbccb7fe49274a263ca120486bceab6e6009ea072cb99c0","2e34908f60502ead6ad08af1554c305b88741d09e36b2c24d85fd9bac4a11d2f","9b2be97c2950391d9c16497d4362e0feb5e88bfe4994f6d31b4fda7769b1c780","9a2a855b4ce30678d06a97f7e9f4edbd607f286d2a6ea1dde0a1c55a4512bb29","51ab25a9a403547ec6ac5c095d904d6bc91856557049b5739457367d17e831a7","b4156c2cd85285a2cb12dd208fcecb5d88820816b6371501e53cb47b4fe376fd","897b0d0e64cf87ac7086241c86f757f3c94d6826f949a1f0fec9c40892c0cecb")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring64 NOT NULL AND customstring64 IN ("378b000edf3bfe114e1b7ba8045371080a256825f25faaea364cf57fa6d898d7","ba8f84fdc1678e133ad265e357e99dba7031872371d444e84d6a47a022914de9","a01672db8b14a2018f760258cf3ba80cda6a19febbff8db29555f46592aedea6","02acf78048776cd52064a0adf3f7a061afb7418b3da21b793960de8a258faf29","2384abde79fae57568039ae33014184626a54409e38dee3cfb97c58c7f159e32","4b45b01bedd0140ced78e879d1c9081cecc4dd124dcf10ffcd3e015454501503","08d606e87da9ec45d257fcfc1b5ea169b582d79376626672813b964574709cba","4b45b01bedd0140ced78e879d1c9081cecc4dd124dcf10ffcd3e015454501503","08d606e87da9ec45d257fcfc1b5ea169b582d79376626672813b964574709cba","585e52757fe9d54a97ec67f4b2d82d81a547ec1bd402d609749ba10a24c9af53","51f1d5d41e5f5f17084d390e026551bc4e9a001aeb04995aff1c3a8dbf2d2ff3","44a54797ca1ee9c896ce95d78b24d6b710c2d4bcb6f0bcdc80cd79ab95f1f096","b28473a7e5281f63fd25b3cb75f4e3346112af6ae5de44e978d6cf2aac1538c1","96e22fa78d6f5124722fe20850c63e9d1c1f38c658146715b4fb071112c7db13","f9d8b85fac10f088ebbccb7fe49274a263ca120486bceab6e6009ea072cb99c0","2e34908f60502ead6ad08af1554c305b88741d09e36b2c24d85fd9bac4a11d2f","9b2be97c2950391d9c16497d4362e0feb5e88bfe4994f6d31b4fda7769b1c780","9a2a855b4ce30678d06a97f7e9f4edbd607f286d2a6ea1dde0a1c55a4512bb29","51ab25a9a403547ec6ac5c095d904d6bc91856557049b5739457367d17e831a7","b4156c2cd85285a2cb12dd208fcecb5d88820816b6371501e53cb47b4fe376fd","897b0d0e64cf87ac7086241c86f757f3c94d6826f949a1f0fec9c40892c0cecb")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("378b000edf3bfe114e1b7ba8045371080a256825f25faaea364cf57fa6d898d7","ba8f84fdc1678e133ad265e357e99dba7031872371d444e84d6a47a022914de9","a01672db8b14a2018f760258cf3ba80cda6a19febbff8db29555f46592aedea6","02acf78048776cd52064a0adf3f7a061afb7418b3da21b793960de8a258faf29","2384abde79fae57568039ae33014184626a54409e38dee3cfb97c58c7f159e32","4b45b01bedd0140ced78e879d1c9081cecc4dd124dcf10ffcd3e015454501503","08d606e87da9ec45d257fcfc1b5ea169b582d79376626672813b964574709cba","4b45b01bedd0140ced78e879d1c9081cecc4dd124dcf10ffcd3e015454501503","08d606e87da9ec45d257fcfc1b5ea169b582d79376626672813b964574709cba","585e52757fe9d54a97ec67f4b2d82d81a547ec1bd402d609749ba10a24c9af53","51f1d5d41e5f5f17084d390e026551bc4e9a001aeb04995aff1c3a8dbf2d2ff3","44a54797ca1ee9c896ce95d78b24d6b710c2d4bcb6f0bcdc80cd79ab95f1f096","b28473a7e5281f63fd25b3cb75f4e3346112af6ae5de44e978d6cf2aac1538c1","96e22fa78d6f5124722fe20850c63e9d1c1f38c658146715b4fb071112c7db13","f9d8b85fac10f088ebbccb7fe49274a263ca120486bceab6e6009ea072cb99c0","2e34908f60502ead6ad08af1554c305b88741d09e36b2c24d85fd9bac4a11d2f","9b2be97c2950391d9c16497d4362e0feb5e88bfe4994f6d31b4fda7769b1c780","9a2a855b4ce30678d06a97f7e9f4edbd607f286d2a6ea1dde0a1c55a4512bb29","51ab25a9a403547ec6ac5c095d904d6bc91856557049b5739457367d17e831a7","b4156c2cd85285a2cb12dd208fcecb5d88820816b6371501e53cb47b4fe376fd","897b0d0e64cf87ac7086241c86f757f3c94d6826f949a1f0fec9c40892c0cecb")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("378b000edf3bfe114e1b7ba8045371080a256825f25faaea364cf57fa6d898d7","ba8f84fdc1678e133ad265e357e99dba7031872371d444e84d6a47a022914de9","a01672db8b14a2018f760258cf3ba80cda6a19febbff8db29555f46592aedea6","02acf78048776cd52064a0adf3f7a061afb7418b3da21b793960de8a258faf29","2384abde79fae57568039ae33014184626a54409e38dee3cfb97c58c7f159e32","4b45b01bedd0140ced78e879d1c9081cecc4dd124dcf10ffcd3e015454501503","08d606e87da9ec45d257fcfc1b5ea169b582d79376626672813b964574709cba","4b45b01bedd0140ced78e879d1c9081cecc4dd124dcf10ffcd3e015454501503","08d606e87da9ec45d257fcfc1b5ea169b582d79376626672813b964574709cba","585e52757fe9d54a97ec67f4b2d82d81a547ec1bd402d609749ba10a24c9af53","51f1d5d41e5f5f17084d390e026551bc4e9a001aeb04995aff1c3a8dbf2d2ff3","44a54797ca1ee9c896ce95d78b24d6b710c2d4bcb6f0bcdc80cd79ab95f1f096","b28473a7e5281f63fd25b3cb75f4e3346112af6ae5de44e978d6cf2aac1538c1","96e22fa78d6f5124722fe20850c63e9d1c1f38c658146715b4fb071112c7db13","f9d8b85fac10f088ebbccb7fe49274a263ca120486bceab6e6009ea072cb99c0","2e34908f60502ead6ad08af1554c305b88741d09e36b2c24d85fd9bac4a11d2f","9b2be97c2950391d9c16497d4362e0feb5e88bfe4994f6d31b4fda7769b1c780","9a2a855b4ce30678d06a97f7e9f4edbd607f286d2a6ea1dde0a1c55a4512bb29","51ab25a9a403547ec6ac5c095d904d6bc91856557049b5739457367d17e831a7","b4156c2cd85285a2cb12dd208fcecb5d88820816b6371501e53cb47b4fe376fd","897b0d0e64cf87ac7086241c86f757f3c94d6826f949a1f0fec9c40892c0cecb")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("378b000edf3bfe114e1b7ba8045371080a256825f25faaea364cf57fa6d898d7","ba8f84fdc1678e133ad265e357e99dba7031872371d444e84d6a47a022914de9","a01672db8b14a2018f760258cf3ba80cda6a19febbff8db29555f46592aedea6","02acf78048776cd52064a0adf3f7a061afb7418b3da21b793960de8a258faf29","2384abde79fae57568039ae33014184626a54409e38dee3cfb97c58c7f159e32","4b45b01bedd0140ced78e879d1c9081cecc4dd124dcf10ffcd3e015454501503","08d606e87da9ec45d257fcfc1b5ea169b582d79376626672813b964574709cba","4b45b01bedd0140ced78e879d1c9081cecc4dd124dcf10ffcd3e015454501503","08d606e87da9ec45d257fcfc1b5ea169b582d79376626672813b964574709cba","585e52757fe9d54a97ec67f4b2d82d81a547ec1bd402d609749ba10a24c9af53","51f1d5d41e5f5f17084d390e026551bc4e9a001aeb04995aff1c3a8dbf2d2ff3","44a54797ca1ee9c896ce95d78b24d6b710c2d4bcb6f0bcdc80cd79ab95f1f096","b28473a7e5281f63fd25b3cb75f4e3346112af6ae5de44e978d6cf2aac1538c1","96e22fa78d6f5124722fe20850c63e9d1c1f38c658146715b4fb071112c7db13","f9d8b85fac10f088ebbccb7fe49274a263ca120486bceab6e6009ea072cb99c0","2e34908f60502ead6ad08af1554c305b88741d09e36b2c24d85fd9bac4a11d2f","9b2be97c2950391d9c16497d4362e0feb5e88bfe4994f6d31b4fda7769b1c780","9a2a855b4ce30678d06a97f7e9f4edbd607f286d2a6ea1dde0a1c55a4512bb29","51ab25a9a403547ec6ac5c095d904d6bc91856557049b5739457367d17e831a7","b4156c2cd85285a2cb12dd208fcecb5d88820816b6371501e53cb47b4fe376fd","897b0d0e64cf87ac7086241c86f757f3c94d6826f949a1f0fec9c40892c0cecb")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring64 NOT NULL AND customstring64 IN ("378b000edf3bfe114e1b7ba8045371080a256825f25faaea364cf57fa6d898d7","ba8f84fdc1678e133ad265e357e99dba7031872371d444e84d6a47a022914de9","a01672db8b14a2018f760258cf3ba80cda6a19febbff8db29555f46592aedea6","02acf78048776cd52064a0adf3f7a061afb7418b3da21b793960de8a258faf29","2384abde79fae57568039ae33014184626a54409e38dee3cfb97c58c7f159e32","4b45b01bedd0140ced78e879d1c9081cecc4dd124dcf10ffcd3e015454501503","08d606e87da9ec45d257fcfc1b5ea169b582d79376626672813b964574709cba","4b45b01bedd0140ced78e879d1c9081cecc4dd124dcf10ffcd3e015454501503","08d606e87da9ec45d257fcfc1b5ea169b582d79376626672813b964574709cba","585e52757fe9d54a97ec67f4b2d82d81a547ec1bd402d609749ba10a24c9af53","51f1d5d41e5f5f17084d390e026551bc4e9a001aeb04995aff1c3a8dbf2d2ff3","44a54797ca1ee9c896ce95d78b24d6b710c2d4bcb6f0bcdc80cd79ab95f1f096","b28473a7e5281f63fd25b3cb75f4e3346112af6ae5de44e978d6cf2aac1538c1","96e22fa78d6f5124722fe20850c63e9d1c1f38c658146715b4fb071112c7db13","f9d8b85fac10f088ebbccb7fe49274a263ca120486bceab6e6009ea072cb99c0","2e34908f60502ead6ad08af1554c305b88741d09e36b2c24d85fd9bac4a11d2f","9b2be97c2950391d9c16497d4362e0feb5e88bfe4994f6d31b4fda7769b1c780","9a2a855b4ce30678d06a97f7e9f4edbd607f286d2a6ea1dde0a1c55a4512bb29","51ab25a9a403547ec6ac5c095d904d6bc91856557049b5739457367d17e831a7","b4156c2cd85285a2cb12dd208fcecb5d88820816b6371501e53cb47b4fe376fd","897b0d0e64cf87ac7086241c86f757f3c94d6826f949a1f0fec9c40892c0cecb")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("378b000edf3bfe114e1b7ba8045371080a256825f25faaea364cf57fa6d898d7","ba8f84fdc1678e133ad265e357e99dba7031872371d444e84d6a47a022914de9","a01672db8b14a2018f760258cf3ba80cda6a19febbff8db29555f46592aedea6","02acf78048776cd52064a0adf3f7a061afb7418b3da21b793960de8a258faf29","2384abde79fae57568039ae33014184626a54409e38dee3cfb97c58c7f159e32","4b45b01bedd0140ced78e879d1c9081cecc4dd124dcf10ffcd3e015454501503","08d606e87da9ec45d257fcfc1b5ea169b582d79376626672813b964574709cba","4b45b01bedd0140ced78e879d1c9081cecc4dd124dcf10ffcd3e015454501503","08d606e87da9ec45d257fcfc1b5ea169b582d79376626672813b964574709cba","585e52757fe9d54a97ec67f4b2d82d81a547ec1bd402d609749ba10a24c9af53","51f1d5d41e5f5f17084d390e026551bc4e9a001aeb04995aff1c3a8dbf2d2ff3","44a54797ca1ee9c896ce95d78b24d6b710c2d4bcb6f0bcdc80cd79ab95f1f096","b28473a7e5281f63fd25b3cb75f4e3346112af6ae5de44e978d6cf2aac1538c1","96e22fa78d6f5124722fe20850c63e9d1c1f38c658146715b4fb071112c7db13","f9d8b85fac10f088ebbccb7fe49274a263ca120486bceab6e6009ea072cb99c0","2e34908f60502ead6ad08af1554c305b88741d09e36b2c24d85fd9bac4a11d2f","9b2be97c2950391d9c16497d4362e0feb5e88bfe4994f6d31b4fda7769b1c780","9a2a855b4ce30678d06a97f7e9f4edbd607f286d2a6ea1dde0a1c55a4512bb29","51ab25a9a403547ec6ac5c095d904d6bc91856557049b5739457367d17e831a7","b4156c2cd85285a2cb12dd208fcecb5d88820816b6371501e53cb47b4fe376fd","897b0d0e64cf87ac7086241c86f757f3c94d6826f949a1f0fec9c40892c0cecb")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("378b000edf3bfe114e1b7ba8045371080a256825f25faaea364cf57fa6d898d7","ba8f84fdc1678e133ad265e357e99dba7031872371d444e84d6a47a022914de9","a01672db8b14a2018f760258cf3ba80cda6a19febbff8db29555f46592aedea6","02acf78048776cd52064a0adf3f7a061afb7418b3da21b793960de8a258faf29","2384abde79fae57568039ae33014184626a54409e38dee3cfb97c58c7f159e32","4b45b01bedd0140ced78e879d1c9081cecc4dd124dcf10ffcd3e015454501503","08d606e87da9ec45d257fcfc1b5ea169b582d79376626672813b964574709cba","4b45b01bedd0140ced78e879d1c9081cecc4dd124dcf10ffcd3e015454501503","08d606e87da9ec45d257fcfc1b5ea169b582d79376626672813b964574709cba","585e52757fe9d54a97ec67f4b2d82d81a547ec1bd402d609749ba10a24c9af53","51f1d5d41e5f5f17084d390e026551bc4e9a001aeb04995aff1c3a8dbf2d2ff3","44a54797ca1ee9c896ce95d78b24d6b710c2d4bcb6f0bcdc80cd79ab95f1f096","b28473a7e5281f63fd25b3cb75f4e3346112af6ae5de44e978d6cf2aac1538c1","96e22fa78d6f5124722fe20850c63e9d1c1f38c658146715b4fb071112c7db13","f9d8b85fac10f088ebbccb7fe49274a263ca120486bceab6e6009ea072cb99c0","2e34908f60502ead6ad08af1554c305b88741d09e36b2c24d85fd9bac4a11d2f","9b2be97c2950391d9c16497d4362e0feb5e88bfe4994f6d31b4fda7769b1c780","9a2a855b4ce30678d06a97f7e9f4edbd607f286d2a6ea1dde0a1c55a4512bb29","51ab25a9a403547ec6ac5c095d904d6bc91856557049b5739457367d17e831a7","b4156c2cd85285a2cb12dd208fcecb5d88820816b6371501e53cb47b4fe376fd","897b0d0e64cf87ac7086241c86f757f3c94d6826f949a1f0fec9c40892c0cecb")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("378b000edf3bfe114e1b7ba8045371080a256825f25faaea364cf57fa6d898d7","ba8f84fdc1678e133ad265e357e99dba7031872371d444e84d6a47a022914de9","a01672db8b14a2018f760258cf3ba80cda6a19febbff8db29555f46592aedea6","02acf78048776cd52064a0adf3f7a061afb7418b3da21b793960de8a258faf29","2384abde79fae57568039ae33014184626a54409e38dee3cfb97c58c7f159e32","4b45b01bedd0140ced78e879d1c9081cecc4dd124dcf10ffcd3e015454501503","08d606e87da9ec45d257fcfc1b5ea169b582d79376626672813b964574709cba","4b45b01bedd0140ced78e879d1c9081cecc4dd124dcf10ffcd3e015454501503","08d606e87da9ec45d257fcfc1b5ea169b582d79376626672813b964574709cba","585e52757fe9d54a97ec67f4b2d82d81a547ec1bd402d609749ba10a24c9af53","51f1d5d41e5f5f17084d390e026551bc4e9a001aeb04995aff1c3a8dbf2d2ff3","44a54797ca1ee9c896ce95d78b24d6b710c2d4bcb6f0bcdc80cd79ab95f1f096","b28473a7e5281f63fd25b3cb75f4e3346112af6ae5de44e978d6cf2aac1538c1","96e22fa78d6f5124722fe20850c63e9d1c1f38c658146715b4fb071112c7db13","f9d8b85fac10f088ebbccb7fe49274a263ca120486bceab6e6009ea072cb99c0","2e34908f60502ead6ad08af1554c305b88741d09e36b2c24d85fd9bac4a11d2f","9b2be97c2950391d9c16497d4362e0feb5e88bfe4994f6d31b4fda7769b1c780","9a2a855b4ce30678d06a97f7e9f4edbd607f286d2a6ea1dde0a1c55a4512bb29","51ab25a9a403547ec6ac5c095d904d6bc91856557049b5739457367d17e831a7","b4156c2cd85285a2cb12dd208fcecb5d88820816b6371501e53cb47b4fe376fd","897b0d0e64cf87ac7086241c86f757f3c94d6826f949a1f0fec9c40892c0cecb")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring64 NOT NULL AND customstring64 IN ("378b000edf3bfe114e1b7ba8045371080a256825f25faaea364cf57fa6d898d7","ba8f84fdc1678e133ad265e357e99dba7031872371d444e84d6a47a022914de9","a01672db8b14a2018f760258cf3ba80cda6a19febbff8db29555f46592aedea6","02acf78048776cd52064a0adf3f7a061afb7418b3da21b793960de8a258faf29","2384abde79fae57568039ae33014184626a54409e38dee3cfb97c58c7f159e32","4b45b01bedd0140ced78e879d1c9081cecc4dd124dcf10ffcd3e015454501503","08d606e87da9ec45d257fcfc1b5ea169b582d79376626672813b964574709cba","4b45b01bedd0140ced78e879d1c9081cecc4dd124dcf10ffcd3e015454501503","08d606e87da9ec45d257fcfc1b5ea169b582d79376626672813b964574709cba","585e52757fe9d54a97ec67f4b2d82d81a547ec1bd402d609749ba10a24c9af53","51f1d5d41e5f5f17084d390e026551bc4e9a001aeb04995aff1c3a8dbf2d2ff3","44a54797ca1ee9c896ce95d78b24d6b710c2d4bcb6f0bcdc80cd79ab95f1f096","b28473a7e5281f63fd25b3cb75f4e3346112af6ae5de44e978d6cf2aac1538c1","96e22fa78d6f5124722fe20850c63e9d1c1f38c658146715b4fb071112c7db13","f9d8b85fac10f088ebbccb7fe49274a263ca120486bceab6e6009ea072cb99c0","2e34908f60502ead6ad08af1554c305b88741d09e36b2c24d85fd9bac4a11d2f","9b2be97c2950391d9c16497d4362e0feb5e88bfe4994f6d31b4fda7769b1c780","9a2a855b4ce30678d06a97f7e9f4edbd607f286d2a6ea1dde0a1c55a4512bb29","51ab25a9a403547ec6ac5c095d904d6bc91856557049b5739457367d17e831a7","b4156c2cd85285a2cb12dd208fcecb5d88820816b6371501e53cb47b4fe376fd","897b0d0e64cf87ac7086241c86f757f3c94d6826f949a1f0fec9c40892c0cecb")
index=activity AND rg_functionality="Endpoint Management Systems" AND requesturl NOT NULL AND requesturl IN ("http://adfhjadfbjadbfjkhad44jka.com/aa","http://adfhjadfbjadbfjkhad44jka.com/xxhhodrq","http://adfhjadfbjadbfjkhad44jka.com/zanmjtvh","http://nextroundst.com/aa","http://nextroundst.com/ffcxlohx","http://nextroundst.com/nlcsphze","http://diveupdown.com/aa","http://diveupdown.com/aaa","http://diveupdown.com/hlsxaifp","http://diveupdown.com/yhmrmmgc")
index=activity AND rg_functionality="Endpoint Management Systems" AND Message NOT NULL AND Message IN ("http://adfhjadfbjadbfjkhad44jka.com/aa","http://adfhjadfbjadbfjkhad44jka.com/xxhhodrq","http://adfhjadfbjadbfjkhad44jka.com/zanmjtvh","http://nextroundst.com/aa","http://nextroundst.com/ffcxlohx","http://nextroundst.com/nlcsphze","http://diveupdown.com/aa","http://diveupdown.com/aaa","http://diveupdown.com/hlsxaifp","http://diveupdown.com/yhmrmmgc")
index=activity AND rg_functionality="Endpoint Management Systems" AND Requestcontext NOT NULL AND Requestcontext IN ("http://adfhjadfbjadbfjkhad44jka.com/aa","http://adfhjadfbjadbfjkhad44jka.com/xxhhodrq","http://adfhjadfbjadbfjkhad44jka.com/zanmjtvh","http://nextroundst.com/aa","http://nextroundst.com/ffcxlohx","http://nextroundst.com/nlcsphze","http://diveupdown.com/aa","http://diveupdown.com/aaa","http://diveupdown.com/hlsxaifp","http://diveupdown.com/yhmrmmgc")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("http://adfhjadfbjadbfjkhad44jka.com/aa","http://adfhjadfbjadbfjkhad44jka.com/xxhhodrq","http://adfhjadfbjadbfjkhad44jka.com/zanmjtvh","http://nextroundst.com/aa","http://nextroundst.com/ffcxlohx","http://nextroundst.com/nlcsphze","http://diveupdown.com/aa","http://diveupdown.com/aaa","http://diveupdown.com/hlsxaifp","http://diveupdown.com/yhmrmmgc")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND requesturl NOT NULL AND requesturl IN ("http://adfhjadfbjadbfjkhad44jka.com/aa","http://adfhjadfbjadbfjkhad44jka.com/xxhhodrq","http://adfhjadfbjadbfjkhad44jka.com/zanmjtvh","http://nextroundst.com/aa","http://nextroundst.com/ffcxlohx","http://nextroundst.com/nlcsphze","http://diveupdown.com/aa","http://diveupdown.com/aaa","http://diveupdown.com/hlsxaifp","http://diveupdown.com/yhmrmmgc")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND Message NOT NULL AND Message IN ("http://adfhjadfbjadbfjkhad44jka.com/aa","http://adfhjadfbjadbfjkhad44jka.com/xxhhodrq","http://adfhjadfbjadbfjkhad44jka.com/zanmjtvh","http://nextroundst.com/aa","http://nextroundst.com/ffcxlohx","http://nextroundst.com/nlcsphze","http://diveupdown.com/aa","http://diveupdown.com/aaa","http://diveupdown.com/hlsxaifp","http://diveupdown.com/yhmrmmgc")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND Requestcontext NOT NULL AND Requestcontext IN ("http://adfhjadfbjadbfjkhad44jka.com/aa","http://adfhjadfbjadbfjkhad44jka.com/xxhhodrq","http://adfhjadfbjadbfjkhad44jka.com/zanmjtvh","http://nextroundst.com/aa","http://nextroundst.com/ffcxlohx","http://nextroundst.com/nlcsphze","http://diveupdown.com/aa","http://diveupdown.com/aaa","http://diveupdown.com/hlsxaifp","http://diveupdown.com/yhmrmmgc")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("http://adfhjadfbjadbfjkhad44jka.com/aa","http://adfhjadfbjadbfjkhad44jka.com/xxhhodrq","http://adfhjadfbjadbfjkhad44jka.com/zanmjtvh","http://nextroundst.com/aa","http://nextroundst.com/ffcxlohx","http://nextroundst.com/nlcsphze","http://diveupdown.com/aa","http://diveupdown.com/aaa","http://diveupdown.com/hlsxaifp","http://diveupdown.com/yhmrmmgc")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND requesturl NOT NULL AND requesturl IN ("http://adfhjadfbjadbfjkhad44jka.com/aa","http://adfhjadfbjadbfjkhad44jka.com/xxhhodrq","http://adfhjadfbjadbfjkhad44jka.com/zanmjtvh","http://nextroundst.com/aa","http://nextroundst.com/ffcxlohx","http://nextroundst.com/nlcsphze","http://diveupdown.com/aa","http://diveupdown.com/aaa","http://diveupdown.com/hlsxaifp","http://diveupdown.com/yhmrmmgc")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND Message NOT NULL AND Message IN ("http://adfhjadfbjadbfjkhad44jka.com/aa","http://adfhjadfbjadbfjkhad44jka.com/xxhhodrq","http://adfhjadfbjadbfjkhad44jka.com/zanmjtvh","http://nextroundst.com/aa","http://nextroundst.com/ffcxlohx","http://nextroundst.com/nlcsphze","http://diveupdown.com/aa","http://diveupdown.com/aaa","http://diveupdown.com/hlsxaifp","http://diveupdown.com/yhmrmmgc")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND Requestcontext NOT NULL AND Requestcontext IN ("http://adfhjadfbjadbfjkhad44jka.com/aa","http://adfhjadfbjadbfjkhad44jka.com/xxhhodrq","http://adfhjadfbjadbfjkhad44jka.com/zanmjtvh","http://nextroundst.com/aa","http://nextroundst.com/ffcxlohx","http://nextroundst.com/nlcsphze","http://diveupdown.com/aa","http://diveupdown.com/aaa","http://diveupdown.com/hlsxaifp","http://diveupdown.com/yhmrmmgc")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("http://adfhjadfbjadbfjkhad44jka.com/aa","http://adfhjadfbjadbfjkhad44jka.com/xxhhodrq","http://adfhjadfbjadbfjkhad44jka.com/zanmjtvh","http://nextroundst.com/aa","http://nextroundst.com/ffcxlohx","http://nextroundst.com/nlcsphze","http://diveupdown.com/aa","http://diveupdown.com/aaa","http://diveupdown.com/hlsxaifp","http://diveupdown.com/yhmrmmgc")
index=activity AND rg_functionality="Email / Email Security" AND requesturl NOT NULL AND requesturl IN ("http://adfhjadfbjadbfjkhad44jka.com/aa","http://adfhjadfbjadbfjkhad44jka.com/xxhhodrq","http://adfhjadfbjadbfjkhad44jka.com/zanmjtvh","http://nextroundst.com/aa","http://nextroundst.com/ffcxlohx","http://nextroundst.com/nlcsphze","http://diveupdown.com/aa","http://diveupdown.com/aaa","http://diveupdown.com/hlsxaifp","http://diveupdown.com/yhmrmmgc")
index=activity AND rg_functionality="Email / Email Security" AND Message NOT NULL AND Message IN ("http://adfhjadfbjadbfjkhad44jka.com/aa","http://adfhjadfbjadbfjkhad44jka.com/xxhhodrq","http://adfhjadfbjadbfjkhad44jka.com/zanmjtvh","http://nextroundst.com/aa","http://nextroundst.com/ffcxlohx","http://nextroundst.com/nlcsphze","http://diveupdown.com/aa","http://diveupdown.com/aaa","http://diveupdown.com/hlsxaifp","http://diveupdown.com/yhmrmmgc")
index=activity AND rg_functionality="Email / Email Security" AND Requestcontext NOT NULL AND Requestcontext IN ("http://adfhjadfbjadbfjkhad44jka.com/aa","http://adfhjadfbjadbfjkhad44jka.com/xxhhodrq","http://adfhjadfbjadbfjkhad44jka.com/zanmjtvh","http://nextroundst.com/aa","http://nextroundst.com/ffcxlohx","http://nextroundst.com/nlcsphze","http://diveupdown.com/aa","http://diveupdown.com/aaa","http://diveupdown.com/hlsxaifp","http://diveupdown.com/yhmrmmgc")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("http://adfhjadfbjadbfjkhad44jka.com/aa","http://adfhjadfbjadbfjkhad44jka.com/xxhhodrq","http://adfhjadfbjadbfjkhad44jka.com/zanmjtvh","http://nextroundst.com/aa","http://nextroundst.com/ffcxlohx","http://nextroundst.com/nlcsphze","http://diveupdown.com/aa","http://diveupdown.com/aaa","http://diveupdown.com/hlsxaifp","http://diveupdown.com/yhmrmmgc")
index=activity AND rg_functionality="Cloud Email / Email Security" AND requesturl NOT NULL AND requesturl IN ("http://adfhjadfbjadbfjkhad44jka.com/aa","http://adfhjadfbjadbfjkhad44jka.com/xxhhodrq","http://adfhjadfbjadbfjkhad44jka.com/zanmjtvh","http://nextroundst.com/aa","http://nextroundst.com/ffcxlohx","http://nextroundst.com/nlcsphze","http://diveupdown.com/aa","http://diveupdown.com/aaa","http://diveupdown.com/hlsxaifp","http://diveupdown.com/yhmrmmgc")
index=activity AND rg_functionality="Cloud Email / Email Security" AND Message NOT NULL AND Message IN ("http://adfhjadfbjadbfjkhad44jka.com/aa","http://adfhjadfbjadbfjkhad44jka.com/xxhhodrq","http://adfhjadfbjadbfjkhad44jka.com/zanmjtvh","http://nextroundst.com/aa","http://nextroundst.com/ffcxlohx","http://nextroundst.com/nlcsphze","http://diveupdown.com/aa","http://diveupdown.com/aaa","http://diveupdown.com/hlsxaifp","http://diveupdown.com/yhmrmmgc")
index=activity AND rg_functionality="Cloud Email / Email Security" AND Requestcontext NOT NULL AND Requestcontext IN ("http://adfhjadfbjadbfjkhad44jka.com/aa","http://adfhjadfbjadbfjkhad44jka.com/xxhhodrq","http://adfhjadfbjadbfjkhad44jka.com/zanmjtvh","http://nextroundst.com/aa","http://nextroundst.com/ffcxlohx","http://nextroundst.com/nlcsphze","http://diveupdown.com/aa","http://diveupdown.com/aaa","http://diveupdown.com/hlsxaifp","http://diveupdown.com/yhmrmmgc")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("http://adfhjadfbjadbfjkhad44jka.com/aa","http://adfhjadfbjadbfjkhad44jka.com/xxhhodrq","http://adfhjadfbjadbfjkhad44jka.com/zanmjtvh","http://nextroundst.com/aa","http://nextroundst.com/ffcxlohx","http://nextroundst.com/nlcsphze","http://diveupdown.com/aa","http://diveupdown.com/aaa","http://diveupdown.com/hlsxaifp","http://diveupdown.com/yhmrmmgc")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND requesturl NOT NULL AND requesturl IN ("http://adfhjadfbjadbfjkhad44jka.com/aa","http://adfhjadfbjadbfjkhad44jka.com/xxhhodrq","http://adfhjadfbjadbfjkhad44jka.com/zanmjtvh","http://nextroundst.com/aa","http://nextroundst.com/ffcxlohx","http://nextroundst.com/nlcsphze","http://diveupdown.com/aa","http://diveupdown.com/aaa","http://diveupdown.com/hlsxaifp","http://diveupdown.com/yhmrmmgc")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND Message NOT NULL AND Message IN ("http://adfhjadfbjadbfjkhad44jka.com/aa","http://adfhjadfbjadbfjkhad44jka.com/xxhhodrq","http://adfhjadfbjadbfjkhad44jka.com/zanmjtvh","http://nextroundst.com/aa","http://nextroundst.com/ffcxlohx","http://nextroundst.com/nlcsphze","http://diveupdown.com/aa","http://diveupdown.com/aaa","http://diveupdown.com/hlsxaifp","http://diveupdown.com/yhmrmmgc")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND Requestcontext NOT NULL AND Requestcontext IN ("http://adfhjadfbjadbfjkhad44jka.com/aa","http://adfhjadfbjadbfjkhad44jka.com/xxhhodrq","http://adfhjadfbjadbfjkhad44jka.com/zanmjtvh","http://nextroundst.com/aa","http://nextroundst.com/ffcxlohx","http://nextroundst.com/nlcsphze","http://diveupdown.com/aa","http://diveupdown.com/aaa","http://diveupdown.com/hlsxaifp","http://diveupdown.com/yhmrmmgc")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("http://adfhjadfbjadbfjkhad44jka.com/aa","http://adfhjadfbjadbfjkhad44jka.com/xxhhodrq","http://adfhjadfbjadbfjkhad44jka.com/zanmjtvh","http://nextroundst.com/aa","http://nextroundst.com/ffcxlohx","http://nextroundst.com/nlcsphze","http://diveupdown.com/aa","http://diveupdown.com/aaa","http://diveupdown.com/hlsxaifp","http://diveupdown.com/yhmrmmgc")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND requesturl NOT NULL AND requesturl IN ("http://adfhjadfbjadbfjkhad44jka.com/aa","http://adfhjadfbjadbfjkhad44jka.com/xxhhodrq","http://adfhjadfbjadbfjkhad44jka.com/zanmjtvh","http://nextroundst.com/aa","http://nextroundst.com/ffcxlohx","http://nextroundst.com/nlcsphze","http://diveupdown.com/aa","http://diveupdown.com/aaa","http://diveupdown.com/hlsxaifp","http://diveupdown.com/yhmrmmgc")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND Message NOT NULL AND Message IN ("http://adfhjadfbjadbfjkhad44jka.com/aa","http://adfhjadfbjadbfjkhad44jka.com/xxhhodrq","http://adfhjadfbjadbfjkhad44jka.com/zanmjtvh","http://nextroundst.com/aa","http://nextroundst.com/ffcxlohx","http://nextroundst.com/nlcsphze","http://diveupdown.com/aa","http://diveupdown.com/aaa","http://diveupdown.com/hlsxaifp","http://diveupdown.com/yhmrmmgc")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND Requestcontext NOT NULL AND Requestcontext IN ("http://adfhjadfbjadbfjkhad44jka.com/aa","http://adfhjadfbjadbfjkhad44jka.com/xxhhodrq","http://adfhjadfbjadbfjkhad44jka.com/zanmjtvh","http://nextroundst.com/aa","http://nextroundst.com/ffcxlohx","http://nextroundst.com/nlcsphze","http://diveupdown.com/aa","http://diveupdown.com/aaa","http://diveupdown.com/hlsxaifp","http://diveupdown.com/yhmrmmgc")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("http://adfhjadfbjadbfjkhad44jka.com/aa","http://adfhjadfbjadbfjkhad44jka.com/xxhhodrq","http://adfhjadfbjadbfjkhad44jka.com/zanmjtvh","http://nextroundst.com/aa","http://nextroundst.com/ffcxlohx","http://nextroundst.com/nlcsphze","http://diveupdown.com/aa","http://diveupdown.com/aaa","http://diveupdown.com/hlsxaifp","http://diveupdown.com/yhmrmmgc")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND requesturl NOT NULL AND requesturl IN ("http://adfhjadfbjadbfjkhad44jka.com/aa","http://adfhjadfbjadbfjkhad44jka.com/xxhhodrq","http://adfhjadfbjadbfjkhad44jka.com/zanmjtvh","http://nextroundst.com/aa","http://nextroundst.com/ffcxlohx","http://nextroundst.com/nlcsphze","http://diveupdown.com/aa","http://diveupdown.com/aaa","http://diveupdown.com/hlsxaifp","http://diveupdown.com/yhmrmmgc")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND Message NOT NULL AND Message IN ("http://adfhjadfbjadbfjkhad44jka.com/aa","http://adfhjadfbjadbfjkhad44jka.com/xxhhodrq","http://adfhjadfbjadbfjkhad44jka.com/zanmjtvh","http://nextroundst.com/aa","http://nextroundst.com/ffcxlohx","http://nextroundst.com/nlcsphze","http://diveupdown.com/aa","http://diveupdown.com/aaa","http://diveupdown.com/hlsxaifp","http://diveupdown.com/yhmrmmgc")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND Requestcontext NOT NULL AND Requestcontext IN ("http://adfhjadfbjadbfjkhad44jka.com/aa","http://adfhjadfbjadbfjkhad44jka.com/xxhhodrq","http://adfhjadfbjadbfjkhad44jka.com/zanmjtvh","http://nextroundst.com/aa","http://nextroundst.com/ffcxlohx","http://nextroundst.com/nlcsphze","http://diveupdown.com/aa","http://diveupdown.com/aaa","http://diveupdown.com/hlsxaifp","http://diveupdown.com/yhmrmmgc")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("http://adfhjadfbjadbfjkhad44jka.com/aa","http://adfhjadfbjadbfjkhad44jka.com/xxhhodrq","http://adfhjadfbjadbfjkhad44jka.com/zanmjtvh","http://nextroundst.com/aa","http://nextroundst.com/ffcxlohx","http://nextroundst.com/nlcsphze","http://diveupdown.com/aa","http://diveupdown.com/aaa","http://diveupdown.com/hlsxaifp","http://diveupdown.com/yhmrmmgc")
index=activity AND rg_functionality="Web Proxy" AND requesturl NOT NULL AND requesturl IN ("http://adfhjadfbjadbfjkhad44jka.com/aa","http://adfhjadfbjadbfjkhad44jka.com/xxhhodrq","http://adfhjadfbjadbfjkhad44jka.com/zanmjtvh","http://nextroundst.com/aa","http://nextroundst.com/ffcxlohx","http://nextroundst.com/nlcsphze","http://diveupdown.com/aa","http://diveupdown.com/aaa","http://diveupdown.com/hlsxaifp","http://diveupdown.com/yhmrmmgc")
index=activity AND rg_functionality="Web Proxy" AND Message NOT NULL AND Message IN ("http://adfhjadfbjadbfjkhad44jka.com/aa","http://adfhjadfbjadbfjkhad44jka.com/xxhhodrq","http://adfhjadfbjadbfjkhad44jka.com/zanmjtvh","http://nextroundst.com/aa","http://nextroundst.com/ffcxlohx","http://nextroundst.com/nlcsphze","http://diveupdown.com/aa","http://diveupdown.com/aaa","http://diveupdown.com/hlsxaifp","http://diveupdown.com/yhmrmmgc")
index=activity AND rg_functionality="Web Proxy" AND Requestcontext NOT NULL AND Requestcontext IN ("http://adfhjadfbjadbfjkhad44jka.com/aa","http://adfhjadfbjadbfjkhad44jka.com/xxhhodrq","http://adfhjadfbjadbfjkhad44jka.com/zanmjtvh","http://nextroundst.com/aa","http://nextroundst.com/ffcxlohx","http://nextroundst.com/nlcsphze","http://diveupdown.com/aa","http://diveupdown.com/aaa","http://diveupdown.com/hlsxaifp","http://diveupdown.com/yhmrmmgc")
index=activity AND rg_functionality="Web Proxy" AND customstring3 NOT NULL AND customstring3 IN ("http://adfhjadfbjadbfjkhad44jka.com/aa","http://adfhjadfbjadbfjkhad44jka.com/xxhhodrq","http://adfhjadfbjadbfjkhad44jka.com/zanmjtvh","http://nextroundst.com/aa","http://nextroundst.com/ffcxlohx","http://nextroundst.com/nlcsphze","http://diveupdown.com/aa","http://diveupdown.com/aaa","http://diveupdown.com/hlsxaifp","http://diveupdown.com/yhmrmmgc")
index=activity AND rg_functionality="Next Generation Firewall" AND requesturl NOT NULL AND requesturl IN ("http://adfhjadfbjadbfjkhad44jka.com/aa","http://adfhjadfbjadbfjkhad44jka.com/xxhhodrq","http://adfhjadfbjadbfjkhad44jka.com/zanmjtvh","http://nextroundst.com/aa","http://nextroundst.com/ffcxlohx","http://nextroundst.com/nlcsphze","http://diveupdown.com/aa","http://diveupdown.com/aaa","http://diveupdown.com/hlsxaifp","http://diveupdown.com/yhmrmmgc")
index=activity AND rg_functionality="Next Generation Firewall" AND Message NOT NULL AND Message IN ("http://adfhjadfbjadbfjkhad44jka.com/aa","http://adfhjadfbjadbfjkhad44jka.com/xxhhodrq","http://adfhjadfbjadbfjkhad44jka.com/zanmjtvh","http://nextroundst.com/aa","http://nextroundst.com/ffcxlohx","http://nextroundst.com/nlcsphze","http://diveupdown.com/aa","http://diveupdown.com/aaa","http://diveupdown.com/hlsxaifp","http://diveupdown.com/yhmrmmgc")
index=activity AND rg_functionality="Next Generation Firewall" AND Requestcontext NOT NULL AND Requestcontext IN ("http://adfhjadfbjadbfjkhad44jka.com/aa","http://adfhjadfbjadbfjkhad44jka.com/xxhhodrq","http://adfhjadfbjadbfjkhad44jka.com/zanmjtvh","http://nextroundst.com/aa","http://nextroundst.com/ffcxlohx","http://nextroundst.com/nlcsphze","http://diveupdown.com/aa","http://diveupdown.com/aaa","http://diveupdown.com/hlsxaifp","http://diveupdown.com/yhmrmmgc")
index=activity AND rg_functionality="Next Generation Firewall" AND customstring3 NOT NULL AND customstring3 IN ("http://adfhjadfbjadbfjkhad44jka.com/aa","http://adfhjadfbjadbfjkhad44jka.com/xxhhodrq","http://adfhjadfbjadbfjkhad44jka.com/zanmjtvh","http://nextroundst.com/aa","http://nextroundst.com/ffcxlohx","http://nextroundst.com/nlcsphze","http://diveupdown.com/aa","http://diveupdown.com/aaa","http://diveupdown.com/hlsxaifp","http://diveupdown.com/yhmrmmgc")
index=activity AND rg_functionality="Flow" AND requesturl NOT NULL AND requesturl IN ("http://adfhjadfbjadbfjkhad44jka.com/aa","http://adfhjadfbjadbfjkhad44jka.com/xxhhodrq","http://adfhjadfbjadbfjkhad44jka.com/zanmjtvh","http://nextroundst.com/aa","http://nextroundst.com/ffcxlohx","http://nextroundst.com/nlcsphze","http://diveupdown.com/aa","http://diveupdown.com/aaa","http://diveupdown.com/hlsxaifp","http://diveupdown.com/yhmrmmgc")
index=activity AND rg_functionality="Flow" AND Message NOT NULL AND Message IN ("http://adfhjadfbjadbfjkhad44jka.com/aa","http://adfhjadfbjadbfjkhad44jka.com/xxhhodrq","http://adfhjadfbjadbfjkhad44jka.com/zanmjtvh","http://nextroundst.com/aa","http://nextroundst.com/ffcxlohx","http://nextroundst.com/nlcsphze","http://diveupdown.com/aa","http://diveupdown.com/aaa","http://diveupdown.com/hlsxaifp","http://diveupdown.com/yhmrmmgc")
index=activity AND rg_functionality="Flow" AND Requestcontext NOT NULL AND Requestcontext IN ("http://adfhjadfbjadbfjkhad44jka.com/aa","http://adfhjadfbjadbfjkhad44jka.com/xxhhodrq","http://adfhjadfbjadbfjkhad44jka.com/zanmjtvh","http://nextroundst.com/aa","http://nextroundst.com/ffcxlohx","http://nextroundst.com/nlcsphze","http://diveupdown.com/aa","http://diveupdown.com/aaa","http://diveupdown.com/hlsxaifp","http://diveupdown.com/yhmrmmgc")
index=activity AND rg_functionality="Flow" AND customstring3 NOT NULL AND customstring3 IN ("http://adfhjadfbjadbfjkhad44jka.com/aa","http://adfhjadfbjadbfjkhad44jka.com/xxhhodrq","http://adfhjadfbjadbfjkhad44jka.com/zanmjtvh","http://nextroundst.com/aa","http://nextroundst.com/ffcxlohx","http://nextroundst.com/nlcsphze","http://diveupdown.com/aa","http://diveupdown.com/aaa","http://diveupdown.com/hlsxaifp","http://diveupdown.com/yhmrmmgc")
index=activity AND rg_functionality="Web Server" AND requesturl NOT NULL AND requesturl IN ("http://adfhjadfbjadbfjkhad44jka.com/aa","http://adfhjadfbjadbfjkhad44jka.com/xxhhodrq","http://adfhjadfbjadbfjkhad44jka.com/zanmjtvh","http://nextroundst.com/aa","http://nextroundst.com/ffcxlohx","http://nextroundst.com/nlcsphze","http://diveupdown.com/aa","http://diveupdown.com/aaa","http://diveupdown.com/hlsxaifp","http://diveupdown.com/yhmrmmgc")
index=activity AND rg_functionality="Web Server" AND Message NOT NULL AND Message IN ("http://adfhjadfbjadbfjkhad44jka.com/aa","http://adfhjadfbjadbfjkhad44jka.com/xxhhodrq","http://adfhjadfbjadbfjkhad44jka.com/zanmjtvh","http://nextroundst.com/aa","http://nextroundst.com/ffcxlohx","http://nextroundst.com/nlcsphze","http://diveupdown.com/aa","http://diveupdown.com/aaa","http://diveupdown.com/hlsxaifp","http://diveupdown.com/yhmrmmgc")
index=activity AND rg_functionality="Web Server" AND Requestcontext NOT NULL AND Requestcontext IN ("http://adfhjadfbjadbfjkhad44jka.com/aa","http://adfhjadfbjadbfjkhad44jka.com/xxhhodrq","http://adfhjadfbjadbfjkhad44jka.com/zanmjtvh","http://nextroundst.com/aa","http://nextroundst.com/ffcxlohx","http://nextroundst.com/nlcsphze","http://diveupdown.com/aa","http://diveupdown.com/aaa","http://diveupdown.com/hlsxaifp","http://diveupdown.com/yhmrmmgc")
index=activity AND rg_functionality="Web Server" AND customstring3 NOT NULL AND customstring3 IN ("http://adfhjadfbjadbfjkhad44jka.com/aa","http://adfhjadfbjadbfjkhad44jka.com/xxhhodrq","http://adfhjadfbjadbfjkhad44jka.com/zanmjtvh","http://nextroundst.com/aa","http://nextroundst.com/ffcxlohx","http://nextroundst.com/nlcsphze","http://diveupdown.com/aa","http://diveupdown.com/aaa","http://diveupdown.com/hlsxaifp","http://diveupdown.com/yhmrmmgc")
index=activity AND rg_functionality="Email / Email Security" AND requesturl NOT NULL AND requesturl IN ("http://adfhjadfbjadbfjkhad44jka.com/aa","http://adfhjadfbjadbfjkhad44jka.com/xxhhodrq","http://adfhjadfbjadbfjkhad44jka.com/zanmjtvh","http://nextroundst.com/aa","http://nextroundst.com/ffcxlohx","http://nextroundst.com/nlcsphze","http://diveupdown.com/aa","http://diveupdown.com/aaa","http://diveupdown.com/hlsxaifp","http://diveupdown.com/yhmrmmgc")
index=activity AND rg_functionality="Email / Email Security" AND Message NOT NULL AND Message IN ("http://adfhjadfbjadbfjkhad44jka.com/aa","http://adfhjadfbjadbfjkhad44jka.com/xxhhodrq","http://adfhjadfbjadbfjkhad44jka.com/zanmjtvh","http://nextroundst.com/aa","http://nextroundst.com/ffcxlohx","http://nextroundst.com/nlcsphze","http://diveupdown.com/aa","http://diveupdown.com/aaa","http://diveupdown.com/hlsxaifp","http://diveupdown.com/yhmrmmgc")
index=activity AND rg_functionality="Email / Email Security" AND Requestcontext NOT NULL AND Requestcontext IN ("http://adfhjadfbjadbfjkhad44jka.com/aa","http://adfhjadfbjadbfjkhad44jka.com/xxhhodrq","http://adfhjadfbjadbfjkhad44jka.com/zanmjtvh","http://nextroundst.com/aa","http://nextroundst.com/ffcxlohx","http://nextroundst.com/nlcsphze","http://diveupdown.com/aa","http://diveupdown.com/aaa","http://diveupdown.com/hlsxaifp","http://diveupdown.com/yhmrmmgc")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("http://adfhjadfbjadbfjkhad44jka.com/aa","http://adfhjadfbjadbfjkhad44jka.com/xxhhodrq","http://adfhjadfbjadbfjkhad44jka.com/zanmjtvh","http://nextroundst.com/aa","http://nextroundst.com/ffcxlohx","http://nextroundst.com/nlcsphze","http://diveupdown.com/aa","http://diveupdown.com/aaa","http://diveupdown.com/hlsxaifp","http://diveupdown.com/yhmrmmgc")
index=activity AND rg_functionality="Cloud Email / Email Security" AND requesturl NOT NULL AND requesturl IN ("http://adfhjadfbjadbfjkhad44jka.com/aa","http://adfhjadfbjadbfjkhad44jka.com/xxhhodrq","http://adfhjadfbjadbfjkhad44jka.com/zanmjtvh","http://nextroundst.com/aa","http://nextroundst.com/ffcxlohx","http://nextroundst.com/nlcsphze","http://diveupdown.com/aa","http://diveupdown.com/aaa","http://diveupdown.com/hlsxaifp","http://diveupdown.com/yhmrmmgc")
index=activity AND rg_functionality="Cloud Email / Email Security" AND Message NOT NULL AND Message IN ("http://adfhjadfbjadbfjkhad44jka.com/aa","http://adfhjadfbjadbfjkhad44jka.com/xxhhodrq","http://adfhjadfbjadbfjkhad44jka.com/zanmjtvh","http://nextroundst.com/aa","http://nextroundst.com/ffcxlohx","http://nextroundst.com/nlcsphze","http://diveupdown.com/aa","http://diveupdown.com/aaa","http://diveupdown.com/hlsxaifp","http://diveupdown.com/yhmrmmgc")
index=activity AND rg_functionality="Cloud Email / Email Security" AND Requestcontext NOT NULL AND Requestcontext IN ("http://adfhjadfbjadbfjkhad44jka.com/aa","http://adfhjadfbjadbfjkhad44jka.com/xxhhodrq","http://adfhjadfbjadbfjkhad44jka.com/zanmjtvh","http://nextroundst.com/aa","http://nextroundst.com/ffcxlohx","http://nextroundst.com/nlcsphze","http://diveupdown.com/aa","http://diveupdown.com/aaa","http://diveupdown.com/hlsxaifp","http://diveupdown.com/yhmrmmgc")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("http://adfhjadfbjadbfjkhad44jka.com/aa","http://adfhjadfbjadbfjkhad44jka.com/xxhhodrq","http://adfhjadfbjadbfjkhad44jka.com/zanmjtvh","http://nextroundst.com/aa","http://nextroundst.com/ffcxlohx","http://nextroundst.com/nlcsphze","http://diveupdown.com/aa","http://diveupdown.com/aaa","http://diveupdown.com/hlsxaifp","http://diveupdown.com/yhmrmmgc")
index=activity AND rg_functionality="Web Application Firewall" AND requesturl NOT NULL AND requesturl IN ("http://adfhjadfbjadbfjkhad44jka.com/aa","http://adfhjadfbjadbfjkhad44jka.com/xxhhodrq","http://adfhjadfbjadbfjkhad44jka.com/zanmjtvh","http://nextroundst.com/aa","http://nextroundst.com/ffcxlohx","http://nextroundst.com/nlcsphze","http://diveupdown.com/aa","http://diveupdown.com/aaa","http://diveupdown.com/hlsxaifp","http://diveupdown.com/yhmrmmgc")
index=activity AND rg_functionality="Web Application Firewall" AND Message NOT NULL AND Message IN ("http://adfhjadfbjadbfjkhad44jka.com/aa","http://adfhjadfbjadbfjkhad44jka.com/xxhhodrq","http://adfhjadfbjadbfjkhad44jka.com/zanmjtvh","http://nextroundst.com/aa","http://nextroundst.com/ffcxlohx","http://nextroundst.com/nlcsphze","http://diveupdown.com/aa","http://diveupdown.com/aaa","http://diveupdown.com/hlsxaifp","http://diveupdown.com/yhmrmmgc")
index=activity AND rg_functionality="Web Application Firewall" AND Requestcontext NOT NULL AND Requestcontext IN ("http://adfhjadfbjadbfjkhad44jka.com/aa","http://adfhjadfbjadbfjkhad44jka.com/xxhhodrq","http://adfhjadfbjadbfjkhad44jka.com/zanmjtvh","http://nextroundst.com/aa","http://nextroundst.com/ffcxlohx","http://nextroundst.com/nlcsphze","http://diveupdown.com/aa","http://diveupdown.com/aaa","http://diveupdown.com/hlsxaifp","http://diveupdown.com/yhmrmmgc")
index=activity AND rg_functionality="Web Application Firewall" AND customstring3 NOT NULL AND customstring3 IN ("http://adfhjadfbjadbfjkhad44jka.com/aa","http://adfhjadfbjadbfjkhad44jka.com/xxhhodrq","http://adfhjadfbjadbfjkhad44jka.com/zanmjtvh","http://nextroundst.com/aa","http://nextroundst.com/ffcxlohx","http://nextroundst.com/nlcsphze","http://diveupdown.com/aa","http://diveupdown.com/aaa","http://diveupdown.com/hlsxaifp","http://diveupdown.com/yhmrmmgc")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND requesturl NOT NULL AND requesturl IN ("http://adfhjadfbjadbfjkhad44jka.com/aa","http://adfhjadfbjadbfjkhad44jka.com/xxhhodrq","http://adfhjadfbjadbfjkhad44jka.com/zanmjtvh","http://nextroundst.com/aa","http://nextroundst.com/ffcxlohx","http://nextroundst.com/nlcsphze","http://diveupdown.com/aa","http://diveupdown.com/aaa","http://diveupdown.com/hlsxaifp","http://diveupdown.com/yhmrmmgc")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND Message NOT NULL AND Message IN ("http://adfhjadfbjadbfjkhad44jka.com/aa","http://adfhjadfbjadbfjkhad44jka.com/xxhhodrq","http://adfhjadfbjadbfjkhad44jka.com/zanmjtvh","http://nextroundst.com/aa","http://nextroundst.com/ffcxlohx","http://nextroundst.com/nlcsphze","http://diveupdown.com/aa","http://diveupdown.com/aaa","http://diveupdown.com/hlsxaifp","http://diveupdown.com/yhmrmmgc")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND Requestcontext NOT NULL AND Requestcontext IN ("http://adfhjadfbjadbfjkhad44jka.com/aa","http://adfhjadfbjadbfjkhad44jka.com/xxhhodrq","http://adfhjadfbjadbfjkhad44jka.com/zanmjtvh","http://nextroundst.com/aa","http://nextroundst.com/ffcxlohx","http://nextroundst.com/nlcsphze","http://diveupdown.com/aa","http://diveupdown.com/aaa","http://diveupdown.com/hlsxaifp","http://diveupdown.com/yhmrmmgc")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("http://adfhjadfbjadbfjkhad44jka.com/aa","http://adfhjadfbjadbfjkhad44jka.com/xxhhodrq","http://adfhjadfbjadbfjkhad44jka.com/zanmjtvh","http://nextroundst.com/aa","http://nextroundst.com/ffcxlohx","http://nextroundst.com/nlcsphze","http://diveupdown.com/aa","http://diveupdown.com/aaa","http://diveupdown.com/hlsxaifp","http://diveupdown.com/yhmrmmgc")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND requesturl NOT NULL AND requesturl IN ("http://adfhjadfbjadbfjkhad44jka.com/aa","http://adfhjadfbjadbfjkhad44jka.com/xxhhodrq","http://adfhjadfbjadbfjkhad44jka.com/zanmjtvh","http://nextroundst.com/aa","http://nextroundst.com/ffcxlohx","http://nextroundst.com/nlcsphze","http://diveupdown.com/aa","http://diveupdown.com/aaa","http://diveupdown.com/hlsxaifp","http://diveupdown.com/yhmrmmgc")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND Message NOT NULL AND Message IN ("http://adfhjadfbjadbfjkhad44jka.com/aa","http://adfhjadfbjadbfjkhad44jka.com/xxhhodrq","http://adfhjadfbjadbfjkhad44jka.com/zanmjtvh","http://nextroundst.com/aa","http://nextroundst.com/ffcxlohx","http://nextroundst.com/nlcsphze","http://diveupdown.com/aa","http://diveupdown.com/aaa","http://diveupdown.com/hlsxaifp","http://diveupdown.com/yhmrmmgc")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND Requestcontext NOT NULL AND Requestcontext IN ("http://adfhjadfbjadbfjkhad44jka.com/aa","http://adfhjadfbjadbfjkhad44jka.com/xxhhodrq","http://adfhjadfbjadbfjkhad44jka.com/zanmjtvh","http://nextroundst.com/aa","http://nextroundst.com/ffcxlohx","http://nextroundst.com/nlcsphze","http://diveupdown.com/aa","http://diveupdown.com/aaa","http://diveupdown.com/hlsxaifp","http://diveupdown.com/yhmrmmgc")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND customstring3 NOT NULL AND customstring3 IN ("http://adfhjadfbjadbfjkhad44jka.com/aa","http://adfhjadfbjadbfjkhad44jka.com/xxhhodrq","http://adfhjadfbjadbfjkhad44jka.com/zanmjtvh","http://nextroundst.com/aa","http://nextroundst.com/ffcxlohx","http://nextroundst.com/nlcsphze","http://diveupdown.com/aa","http://diveupdown.com/aaa","http://diveupdown.com/hlsxaifp","http://diveupdown.com/yhmrmmgc")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND requesturl NOT NULL AND requesturl IN ("http://adfhjadfbjadbfjkhad44jka.com/aa","http://adfhjadfbjadbfjkhad44jka.com/xxhhodrq","http://adfhjadfbjadbfjkhad44jka.com/zanmjtvh","http://nextroundst.com/aa","http://nextroundst.com/ffcxlohx","http://nextroundst.com/nlcsphze","http://diveupdown.com/aa","http://diveupdown.com/aaa","http://diveupdown.com/hlsxaifp","http://diveupdown.com/yhmrmmgc")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND Message NOT NULL AND Message IN ("http://adfhjadfbjadbfjkhad44jka.com/aa","http://adfhjadfbjadbfjkhad44jka.com/xxhhodrq","http://adfhjadfbjadbfjkhad44jka.com/zanmjtvh","http://nextroundst.com/aa","http://nextroundst.com/ffcxlohx","http://nextroundst.com/nlcsphze","http://diveupdown.com/aa","http://diveupdown.com/aaa","http://diveupdown.com/hlsxaifp","http://diveupdown.com/yhmrmmgc")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND Requestcontext NOT NULL AND Requestcontext IN ("http://adfhjadfbjadbfjkhad44jka.com/aa","http://adfhjadfbjadbfjkhad44jka.com/xxhhodrq","http://adfhjadfbjadbfjkhad44jka.com/zanmjtvh","http://nextroundst.com/aa","http://nextroundst.com/ffcxlohx","http://nextroundst.com/nlcsphze","http://diveupdown.com/aa","http://diveupdown.com/aaa","http://diveupdown.com/hlsxaifp","http://diveupdown.com/yhmrmmgc")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND customstring3 NOT NULL AND customstring3 IN ("http://adfhjadfbjadbfjkhad44jka.com/aa","http://adfhjadfbjadbfjkhad44jka.com/xxhhodrq","http://adfhjadfbjadbfjkhad44jka.com/zanmjtvh","http://nextroundst.com/aa","http://nextroundst.com/ffcxlohx","http://nextroundst.com/nlcsphze","http://diveupdown.com/aa","http://diveupdown.com/aaa","http://diveupdown.com/hlsxaifp","http://diveupdown.com/yhmrmmgc")
index=activity AND rg_functionality="Cloud Application Security Broker" AND requesturl NOT NULL AND requesturl IN ("http://adfhjadfbjadbfjkhad44jka.com/aa","http://adfhjadfbjadbfjkhad44jka.com/xxhhodrq","http://adfhjadfbjadbfjkhad44jka.com/zanmjtvh","http://nextroundst.com/aa","http://nextroundst.com/ffcxlohx","http://nextroundst.com/nlcsphze","http://diveupdown.com/aa","http://diveupdown.com/aaa","http://diveupdown.com/hlsxaifp","http://diveupdown.com/yhmrmmgc")
index=activity AND rg_functionality="Cloud Application Security Broker" AND Message NOT NULL AND Message IN ("http://adfhjadfbjadbfjkhad44jka.com/aa","http://adfhjadfbjadbfjkhad44jka.com/xxhhodrq","http://adfhjadfbjadbfjkhad44jka.com/zanmjtvh","http://nextroundst.com/aa","http://nextroundst.com/ffcxlohx","http://nextroundst.com/nlcsphze","http://diveupdown.com/aa","http://diveupdown.com/aaa","http://diveupdown.com/hlsxaifp","http://diveupdown.com/yhmrmmgc")
index=activity AND rg_functionality="Cloud Application Security Broker" AND Requestcontext NOT NULL AND Requestcontext IN ("http://adfhjadfbjadbfjkhad44jka.com/aa","http://adfhjadfbjadbfjkhad44jka.com/xxhhodrq","http://adfhjadfbjadbfjkhad44jka.com/zanmjtvh","http://nextroundst.com/aa","http://nextroundst.com/ffcxlohx","http://nextroundst.com/nlcsphze","http://diveupdown.com/aa","http://diveupdown.com/aaa","http://diveupdown.com/hlsxaifp","http://diveupdown.com/yhmrmmgc")
index=activity AND rg_functionality="Cloud Application Security Broker" AND customstring3 NOT NULL AND customstring3 IN ("http://adfhjadfbjadbfjkhad44jka.com/aa","http://adfhjadfbjadbfjkhad44jka.com/xxhhodrq","http://adfhjadfbjadbfjkhad44jka.com/zanmjtvh","http://nextroundst.com/aa","http://nextroundst.com/ffcxlohx","http://nextroundst.com/nlcsphze","http://diveupdown.com/aa","http://diveupdown.com/aaa","http://diveupdown.com/hlsxaifp","http://diveupdown.com/yhmrmmgc")
index=activity AND rg_functionality="Source Code Repository" AND requesturl NOT NULL AND requesturl IN ("http://adfhjadfbjadbfjkhad44jka.com/aa","http://adfhjadfbjadbfjkhad44jka.com/xxhhodrq","http://adfhjadfbjadbfjkhad44jka.com/zanmjtvh","http://nextroundst.com/aa","http://nextroundst.com/ffcxlohx","http://nextroundst.com/nlcsphze","http://diveupdown.com/aa","http://diveupdown.com/aaa","http://diveupdown.com/hlsxaifp","http://diveupdown.com/yhmrmmgc")
index=activity AND rg_functionality="Source Code Repository" AND Message NOT NULL AND Message IN ("http://adfhjadfbjadbfjkhad44jka.com/aa","http://adfhjadfbjadbfjkhad44jka.com/xxhhodrq","http://adfhjadfbjadbfjkhad44jka.com/zanmjtvh","http://nextroundst.com/aa","http://nextroundst.com/ffcxlohx","http://nextroundst.com/nlcsphze","http://diveupdown.com/aa","http://diveupdown.com/aaa","http://diveupdown.com/hlsxaifp","http://diveupdown.com/yhmrmmgc")
index=activity AND rg_functionality="Source Code Repository" AND Requestcontext NOT NULL AND Requestcontext IN ("http://adfhjadfbjadbfjkhad44jka.com/aa","http://adfhjadfbjadbfjkhad44jka.com/xxhhodrq","http://adfhjadfbjadbfjkhad44jka.com/zanmjtvh","http://nextroundst.com/aa","http://nextroundst.com/ffcxlohx","http://nextroundst.com/nlcsphze","http://diveupdown.com/aa","http://diveupdown.com/aaa","http://diveupdown.com/hlsxaifp","http://diveupdown.com/yhmrmmgc")
index=activity AND rg_functionality="Source Code Repository" AND customstring3 NOT NULL AND customstring3 IN ("http://adfhjadfbjadbfjkhad44jka.com/aa","http://adfhjadfbjadbfjkhad44jka.com/xxhhodrq","http://adfhjadfbjadbfjkhad44jka.com/zanmjtvh","http://nextroundst.com/aa","http://nextroundst.com/ffcxlohx","http://nextroundst.com/nlcsphze","http://diveupdown.com/aa","http://diveupdown.com/aaa","http://diveupdown.com/hlsxaifp","http://diveupdown.com/yhmrmmgc")
index=activity AND rg_functionality="Authentication / VPN" AND requesturl NOT NULL AND requesturl IN ("http://adfhjadfbjadbfjkhad44jka.com/aa","http://adfhjadfbjadbfjkhad44jka.com/xxhhodrq","http://adfhjadfbjadbfjkhad44jka.com/zanmjtvh","http://nextroundst.com/aa","http://nextroundst.com/ffcxlohx","http://nextroundst.com/nlcsphze","http://diveupdown.com/aa","http://diveupdown.com/aaa","http://diveupdown.com/hlsxaifp","http://diveupdown.com/yhmrmmgc")
index=activity AND rg_functionality="Authentication / VPN" AND Message NOT NULL AND Message IN ("http://adfhjadfbjadbfjkhad44jka.com/aa","http://adfhjadfbjadbfjkhad44jka.com/xxhhodrq","http://adfhjadfbjadbfjkhad44jka.com/zanmjtvh","http://nextroundst.com/aa","http://nextroundst.com/ffcxlohx","http://nextroundst.com/nlcsphze","http://diveupdown.com/aa","http://diveupdown.com/aaa","http://diveupdown.com/hlsxaifp","http://diveupdown.com/yhmrmmgc")
index=activity AND rg_functionality="Authentication / VPN" AND Requestcontext NOT NULL AND Requestcontext IN ("http://adfhjadfbjadbfjkhad44jka.com/aa","http://adfhjadfbjadbfjkhad44jka.com/xxhhodrq","http://adfhjadfbjadbfjkhad44jka.com/zanmjtvh","http://nextroundst.com/aa","http://nextroundst.com/ffcxlohx","http://nextroundst.com/nlcsphze","http://diveupdown.com/aa","http://diveupdown.com/aaa","http://diveupdown.com/hlsxaifp","http://diveupdown.com/yhmrmmgc")
index=activity AND rg_functionality="Authentication / VPN" AND customstring3 NOT NULL AND customstring3 IN ("http://adfhjadfbjadbfjkhad44jka.com/aa","http://adfhjadfbjadbfjkhad44jka.com/xxhhodrq","http://adfhjadfbjadbfjkhad44jka.com/zanmjtvh","http://nextroundst.com/aa","http://nextroundst.com/ffcxlohx","http://nextroundst.com/nlcsphze","http://diveupdown.com/aa","http://diveupdown.com/aaa","http://diveupdown.com/hlsxaifp","http://diveupdown.com/yhmrmmgc")
index=activity AND rg_functionality="Cloud Content Management System" AND requesturl NOT NULL AND requesturl IN ("http://adfhjadfbjadbfjkhad44jka.com/aa","http://adfhjadfbjadbfjkhad44jka.com/xxhhodrq","http://adfhjadfbjadbfjkhad44jka.com/zanmjtvh","http://nextroundst.com/aa","http://nextroundst.com/ffcxlohx","http://nextroundst.com/nlcsphze","http://diveupdown.com/aa","http://diveupdown.com/aaa","http://diveupdown.com/hlsxaifp","http://diveupdown.com/yhmrmmgc")
index=activity AND rg_functionality="Cloud Content Management System" AND Message NOT NULL AND Message IN ("http://adfhjadfbjadbfjkhad44jka.com/aa","http://adfhjadfbjadbfjkhad44jka.com/xxhhodrq","http://adfhjadfbjadbfjkhad44jka.com/zanmjtvh","http://nextroundst.com/aa","http://nextroundst.com/ffcxlohx","http://nextroundst.com/nlcsphze","http://diveupdown.com/aa","http://diveupdown.com/aaa","http://diveupdown.com/hlsxaifp","http://diveupdown.com/yhmrmmgc")
index=activity AND rg_functionality="Cloud Content Management System" AND Requestcontext NOT NULL AND Requestcontext IN ("http://adfhjadfbjadbfjkhad44jka.com/aa","http://adfhjadfbjadbfjkhad44jka.com/xxhhodrq","http://adfhjadfbjadbfjkhad44jka.com/zanmjtvh","http://nextroundst.com/aa","http://nextroundst.com/ffcxlohx","http://nextroundst.com/nlcsphze","http://diveupdown.com/aa","http://diveupdown.com/aaa","http://diveupdown.com/hlsxaifp","http://diveupdown.com/yhmrmmgc")
index=activity AND rg_functionality="Cloud Content Management System" AND customstring3 NOT NULL AND customstring3 IN ("http://adfhjadfbjadbfjkhad44jka.com/aa","http://adfhjadfbjadbfjkhad44jka.com/xxhhodrq","http://adfhjadfbjadbfjkhad44jka.com/zanmjtvh","http://nextroundst.com/aa","http://nextroundst.com/ffcxlohx","http://nextroundst.com/nlcsphze","http://diveupdown.com/aa","http://diveupdown.com/aaa","http://diveupdown.com/hlsxaifp","http://diveupdown.com/yhmrmmgc")
index=activity AND rg_functionality="Cloud Services / Applications" AND requesturl NOT NULL AND requesturl IN ("http://adfhjadfbjadbfjkhad44jka.com/aa","http://adfhjadfbjadbfjkhad44jka.com/xxhhodrq","http://adfhjadfbjadbfjkhad44jka.com/zanmjtvh","http://nextroundst.com/aa","http://nextroundst.com/ffcxlohx","http://nextroundst.com/nlcsphze","http://diveupdown.com/aa","http://diveupdown.com/aaa","http://diveupdown.com/hlsxaifp","http://diveupdown.com/yhmrmmgc")
index=activity AND rg_functionality="Cloud Services / Applications" AND Message NOT NULL AND Message IN ("http://adfhjadfbjadbfjkhad44jka.com/aa","http://adfhjadfbjadbfjkhad44jka.com/xxhhodrq","http://adfhjadfbjadbfjkhad44jka.com/zanmjtvh","http://nextroundst.com/aa","http://nextroundst.com/ffcxlohx","http://nextroundst.com/nlcsphze","http://diveupdown.com/aa","http://diveupdown.com/aaa","http://diveupdown.com/hlsxaifp","http://diveupdown.com/yhmrmmgc")
index=activity AND rg_functionality="Cloud Services / Applications" AND Requestcontext NOT NULL AND Requestcontext IN ("http://adfhjadfbjadbfjkhad44jka.com/aa","http://adfhjadfbjadbfjkhad44jka.com/xxhhodrq","http://adfhjadfbjadbfjkhad44jka.com/zanmjtvh","http://nextroundst.com/aa","http://nextroundst.com/ffcxlohx","http://nextroundst.com/nlcsphze","http://diveupdown.com/aa","http://diveupdown.com/aaa","http://diveupdown.com/hlsxaifp","http://diveupdown.com/yhmrmmgc")
index=activity AND rg_functionality="Cloud Services / Applications" AND customstring3 NOT NULL AND customstring3 IN ("http://adfhjadfbjadbfjkhad44jka.com/aa","http://adfhjadfbjadbfjkhad44jka.com/xxhhodrq","http://adfhjadfbjadbfjkhad44jka.com/zanmjtvh","http://nextroundst.com/aa","http://nextroundst.com/ffcxlohx","http://nextroundst.com/nlcsphze","http://diveupdown.com/aa","http://diveupdown.com/aaa","http://diveupdown.com/hlsxaifp","http://diveupdown.com/yhmrmmgc")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND requesturl NOT NULL AND requesturl IN ("http://adfhjadfbjadbfjkhad44jka.com/aa","http://adfhjadfbjadbfjkhad44jka.com/xxhhodrq","http://adfhjadfbjadbfjkhad44jka.com/zanmjtvh","http://nextroundst.com/aa","http://nextroundst.com/ffcxlohx","http://nextroundst.com/nlcsphze","http://diveupdown.com/aa","http://diveupdown.com/aaa","http://diveupdown.com/hlsxaifp","http://diveupdown.com/yhmrmmgc")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND Message NOT NULL AND Message IN ("http://adfhjadfbjadbfjkhad44jka.com/aa","http://adfhjadfbjadbfjkhad44jka.com/xxhhodrq","http://adfhjadfbjadbfjkhad44jka.com/zanmjtvh","http://nextroundst.com/aa","http://nextroundst.com/ffcxlohx","http://nextroundst.com/nlcsphze","http://diveupdown.com/aa","http://diveupdown.com/aaa","http://diveupdown.com/hlsxaifp","http://diveupdown.com/yhmrmmgc")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND Requestcontext NOT NULL AND Requestcontext IN ("http://adfhjadfbjadbfjkhad44jka.com/aa","http://adfhjadfbjadbfjkhad44jka.com/xxhhodrq","http://adfhjadfbjadbfjkhad44jka.com/zanmjtvh","http://nextroundst.com/aa","http://nextroundst.com/ffcxlohx","http://nextroundst.com/nlcsphze","http://diveupdown.com/aa","http://diveupdown.com/aaa","http://diveupdown.com/hlsxaifp","http://diveupdown.com/yhmrmmgc")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("http://adfhjadfbjadbfjkhad44jka.com/aa","http://adfhjadfbjadbfjkhad44jka.com/xxhhodrq","http://adfhjadfbjadbfjkhad44jka.com/zanmjtvh","http://nextroundst.com/aa","http://nextroundst.com/ffcxlohx","http://nextroundst.com/nlcsphze","http://diveupdown.com/aa","http://diveupdown.com/aaa","http://diveupdown.com/hlsxaifp","http://diveupdown.com/yhmrmmgc")
index=activity AND rg_functionality="Web Application Firewall" AND requesturl NOT NULL AND requesturl IN ("http://adfhjadfbjadbfjkhad44jka.com/aa","http://adfhjadfbjadbfjkhad44jka.com/xxhhodrq","http://adfhjadfbjadbfjkhad44jka.com/zanmjtvh","http://nextroundst.com/aa","http://nextroundst.com/ffcxlohx","http://nextroundst.com/nlcsphze","http://diveupdown.com/aa","http://diveupdown.com/aaa","http://diveupdown.com/hlsxaifp","http://diveupdown.com/yhmrmmgc")
index=activity AND rg_functionality="Web Application Firewall" AND Message NOT NULL AND Message IN ("http://adfhjadfbjadbfjkhad44jka.com/aa","http://adfhjadfbjadbfjkhad44jka.com/xxhhodrq","http://adfhjadfbjadbfjkhad44jka.com/zanmjtvh","http://nextroundst.com/aa","http://nextroundst.com/ffcxlohx","http://nextroundst.com/nlcsphze","http://diveupdown.com/aa","http://diveupdown.com/aaa","http://diveupdown.com/hlsxaifp","http://diveupdown.com/yhmrmmgc")
index=activity AND rg_functionality="Web Application Firewall" AND Requestcontext NOT NULL AND Requestcontext IN ("http://adfhjadfbjadbfjkhad44jka.com/aa","http://adfhjadfbjadbfjkhad44jka.com/xxhhodrq","http://adfhjadfbjadbfjkhad44jka.com/zanmjtvh","http://nextroundst.com/aa","http://nextroundst.com/ffcxlohx","http://nextroundst.com/nlcsphze","http://diveupdown.com/aa","http://diveupdown.com/aaa","http://diveupdown.com/hlsxaifp","http://diveupdown.com/yhmrmmgc")
index=activity AND rg_functionality="Web Application Firewall" AND customstring3 NOT NULL AND customstring3 IN ("http://adfhjadfbjadbfjkhad44jka.com/aa","http://adfhjadfbjadbfjkhad44jka.com/xxhhodrq","http://adfhjadfbjadbfjkhad44jka.com/zanmjtvh","http://nextroundst.com/aa","http://nextroundst.com/ffcxlohx","http://nextroundst.com/nlcsphze","http://diveupdown.com/aa","http://diveupdown.com/aaa","http://diveupdown.com/hlsxaifp","http://diveupdown.com/yhmrmmgc")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND requesturl NOT NULL AND requesturl IN ("http://adfhjadfbjadbfjkhad44jka.com/aa","http://adfhjadfbjadbfjkhad44jka.com/xxhhodrq","http://adfhjadfbjadbfjkhad44jka.com/zanmjtvh","http://nextroundst.com/aa","http://nextroundst.com/ffcxlohx","http://nextroundst.com/nlcsphze","http://diveupdown.com/aa","http://diveupdown.com/aaa","http://diveupdown.com/hlsxaifp","http://diveupdown.com/yhmrmmgc")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND Message NOT NULL AND Message IN ("http://adfhjadfbjadbfjkhad44jka.com/aa","http://adfhjadfbjadbfjkhad44jka.com/xxhhodrq","http://adfhjadfbjadbfjkhad44jka.com/zanmjtvh","http://nextroundst.com/aa","http://nextroundst.com/ffcxlohx","http://nextroundst.com/nlcsphze","http://diveupdown.com/aa","http://diveupdown.com/aaa","http://diveupdown.com/hlsxaifp","http://diveupdown.com/yhmrmmgc")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND Requestcontext NOT NULL AND Requestcontext IN ("http://adfhjadfbjadbfjkhad44jka.com/aa","http://adfhjadfbjadbfjkhad44jka.com/xxhhodrq","http://adfhjadfbjadbfjkhad44jka.com/zanmjtvh","http://nextroundst.com/aa","http://nextroundst.com/ffcxlohx","http://nextroundst.com/nlcsphze","http://diveupdown.com/aa","http://diveupdown.com/aaa","http://diveupdown.com/hlsxaifp","http://diveupdown.com/yhmrmmgc")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND customstring3 NOT NULL AND customstring3 IN ("http://adfhjadfbjadbfjkhad44jka.com/aa","http://adfhjadfbjadbfjkhad44jka.com/xxhhodrq","http://adfhjadfbjadbfjkhad44jka.com/zanmjtvh","http://nextroundst.com/aa","http://nextroundst.com/ffcxlohx","http://nextroundst.com/nlcsphze","http://diveupdown.com/aa","http://diveupdown.com/aaa","http://diveupdown.com/hlsxaifp","http://diveupdown.com/yhmrmmgc")
