index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("48e75d6e2bdb2b00ecbf4801a98f96732e397858","ec8b6a0a7a7407ca3cd18de5f93489166996116c","3f8ef8649e6b9162cfb0c739f01043a19e9538e7","f6517b68f8317504fdcd415653cf46530e19d94a","01c0d61bfb4c8269ca56e0f1f666cbf36abe69ad","2e3e1b95e22e4a8f4c75334ba5fc30d6a54c34c1","7c8724b75bf7a9b8f27f5e86aac9445aafccb6ac","5f5d3a86437082fa512b5c93a6b4e39397e1adc8","7c5b2cafaeabbceb9765d20c6a323a07fa928624","ba1a54f4ffa42765232ba094aaafaee5d3bb2b8c","6f049d8a0723df10144cb51a43ce15147634fafe","8feca3f5143d15437025777285d8e2e3aa9d6caa","380bd7eda453487cf11509d548ef5e5a666acd95")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("48e75d6e2bdb2b00ecbf4801a98f96732e397858","ec8b6a0a7a7407ca3cd18de5f93489166996116c","3f8ef8649e6b9162cfb0c739f01043a19e9538e7","f6517b68f8317504fdcd415653cf46530e19d94a","01c0d61bfb4c8269ca56e0f1f666cbf36abe69ad","2e3e1b95e22e4a8f4c75334ba5fc30d6a54c34c1","7c8724b75bf7a9b8f27f5e86aac9445aafccb6ac","5f5d3a86437082fa512b5c93a6b4e39397e1adc8","7c5b2cafaeabbceb9765d20c6a323a07fa928624","ba1a54f4ffa42765232ba094aaafaee5d3bb2b8c","6f049d8a0723df10144cb51a43ce15147634fafe","8feca3f5143d15437025777285d8e2e3aa9d6caa","380bd7eda453487cf11509d548ef5e5a666acd95")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("48e75d6e2bdb2b00ecbf4801a98f96732e397858","ec8b6a0a7a7407ca3cd18de5f93489166996116c","3f8ef8649e6b9162cfb0c739f01043a19e9538e7","f6517b68f8317504fdcd415653cf46530e19d94a","01c0d61bfb4c8269ca56e0f1f666cbf36abe69ad","2e3e1b95e22e4a8f4c75334ba5fc30d6a54c34c1","7c8724b75bf7a9b8f27f5e86aac9445aafccb6ac","5f5d3a86437082fa512b5c93a6b4e39397e1adc8","7c5b2cafaeabbceb9765d20c6a323a07fa928624","ba1a54f4ffa42765232ba094aaafaee5d3bb2b8c","6f049d8a0723df10144cb51a43ce15147634fafe","8feca3f5143d15437025777285d8e2e3aa9d6caa","380bd7eda453487cf11509d548ef5e5a666acd95")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring64 NOT NULL AND customstring64 IN ("48e75d6e2bdb2b00ecbf4801a98f96732e397858","ec8b6a0a7a7407ca3cd18de5f93489166996116c","3f8ef8649e6b9162cfb0c739f01043a19e9538e7","f6517b68f8317504fdcd415653cf46530e19d94a","01c0d61bfb4c8269ca56e0f1f666cbf36abe69ad","2e3e1b95e22e4a8f4c75334ba5fc30d6a54c34c1","7c8724b75bf7a9b8f27f5e86aac9445aafccb6ac","5f5d3a86437082fa512b5c93a6b4e39397e1adc8","7c5b2cafaeabbceb9765d20c6a323a07fa928624","ba1a54f4ffa42765232ba094aaafaee5d3bb2b8c","6f049d8a0723df10144cb51a43ce15147634fafe","8feca3f5143d15437025777285d8e2e3aa9d6caa","380bd7eda453487cf11509d548ef5e5a666acd95")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("48e75d6e2bdb2b00ecbf4801a98f96732e397858","ec8b6a0a7a7407ca3cd18de5f93489166996116c","3f8ef8649e6b9162cfb0c739f01043a19e9538e7","f6517b68f8317504fdcd415653cf46530e19d94a","01c0d61bfb4c8269ca56e0f1f666cbf36abe69ad","2e3e1b95e22e4a8f4c75334ba5fc30d6a54c34c1","7c8724b75bf7a9b8f27f5e86aac9445aafccb6ac","5f5d3a86437082fa512b5c93a6b4e39397e1adc8","7c5b2cafaeabbceb9765d20c6a323a07fa928624","ba1a54f4ffa42765232ba094aaafaee5d3bb2b8c","6f049d8a0723df10144cb51a43ce15147634fafe","8feca3f5143d15437025777285d8e2e3aa9d6caa","380bd7eda453487cf11509d548ef5e5a666acd95")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("48e75d6e2bdb2b00ecbf4801a98f96732e397858","ec8b6a0a7a7407ca3cd18de5f93489166996116c","3f8ef8649e6b9162cfb0c739f01043a19e9538e7","f6517b68f8317504fdcd415653cf46530e19d94a","01c0d61bfb4c8269ca56e0f1f666cbf36abe69ad","2e3e1b95e22e4a8f4c75334ba5fc30d6a54c34c1","7c8724b75bf7a9b8f27f5e86aac9445aafccb6ac","5f5d3a86437082fa512b5c93a6b4e39397e1adc8","7c5b2cafaeabbceb9765d20c6a323a07fa928624","ba1a54f4ffa42765232ba094aaafaee5d3bb2b8c","6f049d8a0723df10144cb51a43ce15147634fafe","8feca3f5143d15437025777285d8e2e3aa9d6caa","380bd7eda453487cf11509d548ef5e5a666acd95")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("48e75d6e2bdb2b00ecbf4801a98f96732e397858","ec8b6a0a7a7407ca3cd18de5f93489166996116c","3f8ef8649e6b9162cfb0c739f01043a19e9538e7","f6517b68f8317504fdcd415653cf46530e19d94a","01c0d61bfb4c8269ca56e0f1f666cbf36abe69ad","2e3e1b95e22e4a8f4c75334ba5fc30d6a54c34c1","7c8724b75bf7a9b8f27f5e86aac9445aafccb6ac","5f5d3a86437082fa512b5c93a6b4e39397e1adc8","7c5b2cafaeabbceb9765d20c6a323a07fa928624","ba1a54f4ffa42765232ba094aaafaee5d3bb2b8c","6f049d8a0723df10144cb51a43ce15147634fafe","8feca3f5143d15437025777285d8e2e3aa9d6caa","380bd7eda453487cf11509d548ef5e5a666acd95")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("48e75d6e2bdb2b00ecbf4801a98f96732e397858","ec8b6a0a7a7407ca3cd18de5f93489166996116c","3f8ef8649e6b9162cfb0c739f01043a19e9538e7","f6517b68f8317504fdcd415653cf46530e19d94a","01c0d61bfb4c8269ca56e0f1f666cbf36abe69ad","2e3e1b95e22e4a8f4c75334ba5fc30d6a54c34c1","7c8724b75bf7a9b8f27f5e86aac9445aafccb6ac","5f5d3a86437082fa512b5c93a6b4e39397e1adc8","7c5b2cafaeabbceb9765d20c6a323a07fa928624","ba1a54f4ffa42765232ba094aaafaee5d3bb2b8c","6f049d8a0723df10144cb51a43ce15147634fafe","8feca3f5143d15437025777285d8e2e3aa9d6caa","380bd7eda453487cf11509d548ef5e5a666acd95")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("48e75d6e2bdb2b00ecbf4801a98f96732e397858","ec8b6a0a7a7407ca3cd18de5f93489166996116c","3f8ef8649e6b9162cfb0c739f01043a19e9538e7","f6517b68f8317504fdcd415653cf46530e19d94a","01c0d61bfb4c8269ca56e0f1f666cbf36abe69ad","2e3e1b95e22e4a8f4c75334ba5fc30d6a54c34c1","7c8724b75bf7a9b8f27f5e86aac9445aafccb6ac","5f5d3a86437082fa512b5c93a6b4e39397e1adc8","7c5b2cafaeabbceb9765d20c6a323a07fa928624","ba1a54f4ffa42765232ba094aaafaee5d3bb2b8c","6f049d8a0723df10144cb51a43ce15147634fafe","8feca3f5143d15437025777285d8e2e3aa9d6caa","380bd7eda453487cf11509d548ef5e5a666acd95")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("48e75d6e2bdb2b00ecbf4801a98f96732e397858","ec8b6a0a7a7407ca3cd18de5f93489166996116c","3f8ef8649e6b9162cfb0c739f01043a19e9538e7","f6517b68f8317504fdcd415653cf46530e19d94a","01c0d61bfb4c8269ca56e0f1f666cbf36abe69ad","2e3e1b95e22e4a8f4c75334ba5fc30d6a54c34c1","7c8724b75bf7a9b8f27f5e86aac9445aafccb6ac","5f5d3a86437082fa512b5c93a6b4e39397e1adc8","7c5b2cafaeabbceb9765d20c6a323a07fa928624","ba1a54f4ffa42765232ba094aaafaee5d3bb2b8c","6f049d8a0723df10144cb51a43ce15147634fafe","8feca3f5143d15437025777285d8e2e3aa9d6caa","380bd7eda453487cf11509d548ef5e5a666acd95")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("48e75d6e2bdb2b00ecbf4801a98f96732e397858","ec8b6a0a7a7407ca3cd18de5f93489166996116c","3f8ef8649e6b9162cfb0c739f01043a19e9538e7","f6517b68f8317504fdcd415653cf46530e19d94a","01c0d61bfb4c8269ca56e0f1f666cbf36abe69ad","2e3e1b95e22e4a8f4c75334ba5fc30d6a54c34c1","7c8724b75bf7a9b8f27f5e86aac9445aafccb6ac","5f5d3a86437082fa512b5c93a6b4e39397e1adc8","7c5b2cafaeabbceb9765d20c6a323a07fa928624","ba1a54f4ffa42765232ba094aaafaee5d3bb2b8c","6f049d8a0723df10144cb51a43ce15147634fafe","8feca3f5143d15437025777285d8e2e3aa9d6caa","380bd7eda453487cf11509d548ef5e5a666acd95")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("48e75d6e2bdb2b00ecbf4801a98f96732e397858","ec8b6a0a7a7407ca3cd18de5f93489166996116c","3f8ef8649e6b9162cfb0c739f01043a19e9538e7","f6517b68f8317504fdcd415653cf46530e19d94a","01c0d61bfb4c8269ca56e0f1f666cbf36abe69ad","2e3e1b95e22e4a8f4c75334ba5fc30d6a54c34c1","7c8724b75bf7a9b8f27f5e86aac9445aafccb6ac","5f5d3a86437082fa512b5c93a6b4e39397e1adc8","7c5b2cafaeabbceb9765d20c6a323a07fa928624","ba1a54f4ffa42765232ba094aaafaee5d3bb2b8c","6f049d8a0723df10144cb51a43ce15147634fafe","8feca3f5143d15437025777285d8e2e3aa9d6caa","380bd7eda453487cf11509d548ef5e5a666acd95")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("48e75d6e2bdb2b00ecbf4801a98f96732e397858","ec8b6a0a7a7407ca3cd18de5f93489166996116c","3f8ef8649e6b9162cfb0c739f01043a19e9538e7","f6517b68f8317504fdcd415653cf46530e19d94a","01c0d61bfb4c8269ca56e0f1f666cbf36abe69ad","2e3e1b95e22e4a8f4c75334ba5fc30d6a54c34c1","7c8724b75bf7a9b8f27f5e86aac9445aafccb6ac","5f5d3a86437082fa512b5c93a6b4e39397e1adc8","7c5b2cafaeabbceb9765d20c6a323a07fa928624","ba1a54f4ffa42765232ba094aaafaee5d3bb2b8c","6f049d8a0723df10144cb51a43ce15147634fafe","8feca3f5143d15437025777285d8e2e3aa9d6caa","380bd7eda453487cf11509d548ef5e5a666acd95")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("48e75d6e2bdb2b00ecbf4801a98f96732e397858","ec8b6a0a7a7407ca3cd18de5f93489166996116c","3f8ef8649e6b9162cfb0c739f01043a19e9538e7","f6517b68f8317504fdcd415653cf46530e19d94a","01c0d61bfb4c8269ca56e0f1f666cbf36abe69ad","2e3e1b95e22e4a8f4c75334ba5fc30d6a54c34c1","7c8724b75bf7a9b8f27f5e86aac9445aafccb6ac","5f5d3a86437082fa512b5c93a6b4e39397e1adc8","7c5b2cafaeabbceb9765d20c6a323a07fa928624","ba1a54f4ffa42765232ba094aaafaee5d3bb2b8c","6f049d8a0723df10144cb51a43ce15147634fafe","8feca3f5143d15437025777285d8e2e3aa9d6caa","380bd7eda453487cf11509d548ef5e5a666acd95")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("48e75d6e2bdb2b00ecbf4801a98f96732e397858","ec8b6a0a7a7407ca3cd18de5f93489166996116c","3f8ef8649e6b9162cfb0c739f01043a19e9538e7","f6517b68f8317504fdcd415653cf46530e19d94a","01c0d61bfb4c8269ca56e0f1f666cbf36abe69ad","2e3e1b95e22e4a8f4c75334ba5fc30d6a54c34c1","7c8724b75bf7a9b8f27f5e86aac9445aafccb6ac","5f5d3a86437082fa512b5c93a6b4e39397e1adc8","7c5b2cafaeabbceb9765d20c6a323a07fa928624","ba1a54f4ffa42765232ba094aaafaee5d3bb2b8c","6f049d8a0723df10144cb51a43ce15147634fafe","8feca3f5143d15437025777285d8e2e3aa9d6caa","380bd7eda453487cf11509d548ef5e5a666acd95")
index=activity AND rg_functionality="Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("48e75d6e2bdb2b00ecbf4801a98f96732e397858","ec8b6a0a7a7407ca3cd18de5f93489166996116c","3f8ef8649e6b9162cfb0c739f01043a19e9538e7","f6517b68f8317504fdcd415653cf46530e19d94a","01c0d61bfb4c8269ca56e0f1f666cbf36abe69ad","2e3e1b95e22e4a8f4c75334ba5fc30d6a54c34c1","7c8724b75bf7a9b8f27f5e86aac9445aafccb6ac","5f5d3a86437082fa512b5c93a6b4e39397e1adc8","7c5b2cafaeabbceb9765d20c6a323a07fa928624","ba1a54f4ffa42765232ba094aaafaee5d3bb2b8c","6f049d8a0723df10144cb51a43ce15147634fafe","8feca3f5143d15437025777285d8e2e3aa9d6caa","380bd7eda453487cf11509d548ef5e5a666acd95")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("48e75d6e2bdb2b00ecbf4801a98f96732e397858","ec8b6a0a7a7407ca3cd18de5f93489166996116c","3f8ef8649e6b9162cfb0c739f01043a19e9538e7","f6517b68f8317504fdcd415653cf46530e19d94a","01c0d61bfb4c8269ca56e0f1f666cbf36abe69ad","2e3e1b95e22e4a8f4c75334ba5fc30d6a54c34c1","7c8724b75bf7a9b8f27f5e86aac9445aafccb6ac","5f5d3a86437082fa512b5c93a6b4e39397e1adc8","7c5b2cafaeabbceb9765d20c6a323a07fa928624","ba1a54f4ffa42765232ba094aaafaee5d3bb2b8c","6f049d8a0723df10144cb51a43ce15147634fafe","8feca3f5143d15437025777285d8e2e3aa9d6caa","380bd7eda453487cf11509d548ef5e5a666acd95")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("48e75d6e2bdb2b00ecbf4801a98f96732e397858","ec8b6a0a7a7407ca3cd18de5f93489166996116c","3f8ef8649e6b9162cfb0c739f01043a19e9538e7","f6517b68f8317504fdcd415653cf46530e19d94a","01c0d61bfb4c8269ca56e0f1f666cbf36abe69ad","2e3e1b95e22e4a8f4c75334ba5fc30d6a54c34c1","7c8724b75bf7a9b8f27f5e86aac9445aafccb6ac","5f5d3a86437082fa512b5c93a6b4e39397e1adc8","7c5b2cafaeabbceb9765d20c6a323a07fa928624","ba1a54f4ffa42765232ba094aaafaee5d3bb2b8c","6f049d8a0723df10144cb51a43ce15147634fafe","8feca3f5143d15437025777285d8e2e3aa9d6caa","380bd7eda453487cf11509d548ef5e5a666acd95")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("48e75d6e2bdb2b00ecbf4801a98f96732e397858","ec8b6a0a7a7407ca3cd18de5f93489166996116c","3f8ef8649e6b9162cfb0c739f01043a19e9538e7","f6517b68f8317504fdcd415653cf46530e19d94a","01c0d61bfb4c8269ca56e0f1f666cbf36abe69ad","2e3e1b95e22e4a8f4c75334ba5fc30d6a54c34c1","7c8724b75bf7a9b8f27f5e86aac9445aafccb6ac","5f5d3a86437082fa512b5c93a6b4e39397e1adc8","7c5b2cafaeabbceb9765d20c6a323a07fa928624","ba1a54f4ffa42765232ba094aaafaee5d3bb2b8c","6f049d8a0723df10144cb51a43ce15147634fafe","8feca3f5143d15437025777285d8e2e3aa9d6caa","380bd7eda453487cf11509d548ef5e5a666acd95")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("48e75d6e2bdb2b00ecbf4801a98f96732e397858","ec8b6a0a7a7407ca3cd18de5f93489166996116c","3f8ef8649e6b9162cfb0c739f01043a19e9538e7","f6517b68f8317504fdcd415653cf46530e19d94a","01c0d61bfb4c8269ca56e0f1f666cbf36abe69ad","2e3e1b95e22e4a8f4c75334ba5fc30d6a54c34c1","7c8724b75bf7a9b8f27f5e86aac9445aafccb6ac","5f5d3a86437082fa512b5c93a6b4e39397e1adc8","7c5b2cafaeabbceb9765d20c6a323a07fa928624","ba1a54f4ffa42765232ba094aaafaee5d3bb2b8c","6f049d8a0723df10144cb51a43ce15147634fafe","8feca3f5143d15437025777285d8e2e3aa9d6caa","380bd7eda453487cf11509d548ef5e5a666acd95")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("48e75d6e2bdb2b00ecbf4801a98f96732e397858","ec8b6a0a7a7407ca3cd18de5f93489166996116c","3f8ef8649e6b9162cfb0c739f01043a19e9538e7","f6517b68f8317504fdcd415653cf46530e19d94a","01c0d61bfb4c8269ca56e0f1f666cbf36abe69ad","2e3e1b95e22e4a8f4c75334ba5fc30d6a54c34c1","7c8724b75bf7a9b8f27f5e86aac9445aafccb6ac","5f5d3a86437082fa512b5c93a6b4e39397e1adc8","7c5b2cafaeabbceb9765d20c6a323a07fa928624","ba1a54f4ffa42765232ba094aaafaee5d3bb2b8c","6f049d8a0723df10144cb51a43ce15147634fafe","8feca3f5143d15437025777285d8e2e3aa9d6caa","380bd7eda453487cf11509d548ef5e5a666acd95")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("48e75d6e2bdb2b00ecbf4801a98f96732e397858","ec8b6a0a7a7407ca3cd18de5f93489166996116c","3f8ef8649e6b9162cfb0c739f01043a19e9538e7","f6517b68f8317504fdcd415653cf46530e19d94a","01c0d61bfb4c8269ca56e0f1f666cbf36abe69ad","2e3e1b95e22e4a8f4c75334ba5fc30d6a54c34c1","7c8724b75bf7a9b8f27f5e86aac9445aafccb6ac","5f5d3a86437082fa512b5c93a6b4e39397e1adc8","7c5b2cafaeabbceb9765d20c6a323a07fa928624","ba1a54f4ffa42765232ba094aaafaee5d3bb2b8c","6f049d8a0723df10144cb51a43ce15147634fafe","8feca3f5143d15437025777285d8e2e3aa9d6caa","380bd7eda453487cf11509d548ef5e5a666acd95")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("48e75d6e2bdb2b00ecbf4801a98f96732e397858","ec8b6a0a7a7407ca3cd18de5f93489166996116c","3f8ef8649e6b9162cfb0c739f01043a19e9538e7","f6517b68f8317504fdcd415653cf46530e19d94a","01c0d61bfb4c8269ca56e0f1f666cbf36abe69ad","2e3e1b95e22e4a8f4c75334ba5fc30d6a54c34c1","7c8724b75bf7a9b8f27f5e86aac9445aafccb6ac","5f5d3a86437082fa512b5c93a6b4e39397e1adc8","7c5b2cafaeabbceb9765d20c6a323a07fa928624","ba1a54f4ffa42765232ba094aaafaee5d3bb2b8c","6f049d8a0723df10144cb51a43ce15147634fafe","8feca3f5143d15437025777285d8e2e3aa9d6caa","380bd7eda453487cf11509d548ef5e5a666acd95")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring64 NOT NULL AND customstring64 IN ("48e75d6e2bdb2b00ecbf4801a98f96732e397858","ec8b6a0a7a7407ca3cd18de5f93489166996116c","3f8ef8649e6b9162cfb0c739f01043a19e9538e7","f6517b68f8317504fdcd415653cf46530e19d94a","01c0d61bfb4c8269ca56e0f1f666cbf36abe69ad","2e3e1b95e22e4a8f4c75334ba5fc30d6a54c34c1","7c8724b75bf7a9b8f27f5e86aac9445aafccb6ac","5f5d3a86437082fa512b5c93a6b4e39397e1adc8","7c5b2cafaeabbceb9765d20c6a323a07fa928624","ba1a54f4ffa42765232ba094aaafaee5d3bb2b8c","6f049d8a0723df10144cb51a43ce15147634fafe","8feca3f5143d15437025777285d8e2e3aa9d6caa","380bd7eda453487cf11509d548ef5e5a666acd95")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("48e75d6e2bdb2b00ecbf4801a98f96732e397858","ec8b6a0a7a7407ca3cd18de5f93489166996116c","3f8ef8649e6b9162cfb0c739f01043a19e9538e7","f6517b68f8317504fdcd415653cf46530e19d94a","01c0d61bfb4c8269ca56e0f1f666cbf36abe69ad","2e3e1b95e22e4a8f4c75334ba5fc30d6a54c34c1","7c8724b75bf7a9b8f27f5e86aac9445aafccb6ac","5f5d3a86437082fa512b5c93a6b4e39397e1adc8","7c5b2cafaeabbceb9765d20c6a323a07fa928624","ba1a54f4ffa42765232ba094aaafaee5d3bb2b8c","6f049d8a0723df10144cb51a43ce15147634fafe","8feca3f5143d15437025777285d8e2e3aa9d6caa","380bd7eda453487cf11509d548ef5e5a666acd95")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("48e75d6e2bdb2b00ecbf4801a98f96732e397858","ec8b6a0a7a7407ca3cd18de5f93489166996116c","3f8ef8649e6b9162cfb0c739f01043a19e9538e7","f6517b68f8317504fdcd415653cf46530e19d94a","01c0d61bfb4c8269ca56e0f1f666cbf36abe69ad","2e3e1b95e22e4a8f4c75334ba5fc30d6a54c34c1","7c8724b75bf7a9b8f27f5e86aac9445aafccb6ac","5f5d3a86437082fa512b5c93a6b4e39397e1adc8","7c5b2cafaeabbceb9765d20c6a323a07fa928624","ba1a54f4ffa42765232ba094aaafaee5d3bb2b8c","6f049d8a0723df10144cb51a43ce15147634fafe","8feca3f5143d15437025777285d8e2e3aa9d6caa","380bd7eda453487cf11509d548ef5e5a666acd95")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("48e75d6e2bdb2b00ecbf4801a98f96732e397858","ec8b6a0a7a7407ca3cd18de5f93489166996116c","3f8ef8649e6b9162cfb0c739f01043a19e9538e7","f6517b68f8317504fdcd415653cf46530e19d94a","01c0d61bfb4c8269ca56e0f1f666cbf36abe69ad","2e3e1b95e22e4a8f4c75334ba5fc30d6a54c34c1","7c8724b75bf7a9b8f27f5e86aac9445aafccb6ac","5f5d3a86437082fa512b5c93a6b4e39397e1adc8","7c5b2cafaeabbceb9765d20c6a323a07fa928624","ba1a54f4ffa42765232ba094aaafaee5d3bb2b8c","6f049d8a0723df10144cb51a43ce15147634fafe","8feca3f5143d15437025777285d8e2e3aa9d6caa","380bd7eda453487cf11509d548ef5e5a666acd95")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring64 NOT NULL AND customstring64 IN ("48e75d6e2bdb2b00ecbf4801a98f96732e397858","ec8b6a0a7a7407ca3cd18de5f93489166996116c","3f8ef8649e6b9162cfb0c739f01043a19e9538e7","f6517b68f8317504fdcd415653cf46530e19d94a","01c0d61bfb4c8269ca56e0f1f666cbf36abe69ad","2e3e1b95e22e4a8f4c75334ba5fc30d6a54c34c1","7c8724b75bf7a9b8f27f5e86aac9445aafccb6ac","5f5d3a86437082fa512b5c93a6b4e39397e1adc8","7c5b2cafaeabbceb9765d20c6a323a07fa928624","ba1a54f4ffa42765232ba094aaafaee5d3bb2b8c","6f049d8a0723df10144cb51a43ce15147634fafe","8feca3f5143d15437025777285d8e2e3aa9d6caa","380bd7eda453487cf11509d548ef5e5a666acd95")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("48e75d6e2bdb2b00ecbf4801a98f96732e397858","ec8b6a0a7a7407ca3cd18de5f93489166996116c","3f8ef8649e6b9162cfb0c739f01043a19e9538e7","f6517b68f8317504fdcd415653cf46530e19d94a","01c0d61bfb4c8269ca56e0f1f666cbf36abe69ad","2e3e1b95e22e4a8f4c75334ba5fc30d6a54c34c1","7c8724b75bf7a9b8f27f5e86aac9445aafccb6ac","5f5d3a86437082fa512b5c93a6b4e39397e1adc8","7c5b2cafaeabbceb9765d20c6a323a07fa928624","ba1a54f4ffa42765232ba094aaafaee5d3bb2b8c","6f049d8a0723df10144cb51a43ce15147634fafe","8feca3f5143d15437025777285d8e2e3aa9d6caa","380bd7eda453487cf11509d548ef5e5a666acd95")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("48e75d6e2bdb2b00ecbf4801a98f96732e397858","ec8b6a0a7a7407ca3cd18de5f93489166996116c","3f8ef8649e6b9162cfb0c739f01043a19e9538e7","f6517b68f8317504fdcd415653cf46530e19d94a","01c0d61bfb4c8269ca56e0f1f666cbf36abe69ad","2e3e1b95e22e4a8f4c75334ba5fc30d6a54c34c1","7c8724b75bf7a9b8f27f5e86aac9445aafccb6ac","5f5d3a86437082fa512b5c93a6b4e39397e1adc8","7c5b2cafaeabbceb9765d20c6a323a07fa928624","ba1a54f4ffa42765232ba094aaafaee5d3bb2b8c","6f049d8a0723df10144cb51a43ce15147634fafe","8feca3f5143d15437025777285d8e2e3aa9d6caa","380bd7eda453487cf11509d548ef5e5a666acd95")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("48e75d6e2bdb2b00ecbf4801a98f96732e397858","ec8b6a0a7a7407ca3cd18de5f93489166996116c","3f8ef8649e6b9162cfb0c739f01043a19e9538e7","f6517b68f8317504fdcd415653cf46530e19d94a","01c0d61bfb4c8269ca56e0f1f666cbf36abe69ad","2e3e1b95e22e4a8f4c75334ba5fc30d6a54c34c1","7c8724b75bf7a9b8f27f5e86aac9445aafccb6ac","5f5d3a86437082fa512b5c93a6b4e39397e1adc8","7c5b2cafaeabbceb9765d20c6a323a07fa928624","ba1a54f4ffa42765232ba094aaafaee5d3bb2b8c","6f049d8a0723df10144cb51a43ce15147634fafe","8feca3f5143d15437025777285d8e2e3aa9d6caa","380bd7eda453487cf11509d548ef5e5a666acd95")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring64 NOT NULL AND customstring64 IN ("48e75d6e2bdb2b00ecbf4801a98f96732e397858","ec8b6a0a7a7407ca3cd18de5f93489166996116c","3f8ef8649e6b9162cfb0c739f01043a19e9538e7","f6517b68f8317504fdcd415653cf46530e19d94a","01c0d61bfb4c8269ca56e0f1f666cbf36abe69ad","2e3e1b95e22e4a8f4c75334ba5fc30d6a54c34c1","7c8724b75bf7a9b8f27f5e86aac9445aafccb6ac","5f5d3a86437082fa512b5c93a6b4e39397e1adc8","7c5b2cafaeabbceb9765d20c6a323a07fa928624","ba1a54f4ffa42765232ba094aaafaee5d3bb2b8c","6f049d8a0723df10144cb51a43ce15147634fafe","8feca3f5143d15437025777285d8e2e3aa9d6caa","380bd7eda453487cf11509d548ef5e5a666acd95")
index=activity AND rg_functionality="O365 General" AND filehash NOT NULL AND filehash IN ("48e75d6e2bdb2b00ecbf4801a98f96732e397858","ec8b6a0a7a7407ca3cd18de5f93489166996116c","3f8ef8649e6b9162cfb0c739f01043a19e9538e7","f6517b68f8317504fdcd415653cf46530e19d94a","01c0d61bfb4c8269ca56e0f1f666cbf36abe69ad","2e3e1b95e22e4a8f4c75334ba5fc30d6a54c34c1","7c8724b75bf7a9b8f27f5e86aac9445aafccb6ac","5f5d3a86437082fa512b5c93a6b4e39397e1adc8","7c5b2cafaeabbceb9765d20c6a323a07fa928624","ba1a54f4ffa42765232ba094aaafaee5d3bb2b8c","6f049d8a0723df10144cb51a43ce15147634fafe","8feca3f5143d15437025777285d8e2e3aa9d6caa","380bd7eda453487cf11509d548ef5e5a666acd95")
index=activity AND rg_functionality="O365 General" AND oldfilehash NOT NULL AND oldfilehash IN ("48e75d6e2bdb2b00ecbf4801a98f96732e397858","ec8b6a0a7a7407ca3cd18de5f93489166996116c","3f8ef8649e6b9162cfb0c739f01043a19e9538e7","f6517b68f8317504fdcd415653cf46530e19d94a","01c0d61bfb4c8269ca56e0f1f666cbf36abe69ad","2e3e1b95e22e4a8f4c75334ba5fc30d6a54c34c1","7c8724b75bf7a9b8f27f5e86aac9445aafccb6ac","5f5d3a86437082fa512b5c93a6b4e39397e1adc8","7c5b2cafaeabbceb9765d20c6a323a07fa928624","ba1a54f4ffa42765232ba094aaafaee5d3bb2b8c","6f049d8a0723df10144cb51a43ce15147634fafe","8feca3f5143d15437025777285d8e2e3aa9d6caa","380bd7eda453487cf11509d548ef5e5a666acd95")
index=activity AND rg_functionality="O365 General" AND customstring3 NOT NULL AND customstring3 IN ("48e75d6e2bdb2b00ecbf4801a98f96732e397858","ec8b6a0a7a7407ca3cd18de5f93489166996116c","3f8ef8649e6b9162cfb0c739f01043a19e9538e7","f6517b68f8317504fdcd415653cf46530e19d94a","01c0d61bfb4c8269ca56e0f1f666cbf36abe69ad","2e3e1b95e22e4a8f4c75334ba5fc30d6a54c34c1","7c8724b75bf7a9b8f27f5e86aac9445aafccb6ac","5f5d3a86437082fa512b5c93a6b4e39397e1adc8","7c5b2cafaeabbceb9765d20c6a323a07fa928624","ba1a54f4ffa42765232ba094aaafaee5d3bb2b8c","6f049d8a0723df10144cb51a43ce15147634fafe","8feca3f5143d15437025777285d8e2e3aa9d6caa","380bd7eda453487cf11509d548ef5e5a666acd95")
index=activity AND rg_functionality="O365 General" AND customstring64 NOT NULL AND customstring64 IN ("48e75d6e2bdb2b00ecbf4801a98f96732e397858","ec8b6a0a7a7407ca3cd18de5f93489166996116c","3f8ef8649e6b9162cfb0c739f01043a19e9538e7","f6517b68f8317504fdcd415653cf46530e19d94a","01c0d61bfb4c8269ca56e0f1f666cbf36abe69ad","2e3e1b95e22e4a8f4c75334ba5fc30d6a54c34c1","7c8724b75bf7a9b8f27f5e86aac9445aafccb6ac","5f5d3a86437082fa512b5c93a6b4e39397e1adc8","7c5b2cafaeabbceb9765d20c6a323a07fa928624","ba1a54f4ffa42765232ba094aaafaee5d3bb2b8c","6f049d8a0723df10144cb51a43ce15147634fafe","8feca3f5143d15437025777285d8e2e3aa9d6caa","380bd7eda453487cf11509d548ef5e5a666acd95")
