index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("226cbbf43d9bcedcc5ab69e51e5cce2f4ca841aa7ab39fdf974766203e2c9b66","5420a25fdd6cb6484ab3687c6bba750b40007730eb4232088b668eff0de2c072","12e630d6041eb7322901150079c0d0fdbd47b0098dc5cb0f2de23b6e8d5082e1","498d271d695e424bfd7f9ad1ead187ef0ac62fa8908c6e1f239db495371ff237")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("226cbbf43d9bcedcc5ab69e51e5cce2f4ca841aa7ab39fdf974766203e2c9b66","5420a25fdd6cb6484ab3687c6bba750b40007730eb4232088b668eff0de2c072","12e630d6041eb7322901150079c0d0fdbd47b0098dc5cb0f2de23b6e8d5082e1","498d271d695e424bfd7f9ad1ead187ef0ac62fa8908c6e1f239db495371ff237")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("226cbbf43d9bcedcc5ab69e51e5cce2f4ca841aa7ab39fdf974766203e2c9b66","5420a25fdd6cb6484ab3687c6bba750b40007730eb4232088b668eff0de2c072","12e630d6041eb7322901150079c0d0fdbd47b0098dc5cb0f2de23b6e8d5082e1","498d271d695e424bfd7f9ad1ead187ef0ac62fa8908c6e1f239db495371ff237")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring64 NOT NULL AND customstring64 IN ("226cbbf43d9bcedcc5ab69e51e5cce2f4ca841aa7ab39fdf974766203e2c9b66","5420a25fdd6cb6484ab3687c6bba750b40007730eb4232088b668eff0de2c072","12e630d6041eb7322901150079c0d0fdbd47b0098dc5cb0f2de23b6e8d5082e1","498d271d695e424bfd7f9ad1ead187ef0ac62fa8908c6e1f239db495371ff237")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("226cbbf43d9bcedcc5ab69e51e5cce2f4ca841aa7ab39fdf974766203e2c9b66","5420a25fdd6cb6484ab3687c6bba750b40007730eb4232088b668eff0de2c072","12e630d6041eb7322901150079c0d0fdbd47b0098dc5cb0f2de23b6e8d5082e1","498d271d695e424bfd7f9ad1ead187ef0ac62fa8908c6e1f239db495371ff237")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("226cbbf43d9bcedcc5ab69e51e5cce2f4ca841aa7ab39fdf974766203e2c9b66","5420a25fdd6cb6484ab3687c6bba750b40007730eb4232088b668eff0de2c072","12e630d6041eb7322901150079c0d0fdbd47b0098dc5cb0f2de23b6e8d5082e1","498d271d695e424bfd7f9ad1ead187ef0ac62fa8908c6e1f239db495371ff237")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("226cbbf43d9bcedcc5ab69e51e5cce2f4ca841aa7ab39fdf974766203e2c9b66","5420a25fdd6cb6484ab3687c6bba750b40007730eb4232088b668eff0de2c072","12e630d6041eb7322901150079c0d0fdbd47b0098dc5cb0f2de23b6e8d5082e1","498d271d695e424bfd7f9ad1ead187ef0ac62fa8908c6e1f239db495371ff237")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("226cbbf43d9bcedcc5ab69e51e5cce2f4ca841aa7ab39fdf974766203e2c9b66","5420a25fdd6cb6484ab3687c6bba750b40007730eb4232088b668eff0de2c072","12e630d6041eb7322901150079c0d0fdbd47b0098dc5cb0f2de23b6e8d5082e1","498d271d695e424bfd7f9ad1ead187ef0ac62fa8908c6e1f239db495371ff237")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("226cbbf43d9bcedcc5ab69e51e5cce2f4ca841aa7ab39fdf974766203e2c9b66","5420a25fdd6cb6484ab3687c6bba750b40007730eb4232088b668eff0de2c072","12e630d6041eb7322901150079c0d0fdbd47b0098dc5cb0f2de23b6e8d5082e1","498d271d695e424bfd7f9ad1ead187ef0ac62fa8908c6e1f239db495371ff237")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("226cbbf43d9bcedcc5ab69e51e5cce2f4ca841aa7ab39fdf974766203e2c9b66","5420a25fdd6cb6484ab3687c6bba750b40007730eb4232088b668eff0de2c072","12e630d6041eb7322901150079c0d0fdbd47b0098dc5cb0f2de23b6e8d5082e1","498d271d695e424bfd7f9ad1ead187ef0ac62fa8908c6e1f239db495371ff237")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("226cbbf43d9bcedcc5ab69e51e5cce2f4ca841aa7ab39fdf974766203e2c9b66","5420a25fdd6cb6484ab3687c6bba750b40007730eb4232088b668eff0de2c072","12e630d6041eb7322901150079c0d0fdbd47b0098dc5cb0f2de23b6e8d5082e1","498d271d695e424bfd7f9ad1ead187ef0ac62fa8908c6e1f239db495371ff237")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("226cbbf43d9bcedcc5ab69e51e5cce2f4ca841aa7ab39fdf974766203e2c9b66","5420a25fdd6cb6484ab3687c6bba750b40007730eb4232088b668eff0de2c072","12e630d6041eb7322901150079c0d0fdbd47b0098dc5cb0f2de23b6e8d5082e1","498d271d695e424bfd7f9ad1ead187ef0ac62fa8908c6e1f239db495371ff237")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("226cbbf43d9bcedcc5ab69e51e5cce2f4ca841aa7ab39fdf974766203e2c9b66","5420a25fdd6cb6484ab3687c6bba750b40007730eb4232088b668eff0de2c072","12e630d6041eb7322901150079c0d0fdbd47b0098dc5cb0f2de23b6e8d5082e1","498d271d695e424bfd7f9ad1ead187ef0ac62fa8908c6e1f239db495371ff237")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("226cbbf43d9bcedcc5ab69e51e5cce2f4ca841aa7ab39fdf974766203e2c9b66","5420a25fdd6cb6484ab3687c6bba750b40007730eb4232088b668eff0de2c072","12e630d6041eb7322901150079c0d0fdbd47b0098dc5cb0f2de23b6e8d5082e1","498d271d695e424bfd7f9ad1ead187ef0ac62fa8908c6e1f239db495371ff237")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("226cbbf43d9bcedcc5ab69e51e5cce2f4ca841aa7ab39fdf974766203e2c9b66","5420a25fdd6cb6484ab3687c6bba750b40007730eb4232088b668eff0de2c072","12e630d6041eb7322901150079c0d0fdbd47b0098dc5cb0f2de23b6e8d5082e1","498d271d695e424bfd7f9ad1ead187ef0ac62fa8908c6e1f239db495371ff237")
index=activity AND rg_functionality="Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("226cbbf43d9bcedcc5ab69e51e5cce2f4ca841aa7ab39fdf974766203e2c9b66","5420a25fdd6cb6484ab3687c6bba750b40007730eb4232088b668eff0de2c072","12e630d6041eb7322901150079c0d0fdbd47b0098dc5cb0f2de23b6e8d5082e1","498d271d695e424bfd7f9ad1ead187ef0ac62fa8908c6e1f239db495371ff237")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("226cbbf43d9bcedcc5ab69e51e5cce2f4ca841aa7ab39fdf974766203e2c9b66","5420a25fdd6cb6484ab3687c6bba750b40007730eb4232088b668eff0de2c072","12e630d6041eb7322901150079c0d0fdbd47b0098dc5cb0f2de23b6e8d5082e1","498d271d695e424bfd7f9ad1ead187ef0ac62fa8908c6e1f239db495371ff237")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("226cbbf43d9bcedcc5ab69e51e5cce2f4ca841aa7ab39fdf974766203e2c9b66","5420a25fdd6cb6484ab3687c6bba750b40007730eb4232088b668eff0de2c072","12e630d6041eb7322901150079c0d0fdbd47b0098dc5cb0f2de23b6e8d5082e1","498d271d695e424bfd7f9ad1ead187ef0ac62fa8908c6e1f239db495371ff237")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("226cbbf43d9bcedcc5ab69e51e5cce2f4ca841aa7ab39fdf974766203e2c9b66","5420a25fdd6cb6484ab3687c6bba750b40007730eb4232088b668eff0de2c072","12e630d6041eb7322901150079c0d0fdbd47b0098dc5cb0f2de23b6e8d5082e1","498d271d695e424bfd7f9ad1ead187ef0ac62fa8908c6e1f239db495371ff237")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("226cbbf43d9bcedcc5ab69e51e5cce2f4ca841aa7ab39fdf974766203e2c9b66","5420a25fdd6cb6484ab3687c6bba750b40007730eb4232088b668eff0de2c072","12e630d6041eb7322901150079c0d0fdbd47b0098dc5cb0f2de23b6e8d5082e1","498d271d695e424bfd7f9ad1ead187ef0ac62fa8908c6e1f239db495371ff237")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("226cbbf43d9bcedcc5ab69e51e5cce2f4ca841aa7ab39fdf974766203e2c9b66","5420a25fdd6cb6484ab3687c6bba750b40007730eb4232088b668eff0de2c072","12e630d6041eb7322901150079c0d0fdbd47b0098dc5cb0f2de23b6e8d5082e1","498d271d695e424bfd7f9ad1ead187ef0ac62fa8908c6e1f239db495371ff237")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("226cbbf43d9bcedcc5ab69e51e5cce2f4ca841aa7ab39fdf974766203e2c9b66","5420a25fdd6cb6484ab3687c6bba750b40007730eb4232088b668eff0de2c072","12e630d6041eb7322901150079c0d0fdbd47b0098dc5cb0f2de23b6e8d5082e1","498d271d695e424bfd7f9ad1ead187ef0ac62fa8908c6e1f239db495371ff237")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("226cbbf43d9bcedcc5ab69e51e5cce2f4ca841aa7ab39fdf974766203e2c9b66","5420a25fdd6cb6484ab3687c6bba750b40007730eb4232088b668eff0de2c072","12e630d6041eb7322901150079c0d0fdbd47b0098dc5cb0f2de23b6e8d5082e1","498d271d695e424bfd7f9ad1ead187ef0ac62fa8908c6e1f239db495371ff237")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring64 NOT NULL AND customstring64 IN ("226cbbf43d9bcedcc5ab69e51e5cce2f4ca841aa7ab39fdf974766203e2c9b66","5420a25fdd6cb6484ab3687c6bba750b40007730eb4232088b668eff0de2c072","12e630d6041eb7322901150079c0d0fdbd47b0098dc5cb0f2de23b6e8d5082e1","498d271d695e424bfd7f9ad1ead187ef0ac62fa8908c6e1f239db495371ff237")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("226cbbf43d9bcedcc5ab69e51e5cce2f4ca841aa7ab39fdf974766203e2c9b66","5420a25fdd6cb6484ab3687c6bba750b40007730eb4232088b668eff0de2c072","12e630d6041eb7322901150079c0d0fdbd47b0098dc5cb0f2de23b6e8d5082e1","498d271d695e424bfd7f9ad1ead187ef0ac62fa8908c6e1f239db495371ff237")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("226cbbf43d9bcedcc5ab69e51e5cce2f4ca841aa7ab39fdf974766203e2c9b66","5420a25fdd6cb6484ab3687c6bba750b40007730eb4232088b668eff0de2c072","12e630d6041eb7322901150079c0d0fdbd47b0098dc5cb0f2de23b6e8d5082e1","498d271d695e424bfd7f9ad1ead187ef0ac62fa8908c6e1f239db495371ff237")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("226cbbf43d9bcedcc5ab69e51e5cce2f4ca841aa7ab39fdf974766203e2c9b66","5420a25fdd6cb6484ab3687c6bba750b40007730eb4232088b668eff0de2c072","12e630d6041eb7322901150079c0d0fdbd47b0098dc5cb0f2de23b6e8d5082e1","498d271d695e424bfd7f9ad1ead187ef0ac62fa8908c6e1f239db495371ff237")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring64 NOT NULL AND customstring64 IN ("226cbbf43d9bcedcc5ab69e51e5cce2f4ca841aa7ab39fdf974766203e2c9b66","5420a25fdd6cb6484ab3687c6bba750b40007730eb4232088b668eff0de2c072","12e630d6041eb7322901150079c0d0fdbd47b0098dc5cb0f2de23b6e8d5082e1","498d271d695e424bfd7f9ad1ead187ef0ac62fa8908c6e1f239db495371ff237")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("226cbbf43d9bcedcc5ab69e51e5cce2f4ca841aa7ab39fdf974766203e2c9b66","5420a25fdd6cb6484ab3687c6bba750b40007730eb4232088b668eff0de2c072","12e630d6041eb7322901150079c0d0fdbd47b0098dc5cb0f2de23b6e8d5082e1","498d271d695e424bfd7f9ad1ead187ef0ac62fa8908c6e1f239db495371ff237")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("226cbbf43d9bcedcc5ab69e51e5cce2f4ca841aa7ab39fdf974766203e2c9b66","5420a25fdd6cb6484ab3687c6bba750b40007730eb4232088b668eff0de2c072","12e630d6041eb7322901150079c0d0fdbd47b0098dc5cb0f2de23b6e8d5082e1","498d271d695e424bfd7f9ad1ead187ef0ac62fa8908c6e1f239db495371ff237")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("226cbbf43d9bcedcc5ab69e51e5cce2f4ca841aa7ab39fdf974766203e2c9b66","5420a25fdd6cb6484ab3687c6bba750b40007730eb4232088b668eff0de2c072","12e630d6041eb7322901150079c0d0fdbd47b0098dc5cb0f2de23b6e8d5082e1","498d271d695e424bfd7f9ad1ead187ef0ac62fa8908c6e1f239db495371ff237")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring64 NOT NULL AND customstring64 IN ("226cbbf43d9bcedcc5ab69e51e5cce2f4ca841aa7ab39fdf974766203e2c9b66","5420a25fdd6cb6484ab3687c6bba750b40007730eb4232088b668eff0de2c072","12e630d6041eb7322901150079c0d0fdbd47b0098dc5cb0f2de23b6e8d5082e1","498d271d695e424bfd7f9ad1ead187ef0ac62fa8908c6e1f239db495371ff237")
index=activity AND rg_functionality="O365 General" AND filehash NOT NULL AND filehash IN ("226cbbf43d9bcedcc5ab69e51e5cce2f4ca841aa7ab39fdf974766203e2c9b66","5420a25fdd6cb6484ab3687c6bba750b40007730eb4232088b668eff0de2c072","12e630d6041eb7322901150079c0d0fdbd47b0098dc5cb0f2de23b6e8d5082e1","498d271d695e424bfd7f9ad1ead187ef0ac62fa8908c6e1f239db495371ff237")
index=activity AND rg_functionality="O365 General" AND oldfilehash NOT NULL AND oldfilehash IN ("226cbbf43d9bcedcc5ab69e51e5cce2f4ca841aa7ab39fdf974766203e2c9b66","5420a25fdd6cb6484ab3687c6bba750b40007730eb4232088b668eff0de2c072","12e630d6041eb7322901150079c0d0fdbd47b0098dc5cb0f2de23b6e8d5082e1","498d271d695e424bfd7f9ad1ead187ef0ac62fa8908c6e1f239db495371ff237")
index=activity AND rg_functionality="O365 General" AND customstring3 NOT NULL AND customstring3 IN ("226cbbf43d9bcedcc5ab69e51e5cce2f4ca841aa7ab39fdf974766203e2c9b66","5420a25fdd6cb6484ab3687c6bba750b40007730eb4232088b668eff0de2c072","12e630d6041eb7322901150079c0d0fdbd47b0098dc5cb0f2de23b6e8d5082e1","498d271d695e424bfd7f9ad1ead187ef0ac62fa8908c6e1f239db495371ff237")
index=activity AND rg_functionality="O365 General" AND customstring64 NOT NULL AND customstring64 IN ("226cbbf43d9bcedcc5ab69e51e5cce2f4ca841aa7ab39fdf974766203e2c9b66","5420a25fdd6cb6484ab3687c6bba750b40007730eb4232088b668eff0de2c072","12e630d6041eb7322901150079c0d0fdbd47b0098dc5cb0f2de23b6e8d5082e1","498d271d695e424bfd7f9ad1ead187ef0ac62fa8908c6e1f239db495371ff237")
