index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("2abff990d33d99a0732ddbb3a39831c2c292f36955381d45cd8d40a816d9b47a","68d3fbc9445870447715b513159eddbe2a1077eb99b49a722d51c4abc1e69057","7c585fbcc64c3dcdb5c1562868c97dea3c7f84f4edbf6c6c799834a03766ff65","6723057b5115cfc2202bf3452ac4b25a2e36bd61e5d0f12f88465b356bff2715","18a8a4e41eb618f77eb0cf4b0d0fdd005b5e9fe577df5f2942fe16af831af4e9")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("2abff990d33d99a0732ddbb3a39831c2c292f36955381d45cd8d40a816d9b47a","68d3fbc9445870447715b513159eddbe2a1077eb99b49a722d51c4abc1e69057","7c585fbcc64c3dcdb5c1562868c97dea3c7f84f4edbf6c6c799834a03766ff65","6723057b5115cfc2202bf3452ac4b25a2e36bd61e5d0f12f88465b356bff2715","18a8a4e41eb618f77eb0cf4b0d0fdd005b5e9fe577df5f2942fe16af831af4e9")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("2abff990d33d99a0732ddbb3a39831c2c292f36955381d45cd8d40a816d9b47a","68d3fbc9445870447715b513159eddbe2a1077eb99b49a722d51c4abc1e69057","7c585fbcc64c3dcdb5c1562868c97dea3c7f84f4edbf6c6c799834a03766ff65","6723057b5115cfc2202bf3452ac4b25a2e36bd61e5d0f12f88465b356bff2715","18a8a4e41eb618f77eb0cf4b0d0fdd005b5e9fe577df5f2942fe16af831af4e9")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring64 NOT NULL AND customstring64 IN ("2abff990d33d99a0732ddbb3a39831c2c292f36955381d45cd8d40a816d9b47a","68d3fbc9445870447715b513159eddbe2a1077eb99b49a722d51c4abc1e69057","7c585fbcc64c3dcdb5c1562868c97dea3c7f84f4edbf6c6c799834a03766ff65","6723057b5115cfc2202bf3452ac4b25a2e36bd61e5d0f12f88465b356bff2715","18a8a4e41eb618f77eb0cf4b0d0fdd005b5e9fe577df5f2942fe16af831af4e9")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("2abff990d33d99a0732ddbb3a39831c2c292f36955381d45cd8d40a816d9b47a","68d3fbc9445870447715b513159eddbe2a1077eb99b49a722d51c4abc1e69057","7c585fbcc64c3dcdb5c1562868c97dea3c7f84f4edbf6c6c799834a03766ff65","6723057b5115cfc2202bf3452ac4b25a2e36bd61e5d0f12f88465b356bff2715","18a8a4e41eb618f77eb0cf4b0d0fdd005b5e9fe577df5f2942fe16af831af4e9")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("2abff990d33d99a0732ddbb3a39831c2c292f36955381d45cd8d40a816d9b47a","68d3fbc9445870447715b513159eddbe2a1077eb99b49a722d51c4abc1e69057","7c585fbcc64c3dcdb5c1562868c97dea3c7f84f4edbf6c6c799834a03766ff65","6723057b5115cfc2202bf3452ac4b25a2e36bd61e5d0f12f88465b356bff2715","18a8a4e41eb618f77eb0cf4b0d0fdd005b5e9fe577df5f2942fe16af831af4e9")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("2abff990d33d99a0732ddbb3a39831c2c292f36955381d45cd8d40a816d9b47a","68d3fbc9445870447715b513159eddbe2a1077eb99b49a722d51c4abc1e69057","7c585fbcc64c3dcdb5c1562868c97dea3c7f84f4edbf6c6c799834a03766ff65","6723057b5115cfc2202bf3452ac4b25a2e36bd61e5d0f12f88465b356bff2715","18a8a4e41eb618f77eb0cf4b0d0fdd005b5e9fe577df5f2942fe16af831af4e9")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("2abff990d33d99a0732ddbb3a39831c2c292f36955381d45cd8d40a816d9b47a","68d3fbc9445870447715b513159eddbe2a1077eb99b49a722d51c4abc1e69057","7c585fbcc64c3dcdb5c1562868c97dea3c7f84f4edbf6c6c799834a03766ff65","6723057b5115cfc2202bf3452ac4b25a2e36bd61e5d0f12f88465b356bff2715","18a8a4e41eb618f77eb0cf4b0d0fdd005b5e9fe577df5f2942fe16af831af4e9")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("2abff990d33d99a0732ddbb3a39831c2c292f36955381d45cd8d40a816d9b47a","68d3fbc9445870447715b513159eddbe2a1077eb99b49a722d51c4abc1e69057","7c585fbcc64c3dcdb5c1562868c97dea3c7f84f4edbf6c6c799834a03766ff65","6723057b5115cfc2202bf3452ac4b25a2e36bd61e5d0f12f88465b356bff2715","18a8a4e41eb618f77eb0cf4b0d0fdd005b5e9fe577df5f2942fe16af831af4e9")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("2abff990d33d99a0732ddbb3a39831c2c292f36955381d45cd8d40a816d9b47a","68d3fbc9445870447715b513159eddbe2a1077eb99b49a722d51c4abc1e69057","7c585fbcc64c3dcdb5c1562868c97dea3c7f84f4edbf6c6c799834a03766ff65","6723057b5115cfc2202bf3452ac4b25a2e36bd61e5d0f12f88465b356bff2715","18a8a4e41eb618f77eb0cf4b0d0fdd005b5e9fe577df5f2942fe16af831af4e9")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("2abff990d33d99a0732ddbb3a39831c2c292f36955381d45cd8d40a816d9b47a","68d3fbc9445870447715b513159eddbe2a1077eb99b49a722d51c4abc1e69057","7c585fbcc64c3dcdb5c1562868c97dea3c7f84f4edbf6c6c799834a03766ff65","6723057b5115cfc2202bf3452ac4b25a2e36bd61e5d0f12f88465b356bff2715","18a8a4e41eb618f77eb0cf4b0d0fdd005b5e9fe577df5f2942fe16af831af4e9")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("2abff990d33d99a0732ddbb3a39831c2c292f36955381d45cd8d40a816d9b47a","68d3fbc9445870447715b513159eddbe2a1077eb99b49a722d51c4abc1e69057","7c585fbcc64c3dcdb5c1562868c97dea3c7f84f4edbf6c6c799834a03766ff65","6723057b5115cfc2202bf3452ac4b25a2e36bd61e5d0f12f88465b356bff2715","18a8a4e41eb618f77eb0cf4b0d0fdd005b5e9fe577df5f2942fe16af831af4e9")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("2abff990d33d99a0732ddbb3a39831c2c292f36955381d45cd8d40a816d9b47a","68d3fbc9445870447715b513159eddbe2a1077eb99b49a722d51c4abc1e69057","7c585fbcc64c3dcdb5c1562868c97dea3c7f84f4edbf6c6c799834a03766ff65","6723057b5115cfc2202bf3452ac4b25a2e36bd61e5d0f12f88465b356bff2715","18a8a4e41eb618f77eb0cf4b0d0fdd005b5e9fe577df5f2942fe16af831af4e9")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("2abff990d33d99a0732ddbb3a39831c2c292f36955381d45cd8d40a816d9b47a","68d3fbc9445870447715b513159eddbe2a1077eb99b49a722d51c4abc1e69057","7c585fbcc64c3dcdb5c1562868c97dea3c7f84f4edbf6c6c799834a03766ff65","6723057b5115cfc2202bf3452ac4b25a2e36bd61e5d0f12f88465b356bff2715","18a8a4e41eb618f77eb0cf4b0d0fdd005b5e9fe577df5f2942fe16af831af4e9")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("2abff990d33d99a0732ddbb3a39831c2c292f36955381d45cd8d40a816d9b47a","68d3fbc9445870447715b513159eddbe2a1077eb99b49a722d51c4abc1e69057","7c585fbcc64c3dcdb5c1562868c97dea3c7f84f4edbf6c6c799834a03766ff65","6723057b5115cfc2202bf3452ac4b25a2e36bd61e5d0f12f88465b356bff2715","18a8a4e41eb618f77eb0cf4b0d0fdd005b5e9fe577df5f2942fe16af831af4e9")
index=activity AND rg_functionality="Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("2abff990d33d99a0732ddbb3a39831c2c292f36955381d45cd8d40a816d9b47a","68d3fbc9445870447715b513159eddbe2a1077eb99b49a722d51c4abc1e69057","7c585fbcc64c3dcdb5c1562868c97dea3c7f84f4edbf6c6c799834a03766ff65","6723057b5115cfc2202bf3452ac4b25a2e36bd61e5d0f12f88465b356bff2715","18a8a4e41eb618f77eb0cf4b0d0fdd005b5e9fe577df5f2942fe16af831af4e9")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("2abff990d33d99a0732ddbb3a39831c2c292f36955381d45cd8d40a816d9b47a","68d3fbc9445870447715b513159eddbe2a1077eb99b49a722d51c4abc1e69057","7c585fbcc64c3dcdb5c1562868c97dea3c7f84f4edbf6c6c799834a03766ff65","6723057b5115cfc2202bf3452ac4b25a2e36bd61e5d0f12f88465b356bff2715","18a8a4e41eb618f77eb0cf4b0d0fdd005b5e9fe577df5f2942fe16af831af4e9")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("2abff990d33d99a0732ddbb3a39831c2c292f36955381d45cd8d40a816d9b47a","68d3fbc9445870447715b513159eddbe2a1077eb99b49a722d51c4abc1e69057","7c585fbcc64c3dcdb5c1562868c97dea3c7f84f4edbf6c6c799834a03766ff65","6723057b5115cfc2202bf3452ac4b25a2e36bd61e5d0f12f88465b356bff2715","18a8a4e41eb618f77eb0cf4b0d0fdd005b5e9fe577df5f2942fe16af831af4e9")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("2abff990d33d99a0732ddbb3a39831c2c292f36955381d45cd8d40a816d9b47a","68d3fbc9445870447715b513159eddbe2a1077eb99b49a722d51c4abc1e69057","7c585fbcc64c3dcdb5c1562868c97dea3c7f84f4edbf6c6c799834a03766ff65","6723057b5115cfc2202bf3452ac4b25a2e36bd61e5d0f12f88465b356bff2715","18a8a4e41eb618f77eb0cf4b0d0fdd005b5e9fe577df5f2942fe16af831af4e9")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("2abff990d33d99a0732ddbb3a39831c2c292f36955381d45cd8d40a816d9b47a","68d3fbc9445870447715b513159eddbe2a1077eb99b49a722d51c4abc1e69057","7c585fbcc64c3dcdb5c1562868c97dea3c7f84f4edbf6c6c799834a03766ff65","6723057b5115cfc2202bf3452ac4b25a2e36bd61e5d0f12f88465b356bff2715","18a8a4e41eb618f77eb0cf4b0d0fdd005b5e9fe577df5f2942fe16af831af4e9")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("2abff990d33d99a0732ddbb3a39831c2c292f36955381d45cd8d40a816d9b47a","68d3fbc9445870447715b513159eddbe2a1077eb99b49a722d51c4abc1e69057","7c585fbcc64c3dcdb5c1562868c97dea3c7f84f4edbf6c6c799834a03766ff65","6723057b5115cfc2202bf3452ac4b25a2e36bd61e5d0f12f88465b356bff2715","18a8a4e41eb618f77eb0cf4b0d0fdd005b5e9fe577df5f2942fe16af831af4e9")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("2abff990d33d99a0732ddbb3a39831c2c292f36955381d45cd8d40a816d9b47a","68d3fbc9445870447715b513159eddbe2a1077eb99b49a722d51c4abc1e69057","7c585fbcc64c3dcdb5c1562868c97dea3c7f84f4edbf6c6c799834a03766ff65","6723057b5115cfc2202bf3452ac4b25a2e36bd61e5d0f12f88465b356bff2715","18a8a4e41eb618f77eb0cf4b0d0fdd005b5e9fe577df5f2942fe16af831af4e9")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("2abff990d33d99a0732ddbb3a39831c2c292f36955381d45cd8d40a816d9b47a","68d3fbc9445870447715b513159eddbe2a1077eb99b49a722d51c4abc1e69057","7c585fbcc64c3dcdb5c1562868c97dea3c7f84f4edbf6c6c799834a03766ff65","6723057b5115cfc2202bf3452ac4b25a2e36bd61e5d0f12f88465b356bff2715","18a8a4e41eb618f77eb0cf4b0d0fdd005b5e9fe577df5f2942fe16af831af4e9")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring64 NOT NULL AND customstring64 IN ("2abff990d33d99a0732ddbb3a39831c2c292f36955381d45cd8d40a816d9b47a","68d3fbc9445870447715b513159eddbe2a1077eb99b49a722d51c4abc1e69057","7c585fbcc64c3dcdb5c1562868c97dea3c7f84f4edbf6c6c799834a03766ff65","6723057b5115cfc2202bf3452ac4b25a2e36bd61e5d0f12f88465b356bff2715","18a8a4e41eb618f77eb0cf4b0d0fdd005b5e9fe577df5f2942fe16af831af4e9")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("2abff990d33d99a0732ddbb3a39831c2c292f36955381d45cd8d40a816d9b47a","68d3fbc9445870447715b513159eddbe2a1077eb99b49a722d51c4abc1e69057","7c585fbcc64c3dcdb5c1562868c97dea3c7f84f4edbf6c6c799834a03766ff65","6723057b5115cfc2202bf3452ac4b25a2e36bd61e5d0f12f88465b356bff2715","18a8a4e41eb618f77eb0cf4b0d0fdd005b5e9fe577df5f2942fe16af831af4e9")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("2abff990d33d99a0732ddbb3a39831c2c292f36955381d45cd8d40a816d9b47a","68d3fbc9445870447715b513159eddbe2a1077eb99b49a722d51c4abc1e69057","7c585fbcc64c3dcdb5c1562868c97dea3c7f84f4edbf6c6c799834a03766ff65","6723057b5115cfc2202bf3452ac4b25a2e36bd61e5d0f12f88465b356bff2715","18a8a4e41eb618f77eb0cf4b0d0fdd005b5e9fe577df5f2942fe16af831af4e9")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("2abff990d33d99a0732ddbb3a39831c2c292f36955381d45cd8d40a816d9b47a","68d3fbc9445870447715b513159eddbe2a1077eb99b49a722d51c4abc1e69057","7c585fbcc64c3dcdb5c1562868c97dea3c7f84f4edbf6c6c799834a03766ff65","6723057b5115cfc2202bf3452ac4b25a2e36bd61e5d0f12f88465b356bff2715","18a8a4e41eb618f77eb0cf4b0d0fdd005b5e9fe577df5f2942fe16af831af4e9")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring64 NOT NULL AND customstring64 IN ("2abff990d33d99a0732ddbb3a39831c2c292f36955381d45cd8d40a816d9b47a","68d3fbc9445870447715b513159eddbe2a1077eb99b49a722d51c4abc1e69057","7c585fbcc64c3dcdb5c1562868c97dea3c7f84f4edbf6c6c799834a03766ff65","6723057b5115cfc2202bf3452ac4b25a2e36bd61e5d0f12f88465b356bff2715","18a8a4e41eb618f77eb0cf4b0d0fdd005b5e9fe577df5f2942fe16af831af4e9")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("2abff990d33d99a0732ddbb3a39831c2c292f36955381d45cd8d40a816d9b47a","68d3fbc9445870447715b513159eddbe2a1077eb99b49a722d51c4abc1e69057","7c585fbcc64c3dcdb5c1562868c97dea3c7f84f4edbf6c6c799834a03766ff65","6723057b5115cfc2202bf3452ac4b25a2e36bd61e5d0f12f88465b356bff2715","18a8a4e41eb618f77eb0cf4b0d0fdd005b5e9fe577df5f2942fe16af831af4e9")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("2abff990d33d99a0732ddbb3a39831c2c292f36955381d45cd8d40a816d9b47a","68d3fbc9445870447715b513159eddbe2a1077eb99b49a722d51c4abc1e69057","7c585fbcc64c3dcdb5c1562868c97dea3c7f84f4edbf6c6c799834a03766ff65","6723057b5115cfc2202bf3452ac4b25a2e36bd61e5d0f12f88465b356bff2715","18a8a4e41eb618f77eb0cf4b0d0fdd005b5e9fe577df5f2942fe16af831af4e9")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("2abff990d33d99a0732ddbb3a39831c2c292f36955381d45cd8d40a816d9b47a","68d3fbc9445870447715b513159eddbe2a1077eb99b49a722d51c4abc1e69057","7c585fbcc64c3dcdb5c1562868c97dea3c7f84f4edbf6c6c799834a03766ff65","6723057b5115cfc2202bf3452ac4b25a2e36bd61e5d0f12f88465b356bff2715","18a8a4e41eb618f77eb0cf4b0d0fdd005b5e9fe577df5f2942fe16af831af4e9")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring64 NOT NULL AND customstring64 IN ("2abff990d33d99a0732ddbb3a39831c2c292f36955381d45cd8d40a816d9b47a","68d3fbc9445870447715b513159eddbe2a1077eb99b49a722d51c4abc1e69057","7c585fbcc64c3dcdb5c1562868c97dea3c7f84f4edbf6c6c799834a03766ff65","6723057b5115cfc2202bf3452ac4b25a2e36bd61e5d0f12f88465b356bff2715","18a8a4e41eb618f77eb0cf4b0d0fdd005b5e9fe577df5f2942fe16af831af4e9")
