index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("a1b98b1fbf69af79e5a3f27aa6256417488cc117","f0a25529b0d0aabce9d72ba46aaf1c78c5b48c31","2ba9bf8dd320990119f42f6f68846d8fb14194d6","888f27dd2269119cf9524474a6a0b559d0d201a1","ba14c43031411240a0836bedf8c8692b54698e05","8a85c1399a0e404c8285a723c4214942a45bbff9","612ec1d41b2aa2518363b18381fd89c12315100f","7310d6399683ba3eb2f695a2071e0e45891d743b")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("a1b98b1fbf69af79e5a3f27aa6256417488cc117","f0a25529b0d0aabce9d72ba46aaf1c78c5b48c31","2ba9bf8dd320990119f42f6f68846d8fb14194d6","888f27dd2269119cf9524474a6a0b559d0d201a1","ba14c43031411240a0836bedf8c8692b54698e05","8a85c1399a0e404c8285a723c4214942a45bbff9","612ec1d41b2aa2518363b18381fd89c12315100f","7310d6399683ba3eb2f695a2071e0e45891d743b")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("a1b98b1fbf69af79e5a3f27aa6256417488cc117","f0a25529b0d0aabce9d72ba46aaf1c78c5b48c31","2ba9bf8dd320990119f42f6f68846d8fb14194d6","888f27dd2269119cf9524474a6a0b559d0d201a1","ba14c43031411240a0836bedf8c8692b54698e05","8a85c1399a0e404c8285a723c4214942a45bbff9","612ec1d41b2aa2518363b18381fd89c12315100f","7310d6399683ba3eb2f695a2071e0e45891d743b")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring64 NOT NULL AND customstring64 IN ("a1b98b1fbf69af79e5a3f27aa6256417488cc117","f0a25529b0d0aabce9d72ba46aaf1c78c5b48c31","2ba9bf8dd320990119f42f6f68846d8fb14194d6","888f27dd2269119cf9524474a6a0b559d0d201a1","ba14c43031411240a0836bedf8c8692b54698e05","8a85c1399a0e404c8285a723c4214942a45bbff9","612ec1d41b2aa2518363b18381fd89c12315100f","7310d6399683ba3eb2f695a2071e0e45891d743b")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("a1b98b1fbf69af79e5a3f27aa6256417488cc117","f0a25529b0d0aabce9d72ba46aaf1c78c5b48c31","2ba9bf8dd320990119f42f6f68846d8fb14194d6","888f27dd2269119cf9524474a6a0b559d0d201a1","ba14c43031411240a0836bedf8c8692b54698e05","8a85c1399a0e404c8285a723c4214942a45bbff9","612ec1d41b2aa2518363b18381fd89c12315100f","7310d6399683ba3eb2f695a2071e0e45891d743b")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("a1b98b1fbf69af79e5a3f27aa6256417488cc117","f0a25529b0d0aabce9d72ba46aaf1c78c5b48c31","2ba9bf8dd320990119f42f6f68846d8fb14194d6","888f27dd2269119cf9524474a6a0b559d0d201a1","ba14c43031411240a0836bedf8c8692b54698e05","8a85c1399a0e404c8285a723c4214942a45bbff9","612ec1d41b2aa2518363b18381fd89c12315100f","7310d6399683ba3eb2f695a2071e0e45891d743b")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("a1b98b1fbf69af79e5a3f27aa6256417488cc117","f0a25529b0d0aabce9d72ba46aaf1c78c5b48c31","2ba9bf8dd320990119f42f6f68846d8fb14194d6","888f27dd2269119cf9524474a6a0b559d0d201a1","ba14c43031411240a0836bedf8c8692b54698e05","8a85c1399a0e404c8285a723c4214942a45bbff9","612ec1d41b2aa2518363b18381fd89c12315100f","7310d6399683ba3eb2f695a2071e0e45891d743b")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("a1b98b1fbf69af79e5a3f27aa6256417488cc117","f0a25529b0d0aabce9d72ba46aaf1c78c5b48c31","2ba9bf8dd320990119f42f6f68846d8fb14194d6","888f27dd2269119cf9524474a6a0b559d0d201a1","ba14c43031411240a0836bedf8c8692b54698e05","8a85c1399a0e404c8285a723c4214942a45bbff9","612ec1d41b2aa2518363b18381fd89c12315100f","7310d6399683ba3eb2f695a2071e0e45891d743b")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("a1b98b1fbf69af79e5a3f27aa6256417488cc117","f0a25529b0d0aabce9d72ba46aaf1c78c5b48c31","2ba9bf8dd320990119f42f6f68846d8fb14194d6","888f27dd2269119cf9524474a6a0b559d0d201a1","ba14c43031411240a0836bedf8c8692b54698e05","8a85c1399a0e404c8285a723c4214942a45bbff9","612ec1d41b2aa2518363b18381fd89c12315100f","7310d6399683ba3eb2f695a2071e0e45891d743b")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("a1b98b1fbf69af79e5a3f27aa6256417488cc117","f0a25529b0d0aabce9d72ba46aaf1c78c5b48c31","2ba9bf8dd320990119f42f6f68846d8fb14194d6","888f27dd2269119cf9524474a6a0b559d0d201a1","ba14c43031411240a0836bedf8c8692b54698e05","8a85c1399a0e404c8285a723c4214942a45bbff9","612ec1d41b2aa2518363b18381fd89c12315100f","7310d6399683ba3eb2f695a2071e0e45891d743b")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("a1b98b1fbf69af79e5a3f27aa6256417488cc117","f0a25529b0d0aabce9d72ba46aaf1c78c5b48c31","2ba9bf8dd320990119f42f6f68846d8fb14194d6","888f27dd2269119cf9524474a6a0b559d0d201a1","ba14c43031411240a0836bedf8c8692b54698e05","8a85c1399a0e404c8285a723c4214942a45bbff9","612ec1d41b2aa2518363b18381fd89c12315100f","7310d6399683ba3eb2f695a2071e0e45891d743b")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("a1b98b1fbf69af79e5a3f27aa6256417488cc117","f0a25529b0d0aabce9d72ba46aaf1c78c5b48c31","2ba9bf8dd320990119f42f6f68846d8fb14194d6","888f27dd2269119cf9524474a6a0b559d0d201a1","ba14c43031411240a0836bedf8c8692b54698e05","8a85c1399a0e404c8285a723c4214942a45bbff9","612ec1d41b2aa2518363b18381fd89c12315100f","7310d6399683ba3eb2f695a2071e0e45891d743b")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("a1b98b1fbf69af79e5a3f27aa6256417488cc117","f0a25529b0d0aabce9d72ba46aaf1c78c5b48c31","2ba9bf8dd320990119f42f6f68846d8fb14194d6","888f27dd2269119cf9524474a6a0b559d0d201a1","ba14c43031411240a0836bedf8c8692b54698e05","8a85c1399a0e404c8285a723c4214942a45bbff9","612ec1d41b2aa2518363b18381fd89c12315100f","7310d6399683ba3eb2f695a2071e0e45891d743b")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("a1b98b1fbf69af79e5a3f27aa6256417488cc117","f0a25529b0d0aabce9d72ba46aaf1c78c5b48c31","2ba9bf8dd320990119f42f6f68846d8fb14194d6","888f27dd2269119cf9524474a6a0b559d0d201a1","ba14c43031411240a0836bedf8c8692b54698e05","8a85c1399a0e404c8285a723c4214942a45bbff9","612ec1d41b2aa2518363b18381fd89c12315100f","7310d6399683ba3eb2f695a2071e0e45891d743b")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("a1b98b1fbf69af79e5a3f27aa6256417488cc117","f0a25529b0d0aabce9d72ba46aaf1c78c5b48c31","2ba9bf8dd320990119f42f6f68846d8fb14194d6","888f27dd2269119cf9524474a6a0b559d0d201a1","ba14c43031411240a0836bedf8c8692b54698e05","8a85c1399a0e404c8285a723c4214942a45bbff9","612ec1d41b2aa2518363b18381fd89c12315100f","7310d6399683ba3eb2f695a2071e0e45891d743b")
index=activity AND rg_functionality="Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("a1b98b1fbf69af79e5a3f27aa6256417488cc117","f0a25529b0d0aabce9d72ba46aaf1c78c5b48c31","2ba9bf8dd320990119f42f6f68846d8fb14194d6","888f27dd2269119cf9524474a6a0b559d0d201a1","ba14c43031411240a0836bedf8c8692b54698e05","8a85c1399a0e404c8285a723c4214942a45bbff9","612ec1d41b2aa2518363b18381fd89c12315100f","7310d6399683ba3eb2f695a2071e0e45891d743b")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("a1b98b1fbf69af79e5a3f27aa6256417488cc117","f0a25529b0d0aabce9d72ba46aaf1c78c5b48c31","2ba9bf8dd320990119f42f6f68846d8fb14194d6","888f27dd2269119cf9524474a6a0b559d0d201a1","ba14c43031411240a0836bedf8c8692b54698e05","8a85c1399a0e404c8285a723c4214942a45bbff9","612ec1d41b2aa2518363b18381fd89c12315100f","7310d6399683ba3eb2f695a2071e0e45891d743b")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("a1b98b1fbf69af79e5a3f27aa6256417488cc117","f0a25529b0d0aabce9d72ba46aaf1c78c5b48c31","2ba9bf8dd320990119f42f6f68846d8fb14194d6","888f27dd2269119cf9524474a6a0b559d0d201a1","ba14c43031411240a0836bedf8c8692b54698e05","8a85c1399a0e404c8285a723c4214942a45bbff9","612ec1d41b2aa2518363b18381fd89c12315100f","7310d6399683ba3eb2f695a2071e0e45891d743b")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("a1b98b1fbf69af79e5a3f27aa6256417488cc117","f0a25529b0d0aabce9d72ba46aaf1c78c5b48c31","2ba9bf8dd320990119f42f6f68846d8fb14194d6","888f27dd2269119cf9524474a6a0b559d0d201a1","ba14c43031411240a0836bedf8c8692b54698e05","8a85c1399a0e404c8285a723c4214942a45bbff9","612ec1d41b2aa2518363b18381fd89c12315100f","7310d6399683ba3eb2f695a2071e0e45891d743b")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("a1b98b1fbf69af79e5a3f27aa6256417488cc117","f0a25529b0d0aabce9d72ba46aaf1c78c5b48c31","2ba9bf8dd320990119f42f6f68846d8fb14194d6","888f27dd2269119cf9524474a6a0b559d0d201a1","ba14c43031411240a0836bedf8c8692b54698e05","8a85c1399a0e404c8285a723c4214942a45bbff9","612ec1d41b2aa2518363b18381fd89c12315100f","7310d6399683ba3eb2f695a2071e0e45891d743b")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("a1b98b1fbf69af79e5a3f27aa6256417488cc117","f0a25529b0d0aabce9d72ba46aaf1c78c5b48c31","2ba9bf8dd320990119f42f6f68846d8fb14194d6","888f27dd2269119cf9524474a6a0b559d0d201a1","ba14c43031411240a0836bedf8c8692b54698e05","8a85c1399a0e404c8285a723c4214942a45bbff9","612ec1d41b2aa2518363b18381fd89c12315100f","7310d6399683ba3eb2f695a2071e0e45891d743b")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("a1b98b1fbf69af79e5a3f27aa6256417488cc117","f0a25529b0d0aabce9d72ba46aaf1c78c5b48c31","2ba9bf8dd320990119f42f6f68846d8fb14194d6","888f27dd2269119cf9524474a6a0b559d0d201a1","ba14c43031411240a0836bedf8c8692b54698e05","8a85c1399a0e404c8285a723c4214942a45bbff9","612ec1d41b2aa2518363b18381fd89c12315100f","7310d6399683ba3eb2f695a2071e0e45891d743b")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("a1b98b1fbf69af79e5a3f27aa6256417488cc117","f0a25529b0d0aabce9d72ba46aaf1c78c5b48c31","2ba9bf8dd320990119f42f6f68846d8fb14194d6","888f27dd2269119cf9524474a6a0b559d0d201a1","ba14c43031411240a0836bedf8c8692b54698e05","8a85c1399a0e404c8285a723c4214942a45bbff9","612ec1d41b2aa2518363b18381fd89c12315100f","7310d6399683ba3eb2f695a2071e0e45891d743b")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring64 NOT NULL AND customstring64 IN ("a1b98b1fbf69af79e5a3f27aa6256417488cc117","f0a25529b0d0aabce9d72ba46aaf1c78c5b48c31","2ba9bf8dd320990119f42f6f68846d8fb14194d6","888f27dd2269119cf9524474a6a0b559d0d201a1","ba14c43031411240a0836bedf8c8692b54698e05","8a85c1399a0e404c8285a723c4214942a45bbff9","612ec1d41b2aa2518363b18381fd89c12315100f","7310d6399683ba3eb2f695a2071e0e45891d743b")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("a1b98b1fbf69af79e5a3f27aa6256417488cc117","f0a25529b0d0aabce9d72ba46aaf1c78c5b48c31","2ba9bf8dd320990119f42f6f68846d8fb14194d6","888f27dd2269119cf9524474a6a0b559d0d201a1","ba14c43031411240a0836bedf8c8692b54698e05","8a85c1399a0e404c8285a723c4214942a45bbff9","612ec1d41b2aa2518363b18381fd89c12315100f","7310d6399683ba3eb2f695a2071e0e45891d743b")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("a1b98b1fbf69af79e5a3f27aa6256417488cc117","f0a25529b0d0aabce9d72ba46aaf1c78c5b48c31","2ba9bf8dd320990119f42f6f68846d8fb14194d6","888f27dd2269119cf9524474a6a0b559d0d201a1","ba14c43031411240a0836bedf8c8692b54698e05","8a85c1399a0e404c8285a723c4214942a45bbff9","612ec1d41b2aa2518363b18381fd89c12315100f","7310d6399683ba3eb2f695a2071e0e45891d743b")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("a1b98b1fbf69af79e5a3f27aa6256417488cc117","f0a25529b0d0aabce9d72ba46aaf1c78c5b48c31","2ba9bf8dd320990119f42f6f68846d8fb14194d6","888f27dd2269119cf9524474a6a0b559d0d201a1","ba14c43031411240a0836bedf8c8692b54698e05","8a85c1399a0e404c8285a723c4214942a45bbff9","612ec1d41b2aa2518363b18381fd89c12315100f","7310d6399683ba3eb2f695a2071e0e45891d743b")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring64 NOT NULL AND customstring64 IN ("a1b98b1fbf69af79e5a3f27aa6256417488cc117","f0a25529b0d0aabce9d72ba46aaf1c78c5b48c31","2ba9bf8dd320990119f42f6f68846d8fb14194d6","888f27dd2269119cf9524474a6a0b559d0d201a1","ba14c43031411240a0836bedf8c8692b54698e05","8a85c1399a0e404c8285a723c4214942a45bbff9","612ec1d41b2aa2518363b18381fd89c12315100f","7310d6399683ba3eb2f695a2071e0e45891d743b")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("a1b98b1fbf69af79e5a3f27aa6256417488cc117","f0a25529b0d0aabce9d72ba46aaf1c78c5b48c31","2ba9bf8dd320990119f42f6f68846d8fb14194d6","888f27dd2269119cf9524474a6a0b559d0d201a1","ba14c43031411240a0836bedf8c8692b54698e05","8a85c1399a0e404c8285a723c4214942a45bbff9","612ec1d41b2aa2518363b18381fd89c12315100f","7310d6399683ba3eb2f695a2071e0e45891d743b")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("a1b98b1fbf69af79e5a3f27aa6256417488cc117","f0a25529b0d0aabce9d72ba46aaf1c78c5b48c31","2ba9bf8dd320990119f42f6f68846d8fb14194d6","888f27dd2269119cf9524474a6a0b559d0d201a1","ba14c43031411240a0836bedf8c8692b54698e05","8a85c1399a0e404c8285a723c4214942a45bbff9","612ec1d41b2aa2518363b18381fd89c12315100f","7310d6399683ba3eb2f695a2071e0e45891d743b")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("a1b98b1fbf69af79e5a3f27aa6256417488cc117","f0a25529b0d0aabce9d72ba46aaf1c78c5b48c31","2ba9bf8dd320990119f42f6f68846d8fb14194d6","888f27dd2269119cf9524474a6a0b559d0d201a1","ba14c43031411240a0836bedf8c8692b54698e05","8a85c1399a0e404c8285a723c4214942a45bbff9","612ec1d41b2aa2518363b18381fd89c12315100f","7310d6399683ba3eb2f695a2071e0e45891d743b")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring64 NOT NULL AND customstring64 IN ("a1b98b1fbf69af79e5a3f27aa6256417488cc117","f0a25529b0d0aabce9d72ba46aaf1c78c5b48c31","2ba9bf8dd320990119f42f6f68846d8fb14194d6","888f27dd2269119cf9524474a6a0b559d0d201a1","ba14c43031411240a0836bedf8c8692b54698e05","8a85c1399a0e404c8285a723c4214942a45bbff9","612ec1d41b2aa2518363b18381fd89c12315100f","7310d6399683ba3eb2f695a2071e0e45891d743b")
