index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("57EE78299598170C766FF73CEFCA9E78B9B81AC6999E8ADB61903BC89BE313BA","7259975D7E3B3D9D059A38F4393AB920764B46CA243E192E08F7699999382E07","172BBF46E5F46DD7A9EA0C22054B644F60EFC3A9AD26A6F0E95CA57E38AF60A7","9845619CB9C3612055A934C4270568391832EAB40A66DBB22B1B37FA05559C92","5120998FA1482D4D0D0099D91AAB2AF647C0272819D7DCF792EEC01C77AB9391","4D6272AEADF7FC131AC126DC07D7BFD2E878D359E5E7BB5376A67295CE05FC15","0794C8630F40F04C0E7CEA40F11DC3F1A829A3BE69852FE9E184AA8B7ED20797","7A8128F8788524E54A69619B69870DFD4C50DB46E3EB786899F7275DAB73D2D9","4EAF5E93953756BC2196BFCFB030B6EAAD687FA1E8DB9F47B09819F3B4315230","8C294F1EF05DF823460BD11CE34EA7860178DE6BC3D9B0127A3B9C08CF62437F","A9A6D35469E471666758ED5D1174EDC5B650C0ACB2C351213EADFB408F74BDCB","039DA6B099303FDFD087BB7DF94012780DFE375C67234CE495C78CF2DCF7FD9D","699FFB898864BF804CF726F39B5E8168D55E44FC1584B71BA25E31B43AE543E8","EE10F3A798AAA03F4CED2DDB28D2B36FE415EA2CBBD9C3B97B2A230A72D77F5C","C1F963ABA616680E611601E446955E9552C69DB23DABAB8444718D82AD830029","5AA7DE7EAB570522C93D337D395396057033AD6596DB4A0BDA15D77A6D4C6C3A","84755B2177B72364918F18C62A23854E7A8A66C4F5005CC040357850ADF9D811","ce5ba1e5d70d95d52b89a1b8278ff8dd4d1e25c38c90ca202b43bdc014795d78","35ffc1263005fd0a954deed20a7fb0cd53dbab6bb17ff8bd34559a5a124686c7")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("57EE78299598170C766FF73CEFCA9E78B9B81AC6999E8ADB61903BC89BE313BA","7259975D7E3B3D9D059A38F4393AB920764B46CA243E192E08F7699999382E07","172BBF46E5F46DD7A9EA0C22054B644F60EFC3A9AD26A6F0E95CA57E38AF60A7","9845619CB9C3612055A934C4270568391832EAB40A66DBB22B1B37FA05559C92","5120998FA1482D4D0D0099D91AAB2AF647C0272819D7DCF792EEC01C77AB9391","4D6272AEADF7FC131AC126DC07D7BFD2E878D359E5E7BB5376A67295CE05FC15","0794C8630F40F04C0E7CEA40F11DC3F1A829A3BE69852FE9E184AA8B7ED20797","7A8128F8788524E54A69619B69870DFD4C50DB46E3EB786899F7275DAB73D2D9","4EAF5E93953756BC2196BFCFB030B6EAAD687FA1E8DB9F47B09819F3B4315230","8C294F1EF05DF823460BD11CE34EA7860178DE6BC3D9B0127A3B9C08CF62437F","A9A6D35469E471666758ED5D1174EDC5B650C0ACB2C351213EADFB408F74BDCB","039DA6B099303FDFD087BB7DF94012780DFE375C67234CE495C78CF2DCF7FD9D","699FFB898864BF804CF726F39B5E8168D55E44FC1584B71BA25E31B43AE543E8","EE10F3A798AAA03F4CED2DDB28D2B36FE415EA2CBBD9C3B97B2A230A72D77F5C","C1F963ABA616680E611601E446955E9552C69DB23DABAB8444718D82AD830029","5AA7DE7EAB570522C93D337D395396057033AD6596DB4A0BDA15D77A6D4C6C3A","84755B2177B72364918F18C62A23854E7A8A66C4F5005CC040357850ADF9D811","ce5ba1e5d70d95d52b89a1b8278ff8dd4d1e25c38c90ca202b43bdc014795d78","35ffc1263005fd0a954deed20a7fb0cd53dbab6bb17ff8bd34559a5a124686c7")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("57EE78299598170C766FF73CEFCA9E78B9B81AC6999E8ADB61903BC89BE313BA","7259975D7E3B3D9D059A38F4393AB920764B46CA243E192E08F7699999382E07","172BBF46E5F46DD7A9EA0C22054B644F60EFC3A9AD26A6F0E95CA57E38AF60A7","9845619CB9C3612055A934C4270568391832EAB40A66DBB22B1B37FA05559C92","5120998FA1482D4D0D0099D91AAB2AF647C0272819D7DCF792EEC01C77AB9391","4D6272AEADF7FC131AC126DC07D7BFD2E878D359E5E7BB5376A67295CE05FC15","0794C8630F40F04C0E7CEA40F11DC3F1A829A3BE69852FE9E184AA8B7ED20797","7A8128F8788524E54A69619B69870DFD4C50DB46E3EB786899F7275DAB73D2D9","4EAF5E93953756BC2196BFCFB030B6EAAD687FA1E8DB9F47B09819F3B4315230","8C294F1EF05DF823460BD11CE34EA7860178DE6BC3D9B0127A3B9C08CF62437F","A9A6D35469E471666758ED5D1174EDC5B650C0ACB2C351213EADFB408F74BDCB","039DA6B099303FDFD087BB7DF94012780DFE375C67234CE495C78CF2DCF7FD9D","699FFB898864BF804CF726F39B5E8168D55E44FC1584B71BA25E31B43AE543E8","EE10F3A798AAA03F4CED2DDB28D2B36FE415EA2CBBD9C3B97B2A230A72D77F5C","C1F963ABA616680E611601E446955E9552C69DB23DABAB8444718D82AD830029","5AA7DE7EAB570522C93D337D395396057033AD6596DB4A0BDA15D77A6D4C6C3A","84755B2177B72364918F18C62A23854E7A8A66C4F5005CC040357850ADF9D811","ce5ba1e5d70d95d52b89a1b8278ff8dd4d1e25c38c90ca202b43bdc014795d78","35ffc1263005fd0a954deed20a7fb0cd53dbab6bb17ff8bd34559a5a124686c7")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("57EE78299598170C766FF73CEFCA9E78B9B81AC6999E8ADB61903BC89BE313BA","7259975D7E3B3D9D059A38F4393AB920764B46CA243E192E08F7699999382E07","172BBF46E5F46DD7A9EA0C22054B644F60EFC3A9AD26A6F0E95CA57E38AF60A7","9845619CB9C3612055A934C4270568391832EAB40A66DBB22B1B37FA05559C92","5120998FA1482D4D0D0099D91AAB2AF647C0272819D7DCF792EEC01C77AB9391","4D6272AEADF7FC131AC126DC07D7BFD2E878D359E5E7BB5376A67295CE05FC15","0794C8630F40F04C0E7CEA40F11DC3F1A829A3BE69852FE9E184AA8B7ED20797","7A8128F8788524E54A69619B69870DFD4C50DB46E3EB786899F7275DAB73D2D9","4EAF5E93953756BC2196BFCFB030B6EAAD687FA1E8DB9F47B09819F3B4315230","8C294F1EF05DF823460BD11CE34EA7860178DE6BC3D9B0127A3B9C08CF62437F","A9A6D35469E471666758ED5D1174EDC5B650C0ACB2C351213EADFB408F74BDCB","039DA6B099303FDFD087BB7DF94012780DFE375C67234CE495C78CF2DCF7FD9D","699FFB898864BF804CF726F39B5E8168D55E44FC1584B71BA25E31B43AE543E8","EE10F3A798AAA03F4CED2DDB28D2B36FE415EA2CBBD9C3B97B2A230A72D77F5C","C1F963ABA616680E611601E446955E9552C69DB23DABAB8444718D82AD830029","5AA7DE7EAB570522C93D337D395396057033AD6596DB4A0BDA15D77A6D4C6C3A","84755B2177B72364918F18C62A23854E7A8A66C4F5005CC040357850ADF9D811","ce5ba1e5d70d95d52b89a1b8278ff8dd4d1e25c38c90ca202b43bdc014795d78","35ffc1263005fd0a954deed20a7fb0cd53dbab6bb17ff8bd34559a5a124686c7")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("57EE78299598170C766FF73CEFCA9E78B9B81AC6999E8ADB61903BC89BE313BA","7259975D7E3B3D9D059A38F4393AB920764B46CA243E192E08F7699999382E07","172BBF46E5F46DD7A9EA0C22054B644F60EFC3A9AD26A6F0E95CA57E38AF60A7","9845619CB9C3612055A934C4270568391832EAB40A66DBB22B1B37FA05559C92","5120998FA1482D4D0D0099D91AAB2AF647C0272819D7DCF792EEC01C77AB9391","4D6272AEADF7FC131AC126DC07D7BFD2E878D359E5E7BB5376A67295CE05FC15","0794C8630F40F04C0E7CEA40F11DC3F1A829A3BE69852FE9E184AA8B7ED20797","7A8128F8788524E54A69619B69870DFD4C50DB46E3EB786899F7275DAB73D2D9","4EAF5E93953756BC2196BFCFB030B6EAAD687FA1E8DB9F47B09819F3B4315230","8C294F1EF05DF823460BD11CE34EA7860178DE6BC3D9B0127A3B9C08CF62437F","A9A6D35469E471666758ED5D1174EDC5B650C0ACB2C351213EADFB408F74BDCB","039DA6B099303FDFD087BB7DF94012780DFE375C67234CE495C78CF2DCF7FD9D","699FFB898864BF804CF726F39B5E8168D55E44FC1584B71BA25E31B43AE543E8","EE10F3A798AAA03F4CED2DDB28D2B36FE415EA2CBBD9C3B97B2A230A72D77F5C","C1F963ABA616680E611601E446955E9552C69DB23DABAB8444718D82AD830029","5AA7DE7EAB570522C93D337D395396057033AD6596DB4A0BDA15D77A6D4C6C3A","84755B2177B72364918F18C62A23854E7A8A66C4F5005CC040357850ADF9D811","ce5ba1e5d70d95d52b89a1b8278ff8dd4d1e25c38c90ca202b43bdc014795d78","35ffc1263005fd0a954deed20a7fb0cd53dbab6bb17ff8bd34559a5a124686c7")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("57EE78299598170C766FF73CEFCA9E78B9B81AC6999E8ADB61903BC89BE313BA","7259975D7E3B3D9D059A38F4393AB920764B46CA243E192E08F7699999382E07","172BBF46E5F46DD7A9EA0C22054B644F60EFC3A9AD26A6F0E95CA57E38AF60A7","9845619CB9C3612055A934C4270568391832EAB40A66DBB22B1B37FA05559C92","5120998FA1482D4D0D0099D91AAB2AF647C0272819D7DCF792EEC01C77AB9391","4D6272AEADF7FC131AC126DC07D7BFD2E878D359E5E7BB5376A67295CE05FC15","0794C8630F40F04C0E7CEA40F11DC3F1A829A3BE69852FE9E184AA8B7ED20797","7A8128F8788524E54A69619B69870DFD4C50DB46E3EB786899F7275DAB73D2D9","4EAF5E93953756BC2196BFCFB030B6EAAD687FA1E8DB9F47B09819F3B4315230","8C294F1EF05DF823460BD11CE34EA7860178DE6BC3D9B0127A3B9C08CF62437F","A9A6D35469E471666758ED5D1174EDC5B650C0ACB2C351213EADFB408F74BDCB","039DA6B099303FDFD087BB7DF94012780DFE375C67234CE495C78CF2DCF7FD9D","699FFB898864BF804CF726F39B5E8168D55E44FC1584B71BA25E31B43AE543E8","EE10F3A798AAA03F4CED2DDB28D2B36FE415EA2CBBD9C3B97B2A230A72D77F5C","C1F963ABA616680E611601E446955E9552C69DB23DABAB8444718D82AD830029","5AA7DE7EAB570522C93D337D395396057033AD6596DB4A0BDA15D77A6D4C6C3A","84755B2177B72364918F18C62A23854E7A8A66C4F5005CC040357850ADF9D811","ce5ba1e5d70d95d52b89a1b8278ff8dd4d1e25c38c90ca202b43bdc014795d78","35ffc1263005fd0a954deed20a7fb0cd53dbab6bb17ff8bd34559a5a124686c7")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "epsilons.red")
index=activity AND rg_functionality="Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "epsilons.red")
index=activity AND rg_functionality="Web Proxy" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "epsilons.red")
