index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("5dd0d74ce7e044c93ae79a7d5a66e1a1cd2a8c838c89e19f67279ab91dc19bd9","051829813ea3c66e37f184bbfaa2fa3d8752abbfa4828fa5847f1986ae461e3c","a2b284d185326ef5a6031fd2278302a715181989230b54f9e4e4d79545a0dde7")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("5dd0d74ce7e044c93ae79a7d5a66e1a1cd2a8c838c89e19f67279ab91dc19bd9","051829813ea3c66e37f184bbfaa2fa3d8752abbfa4828fa5847f1986ae461e3c","a2b284d185326ef5a6031fd2278302a715181989230b54f9e4e4d79545a0dde7")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("5dd0d74ce7e044c93ae79a7d5a66e1a1cd2a8c838c89e19f67279ab91dc19bd9","051829813ea3c66e37f184bbfaa2fa3d8752abbfa4828fa5847f1986ae461e3c","a2b284d185326ef5a6031fd2278302a715181989230b54f9e4e4d79545a0dde7")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring64 NOT NULL AND customstring64 IN ("5dd0d74ce7e044c93ae79a7d5a66e1a1cd2a8c838c89e19f67279ab91dc19bd9","051829813ea3c66e37f184bbfaa2fa3d8752abbfa4828fa5847f1986ae461e3c","a2b284d185326ef5a6031fd2278302a715181989230b54f9e4e4d79545a0dde7")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("5dd0d74ce7e044c93ae79a7d5a66e1a1cd2a8c838c89e19f67279ab91dc19bd9","051829813ea3c66e37f184bbfaa2fa3d8752abbfa4828fa5847f1986ae461e3c","a2b284d185326ef5a6031fd2278302a715181989230b54f9e4e4d79545a0dde7")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("5dd0d74ce7e044c93ae79a7d5a66e1a1cd2a8c838c89e19f67279ab91dc19bd9","051829813ea3c66e37f184bbfaa2fa3d8752abbfa4828fa5847f1986ae461e3c","a2b284d185326ef5a6031fd2278302a715181989230b54f9e4e4d79545a0dde7")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("5dd0d74ce7e044c93ae79a7d5a66e1a1cd2a8c838c89e19f67279ab91dc19bd9","051829813ea3c66e37f184bbfaa2fa3d8752abbfa4828fa5847f1986ae461e3c","a2b284d185326ef5a6031fd2278302a715181989230b54f9e4e4d79545a0dde7")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("5dd0d74ce7e044c93ae79a7d5a66e1a1cd2a8c838c89e19f67279ab91dc19bd9","051829813ea3c66e37f184bbfaa2fa3d8752abbfa4828fa5847f1986ae461e3c","a2b284d185326ef5a6031fd2278302a715181989230b54f9e4e4d79545a0dde7")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("5dd0d74ce7e044c93ae79a7d5a66e1a1cd2a8c838c89e19f67279ab91dc19bd9","051829813ea3c66e37f184bbfaa2fa3d8752abbfa4828fa5847f1986ae461e3c","a2b284d185326ef5a6031fd2278302a715181989230b54f9e4e4d79545a0dde7")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("5dd0d74ce7e044c93ae79a7d5a66e1a1cd2a8c838c89e19f67279ab91dc19bd9","051829813ea3c66e37f184bbfaa2fa3d8752abbfa4828fa5847f1986ae461e3c","a2b284d185326ef5a6031fd2278302a715181989230b54f9e4e4d79545a0dde7")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("5dd0d74ce7e044c93ae79a7d5a66e1a1cd2a8c838c89e19f67279ab91dc19bd9","051829813ea3c66e37f184bbfaa2fa3d8752abbfa4828fa5847f1986ae461e3c","a2b284d185326ef5a6031fd2278302a715181989230b54f9e4e4d79545a0dde7")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("5dd0d74ce7e044c93ae79a7d5a66e1a1cd2a8c838c89e19f67279ab91dc19bd9","051829813ea3c66e37f184bbfaa2fa3d8752abbfa4828fa5847f1986ae461e3c","a2b284d185326ef5a6031fd2278302a715181989230b54f9e4e4d79545a0dde7")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("5dd0d74ce7e044c93ae79a7d5a66e1a1cd2a8c838c89e19f67279ab91dc19bd9","051829813ea3c66e37f184bbfaa2fa3d8752abbfa4828fa5847f1986ae461e3c","a2b284d185326ef5a6031fd2278302a715181989230b54f9e4e4d79545a0dde7")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("5dd0d74ce7e044c93ae79a7d5a66e1a1cd2a8c838c89e19f67279ab91dc19bd9","051829813ea3c66e37f184bbfaa2fa3d8752abbfa4828fa5847f1986ae461e3c","a2b284d185326ef5a6031fd2278302a715181989230b54f9e4e4d79545a0dde7")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("5dd0d74ce7e044c93ae79a7d5a66e1a1cd2a8c838c89e19f67279ab91dc19bd9","051829813ea3c66e37f184bbfaa2fa3d8752abbfa4828fa5847f1986ae461e3c","a2b284d185326ef5a6031fd2278302a715181989230b54f9e4e4d79545a0dde7")
index=activity AND rg_functionality="Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("5dd0d74ce7e044c93ae79a7d5a66e1a1cd2a8c838c89e19f67279ab91dc19bd9","051829813ea3c66e37f184bbfaa2fa3d8752abbfa4828fa5847f1986ae461e3c","a2b284d185326ef5a6031fd2278302a715181989230b54f9e4e4d79545a0dde7")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("5dd0d74ce7e044c93ae79a7d5a66e1a1cd2a8c838c89e19f67279ab91dc19bd9","051829813ea3c66e37f184bbfaa2fa3d8752abbfa4828fa5847f1986ae461e3c","a2b284d185326ef5a6031fd2278302a715181989230b54f9e4e4d79545a0dde7")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("5dd0d74ce7e044c93ae79a7d5a66e1a1cd2a8c838c89e19f67279ab91dc19bd9","051829813ea3c66e37f184bbfaa2fa3d8752abbfa4828fa5847f1986ae461e3c","a2b284d185326ef5a6031fd2278302a715181989230b54f9e4e4d79545a0dde7")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("5dd0d74ce7e044c93ae79a7d5a66e1a1cd2a8c838c89e19f67279ab91dc19bd9","051829813ea3c66e37f184bbfaa2fa3d8752abbfa4828fa5847f1986ae461e3c","a2b284d185326ef5a6031fd2278302a715181989230b54f9e4e4d79545a0dde7")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("5dd0d74ce7e044c93ae79a7d5a66e1a1cd2a8c838c89e19f67279ab91dc19bd9","051829813ea3c66e37f184bbfaa2fa3d8752abbfa4828fa5847f1986ae461e3c","a2b284d185326ef5a6031fd2278302a715181989230b54f9e4e4d79545a0dde7")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("5dd0d74ce7e044c93ae79a7d5a66e1a1cd2a8c838c89e19f67279ab91dc19bd9","051829813ea3c66e37f184bbfaa2fa3d8752abbfa4828fa5847f1986ae461e3c","a2b284d185326ef5a6031fd2278302a715181989230b54f9e4e4d79545a0dde7")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("5dd0d74ce7e044c93ae79a7d5a66e1a1cd2a8c838c89e19f67279ab91dc19bd9","051829813ea3c66e37f184bbfaa2fa3d8752abbfa4828fa5847f1986ae461e3c","a2b284d185326ef5a6031fd2278302a715181989230b54f9e4e4d79545a0dde7")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("5dd0d74ce7e044c93ae79a7d5a66e1a1cd2a8c838c89e19f67279ab91dc19bd9","051829813ea3c66e37f184bbfaa2fa3d8752abbfa4828fa5847f1986ae461e3c","a2b284d185326ef5a6031fd2278302a715181989230b54f9e4e4d79545a0dde7")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring64 NOT NULL AND customstring64 IN ("5dd0d74ce7e044c93ae79a7d5a66e1a1cd2a8c838c89e19f67279ab91dc19bd9","051829813ea3c66e37f184bbfaa2fa3d8752abbfa4828fa5847f1986ae461e3c","a2b284d185326ef5a6031fd2278302a715181989230b54f9e4e4d79545a0dde7")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("5dd0d74ce7e044c93ae79a7d5a66e1a1cd2a8c838c89e19f67279ab91dc19bd9","051829813ea3c66e37f184bbfaa2fa3d8752abbfa4828fa5847f1986ae461e3c","a2b284d185326ef5a6031fd2278302a715181989230b54f9e4e4d79545a0dde7")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("5dd0d74ce7e044c93ae79a7d5a66e1a1cd2a8c838c89e19f67279ab91dc19bd9","051829813ea3c66e37f184bbfaa2fa3d8752abbfa4828fa5847f1986ae461e3c","a2b284d185326ef5a6031fd2278302a715181989230b54f9e4e4d79545a0dde7")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("5dd0d74ce7e044c93ae79a7d5a66e1a1cd2a8c838c89e19f67279ab91dc19bd9","051829813ea3c66e37f184bbfaa2fa3d8752abbfa4828fa5847f1986ae461e3c","a2b284d185326ef5a6031fd2278302a715181989230b54f9e4e4d79545a0dde7")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring64 NOT NULL AND customstring64 IN ("5dd0d74ce7e044c93ae79a7d5a66e1a1cd2a8c838c89e19f67279ab91dc19bd9","051829813ea3c66e37f184bbfaa2fa3d8752abbfa4828fa5847f1986ae461e3c","a2b284d185326ef5a6031fd2278302a715181989230b54f9e4e4d79545a0dde7")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("5dd0d74ce7e044c93ae79a7d5a66e1a1cd2a8c838c89e19f67279ab91dc19bd9","051829813ea3c66e37f184bbfaa2fa3d8752abbfa4828fa5847f1986ae461e3c","a2b284d185326ef5a6031fd2278302a715181989230b54f9e4e4d79545a0dde7")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("5dd0d74ce7e044c93ae79a7d5a66e1a1cd2a8c838c89e19f67279ab91dc19bd9","051829813ea3c66e37f184bbfaa2fa3d8752abbfa4828fa5847f1986ae461e3c","a2b284d185326ef5a6031fd2278302a715181989230b54f9e4e4d79545a0dde7")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("5dd0d74ce7e044c93ae79a7d5a66e1a1cd2a8c838c89e19f67279ab91dc19bd9","051829813ea3c66e37f184bbfaa2fa3d8752abbfa4828fa5847f1986ae461e3c","a2b284d185326ef5a6031fd2278302a715181989230b54f9e4e4d79545a0dde7")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring64 NOT NULL AND customstring64 IN ("5dd0d74ce7e044c93ae79a7d5a66e1a1cd2a8c838c89e19f67279ab91dc19bd9","051829813ea3c66e37f184bbfaa2fa3d8752abbfa4828fa5847f1986ae461e3c","a2b284d185326ef5a6031fd2278302a715181989230b54f9e4e4d79545a0dde7")
