index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("5d2204f3a20e163120f52a2e3595db19890050b2faa96c6cba6b094b0a52b0aa","7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a","ae7c868713e1d02b4db60128c651eb1e3f6a33c02544cc4cb57c3aa6c6581b6e","17205c43189c22dfcb278f5cc45c2562f622b0b6280dcd43cc1d3c274095eb90","a54fef5fe2af58f5bd75c3af44f1fba22b721f34406c5963b19c5376ab278cd1","1d040540c3c2ed8f73e04c578e7fb96d0b47d858bbb67e9b39ec2f4674b04250","2967e1d97d32605fc5ace49a10828800fbbefcc1e010f6004a9c88ef3ecdad88","f088e6944b2632bb7c93fa3c7ba1707914c05c00f9491e033f78a709d65d7cff")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("5d2204f3a20e163120f52a2e3595db19890050b2faa96c6cba6b094b0a52b0aa","7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a","ae7c868713e1d02b4db60128c651eb1e3f6a33c02544cc4cb57c3aa6c6581b6e","17205c43189c22dfcb278f5cc45c2562f622b0b6280dcd43cc1d3c274095eb90","a54fef5fe2af58f5bd75c3af44f1fba22b721f34406c5963b19c5376ab278cd1","1d040540c3c2ed8f73e04c578e7fb96d0b47d858bbb67e9b39ec2f4674b04250","2967e1d97d32605fc5ace49a10828800fbbefcc1e010f6004a9c88ef3ecdad88","f088e6944b2632bb7c93fa3c7ba1707914c05c00f9491e033f78a709d65d7cff")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("5d2204f3a20e163120f52a2e3595db19890050b2faa96c6cba6b094b0a52b0aa","7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a","ae7c868713e1d02b4db60128c651eb1e3f6a33c02544cc4cb57c3aa6c6581b6e","17205c43189c22dfcb278f5cc45c2562f622b0b6280dcd43cc1d3c274095eb90","a54fef5fe2af58f5bd75c3af44f1fba22b721f34406c5963b19c5376ab278cd1","1d040540c3c2ed8f73e04c578e7fb96d0b47d858bbb67e9b39ec2f4674b04250","2967e1d97d32605fc5ace49a10828800fbbefcc1e010f6004a9c88ef3ecdad88","f088e6944b2632bb7c93fa3c7ba1707914c05c00f9491e033f78a709d65d7cff")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("5d2204f3a20e163120f52a2e3595db19890050b2faa96c6cba6b094b0a52b0aa","7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a","ae7c868713e1d02b4db60128c651eb1e3f6a33c02544cc4cb57c3aa6c6581b6e","17205c43189c22dfcb278f5cc45c2562f622b0b6280dcd43cc1d3c274095eb90","a54fef5fe2af58f5bd75c3af44f1fba22b721f34406c5963b19c5376ab278cd1","1d040540c3c2ed8f73e04c578e7fb96d0b47d858bbb67e9b39ec2f4674b04250","2967e1d97d32605fc5ace49a10828800fbbefcc1e010f6004a9c88ef3ecdad88","f088e6944b2632bb7c93fa3c7ba1707914c05c00f9491e033f78a709d65d7cff")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("5d2204f3a20e163120f52a2e3595db19890050b2faa96c6cba6b094b0a52b0aa","7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a","ae7c868713e1d02b4db60128c651eb1e3f6a33c02544cc4cb57c3aa6c6581b6e","17205c43189c22dfcb278f5cc45c2562f622b0b6280dcd43cc1d3c274095eb90","a54fef5fe2af58f5bd75c3af44f1fba22b721f34406c5963b19c5376ab278cd1","1d040540c3c2ed8f73e04c578e7fb96d0b47d858bbb67e9b39ec2f4674b04250","2967e1d97d32605fc5ace49a10828800fbbefcc1e010f6004a9c88ef3ecdad88","f088e6944b2632bb7c93fa3c7ba1707914c05c00f9491e033f78a709d65d7cff")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("5d2204f3a20e163120f52a2e3595db19890050b2faa96c6cba6b094b0a52b0aa","7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a","ae7c868713e1d02b4db60128c651eb1e3f6a33c02544cc4cb57c3aa6c6581b6e","17205c43189c22dfcb278f5cc45c2562f622b0b6280dcd43cc1d3c274095eb90","a54fef5fe2af58f5bd75c3af44f1fba22b721f34406c5963b19c5376ab278cd1","1d040540c3c2ed8f73e04c578e7fb96d0b47d858bbb67e9b39ec2f4674b04250","2967e1d97d32605fc5ace49a10828800fbbefcc1e010f6004a9c88ef3ecdad88","f088e6944b2632bb7c93fa3c7ba1707914c05c00f9491e033f78a709d65d7cff")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("5d2204f3a20e163120f52a2e3595db19890050b2faa96c6cba6b094b0a52b0aa","7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a","ae7c868713e1d02b4db60128c651eb1e3f6a33c02544cc4cb57c3aa6c6581b6e","17205c43189c22dfcb278f5cc45c2562f622b0b6280dcd43cc1d3c274095eb90","a54fef5fe2af58f5bd75c3af44f1fba22b721f34406c5963b19c5376ab278cd1","1d040540c3c2ed8f73e04c578e7fb96d0b47d858bbb67e9b39ec2f4674b04250","2967e1d97d32605fc5ace49a10828800fbbefcc1e010f6004a9c88ef3ecdad88","f088e6944b2632bb7c93fa3c7ba1707914c05c00f9491e033f78a709d65d7cff")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("5d2204f3a20e163120f52a2e3595db19890050b2faa96c6cba6b094b0a52b0aa","7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a","ae7c868713e1d02b4db60128c651eb1e3f6a33c02544cc4cb57c3aa6c6581b6e","17205c43189c22dfcb278f5cc45c2562f622b0b6280dcd43cc1d3c274095eb90","a54fef5fe2af58f5bd75c3af44f1fba22b721f34406c5963b19c5376ab278cd1","1d040540c3c2ed8f73e04c578e7fb96d0b47d858bbb67e9b39ec2f4674b04250","2967e1d97d32605fc5ace49a10828800fbbefcc1e010f6004a9c88ef3ecdad88","f088e6944b2632bb7c93fa3c7ba1707914c05c00f9491e033f78a709d65d7cff")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("5d2204f3a20e163120f52a2e3595db19890050b2faa96c6cba6b094b0a52b0aa","7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a","ae7c868713e1d02b4db60128c651eb1e3f6a33c02544cc4cb57c3aa6c6581b6e","17205c43189c22dfcb278f5cc45c2562f622b0b6280dcd43cc1d3c274095eb90","a54fef5fe2af58f5bd75c3af44f1fba22b721f34406c5963b19c5376ab278cd1","1d040540c3c2ed8f73e04c578e7fb96d0b47d858bbb67e9b39ec2f4674b04250","2967e1d97d32605fc5ace49a10828800fbbefcc1e010f6004a9c88ef3ecdad88","f088e6944b2632bb7c93fa3c7ba1707914c05c00f9491e033f78a709d65d7cff")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("5d2204f3a20e163120f52a2e3595db19890050b2faa96c6cba6b094b0a52b0aa","7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a","ae7c868713e1d02b4db60128c651eb1e3f6a33c02544cc4cb57c3aa6c6581b6e","17205c43189c22dfcb278f5cc45c2562f622b0b6280dcd43cc1d3c274095eb90","a54fef5fe2af58f5bd75c3af44f1fba22b721f34406c5963b19c5376ab278cd1","1d040540c3c2ed8f73e04c578e7fb96d0b47d858bbb67e9b39ec2f4674b04250","2967e1d97d32605fc5ace49a10828800fbbefcc1e010f6004a9c88ef3ecdad88","f088e6944b2632bb7c93fa3c7ba1707914c05c00f9491e033f78a709d65d7cff")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("5d2204f3a20e163120f52a2e3595db19890050b2faa96c6cba6b094b0a52b0aa","7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a","ae7c868713e1d02b4db60128c651eb1e3f6a33c02544cc4cb57c3aa6c6581b6e","17205c43189c22dfcb278f5cc45c2562f622b0b6280dcd43cc1d3c274095eb90","a54fef5fe2af58f5bd75c3af44f1fba22b721f34406c5963b19c5376ab278cd1","1d040540c3c2ed8f73e04c578e7fb96d0b47d858bbb67e9b39ec2f4674b04250","2967e1d97d32605fc5ace49a10828800fbbefcc1e010f6004a9c88ef3ecdad88","f088e6944b2632bb7c93fa3c7ba1707914c05c00f9491e033f78a709d65d7cff")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("5d2204f3a20e163120f52a2e3595db19890050b2faa96c6cba6b094b0a52b0aa","7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a","ae7c868713e1d02b4db60128c651eb1e3f6a33c02544cc4cb57c3aa6c6581b6e","17205c43189c22dfcb278f5cc45c2562f622b0b6280dcd43cc1d3c274095eb90","a54fef5fe2af58f5bd75c3af44f1fba22b721f34406c5963b19c5376ab278cd1","1d040540c3c2ed8f73e04c578e7fb96d0b47d858bbb67e9b39ec2f4674b04250","2967e1d97d32605fc5ace49a10828800fbbefcc1e010f6004a9c88ef3ecdad88","f088e6944b2632bb7c93fa3c7ba1707914c05c00f9491e033f78a709d65d7cff")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("5d2204f3a20e163120f52a2e3595db19890050b2faa96c6cba6b094b0a52b0aa","7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a","ae7c868713e1d02b4db60128c651eb1e3f6a33c02544cc4cb57c3aa6c6581b6e","17205c43189c22dfcb278f5cc45c2562f622b0b6280dcd43cc1d3c274095eb90","a54fef5fe2af58f5bd75c3af44f1fba22b721f34406c5963b19c5376ab278cd1","1d040540c3c2ed8f73e04c578e7fb96d0b47d858bbb67e9b39ec2f4674b04250","2967e1d97d32605fc5ace49a10828800fbbefcc1e010f6004a9c88ef3ecdad88","f088e6944b2632bb7c93fa3c7ba1707914c05c00f9491e033f78a709d65d7cff")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("5d2204f3a20e163120f52a2e3595db19890050b2faa96c6cba6b094b0a52b0aa","7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a","ae7c868713e1d02b4db60128c651eb1e3f6a33c02544cc4cb57c3aa6c6581b6e","17205c43189c22dfcb278f5cc45c2562f622b0b6280dcd43cc1d3c274095eb90","a54fef5fe2af58f5bd75c3af44f1fba22b721f34406c5963b19c5376ab278cd1","1d040540c3c2ed8f73e04c578e7fb96d0b47d858bbb67e9b39ec2f4674b04250","2967e1d97d32605fc5ace49a10828800fbbefcc1e010f6004a9c88ef3ecdad88","f088e6944b2632bb7c93fa3c7ba1707914c05c00f9491e033f78a709d65d7cff")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("5d2204f3a20e163120f52a2e3595db19890050b2faa96c6cba6b094b0a52b0aa","7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a","ae7c868713e1d02b4db60128c651eb1e3f6a33c02544cc4cb57c3aa6c6581b6e","17205c43189c22dfcb278f5cc45c2562f622b0b6280dcd43cc1d3c274095eb90","a54fef5fe2af58f5bd75c3af44f1fba22b721f34406c5963b19c5376ab278cd1","1d040540c3c2ed8f73e04c578e7fb96d0b47d858bbb67e9b39ec2f4674b04250","2967e1d97d32605fc5ace49a10828800fbbefcc1e010f6004a9c88ef3ecdad88","f088e6944b2632bb7c93fa3c7ba1707914c05c00f9491e033f78a709d65d7cff")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("5d2204f3a20e163120f52a2e3595db19890050b2faa96c6cba6b094b0a52b0aa","7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a","ae7c868713e1d02b4db60128c651eb1e3f6a33c02544cc4cb57c3aa6c6581b6e","17205c43189c22dfcb278f5cc45c2562f622b0b6280dcd43cc1d3c274095eb90","a54fef5fe2af58f5bd75c3af44f1fba22b721f34406c5963b19c5376ab278cd1","1d040540c3c2ed8f73e04c578e7fb96d0b47d858bbb67e9b39ec2f4674b04250","2967e1d97d32605fc5ace49a10828800fbbefcc1e010f6004a9c88ef3ecdad88","f088e6944b2632bb7c93fa3c7ba1707914c05c00f9491e033f78a709d65d7cff")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("5d2204f3a20e163120f52a2e3595db19890050b2faa96c6cba6b094b0a52b0aa","7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a","ae7c868713e1d02b4db60128c651eb1e3f6a33c02544cc4cb57c3aa6c6581b6e","17205c43189c22dfcb278f5cc45c2562f622b0b6280dcd43cc1d3c274095eb90","a54fef5fe2af58f5bd75c3af44f1fba22b721f34406c5963b19c5376ab278cd1","1d040540c3c2ed8f73e04c578e7fb96d0b47d858bbb67e9b39ec2f4674b04250","2967e1d97d32605fc5ace49a10828800fbbefcc1e010f6004a9c88ef3ecdad88","f088e6944b2632bb7c93fa3c7ba1707914c05c00f9491e033f78a709d65d7cff")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("5d2204f3a20e163120f52a2e3595db19890050b2faa96c6cba6b094b0a52b0aa","7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a","ae7c868713e1d02b4db60128c651eb1e3f6a33c02544cc4cb57c3aa6c6581b6e","17205c43189c22dfcb278f5cc45c2562f622b0b6280dcd43cc1d3c274095eb90","a54fef5fe2af58f5bd75c3af44f1fba22b721f34406c5963b19c5376ab278cd1","1d040540c3c2ed8f73e04c578e7fb96d0b47d858bbb67e9b39ec2f4674b04250","2967e1d97d32605fc5ace49a10828800fbbefcc1e010f6004a9c88ef3ecdad88","f088e6944b2632bb7c93fa3c7ba1707914c05c00f9491e033f78a709d65d7cff")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("5d2204f3a20e163120f52a2e3595db19890050b2faa96c6cba6b094b0a52b0aa","7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a","ae7c868713e1d02b4db60128c651eb1e3f6a33c02544cc4cb57c3aa6c6581b6e","17205c43189c22dfcb278f5cc45c2562f622b0b6280dcd43cc1d3c274095eb90","a54fef5fe2af58f5bd75c3af44f1fba22b721f34406c5963b19c5376ab278cd1","1d040540c3c2ed8f73e04c578e7fb96d0b47d858bbb67e9b39ec2f4674b04250","2967e1d97d32605fc5ace49a10828800fbbefcc1e010f6004a9c88ef3ecdad88","f088e6944b2632bb7c93fa3c7ba1707914c05c00f9491e033f78a709d65d7cff")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("5d2204f3a20e163120f52a2e3595db19890050b2faa96c6cba6b094b0a52b0aa","7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a","ae7c868713e1d02b4db60128c651eb1e3f6a33c02544cc4cb57c3aa6c6581b6e","17205c43189c22dfcb278f5cc45c2562f622b0b6280dcd43cc1d3c274095eb90","a54fef5fe2af58f5bd75c3af44f1fba22b721f34406c5963b19c5376ab278cd1","1d040540c3c2ed8f73e04c578e7fb96d0b47d858bbb67e9b39ec2f4674b04250","2967e1d97d32605fc5ace49a10828800fbbefcc1e010f6004a9c88ef3ecdad88","f088e6944b2632bb7c93fa3c7ba1707914c05c00f9491e033f78a709d65d7cff")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("5d2204f3a20e163120f52a2e3595db19890050b2faa96c6cba6b094b0a52b0aa","7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a","ae7c868713e1d02b4db60128c651eb1e3f6a33c02544cc4cb57c3aa6c6581b6e","17205c43189c22dfcb278f5cc45c2562f622b0b6280dcd43cc1d3c274095eb90","a54fef5fe2af58f5bd75c3af44f1fba22b721f34406c5963b19c5376ab278cd1","1d040540c3c2ed8f73e04c578e7fb96d0b47d858bbb67e9b39ec2f4674b04250","2967e1d97d32605fc5ace49a10828800fbbefcc1e010f6004a9c88ef3ecdad88","f088e6944b2632bb7c93fa3c7ba1707914c05c00f9491e033f78a709d65d7cff")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("5d2204f3a20e163120f52a2e3595db19890050b2faa96c6cba6b094b0a52b0aa","7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a","ae7c868713e1d02b4db60128c651eb1e3f6a33c02544cc4cb57c3aa6c6581b6e","17205c43189c22dfcb278f5cc45c2562f622b0b6280dcd43cc1d3c274095eb90","a54fef5fe2af58f5bd75c3af44f1fba22b721f34406c5963b19c5376ab278cd1","1d040540c3c2ed8f73e04c578e7fb96d0b47d858bbb67e9b39ec2f4674b04250","2967e1d97d32605fc5ace49a10828800fbbefcc1e010f6004a9c88ef3ecdad88","f088e6944b2632bb7c93fa3c7ba1707914c05c00f9491e033f78a709d65d7cff")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("5d2204f3a20e163120f52a2e3595db19890050b2faa96c6cba6b094b0a52b0aa","7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a","ae7c868713e1d02b4db60128c651eb1e3f6a33c02544cc4cb57c3aa6c6581b6e","17205c43189c22dfcb278f5cc45c2562f622b0b6280dcd43cc1d3c274095eb90","a54fef5fe2af58f5bd75c3af44f1fba22b721f34406c5963b19c5376ab278cd1","1d040540c3c2ed8f73e04c578e7fb96d0b47d858bbb67e9b39ec2f4674b04250","2967e1d97d32605fc5ace49a10828800fbbefcc1e010f6004a9c88ef3ecdad88","f088e6944b2632bb7c93fa3c7ba1707914c05c00f9491e033f78a709d65d7cff")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("5d2204f3a20e163120f52a2e3595db19890050b2faa96c6cba6b094b0a52b0aa","7883f01096db9bcf090c2317749b6873036c27ba92451b212b8645770e1f0b8a","ae7c868713e1d02b4db60128c651eb1e3f6a33c02544cc4cb57c3aa6c6581b6e","17205c43189c22dfcb278f5cc45c2562f622b0b6280dcd43cc1d3c274095eb90","a54fef5fe2af58f5bd75c3af44f1fba22b721f34406c5963b19c5376ab278cd1","1d040540c3c2ed8f73e04c578e7fb96d0b47d858bbb67e9b39ec2f4674b04250","2967e1d97d32605fc5ace49a10828800fbbefcc1e010f6004a9c88ef3ecdad88","f088e6944b2632bb7c93fa3c7ba1707914c05c00f9491e033f78a709d65d7cff")
