index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("0005144ebb03d2f5a5b17e21362c628ddc1705e910cfd56032b7b55c932b68da","20e2093192e7b7b96c067cd8f16cee4ccb51e8c10676050646877bc83dc34a27","31e93f3226377174335eabda90bc771425043cf412dd91b257f1814be085c715","6586c7399b24c4b29c2173ec47a733cab38abe3d175b47bbdd7188e3ab1dd0c3","536eaf59d72519d5e1cc52e98e212fdf52855f1828d3326fcd22be5071b231a0","b5f6912f1291dc26442e02bb2e79c7c13613a87d23ddf0c294c9d02b231aab70")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("0005144ebb03d2f5a5b17e21362c628ddc1705e910cfd56032b7b55c932b68da","20e2093192e7b7b96c067cd8f16cee4ccb51e8c10676050646877bc83dc34a27","31e93f3226377174335eabda90bc771425043cf412dd91b257f1814be085c715","6586c7399b24c4b29c2173ec47a733cab38abe3d175b47bbdd7188e3ab1dd0c3","536eaf59d72519d5e1cc52e98e212fdf52855f1828d3326fcd22be5071b231a0","b5f6912f1291dc26442e02bb2e79c7c13613a87d23ddf0c294c9d02b231aab70")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("0005144ebb03d2f5a5b17e21362c628ddc1705e910cfd56032b7b55c932b68da","20e2093192e7b7b96c067cd8f16cee4ccb51e8c10676050646877bc83dc34a27","31e93f3226377174335eabda90bc771425043cf412dd91b257f1814be085c715","6586c7399b24c4b29c2173ec47a733cab38abe3d175b47bbdd7188e3ab1dd0c3","536eaf59d72519d5e1cc52e98e212fdf52855f1828d3326fcd22be5071b231a0","b5f6912f1291dc26442e02bb2e79c7c13613a87d23ddf0c294c9d02b231aab70")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring64 NOT NULL AND customstring64 IN ("0005144ebb03d2f5a5b17e21362c628ddc1705e910cfd56032b7b55c932b68da","20e2093192e7b7b96c067cd8f16cee4ccb51e8c10676050646877bc83dc34a27","31e93f3226377174335eabda90bc771425043cf412dd91b257f1814be085c715","6586c7399b24c4b29c2173ec47a733cab38abe3d175b47bbdd7188e3ab1dd0c3","536eaf59d72519d5e1cc52e98e212fdf52855f1828d3326fcd22be5071b231a0","b5f6912f1291dc26442e02bb2e79c7c13613a87d23ddf0c294c9d02b231aab70")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("0005144ebb03d2f5a5b17e21362c628ddc1705e910cfd56032b7b55c932b68da","20e2093192e7b7b96c067cd8f16cee4ccb51e8c10676050646877bc83dc34a27","31e93f3226377174335eabda90bc771425043cf412dd91b257f1814be085c715","6586c7399b24c4b29c2173ec47a733cab38abe3d175b47bbdd7188e3ab1dd0c3","536eaf59d72519d5e1cc52e98e212fdf52855f1828d3326fcd22be5071b231a0","b5f6912f1291dc26442e02bb2e79c7c13613a87d23ddf0c294c9d02b231aab70")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("0005144ebb03d2f5a5b17e21362c628ddc1705e910cfd56032b7b55c932b68da","20e2093192e7b7b96c067cd8f16cee4ccb51e8c10676050646877bc83dc34a27","31e93f3226377174335eabda90bc771425043cf412dd91b257f1814be085c715","6586c7399b24c4b29c2173ec47a733cab38abe3d175b47bbdd7188e3ab1dd0c3","536eaf59d72519d5e1cc52e98e212fdf52855f1828d3326fcd22be5071b231a0","b5f6912f1291dc26442e02bb2e79c7c13613a87d23ddf0c294c9d02b231aab70")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("0005144ebb03d2f5a5b17e21362c628ddc1705e910cfd56032b7b55c932b68da","20e2093192e7b7b96c067cd8f16cee4ccb51e8c10676050646877bc83dc34a27","31e93f3226377174335eabda90bc771425043cf412dd91b257f1814be085c715","6586c7399b24c4b29c2173ec47a733cab38abe3d175b47bbdd7188e3ab1dd0c3","536eaf59d72519d5e1cc52e98e212fdf52855f1828d3326fcd22be5071b231a0","b5f6912f1291dc26442e02bb2e79c7c13613a87d23ddf0c294c9d02b231aab70")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("0005144ebb03d2f5a5b17e21362c628ddc1705e910cfd56032b7b55c932b68da","20e2093192e7b7b96c067cd8f16cee4ccb51e8c10676050646877bc83dc34a27","31e93f3226377174335eabda90bc771425043cf412dd91b257f1814be085c715","6586c7399b24c4b29c2173ec47a733cab38abe3d175b47bbdd7188e3ab1dd0c3","536eaf59d72519d5e1cc52e98e212fdf52855f1828d3326fcd22be5071b231a0","b5f6912f1291dc26442e02bb2e79c7c13613a87d23ddf0c294c9d02b231aab70")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("0005144ebb03d2f5a5b17e21362c628ddc1705e910cfd56032b7b55c932b68da","20e2093192e7b7b96c067cd8f16cee4ccb51e8c10676050646877bc83dc34a27","31e93f3226377174335eabda90bc771425043cf412dd91b257f1814be085c715","6586c7399b24c4b29c2173ec47a733cab38abe3d175b47bbdd7188e3ab1dd0c3","536eaf59d72519d5e1cc52e98e212fdf52855f1828d3326fcd22be5071b231a0","b5f6912f1291dc26442e02bb2e79c7c13613a87d23ddf0c294c9d02b231aab70")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("0005144ebb03d2f5a5b17e21362c628ddc1705e910cfd56032b7b55c932b68da","20e2093192e7b7b96c067cd8f16cee4ccb51e8c10676050646877bc83dc34a27","31e93f3226377174335eabda90bc771425043cf412dd91b257f1814be085c715","6586c7399b24c4b29c2173ec47a733cab38abe3d175b47bbdd7188e3ab1dd0c3","536eaf59d72519d5e1cc52e98e212fdf52855f1828d3326fcd22be5071b231a0","b5f6912f1291dc26442e02bb2e79c7c13613a87d23ddf0c294c9d02b231aab70")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("0005144ebb03d2f5a5b17e21362c628ddc1705e910cfd56032b7b55c932b68da","20e2093192e7b7b96c067cd8f16cee4ccb51e8c10676050646877bc83dc34a27","31e93f3226377174335eabda90bc771425043cf412dd91b257f1814be085c715","6586c7399b24c4b29c2173ec47a733cab38abe3d175b47bbdd7188e3ab1dd0c3","536eaf59d72519d5e1cc52e98e212fdf52855f1828d3326fcd22be5071b231a0","b5f6912f1291dc26442e02bb2e79c7c13613a87d23ddf0c294c9d02b231aab70")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("0005144ebb03d2f5a5b17e21362c628ddc1705e910cfd56032b7b55c932b68da","20e2093192e7b7b96c067cd8f16cee4ccb51e8c10676050646877bc83dc34a27","31e93f3226377174335eabda90bc771425043cf412dd91b257f1814be085c715","6586c7399b24c4b29c2173ec47a733cab38abe3d175b47bbdd7188e3ab1dd0c3","536eaf59d72519d5e1cc52e98e212fdf52855f1828d3326fcd22be5071b231a0","b5f6912f1291dc26442e02bb2e79c7c13613a87d23ddf0c294c9d02b231aab70")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("0005144ebb03d2f5a5b17e21362c628ddc1705e910cfd56032b7b55c932b68da","20e2093192e7b7b96c067cd8f16cee4ccb51e8c10676050646877bc83dc34a27","31e93f3226377174335eabda90bc771425043cf412dd91b257f1814be085c715","6586c7399b24c4b29c2173ec47a733cab38abe3d175b47bbdd7188e3ab1dd0c3","536eaf59d72519d5e1cc52e98e212fdf52855f1828d3326fcd22be5071b231a0","b5f6912f1291dc26442e02bb2e79c7c13613a87d23ddf0c294c9d02b231aab70")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("0005144ebb03d2f5a5b17e21362c628ddc1705e910cfd56032b7b55c932b68da","20e2093192e7b7b96c067cd8f16cee4ccb51e8c10676050646877bc83dc34a27","31e93f3226377174335eabda90bc771425043cf412dd91b257f1814be085c715","6586c7399b24c4b29c2173ec47a733cab38abe3d175b47bbdd7188e3ab1dd0c3","536eaf59d72519d5e1cc52e98e212fdf52855f1828d3326fcd22be5071b231a0","b5f6912f1291dc26442e02bb2e79c7c13613a87d23ddf0c294c9d02b231aab70")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("0005144ebb03d2f5a5b17e21362c628ddc1705e910cfd56032b7b55c932b68da","20e2093192e7b7b96c067cd8f16cee4ccb51e8c10676050646877bc83dc34a27","31e93f3226377174335eabda90bc771425043cf412dd91b257f1814be085c715","6586c7399b24c4b29c2173ec47a733cab38abe3d175b47bbdd7188e3ab1dd0c3","536eaf59d72519d5e1cc52e98e212fdf52855f1828d3326fcd22be5071b231a0","b5f6912f1291dc26442e02bb2e79c7c13613a87d23ddf0c294c9d02b231aab70")
index=activity AND rg_functionality="Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("0005144ebb03d2f5a5b17e21362c628ddc1705e910cfd56032b7b55c932b68da","20e2093192e7b7b96c067cd8f16cee4ccb51e8c10676050646877bc83dc34a27","31e93f3226377174335eabda90bc771425043cf412dd91b257f1814be085c715","6586c7399b24c4b29c2173ec47a733cab38abe3d175b47bbdd7188e3ab1dd0c3","536eaf59d72519d5e1cc52e98e212fdf52855f1828d3326fcd22be5071b231a0","b5f6912f1291dc26442e02bb2e79c7c13613a87d23ddf0c294c9d02b231aab70")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("0005144ebb03d2f5a5b17e21362c628ddc1705e910cfd56032b7b55c932b68da","20e2093192e7b7b96c067cd8f16cee4ccb51e8c10676050646877bc83dc34a27","31e93f3226377174335eabda90bc771425043cf412dd91b257f1814be085c715","6586c7399b24c4b29c2173ec47a733cab38abe3d175b47bbdd7188e3ab1dd0c3","536eaf59d72519d5e1cc52e98e212fdf52855f1828d3326fcd22be5071b231a0","b5f6912f1291dc26442e02bb2e79c7c13613a87d23ddf0c294c9d02b231aab70")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("0005144ebb03d2f5a5b17e21362c628ddc1705e910cfd56032b7b55c932b68da","20e2093192e7b7b96c067cd8f16cee4ccb51e8c10676050646877bc83dc34a27","31e93f3226377174335eabda90bc771425043cf412dd91b257f1814be085c715","6586c7399b24c4b29c2173ec47a733cab38abe3d175b47bbdd7188e3ab1dd0c3","536eaf59d72519d5e1cc52e98e212fdf52855f1828d3326fcd22be5071b231a0","b5f6912f1291dc26442e02bb2e79c7c13613a87d23ddf0c294c9d02b231aab70")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("0005144ebb03d2f5a5b17e21362c628ddc1705e910cfd56032b7b55c932b68da","20e2093192e7b7b96c067cd8f16cee4ccb51e8c10676050646877bc83dc34a27","31e93f3226377174335eabda90bc771425043cf412dd91b257f1814be085c715","6586c7399b24c4b29c2173ec47a733cab38abe3d175b47bbdd7188e3ab1dd0c3","536eaf59d72519d5e1cc52e98e212fdf52855f1828d3326fcd22be5071b231a0","b5f6912f1291dc26442e02bb2e79c7c13613a87d23ddf0c294c9d02b231aab70")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("0005144ebb03d2f5a5b17e21362c628ddc1705e910cfd56032b7b55c932b68da","20e2093192e7b7b96c067cd8f16cee4ccb51e8c10676050646877bc83dc34a27","31e93f3226377174335eabda90bc771425043cf412dd91b257f1814be085c715","6586c7399b24c4b29c2173ec47a733cab38abe3d175b47bbdd7188e3ab1dd0c3","536eaf59d72519d5e1cc52e98e212fdf52855f1828d3326fcd22be5071b231a0","b5f6912f1291dc26442e02bb2e79c7c13613a87d23ddf0c294c9d02b231aab70")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("0005144ebb03d2f5a5b17e21362c628ddc1705e910cfd56032b7b55c932b68da","20e2093192e7b7b96c067cd8f16cee4ccb51e8c10676050646877bc83dc34a27","31e93f3226377174335eabda90bc771425043cf412dd91b257f1814be085c715","6586c7399b24c4b29c2173ec47a733cab38abe3d175b47bbdd7188e3ab1dd0c3","536eaf59d72519d5e1cc52e98e212fdf52855f1828d3326fcd22be5071b231a0","b5f6912f1291dc26442e02bb2e79c7c13613a87d23ddf0c294c9d02b231aab70")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("0005144ebb03d2f5a5b17e21362c628ddc1705e910cfd56032b7b55c932b68da","20e2093192e7b7b96c067cd8f16cee4ccb51e8c10676050646877bc83dc34a27","31e93f3226377174335eabda90bc771425043cf412dd91b257f1814be085c715","6586c7399b24c4b29c2173ec47a733cab38abe3d175b47bbdd7188e3ab1dd0c3","536eaf59d72519d5e1cc52e98e212fdf52855f1828d3326fcd22be5071b231a0","b5f6912f1291dc26442e02bb2e79c7c13613a87d23ddf0c294c9d02b231aab70")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("0005144ebb03d2f5a5b17e21362c628ddc1705e910cfd56032b7b55c932b68da","20e2093192e7b7b96c067cd8f16cee4ccb51e8c10676050646877bc83dc34a27","31e93f3226377174335eabda90bc771425043cf412dd91b257f1814be085c715","6586c7399b24c4b29c2173ec47a733cab38abe3d175b47bbdd7188e3ab1dd0c3","536eaf59d72519d5e1cc52e98e212fdf52855f1828d3326fcd22be5071b231a0","b5f6912f1291dc26442e02bb2e79c7c13613a87d23ddf0c294c9d02b231aab70")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring64 NOT NULL AND customstring64 IN ("0005144ebb03d2f5a5b17e21362c628ddc1705e910cfd56032b7b55c932b68da","20e2093192e7b7b96c067cd8f16cee4ccb51e8c10676050646877bc83dc34a27","31e93f3226377174335eabda90bc771425043cf412dd91b257f1814be085c715","6586c7399b24c4b29c2173ec47a733cab38abe3d175b47bbdd7188e3ab1dd0c3","536eaf59d72519d5e1cc52e98e212fdf52855f1828d3326fcd22be5071b231a0","b5f6912f1291dc26442e02bb2e79c7c13613a87d23ddf0c294c9d02b231aab70")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("0005144ebb03d2f5a5b17e21362c628ddc1705e910cfd56032b7b55c932b68da","20e2093192e7b7b96c067cd8f16cee4ccb51e8c10676050646877bc83dc34a27","31e93f3226377174335eabda90bc771425043cf412dd91b257f1814be085c715","6586c7399b24c4b29c2173ec47a733cab38abe3d175b47bbdd7188e3ab1dd0c3","536eaf59d72519d5e1cc52e98e212fdf52855f1828d3326fcd22be5071b231a0","b5f6912f1291dc26442e02bb2e79c7c13613a87d23ddf0c294c9d02b231aab70")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("0005144ebb03d2f5a5b17e21362c628ddc1705e910cfd56032b7b55c932b68da","20e2093192e7b7b96c067cd8f16cee4ccb51e8c10676050646877bc83dc34a27","31e93f3226377174335eabda90bc771425043cf412dd91b257f1814be085c715","6586c7399b24c4b29c2173ec47a733cab38abe3d175b47bbdd7188e3ab1dd0c3","536eaf59d72519d5e1cc52e98e212fdf52855f1828d3326fcd22be5071b231a0","b5f6912f1291dc26442e02bb2e79c7c13613a87d23ddf0c294c9d02b231aab70")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("0005144ebb03d2f5a5b17e21362c628ddc1705e910cfd56032b7b55c932b68da","20e2093192e7b7b96c067cd8f16cee4ccb51e8c10676050646877bc83dc34a27","31e93f3226377174335eabda90bc771425043cf412dd91b257f1814be085c715","6586c7399b24c4b29c2173ec47a733cab38abe3d175b47bbdd7188e3ab1dd0c3","536eaf59d72519d5e1cc52e98e212fdf52855f1828d3326fcd22be5071b231a0","b5f6912f1291dc26442e02bb2e79c7c13613a87d23ddf0c294c9d02b231aab70")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring64 NOT NULL AND customstring64 IN ("0005144ebb03d2f5a5b17e21362c628ddc1705e910cfd56032b7b55c932b68da","20e2093192e7b7b96c067cd8f16cee4ccb51e8c10676050646877bc83dc34a27","31e93f3226377174335eabda90bc771425043cf412dd91b257f1814be085c715","6586c7399b24c4b29c2173ec47a733cab38abe3d175b47bbdd7188e3ab1dd0c3","536eaf59d72519d5e1cc52e98e212fdf52855f1828d3326fcd22be5071b231a0","b5f6912f1291dc26442e02bb2e79c7c13613a87d23ddf0c294c9d02b231aab70")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("0005144ebb03d2f5a5b17e21362c628ddc1705e910cfd56032b7b55c932b68da","20e2093192e7b7b96c067cd8f16cee4ccb51e8c10676050646877bc83dc34a27","31e93f3226377174335eabda90bc771425043cf412dd91b257f1814be085c715","6586c7399b24c4b29c2173ec47a733cab38abe3d175b47bbdd7188e3ab1dd0c3","536eaf59d72519d5e1cc52e98e212fdf52855f1828d3326fcd22be5071b231a0","b5f6912f1291dc26442e02bb2e79c7c13613a87d23ddf0c294c9d02b231aab70")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("0005144ebb03d2f5a5b17e21362c628ddc1705e910cfd56032b7b55c932b68da","20e2093192e7b7b96c067cd8f16cee4ccb51e8c10676050646877bc83dc34a27","31e93f3226377174335eabda90bc771425043cf412dd91b257f1814be085c715","6586c7399b24c4b29c2173ec47a733cab38abe3d175b47bbdd7188e3ab1dd0c3","536eaf59d72519d5e1cc52e98e212fdf52855f1828d3326fcd22be5071b231a0","b5f6912f1291dc26442e02bb2e79c7c13613a87d23ddf0c294c9d02b231aab70")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("0005144ebb03d2f5a5b17e21362c628ddc1705e910cfd56032b7b55c932b68da","20e2093192e7b7b96c067cd8f16cee4ccb51e8c10676050646877bc83dc34a27","31e93f3226377174335eabda90bc771425043cf412dd91b257f1814be085c715","6586c7399b24c4b29c2173ec47a733cab38abe3d175b47bbdd7188e3ab1dd0c3","536eaf59d72519d5e1cc52e98e212fdf52855f1828d3326fcd22be5071b231a0","b5f6912f1291dc26442e02bb2e79c7c13613a87d23ddf0c294c9d02b231aab70")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring64 NOT NULL AND customstring64 IN ("0005144ebb03d2f5a5b17e21362c628ddc1705e910cfd56032b7b55c932b68da","20e2093192e7b7b96c067cd8f16cee4ccb51e8c10676050646877bc83dc34a27","31e93f3226377174335eabda90bc771425043cf412dd91b257f1814be085c715","6586c7399b24c4b29c2173ec47a733cab38abe3d175b47bbdd7188e3ab1dd0c3","536eaf59d72519d5e1cc52e98e212fdf52855f1828d3326fcd22be5071b231a0","b5f6912f1291dc26442e02bb2e79c7c13613a87d23ddf0c294c9d02b231aab70")
