index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("d7130e42663e95d23c547d57e55099c239fa249ce3f6537b7f2a8033f3aa73de","1f6369b42a76d02f32558912b57ede4f5ff0a90b18d3b96a4fe24120fa2c300c","0ca0febadb1024b0a8961f21edbf3f6df731ca4dd82702de3793e757687aefbc","9f31a1908afb23a1029c079ee9ba8bdf0f4c815addbe8eac85b4163e02b5e777","5db93f1e882f4d7d6a9669f8b1ab091c0545e12a317ba94c1535eb86bc17bd5b")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("d7130e42663e95d23c547d57e55099c239fa249ce3f6537b7f2a8033f3aa73de","1f6369b42a76d02f32558912b57ede4f5ff0a90b18d3b96a4fe24120fa2c300c","0ca0febadb1024b0a8961f21edbf3f6df731ca4dd82702de3793e757687aefbc","9f31a1908afb23a1029c079ee9ba8bdf0f4c815addbe8eac85b4163e02b5e777","5db93f1e882f4d7d6a9669f8b1ab091c0545e12a317ba94c1535eb86bc17bd5b")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("d7130e42663e95d23c547d57e55099c239fa249ce3f6537b7f2a8033f3aa73de","1f6369b42a76d02f32558912b57ede4f5ff0a90b18d3b96a4fe24120fa2c300c","0ca0febadb1024b0a8961f21edbf3f6df731ca4dd82702de3793e757687aefbc","9f31a1908afb23a1029c079ee9ba8bdf0f4c815addbe8eac85b4163e02b5e777","5db93f1e882f4d7d6a9669f8b1ab091c0545e12a317ba94c1535eb86bc17bd5b")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring64 NOT NULL AND customstring64 IN ("d7130e42663e95d23c547d57e55099c239fa249ce3f6537b7f2a8033f3aa73de","1f6369b42a76d02f32558912b57ede4f5ff0a90b18d3b96a4fe24120fa2c300c","0ca0febadb1024b0a8961f21edbf3f6df731ca4dd82702de3793e757687aefbc","9f31a1908afb23a1029c079ee9ba8bdf0f4c815addbe8eac85b4163e02b5e777","5db93f1e882f4d7d6a9669f8b1ab091c0545e12a317ba94c1535eb86bc17bd5b")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("d7130e42663e95d23c547d57e55099c239fa249ce3f6537b7f2a8033f3aa73de","1f6369b42a76d02f32558912b57ede4f5ff0a90b18d3b96a4fe24120fa2c300c","0ca0febadb1024b0a8961f21edbf3f6df731ca4dd82702de3793e757687aefbc","9f31a1908afb23a1029c079ee9ba8bdf0f4c815addbe8eac85b4163e02b5e777","5db93f1e882f4d7d6a9669f8b1ab091c0545e12a317ba94c1535eb86bc17bd5b")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("d7130e42663e95d23c547d57e55099c239fa249ce3f6537b7f2a8033f3aa73de","1f6369b42a76d02f32558912b57ede4f5ff0a90b18d3b96a4fe24120fa2c300c","0ca0febadb1024b0a8961f21edbf3f6df731ca4dd82702de3793e757687aefbc","9f31a1908afb23a1029c079ee9ba8bdf0f4c815addbe8eac85b4163e02b5e777","5db93f1e882f4d7d6a9669f8b1ab091c0545e12a317ba94c1535eb86bc17bd5b")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("d7130e42663e95d23c547d57e55099c239fa249ce3f6537b7f2a8033f3aa73de","1f6369b42a76d02f32558912b57ede4f5ff0a90b18d3b96a4fe24120fa2c300c","0ca0febadb1024b0a8961f21edbf3f6df731ca4dd82702de3793e757687aefbc","9f31a1908afb23a1029c079ee9ba8bdf0f4c815addbe8eac85b4163e02b5e777","5db93f1e882f4d7d6a9669f8b1ab091c0545e12a317ba94c1535eb86bc17bd5b")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("d7130e42663e95d23c547d57e55099c239fa249ce3f6537b7f2a8033f3aa73de","1f6369b42a76d02f32558912b57ede4f5ff0a90b18d3b96a4fe24120fa2c300c","0ca0febadb1024b0a8961f21edbf3f6df731ca4dd82702de3793e757687aefbc","9f31a1908afb23a1029c079ee9ba8bdf0f4c815addbe8eac85b4163e02b5e777","5db93f1e882f4d7d6a9669f8b1ab091c0545e12a317ba94c1535eb86bc17bd5b")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("d7130e42663e95d23c547d57e55099c239fa249ce3f6537b7f2a8033f3aa73de","1f6369b42a76d02f32558912b57ede4f5ff0a90b18d3b96a4fe24120fa2c300c","0ca0febadb1024b0a8961f21edbf3f6df731ca4dd82702de3793e757687aefbc","9f31a1908afb23a1029c079ee9ba8bdf0f4c815addbe8eac85b4163e02b5e777","5db93f1e882f4d7d6a9669f8b1ab091c0545e12a317ba94c1535eb86bc17bd5b")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("d7130e42663e95d23c547d57e55099c239fa249ce3f6537b7f2a8033f3aa73de","1f6369b42a76d02f32558912b57ede4f5ff0a90b18d3b96a4fe24120fa2c300c","0ca0febadb1024b0a8961f21edbf3f6df731ca4dd82702de3793e757687aefbc","9f31a1908afb23a1029c079ee9ba8bdf0f4c815addbe8eac85b4163e02b5e777","5db93f1e882f4d7d6a9669f8b1ab091c0545e12a317ba94c1535eb86bc17bd5b")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("d7130e42663e95d23c547d57e55099c239fa249ce3f6537b7f2a8033f3aa73de","1f6369b42a76d02f32558912b57ede4f5ff0a90b18d3b96a4fe24120fa2c300c","0ca0febadb1024b0a8961f21edbf3f6df731ca4dd82702de3793e757687aefbc","9f31a1908afb23a1029c079ee9ba8bdf0f4c815addbe8eac85b4163e02b5e777","5db93f1e882f4d7d6a9669f8b1ab091c0545e12a317ba94c1535eb86bc17bd5b")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("d7130e42663e95d23c547d57e55099c239fa249ce3f6537b7f2a8033f3aa73de","1f6369b42a76d02f32558912b57ede4f5ff0a90b18d3b96a4fe24120fa2c300c","0ca0febadb1024b0a8961f21edbf3f6df731ca4dd82702de3793e757687aefbc","9f31a1908afb23a1029c079ee9ba8bdf0f4c815addbe8eac85b4163e02b5e777","5db93f1e882f4d7d6a9669f8b1ab091c0545e12a317ba94c1535eb86bc17bd5b")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("d7130e42663e95d23c547d57e55099c239fa249ce3f6537b7f2a8033f3aa73de","1f6369b42a76d02f32558912b57ede4f5ff0a90b18d3b96a4fe24120fa2c300c","0ca0febadb1024b0a8961f21edbf3f6df731ca4dd82702de3793e757687aefbc","9f31a1908afb23a1029c079ee9ba8bdf0f4c815addbe8eac85b4163e02b5e777","5db93f1e882f4d7d6a9669f8b1ab091c0545e12a317ba94c1535eb86bc17bd5b")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("d7130e42663e95d23c547d57e55099c239fa249ce3f6537b7f2a8033f3aa73de","1f6369b42a76d02f32558912b57ede4f5ff0a90b18d3b96a4fe24120fa2c300c","0ca0febadb1024b0a8961f21edbf3f6df731ca4dd82702de3793e757687aefbc","9f31a1908afb23a1029c079ee9ba8bdf0f4c815addbe8eac85b4163e02b5e777","5db93f1e882f4d7d6a9669f8b1ab091c0545e12a317ba94c1535eb86bc17bd5b")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("d7130e42663e95d23c547d57e55099c239fa249ce3f6537b7f2a8033f3aa73de","1f6369b42a76d02f32558912b57ede4f5ff0a90b18d3b96a4fe24120fa2c300c","0ca0febadb1024b0a8961f21edbf3f6df731ca4dd82702de3793e757687aefbc","9f31a1908afb23a1029c079ee9ba8bdf0f4c815addbe8eac85b4163e02b5e777","5db93f1e882f4d7d6a9669f8b1ab091c0545e12a317ba94c1535eb86bc17bd5b")
index=activity AND rg_functionality="Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("d7130e42663e95d23c547d57e55099c239fa249ce3f6537b7f2a8033f3aa73de","1f6369b42a76d02f32558912b57ede4f5ff0a90b18d3b96a4fe24120fa2c300c","0ca0febadb1024b0a8961f21edbf3f6df731ca4dd82702de3793e757687aefbc","9f31a1908afb23a1029c079ee9ba8bdf0f4c815addbe8eac85b4163e02b5e777","5db93f1e882f4d7d6a9669f8b1ab091c0545e12a317ba94c1535eb86bc17bd5b")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("d7130e42663e95d23c547d57e55099c239fa249ce3f6537b7f2a8033f3aa73de","1f6369b42a76d02f32558912b57ede4f5ff0a90b18d3b96a4fe24120fa2c300c","0ca0febadb1024b0a8961f21edbf3f6df731ca4dd82702de3793e757687aefbc","9f31a1908afb23a1029c079ee9ba8bdf0f4c815addbe8eac85b4163e02b5e777","5db93f1e882f4d7d6a9669f8b1ab091c0545e12a317ba94c1535eb86bc17bd5b")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("d7130e42663e95d23c547d57e55099c239fa249ce3f6537b7f2a8033f3aa73de","1f6369b42a76d02f32558912b57ede4f5ff0a90b18d3b96a4fe24120fa2c300c","0ca0febadb1024b0a8961f21edbf3f6df731ca4dd82702de3793e757687aefbc","9f31a1908afb23a1029c079ee9ba8bdf0f4c815addbe8eac85b4163e02b5e777","5db93f1e882f4d7d6a9669f8b1ab091c0545e12a317ba94c1535eb86bc17bd5b")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("d7130e42663e95d23c547d57e55099c239fa249ce3f6537b7f2a8033f3aa73de","1f6369b42a76d02f32558912b57ede4f5ff0a90b18d3b96a4fe24120fa2c300c","0ca0febadb1024b0a8961f21edbf3f6df731ca4dd82702de3793e757687aefbc","9f31a1908afb23a1029c079ee9ba8bdf0f4c815addbe8eac85b4163e02b5e777","5db93f1e882f4d7d6a9669f8b1ab091c0545e12a317ba94c1535eb86bc17bd5b")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("d7130e42663e95d23c547d57e55099c239fa249ce3f6537b7f2a8033f3aa73de","1f6369b42a76d02f32558912b57ede4f5ff0a90b18d3b96a4fe24120fa2c300c","0ca0febadb1024b0a8961f21edbf3f6df731ca4dd82702de3793e757687aefbc","9f31a1908afb23a1029c079ee9ba8bdf0f4c815addbe8eac85b4163e02b5e777","5db93f1e882f4d7d6a9669f8b1ab091c0545e12a317ba94c1535eb86bc17bd5b")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("d7130e42663e95d23c547d57e55099c239fa249ce3f6537b7f2a8033f3aa73de","1f6369b42a76d02f32558912b57ede4f5ff0a90b18d3b96a4fe24120fa2c300c","0ca0febadb1024b0a8961f21edbf3f6df731ca4dd82702de3793e757687aefbc","9f31a1908afb23a1029c079ee9ba8bdf0f4c815addbe8eac85b4163e02b5e777","5db93f1e882f4d7d6a9669f8b1ab091c0545e12a317ba94c1535eb86bc17bd5b")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("d7130e42663e95d23c547d57e55099c239fa249ce3f6537b7f2a8033f3aa73de","1f6369b42a76d02f32558912b57ede4f5ff0a90b18d3b96a4fe24120fa2c300c","0ca0febadb1024b0a8961f21edbf3f6df731ca4dd82702de3793e757687aefbc","9f31a1908afb23a1029c079ee9ba8bdf0f4c815addbe8eac85b4163e02b5e777","5db93f1e882f4d7d6a9669f8b1ab091c0545e12a317ba94c1535eb86bc17bd5b")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("d7130e42663e95d23c547d57e55099c239fa249ce3f6537b7f2a8033f3aa73de","1f6369b42a76d02f32558912b57ede4f5ff0a90b18d3b96a4fe24120fa2c300c","0ca0febadb1024b0a8961f21edbf3f6df731ca4dd82702de3793e757687aefbc","9f31a1908afb23a1029c079ee9ba8bdf0f4c815addbe8eac85b4163e02b5e777","5db93f1e882f4d7d6a9669f8b1ab091c0545e12a317ba94c1535eb86bc17bd5b")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring64 NOT NULL AND customstring64 IN ("d7130e42663e95d23c547d57e55099c239fa249ce3f6537b7f2a8033f3aa73de","1f6369b42a76d02f32558912b57ede4f5ff0a90b18d3b96a4fe24120fa2c300c","0ca0febadb1024b0a8961f21edbf3f6df731ca4dd82702de3793e757687aefbc","9f31a1908afb23a1029c079ee9ba8bdf0f4c815addbe8eac85b4163e02b5e777","5db93f1e882f4d7d6a9669f8b1ab091c0545e12a317ba94c1535eb86bc17bd5b")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("d7130e42663e95d23c547d57e55099c239fa249ce3f6537b7f2a8033f3aa73de","1f6369b42a76d02f32558912b57ede4f5ff0a90b18d3b96a4fe24120fa2c300c","0ca0febadb1024b0a8961f21edbf3f6df731ca4dd82702de3793e757687aefbc","9f31a1908afb23a1029c079ee9ba8bdf0f4c815addbe8eac85b4163e02b5e777","5db93f1e882f4d7d6a9669f8b1ab091c0545e12a317ba94c1535eb86bc17bd5b")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("d7130e42663e95d23c547d57e55099c239fa249ce3f6537b7f2a8033f3aa73de","1f6369b42a76d02f32558912b57ede4f5ff0a90b18d3b96a4fe24120fa2c300c","0ca0febadb1024b0a8961f21edbf3f6df731ca4dd82702de3793e757687aefbc","9f31a1908afb23a1029c079ee9ba8bdf0f4c815addbe8eac85b4163e02b5e777","5db93f1e882f4d7d6a9669f8b1ab091c0545e12a317ba94c1535eb86bc17bd5b")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("d7130e42663e95d23c547d57e55099c239fa249ce3f6537b7f2a8033f3aa73de","1f6369b42a76d02f32558912b57ede4f5ff0a90b18d3b96a4fe24120fa2c300c","0ca0febadb1024b0a8961f21edbf3f6df731ca4dd82702de3793e757687aefbc","9f31a1908afb23a1029c079ee9ba8bdf0f4c815addbe8eac85b4163e02b5e777","5db93f1e882f4d7d6a9669f8b1ab091c0545e12a317ba94c1535eb86bc17bd5b")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring64 NOT NULL AND customstring64 IN ("d7130e42663e95d23c547d57e55099c239fa249ce3f6537b7f2a8033f3aa73de","1f6369b42a76d02f32558912b57ede4f5ff0a90b18d3b96a4fe24120fa2c300c","0ca0febadb1024b0a8961f21edbf3f6df731ca4dd82702de3793e757687aefbc","9f31a1908afb23a1029c079ee9ba8bdf0f4c815addbe8eac85b4163e02b5e777","5db93f1e882f4d7d6a9669f8b1ab091c0545e12a317ba94c1535eb86bc17bd5b")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("d7130e42663e95d23c547d57e55099c239fa249ce3f6537b7f2a8033f3aa73de","1f6369b42a76d02f32558912b57ede4f5ff0a90b18d3b96a4fe24120fa2c300c","0ca0febadb1024b0a8961f21edbf3f6df731ca4dd82702de3793e757687aefbc","9f31a1908afb23a1029c079ee9ba8bdf0f4c815addbe8eac85b4163e02b5e777","5db93f1e882f4d7d6a9669f8b1ab091c0545e12a317ba94c1535eb86bc17bd5b")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("d7130e42663e95d23c547d57e55099c239fa249ce3f6537b7f2a8033f3aa73de","1f6369b42a76d02f32558912b57ede4f5ff0a90b18d3b96a4fe24120fa2c300c","0ca0febadb1024b0a8961f21edbf3f6df731ca4dd82702de3793e757687aefbc","9f31a1908afb23a1029c079ee9ba8bdf0f4c815addbe8eac85b4163e02b5e777","5db93f1e882f4d7d6a9669f8b1ab091c0545e12a317ba94c1535eb86bc17bd5b")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("d7130e42663e95d23c547d57e55099c239fa249ce3f6537b7f2a8033f3aa73de","1f6369b42a76d02f32558912b57ede4f5ff0a90b18d3b96a4fe24120fa2c300c","0ca0febadb1024b0a8961f21edbf3f6df731ca4dd82702de3793e757687aefbc","9f31a1908afb23a1029c079ee9ba8bdf0f4c815addbe8eac85b4163e02b5e777","5db93f1e882f4d7d6a9669f8b1ab091c0545e12a317ba94c1535eb86bc17bd5b")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring64 NOT NULL AND customstring64 IN ("d7130e42663e95d23c547d57e55099c239fa249ce3f6537b7f2a8033f3aa73de","1f6369b42a76d02f32558912b57ede4f5ff0a90b18d3b96a4fe24120fa2c300c","0ca0febadb1024b0a8961f21edbf3f6df731ca4dd82702de3793e757687aefbc","9f31a1908afb23a1029c079ee9ba8bdf0f4c815addbe8eac85b4163e02b5e777","5db93f1e882f4d7d6a9669f8b1ab091c0545e12a317ba94c1535eb86bc17bd5b")
