index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("b63367bd7da5aad9afef5e7531cac4561c8a671fd2270ade14640cf03849bf52","386b61ccdd4b785c835a064179d5fa58dc0d5fe34970a04487968e1ee0189ce6","4b371777c2c638c97b818057ba4b0a2de246479776eaaacebccf41f467bb93c3","f2e8f1f72abbc42f96c5599b8f27f620d91ae1680aa14b4f0bbf3daabd7bee30")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("b63367bd7da5aad9afef5e7531cac4561c8a671fd2270ade14640cf03849bf52","386b61ccdd4b785c835a064179d5fa58dc0d5fe34970a04487968e1ee0189ce6","4b371777c2c638c97b818057ba4b0a2de246479776eaaacebccf41f467bb93c3","f2e8f1f72abbc42f96c5599b8f27f620d91ae1680aa14b4f0bbf3daabd7bee30")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("b63367bd7da5aad9afef5e7531cac4561c8a671fd2270ade14640cf03849bf52","386b61ccdd4b785c835a064179d5fa58dc0d5fe34970a04487968e1ee0189ce6","4b371777c2c638c97b818057ba4b0a2de246479776eaaacebccf41f467bb93c3","f2e8f1f72abbc42f96c5599b8f27f620d91ae1680aa14b4f0bbf3daabd7bee30")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring64 NOT NULL AND customstring64 IN ("b63367bd7da5aad9afef5e7531cac4561c8a671fd2270ade14640cf03849bf52","386b61ccdd4b785c835a064179d5fa58dc0d5fe34970a04487968e1ee0189ce6","4b371777c2c638c97b818057ba4b0a2de246479776eaaacebccf41f467bb93c3","f2e8f1f72abbc42f96c5599b8f27f620d91ae1680aa14b4f0bbf3daabd7bee30")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("b63367bd7da5aad9afef5e7531cac4561c8a671fd2270ade14640cf03849bf52","386b61ccdd4b785c835a064179d5fa58dc0d5fe34970a04487968e1ee0189ce6","4b371777c2c638c97b818057ba4b0a2de246479776eaaacebccf41f467bb93c3","f2e8f1f72abbc42f96c5599b8f27f620d91ae1680aa14b4f0bbf3daabd7bee30")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("b63367bd7da5aad9afef5e7531cac4561c8a671fd2270ade14640cf03849bf52","386b61ccdd4b785c835a064179d5fa58dc0d5fe34970a04487968e1ee0189ce6","4b371777c2c638c97b818057ba4b0a2de246479776eaaacebccf41f467bb93c3","f2e8f1f72abbc42f96c5599b8f27f620d91ae1680aa14b4f0bbf3daabd7bee30")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("b63367bd7da5aad9afef5e7531cac4561c8a671fd2270ade14640cf03849bf52","386b61ccdd4b785c835a064179d5fa58dc0d5fe34970a04487968e1ee0189ce6","4b371777c2c638c97b818057ba4b0a2de246479776eaaacebccf41f467bb93c3","f2e8f1f72abbc42f96c5599b8f27f620d91ae1680aa14b4f0bbf3daabd7bee30")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("b63367bd7da5aad9afef5e7531cac4561c8a671fd2270ade14640cf03849bf52","386b61ccdd4b785c835a064179d5fa58dc0d5fe34970a04487968e1ee0189ce6","4b371777c2c638c97b818057ba4b0a2de246479776eaaacebccf41f467bb93c3","f2e8f1f72abbc42f96c5599b8f27f620d91ae1680aa14b4f0bbf3daabd7bee30")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("b63367bd7da5aad9afef5e7531cac4561c8a671fd2270ade14640cf03849bf52","386b61ccdd4b785c835a064179d5fa58dc0d5fe34970a04487968e1ee0189ce6","4b371777c2c638c97b818057ba4b0a2de246479776eaaacebccf41f467bb93c3","f2e8f1f72abbc42f96c5599b8f27f620d91ae1680aa14b4f0bbf3daabd7bee30")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("b63367bd7da5aad9afef5e7531cac4561c8a671fd2270ade14640cf03849bf52","386b61ccdd4b785c835a064179d5fa58dc0d5fe34970a04487968e1ee0189ce6","4b371777c2c638c97b818057ba4b0a2de246479776eaaacebccf41f467bb93c3","f2e8f1f72abbc42f96c5599b8f27f620d91ae1680aa14b4f0bbf3daabd7bee30")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("b63367bd7da5aad9afef5e7531cac4561c8a671fd2270ade14640cf03849bf52","386b61ccdd4b785c835a064179d5fa58dc0d5fe34970a04487968e1ee0189ce6","4b371777c2c638c97b818057ba4b0a2de246479776eaaacebccf41f467bb93c3","f2e8f1f72abbc42f96c5599b8f27f620d91ae1680aa14b4f0bbf3daabd7bee30")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("b63367bd7da5aad9afef5e7531cac4561c8a671fd2270ade14640cf03849bf52","386b61ccdd4b785c835a064179d5fa58dc0d5fe34970a04487968e1ee0189ce6","4b371777c2c638c97b818057ba4b0a2de246479776eaaacebccf41f467bb93c3","f2e8f1f72abbc42f96c5599b8f27f620d91ae1680aa14b4f0bbf3daabd7bee30")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("b63367bd7da5aad9afef5e7531cac4561c8a671fd2270ade14640cf03849bf52","386b61ccdd4b785c835a064179d5fa58dc0d5fe34970a04487968e1ee0189ce6","4b371777c2c638c97b818057ba4b0a2de246479776eaaacebccf41f467bb93c3","f2e8f1f72abbc42f96c5599b8f27f620d91ae1680aa14b4f0bbf3daabd7bee30")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("b63367bd7da5aad9afef5e7531cac4561c8a671fd2270ade14640cf03849bf52","386b61ccdd4b785c835a064179d5fa58dc0d5fe34970a04487968e1ee0189ce6","4b371777c2c638c97b818057ba4b0a2de246479776eaaacebccf41f467bb93c3","f2e8f1f72abbc42f96c5599b8f27f620d91ae1680aa14b4f0bbf3daabd7bee30")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("b63367bd7da5aad9afef5e7531cac4561c8a671fd2270ade14640cf03849bf52","386b61ccdd4b785c835a064179d5fa58dc0d5fe34970a04487968e1ee0189ce6","4b371777c2c638c97b818057ba4b0a2de246479776eaaacebccf41f467bb93c3","f2e8f1f72abbc42f96c5599b8f27f620d91ae1680aa14b4f0bbf3daabd7bee30")
index=activity AND rg_functionality="Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("b63367bd7da5aad9afef5e7531cac4561c8a671fd2270ade14640cf03849bf52","386b61ccdd4b785c835a064179d5fa58dc0d5fe34970a04487968e1ee0189ce6","4b371777c2c638c97b818057ba4b0a2de246479776eaaacebccf41f467bb93c3","f2e8f1f72abbc42f96c5599b8f27f620d91ae1680aa14b4f0bbf3daabd7bee30")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("b63367bd7da5aad9afef5e7531cac4561c8a671fd2270ade14640cf03849bf52","386b61ccdd4b785c835a064179d5fa58dc0d5fe34970a04487968e1ee0189ce6","4b371777c2c638c97b818057ba4b0a2de246479776eaaacebccf41f467bb93c3","f2e8f1f72abbc42f96c5599b8f27f620d91ae1680aa14b4f0bbf3daabd7bee30")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("b63367bd7da5aad9afef5e7531cac4561c8a671fd2270ade14640cf03849bf52","386b61ccdd4b785c835a064179d5fa58dc0d5fe34970a04487968e1ee0189ce6","4b371777c2c638c97b818057ba4b0a2de246479776eaaacebccf41f467bb93c3","f2e8f1f72abbc42f96c5599b8f27f620d91ae1680aa14b4f0bbf3daabd7bee30")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("b63367bd7da5aad9afef5e7531cac4561c8a671fd2270ade14640cf03849bf52","386b61ccdd4b785c835a064179d5fa58dc0d5fe34970a04487968e1ee0189ce6","4b371777c2c638c97b818057ba4b0a2de246479776eaaacebccf41f467bb93c3","f2e8f1f72abbc42f96c5599b8f27f620d91ae1680aa14b4f0bbf3daabd7bee30")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("b63367bd7da5aad9afef5e7531cac4561c8a671fd2270ade14640cf03849bf52","386b61ccdd4b785c835a064179d5fa58dc0d5fe34970a04487968e1ee0189ce6","4b371777c2c638c97b818057ba4b0a2de246479776eaaacebccf41f467bb93c3","f2e8f1f72abbc42f96c5599b8f27f620d91ae1680aa14b4f0bbf3daabd7bee30")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("b63367bd7da5aad9afef5e7531cac4561c8a671fd2270ade14640cf03849bf52","386b61ccdd4b785c835a064179d5fa58dc0d5fe34970a04487968e1ee0189ce6","4b371777c2c638c97b818057ba4b0a2de246479776eaaacebccf41f467bb93c3","f2e8f1f72abbc42f96c5599b8f27f620d91ae1680aa14b4f0bbf3daabd7bee30")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("b63367bd7da5aad9afef5e7531cac4561c8a671fd2270ade14640cf03849bf52","386b61ccdd4b785c835a064179d5fa58dc0d5fe34970a04487968e1ee0189ce6","4b371777c2c638c97b818057ba4b0a2de246479776eaaacebccf41f467bb93c3","f2e8f1f72abbc42f96c5599b8f27f620d91ae1680aa14b4f0bbf3daabd7bee30")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("b63367bd7da5aad9afef5e7531cac4561c8a671fd2270ade14640cf03849bf52","386b61ccdd4b785c835a064179d5fa58dc0d5fe34970a04487968e1ee0189ce6","4b371777c2c638c97b818057ba4b0a2de246479776eaaacebccf41f467bb93c3","f2e8f1f72abbc42f96c5599b8f27f620d91ae1680aa14b4f0bbf3daabd7bee30")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring64 NOT NULL AND customstring64 IN ("b63367bd7da5aad9afef5e7531cac4561c8a671fd2270ade14640cf03849bf52","386b61ccdd4b785c835a064179d5fa58dc0d5fe34970a04487968e1ee0189ce6","4b371777c2c638c97b818057ba4b0a2de246479776eaaacebccf41f467bb93c3","f2e8f1f72abbc42f96c5599b8f27f620d91ae1680aa14b4f0bbf3daabd7bee30")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("b63367bd7da5aad9afef5e7531cac4561c8a671fd2270ade14640cf03849bf52","386b61ccdd4b785c835a064179d5fa58dc0d5fe34970a04487968e1ee0189ce6","4b371777c2c638c97b818057ba4b0a2de246479776eaaacebccf41f467bb93c3","f2e8f1f72abbc42f96c5599b8f27f620d91ae1680aa14b4f0bbf3daabd7bee30")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("b63367bd7da5aad9afef5e7531cac4561c8a671fd2270ade14640cf03849bf52","386b61ccdd4b785c835a064179d5fa58dc0d5fe34970a04487968e1ee0189ce6","4b371777c2c638c97b818057ba4b0a2de246479776eaaacebccf41f467bb93c3","f2e8f1f72abbc42f96c5599b8f27f620d91ae1680aa14b4f0bbf3daabd7bee30")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("b63367bd7da5aad9afef5e7531cac4561c8a671fd2270ade14640cf03849bf52","386b61ccdd4b785c835a064179d5fa58dc0d5fe34970a04487968e1ee0189ce6","4b371777c2c638c97b818057ba4b0a2de246479776eaaacebccf41f467bb93c3","f2e8f1f72abbc42f96c5599b8f27f620d91ae1680aa14b4f0bbf3daabd7bee30")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring64 NOT NULL AND customstring64 IN ("b63367bd7da5aad9afef5e7531cac4561c8a671fd2270ade14640cf03849bf52","386b61ccdd4b785c835a064179d5fa58dc0d5fe34970a04487968e1ee0189ce6","4b371777c2c638c97b818057ba4b0a2de246479776eaaacebccf41f467bb93c3","f2e8f1f72abbc42f96c5599b8f27f620d91ae1680aa14b4f0bbf3daabd7bee30")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("b63367bd7da5aad9afef5e7531cac4561c8a671fd2270ade14640cf03849bf52","386b61ccdd4b785c835a064179d5fa58dc0d5fe34970a04487968e1ee0189ce6","4b371777c2c638c97b818057ba4b0a2de246479776eaaacebccf41f467bb93c3","f2e8f1f72abbc42f96c5599b8f27f620d91ae1680aa14b4f0bbf3daabd7bee30")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("b63367bd7da5aad9afef5e7531cac4561c8a671fd2270ade14640cf03849bf52","386b61ccdd4b785c835a064179d5fa58dc0d5fe34970a04487968e1ee0189ce6","4b371777c2c638c97b818057ba4b0a2de246479776eaaacebccf41f467bb93c3","f2e8f1f72abbc42f96c5599b8f27f620d91ae1680aa14b4f0bbf3daabd7bee30")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("b63367bd7da5aad9afef5e7531cac4561c8a671fd2270ade14640cf03849bf52","386b61ccdd4b785c835a064179d5fa58dc0d5fe34970a04487968e1ee0189ce6","4b371777c2c638c97b818057ba4b0a2de246479776eaaacebccf41f467bb93c3","f2e8f1f72abbc42f96c5599b8f27f620d91ae1680aa14b4f0bbf3daabd7bee30")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring64 NOT NULL AND customstring64 IN ("b63367bd7da5aad9afef5e7531cac4561c8a671fd2270ade14640cf03849bf52","386b61ccdd4b785c835a064179d5fa58dc0d5fe34970a04487968e1ee0189ce6","4b371777c2c638c97b818057ba4b0a2de246479776eaaacebccf41f467bb93c3","f2e8f1f72abbc42f96c5599b8f27f620d91ae1680aa14b4f0bbf3daabd7bee30")
index=activity AND rg_functionality="O365 General" AND filehash NOT NULL AND filehash IN ("b63367bd7da5aad9afef5e7531cac4561c8a671fd2270ade14640cf03849bf52","386b61ccdd4b785c835a064179d5fa58dc0d5fe34970a04487968e1ee0189ce6","4b371777c2c638c97b818057ba4b0a2de246479776eaaacebccf41f467bb93c3","f2e8f1f72abbc42f96c5599b8f27f620d91ae1680aa14b4f0bbf3daabd7bee30")
index=activity AND rg_functionality="O365 General" AND oldfilehash NOT NULL AND oldfilehash IN ("b63367bd7da5aad9afef5e7531cac4561c8a671fd2270ade14640cf03849bf52","386b61ccdd4b785c835a064179d5fa58dc0d5fe34970a04487968e1ee0189ce6","4b371777c2c638c97b818057ba4b0a2de246479776eaaacebccf41f467bb93c3","f2e8f1f72abbc42f96c5599b8f27f620d91ae1680aa14b4f0bbf3daabd7bee30")
index=activity AND rg_functionality="O365 General" AND customstring3 NOT NULL AND customstring3 IN ("b63367bd7da5aad9afef5e7531cac4561c8a671fd2270ade14640cf03849bf52","386b61ccdd4b785c835a064179d5fa58dc0d5fe34970a04487968e1ee0189ce6","4b371777c2c638c97b818057ba4b0a2de246479776eaaacebccf41f467bb93c3","f2e8f1f72abbc42f96c5599b8f27f620d91ae1680aa14b4f0bbf3daabd7bee30")
index=activity AND rg_functionality="O365 General" AND customstring64 NOT NULL AND customstring64 IN ("b63367bd7da5aad9afef5e7531cac4561c8a671fd2270ade14640cf03849bf52","386b61ccdd4b785c835a064179d5fa58dc0d5fe34970a04487968e1ee0189ce6","4b371777c2c638c97b818057ba4b0a2de246479776eaaacebccf41f467bb93c3","f2e8f1f72abbc42f96c5599b8f27f620d91ae1680aa14b4f0bbf3daabd7bee30")
