index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("ebc93a546bcdf6cc1eb61d7174bcb85407bbd892","d6d32a1f17d48fe695c0778018c0d51626db4a3b","7d66b550ea68a86fcc0958e7c159531d4431b788","d78f353a70adf68371bc10cf869b761bd51484b0","99bed842b5e222411d19f0c5b54478e8cc7ae68f","5df3c882db6be14887182b7439b72a86bd28b83f","aa823148eea6f43d8eb9bf20412402a7739d91c2","c26f04790c6fb7950d89ab1b08207ace01efb536","5265e8edc9b5f7dd00fc772522511b8f3be217e3","ef189737fb7d61b110b9293e8838526dce920127","3a395daaf518be113fcff2e5e48acd9b9c0de69d","5f1553f3af9425ef5d68341e991b6c5ec96a82eb","cc350ba25947b7f9ec5d11ea8269407c0fd74095","1b06e877c2c12d74336e7532bc0ecf761e5fa5d4")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("ebc93a546bcdf6cc1eb61d7174bcb85407bbd892","d6d32a1f17d48fe695c0778018c0d51626db4a3b","7d66b550ea68a86fcc0958e7c159531d4431b788","d78f353a70adf68371bc10cf869b761bd51484b0","99bed842b5e222411d19f0c5b54478e8cc7ae68f","5df3c882db6be14887182b7439b72a86bd28b83f","aa823148eea6f43d8eb9bf20412402a7739d91c2","c26f04790c6fb7950d89ab1b08207ace01efb536","5265e8edc9b5f7dd00fc772522511b8f3be217e3","ef189737fb7d61b110b9293e8838526dce920127","3a395daaf518be113fcff2e5e48acd9b9c0de69d","5f1553f3af9425ef5d68341e991b6c5ec96a82eb","cc350ba25947b7f9ec5d11ea8269407c0fd74095","1b06e877c2c12d74336e7532bc0ecf761e5fa5d4")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("ebc93a546bcdf6cc1eb61d7174bcb85407bbd892","d6d32a1f17d48fe695c0778018c0d51626db4a3b","7d66b550ea68a86fcc0958e7c159531d4431b788","d78f353a70adf68371bc10cf869b761bd51484b0","99bed842b5e222411d19f0c5b54478e8cc7ae68f","5df3c882db6be14887182b7439b72a86bd28b83f","aa823148eea6f43d8eb9bf20412402a7739d91c2","c26f04790c6fb7950d89ab1b08207ace01efb536","5265e8edc9b5f7dd00fc772522511b8f3be217e3","ef189737fb7d61b110b9293e8838526dce920127","3a395daaf518be113fcff2e5e48acd9b9c0de69d","5f1553f3af9425ef5d68341e991b6c5ec96a82eb","cc350ba25947b7f9ec5d11ea8269407c0fd74095","1b06e877c2c12d74336e7532bc0ecf761e5fa5d4")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring64 NOT NULL AND customstring64 IN ("ebc93a546bcdf6cc1eb61d7174bcb85407bbd892","d6d32a1f17d48fe695c0778018c0d51626db4a3b","7d66b550ea68a86fcc0958e7c159531d4431b788","d78f353a70adf68371bc10cf869b761bd51484b0","99bed842b5e222411d19f0c5b54478e8cc7ae68f","5df3c882db6be14887182b7439b72a86bd28b83f","aa823148eea6f43d8eb9bf20412402a7739d91c2","c26f04790c6fb7950d89ab1b08207ace01efb536","5265e8edc9b5f7dd00fc772522511b8f3be217e3","ef189737fb7d61b110b9293e8838526dce920127","3a395daaf518be113fcff2e5e48acd9b9c0de69d","5f1553f3af9425ef5d68341e991b6c5ec96a82eb","cc350ba25947b7f9ec5d11ea8269407c0fd74095","1b06e877c2c12d74336e7532bc0ecf761e5fa5d4")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("ebc93a546bcdf6cc1eb61d7174bcb85407bbd892","d6d32a1f17d48fe695c0778018c0d51626db4a3b","7d66b550ea68a86fcc0958e7c159531d4431b788","d78f353a70adf68371bc10cf869b761bd51484b0","99bed842b5e222411d19f0c5b54478e8cc7ae68f","5df3c882db6be14887182b7439b72a86bd28b83f","aa823148eea6f43d8eb9bf20412402a7739d91c2","c26f04790c6fb7950d89ab1b08207ace01efb536","5265e8edc9b5f7dd00fc772522511b8f3be217e3","ef189737fb7d61b110b9293e8838526dce920127","3a395daaf518be113fcff2e5e48acd9b9c0de69d","5f1553f3af9425ef5d68341e991b6c5ec96a82eb","cc350ba25947b7f9ec5d11ea8269407c0fd74095","1b06e877c2c12d74336e7532bc0ecf761e5fa5d4")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("ebc93a546bcdf6cc1eb61d7174bcb85407bbd892","d6d32a1f17d48fe695c0778018c0d51626db4a3b","7d66b550ea68a86fcc0958e7c159531d4431b788","d78f353a70adf68371bc10cf869b761bd51484b0","99bed842b5e222411d19f0c5b54478e8cc7ae68f","5df3c882db6be14887182b7439b72a86bd28b83f","aa823148eea6f43d8eb9bf20412402a7739d91c2","c26f04790c6fb7950d89ab1b08207ace01efb536","5265e8edc9b5f7dd00fc772522511b8f3be217e3","ef189737fb7d61b110b9293e8838526dce920127","3a395daaf518be113fcff2e5e48acd9b9c0de69d","5f1553f3af9425ef5d68341e991b6c5ec96a82eb","cc350ba25947b7f9ec5d11ea8269407c0fd74095","1b06e877c2c12d74336e7532bc0ecf761e5fa5d4")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("ebc93a546bcdf6cc1eb61d7174bcb85407bbd892","d6d32a1f17d48fe695c0778018c0d51626db4a3b","7d66b550ea68a86fcc0958e7c159531d4431b788","d78f353a70adf68371bc10cf869b761bd51484b0","99bed842b5e222411d19f0c5b54478e8cc7ae68f","5df3c882db6be14887182b7439b72a86bd28b83f","aa823148eea6f43d8eb9bf20412402a7739d91c2","c26f04790c6fb7950d89ab1b08207ace01efb536","5265e8edc9b5f7dd00fc772522511b8f3be217e3","ef189737fb7d61b110b9293e8838526dce920127","3a395daaf518be113fcff2e5e48acd9b9c0de69d","5f1553f3af9425ef5d68341e991b6c5ec96a82eb","cc350ba25947b7f9ec5d11ea8269407c0fd74095","1b06e877c2c12d74336e7532bc0ecf761e5fa5d4")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("ebc93a546bcdf6cc1eb61d7174bcb85407bbd892","d6d32a1f17d48fe695c0778018c0d51626db4a3b","7d66b550ea68a86fcc0958e7c159531d4431b788","d78f353a70adf68371bc10cf869b761bd51484b0","99bed842b5e222411d19f0c5b54478e8cc7ae68f","5df3c882db6be14887182b7439b72a86bd28b83f","aa823148eea6f43d8eb9bf20412402a7739d91c2","c26f04790c6fb7950d89ab1b08207ace01efb536","5265e8edc9b5f7dd00fc772522511b8f3be217e3","ef189737fb7d61b110b9293e8838526dce920127","3a395daaf518be113fcff2e5e48acd9b9c0de69d","5f1553f3af9425ef5d68341e991b6c5ec96a82eb","cc350ba25947b7f9ec5d11ea8269407c0fd74095","1b06e877c2c12d74336e7532bc0ecf761e5fa5d4")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("ebc93a546bcdf6cc1eb61d7174bcb85407bbd892","d6d32a1f17d48fe695c0778018c0d51626db4a3b","7d66b550ea68a86fcc0958e7c159531d4431b788","d78f353a70adf68371bc10cf869b761bd51484b0","99bed842b5e222411d19f0c5b54478e8cc7ae68f","5df3c882db6be14887182b7439b72a86bd28b83f","aa823148eea6f43d8eb9bf20412402a7739d91c2","c26f04790c6fb7950d89ab1b08207ace01efb536","5265e8edc9b5f7dd00fc772522511b8f3be217e3","ef189737fb7d61b110b9293e8838526dce920127","3a395daaf518be113fcff2e5e48acd9b9c0de69d","5f1553f3af9425ef5d68341e991b6c5ec96a82eb","cc350ba25947b7f9ec5d11ea8269407c0fd74095","1b06e877c2c12d74336e7532bc0ecf761e5fa5d4")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("ebc93a546bcdf6cc1eb61d7174bcb85407bbd892","d6d32a1f17d48fe695c0778018c0d51626db4a3b","7d66b550ea68a86fcc0958e7c159531d4431b788","d78f353a70adf68371bc10cf869b761bd51484b0","99bed842b5e222411d19f0c5b54478e8cc7ae68f","5df3c882db6be14887182b7439b72a86bd28b83f","aa823148eea6f43d8eb9bf20412402a7739d91c2","c26f04790c6fb7950d89ab1b08207ace01efb536","5265e8edc9b5f7dd00fc772522511b8f3be217e3","ef189737fb7d61b110b9293e8838526dce920127","3a395daaf518be113fcff2e5e48acd9b9c0de69d","5f1553f3af9425ef5d68341e991b6c5ec96a82eb","cc350ba25947b7f9ec5d11ea8269407c0fd74095","1b06e877c2c12d74336e7532bc0ecf761e5fa5d4")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("ebc93a546bcdf6cc1eb61d7174bcb85407bbd892","d6d32a1f17d48fe695c0778018c0d51626db4a3b","7d66b550ea68a86fcc0958e7c159531d4431b788","d78f353a70adf68371bc10cf869b761bd51484b0","99bed842b5e222411d19f0c5b54478e8cc7ae68f","5df3c882db6be14887182b7439b72a86bd28b83f","aa823148eea6f43d8eb9bf20412402a7739d91c2","c26f04790c6fb7950d89ab1b08207ace01efb536","5265e8edc9b5f7dd00fc772522511b8f3be217e3","ef189737fb7d61b110b9293e8838526dce920127","3a395daaf518be113fcff2e5e48acd9b9c0de69d","5f1553f3af9425ef5d68341e991b6c5ec96a82eb","cc350ba25947b7f9ec5d11ea8269407c0fd74095","1b06e877c2c12d74336e7532bc0ecf761e5fa5d4")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("ebc93a546bcdf6cc1eb61d7174bcb85407bbd892","d6d32a1f17d48fe695c0778018c0d51626db4a3b","7d66b550ea68a86fcc0958e7c159531d4431b788","d78f353a70adf68371bc10cf869b761bd51484b0","99bed842b5e222411d19f0c5b54478e8cc7ae68f","5df3c882db6be14887182b7439b72a86bd28b83f","aa823148eea6f43d8eb9bf20412402a7739d91c2","c26f04790c6fb7950d89ab1b08207ace01efb536","5265e8edc9b5f7dd00fc772522511b8f3be217e3","ef189737fb7d61b110b9293e8838526dce920127","3a395daaf518be113fcff2e5e48acd9b9c0de69d","5f1553f3af9425ef5d68341e991b6c5ec96a82eb","cc350ba25947b7f9ec5d11ea8269407c0fd74095","1b06e877c2c12d74336e7532bc0ecf761e5fa5d4")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("ebc93a546bcdf6cc1eb61d7174bcb85407bbd892","d6d32a1f17d48fe695c0778018c0d51626db4a3b","7d66b550ea68a86fcc0958e7c159531d4431b788","d78f353a70adf68371bc10cf869b761bd51484b0","99bed842b5e222411d19f0c5b54478e8cc7ae68f","5df3c882db6be14887182b7439b72a86bd28b83f","aa823148eea6f43d8eb9bf20412402a7739d91c2","c26f04790c6fb7950d89ab1b08207ace01efb536","5265e8edc9b5f7dd00fc772522511b8f3be217e3","ef189737fb7d61b110b9293e8838526dce920127","3a395daaf518be113fcff2e5e48acd9b9c0de69d","5f1553f3af9425ef5d68341e991b6c5ec96a82eb","cc350ba25947b7f9ec5d11ea8269407c0fd74095","1b06e877c2c12d74336e7532bc0ecf761e5fa5d4")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("ebc93a546bcdf6cc1eb61d7174bcb85407bbd892","d6d32a1f17d48fe695c0778018c0d51626db4a3b","7d66b550ea68a86fcc0958e7c159531d4431b788","d78f353a70adf68371bc10cf869b761bd51484b0","99bed842b5e222411d19f0c5b54478e8cc7ae68f","5df3c882db6be14887182b7439b72a86bd28b83f","aa823148eea6f43d8eb9bf20412402a7739d91c2","c26f04790c6fb7950d89ab1b08207ace01efb536","5265e8edc9b5f7dd00fc772522511b8f3be217e3","ef189737fb7d61b110b9293e8838526dce920127","3a395daaf518be113fcff2e5e48acd9b9c0de69d","5f1553f3af9425ef5d68341e991b6c5ec96a82eb","cc350ba25947b7f9ec5d11ea8269407c0fd74095","1b06e877c2c12d74336e7532bc0ecf761e5fa5d4")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("ebc93a546bcdf6cc1eb61d7174bcb85407bbd892","d6d32a1f17d48fe695c0778018c0d51626db4a3b","7d66b550ea68a86fcc0958e7c159531d4431b788","d78f353a70adf68371bc10cf869b761bd51484b0","99bed842b5e222411d19f0c5b54478e8cc7ae68f","5df3c882db6be14887182b7439b72a86bd28b83f","aa823148eea6f43d8eb9bf20412402a7739d91c2","c26f04790c6fb7950d89ab1b08207ace01efb536","5265e8edc9b5f7dd00fc772522511b8f3be217e3","ef189737fb7d61b110b9293e8838526dce920127","3a395daaf518be113fcff2e5e48acd9b9c0de69d","5f1553f3af9425ef5d68341e991b6c5ec96a82eb","cc350ba25947b7f9ec5d11ea8269407c0fd74095","1b06e877c2c12d74336e7532bc0ecf761e5fa5d4")
index=activity AND rg_functionality="Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("ebc93a546bcdf6cc1eb61d7174bcb85407bbd892","d6d32a1f17d48fe695c0778018c0d51626db4a3b","7d66b550ea68a86fcc0958e7c159531d4431b788","d78f353a70adf68371bc10cf869b761bd51484b0","99bed842b5e222411d19f0c5b54478e8cc7ae68f","5df3c882db6be14887182b7439b72a86bd28b83f","aa823148eea6f43d8eb9bf20412402a7739d91c2","c26f04790c6fb7950d89ab1b08207ace01efb536","5265e8edc9b5f7dd00fc772522511b8f3be217e3","ef189737fb7d61b110b9293e8838526dce920127","3a395daaf518be113fcff2e5e48acd9b9c0de69d","5f1553f3af9425ef5d68341e991b6c5ec96a82eb","cc350ba25947b7f9ec5d11ea8269407c0fd74095","1b06e877c2c12d74336e7532bc0ecf761e5fa5d4")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("ebc93a546bcdf6cc1eb61d7174bcb85407bbd892","d6d32a1f17d48fe695c0778018c0d51626db4a3b","7d66b550ea68a86fcc0958e7c159531d4431b788","d78f353a70adf68371bc10cf869b761bd51484b0","99bed842b5e222411d19f0c5b54478e8cc7ae68f","5df3c882db6be14887182b7439b72a86bd28b83f","aa823148eea6f43d8eb9bf20412402a7739d91c2","c26f04790c6fb7950d89ab1b08207ace01efb536","5265e8edc9b5f7dd00fc772522511b8f3be217e3","ef189737fb7d61b110b9293e8838526dce920127","3a395daaf518be113fcff2e5e48acd9b9c0de69d","5f1553f3af9425ef5d68341e991b6c5ec96a82eb","cc350ba25947b7f9ec5d11ea8269407c0fd74095","1b06e877c2c12d74336e7532bc0ecf761e5fa5d4")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("ebc93a546bcdf6cc1eb61d7174bcb85407bbd892","d6d32a1f17d48fe695c0778018c0d51626db4a3b","7d66b550ea68a86fcc0958e7c159531d4431b788","d78f353a70adf68371bc10cf869b761bd51484b0","99bed842b5e222411d19f0c5b54478e8cc7ae68f","5df3c882db6be14887182b7439b72a86bd28b83f","aa823148eea6f43d8eb9bf20412402a7739d91c2","c26f04790c6fb7950d89ab1b08207ace01efb536","5265e8edc9b5f7dd00fc772522511b8f3be217e3","ef189737fb7d61b110b9293e8838526dce920127","3a395daaf518be113fcff2e5e48acd9b9c0de69d","5f1553f3af9425ef5d68341e991b6c5ec96a82eb","cc350ba25947b7f9ec5d11ea8269407c0fd74095","1b06e877c2c12d74336e7532bc0ecf761e5fa5d4")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("ebc93a546bcdf6cc1eb61d7174bcb85407bbd892","d6d32a1f17d48fe695c0778018c0d51626db4a3b","7d66b550ea68a86fcc0958e7c159531d4431b788","d78f353a70adf68371bc10cf869b761bd51484b0","99bed842b5e222411d19f0c5b54478e8cc7ae68f","5df3c882db6be14887182b7439b72a86bd28b83f","aa823148eea6f43d8eb9bf20412402a7739d91c2","c26f04790c6fb7950d89ab1b08207ace01efb536","5265e8edc9b5f7dd00fc772522511b8f3be217e3","ef189737fb7d61b110b9293e8838526dce920127","3a395daaf518be113fcff2e5e48acd9b9c0de69d","5f1553f3af9425ef5d68341e991b6c5ec96a82eb","cc350ba25947b7f9ec5d11ea8269407c0fd74095","1b06e877c2c12d74336e7532bc0ecf761e5fa5d4")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("ebc93a546bcdf6cc1eb61d7174bcb85407bbd892","d6d32a1f17d48fe695c0778018c0d51626db4a3b","7d66b550ea68a86fcc0958e7c159531d4431b788","d78f353a70adf68371bc10cf869b761bd51484b0","99bed842b5e222411d19f0c5b54478e8cc7ae68f","5df3c882db6be14887182b7439b72a86bd28b83f","aa823148eea6f43d8eb9bf20412402a7739d91c2","c26f04790c6fb7950d89ab1b08207ace01efb536","5265e8edc9b5f7dd00fc772522511b8f3be217e3","ef189737fb7d61b110b9293e8838526dce920127","3a395daaf518be113fcff2e5e48acd9b9c0de69d","5f1553f3af9425ef5d68341e991b6c5ec96a82eb","cc350ba25947b7f9ec5d11ea8269407c0fd74095","1b06e877c2c12d74336e7532bc0ecf761e5fa5d4")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("ebc93a546bcdf6cc1eb61d7174bcb85407bbd892","d6d32a1f17d48fe695c0778018c0d51626db4a3b","7d66b550ea68a86fcc0958e7c159531d4431b788","d78f353a70adf68371bc10cf869b761bd51484b0","99bed842b5e222411d19f0c5b54478e8cc7ae68f","5df3c882db6be14887182b7439b72a86bd28b83f","aa823148eea6f43d8eb9bf20412402a7739d91c2","c26f04790c6fb7950d89ab1b08207ace01efb536","5265e8edc9b5f7dd00fc772522511b8f3be217e3","ef189737fb7d61b110b9293e8838526dce920127","3a395daaf518be113fcff2e5e48acd9b9c0de69d","5f1553f3af9425ef5d68341e991b6c5ec96a82eb","cc350ba25947b7f9ec5d11ea8269407c0fd74095","1b06e877c2c12d74336e7532bc0ecf761e5fa5d4")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("ebc93a546bcdf6cc1eb61d7174bcb85407bbd892","d6d32a1f17d48fe695c0778018c0d51626db4a3b","7d66b550ea68a86fcc0958e7c159531d4431b788","d78f353a70adf68371bc10cf869b761bd51484b0","99bed842b5e222411d19f0c5b54478e8cc7ae68f","5df3c882db6be14887182b7439b72a86bd28b83f","aa823148eea6f43d8eb9bf20412402a7739d91c2","c26f04790c6fb7950d89ab1b08207ace01efb536","5265e8edc9b5f7dd00fc772522511b8f3be217e3","ef189737fb7d61b110b9293e8838526dce920127","3a395daaf518be113fcff2e5e48acd9b9c0de69d","5f1553f3af9425ef5d68341e991b6c5ec96a82eb","cc350ba25947b7f9ec5d11ea8269407c0fd74095","1b06e877c2c12d74336e7532bc0ecf761e5fa5d4")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("ebc93a546bcdf6cc1eb61d7174bcb85407bbd892","d6d32a1f17d48fe695c0778018c0d51626db4a3b","7d66b550ea68a86fcc0958e7c159531d4431b788","d78f353a70adf68371bc10cf869b761bd51484b0","99bed842b5e222411d19f0c5b54478e8cc7ae68f","5df3c882db6be14887182b7439b72a86bd28b83f","aa823148eea6f43d8eb9bf20412402a7739d91c2","c26f04790c6fb7950d89ab1b08207ace01efb536","5265e8edc9b5f7dd00fc772522511b8f3be217e3","ef189737fb7d61b110b9293e8838526dce920127","3a395daaf518be113fcff2e5e48acd9b9c0de69d","5f1553f3af9425ef5d68341e991b6c5ec96a82eb","cc350ba25947b7f9ec5d11ea8269407c0fd74095","1b06e877c2c12d74336e7532bc0ecf761e5fa5d4")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring64 NOT NULL AND customstring64 IN ("ebc93a546bcdf6cc1eb61d7174bcb85407bbd892","d6d32a1f17d48fe695c0778018c0d51626db4a3b","7d66b550ea68a86fcc0958e7c159531d4431b788","d78f353a70adf68371bc10cf869b761bd51484b0","99bed842b5e222411d19f0c5b54478e8cc7ae68f","5df3c882db6be14887182b7439b72a86bd28b83f","aa823148eea6f43d8eb9bf20412402a7739d91c2","c26f04790c6fb7950d89ab1b08207ace01efb536","5265e8edc9b5f7dd00fc772522511b8f3be217e3","ef189737fb7d61b110b9293e8838526dce920127","3a395daaf518be113fcff2e5e48acd9b9c0de69d","5f1553f3af9425ef5d68341e991b6c5ec96a82eb","cc350ba25947b7f9ec5d11ea8269407c0fd74095","1b06e877c2c12d74336e7532bc0ecf761e5fa5d4")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("ebc93a546bcdf6cc1eb61d7174bcb85407bbd892","d6d32a1f17d48fe695c0778018c0d51626db4a3b","7d66b550ea68a86fcc0958e7c159531d4431b788","d78f353a70adf68371bc10cf869b761bd51484b0","99bed842b5e222411d19f0c5b54478e8cc7ae68f","5df3c882db6be14887182b7439b72a86bd28b83f","aa823148eea6f43d8eb9bf20412402a7739d91c2","c26f04790c6fb7950d89ab1b08207ace01efb536","5265e8edc9b5f7dd00fc772522511b8f3be217e3","ef189737fb7d61b110b9293e8838526dce920127","3a395daaf518be113fcff2e5e48acd9b9c0de69d","5f1553f3af9425ef5d68341e991b6c5ec96a82eb","cc350ba25947b7f9ec5d11ea8269407c0fd74095","1b06e877c2c12d74336e7532bc0ecf761e5fa5d4")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("ebc93a546bcdf6cc1eb61d7174bcb85407bbd892","d6d32a1f17d48fe695c0778018c0d51626db4a3b","7d66b550ea68a86fcc0958e7c159531d4431b788","d78f353a70adf68371bc10cf869b761bd51484b0","99bed842b5e222411d19f0c5b54478e8cc7ae68f","5df3c882db6be14887182b7439b72a86bd28b83f","aa823148eea6f43d8eb9bf20412402a7739d91c2","c26f04790c6fb7950d89ab1b08207ace01efb536","5265e8edc9b5f7dd00fc772522511b8f3be217e3","ef189737fb7d61b110b9293e8838526dce920127","3a395daaf518be113fcff2e5e48acd9b9c0de69d","5f1553f3af9425ef5d68341e991b6c5ec96a82eb","cc350ba25947b7f9ec5d11ea8269407c0fd74095","1b06e877c2c12d74336e7532bc0ecf761e5fa5d4")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("ebc93a546bcdf6cc1eb61d7174bcb85407bbd892","d6d32a1f17d48fe695c0778018c0d51626db4a3b","7d66b550ea68a86fcc0958e7c159531d4431b788","d78f353a70adf68371bc10cf869b761bd51484b0","99bed842b5e222411d19f0c5b54478e8cc7ae68f","5df3c882db6be14887182b7439b72a86bd28b83f","aa823148eea6f43d8eb9bf20412402a7739d91c2","c26f04790c6fb7950d89ab1b08207ace01efb536","5265e8edc9b5f7dd00fc772522511b8f3be217e3","ef189737fb7d61b110b9293e8838526dce920127","3a395daaf518be113fcff2e5e48acd9b9c0de69d","5f1553f3af9425ef5d68341e991b6c5ec96a82eb","cc350ba25947b7f9ec5d11ea8269407c0fd74095","1b06e877c2c12d74336e7532bc0ecf761e5fa5d4")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring64 NOT NULL AND customstring64 IN ("ebc93a546bcdf6cc1eb61d7174bcb85407bbd892","d6d32a1f17d48fe695c0778018c0d51626db4a3b","7d66b550ea68a86fcc0958e7c159531d4431b788","d78f353a70adf68371bc10cf869b761bd51484b0","99bed842b5e222411d19f0c5b54478e8cc7ae68f","5df3c882db6be14887182b7439b72a86bd28b83f","aa823148eea6f43d8eb9bf20412402a7739d91c2","c26f04790c6fb7950d89ab1b08207ace01efb536","5265e8edc9b5f7dd00fc772522511b8f3be217e3","ef189737fb7d61b110b9293e8838526dce920127","3a395daaf518be113fcff2e5e48acd9b9c0de69d","5f1553f3af9425ef5d68341e991b6c5ec96a82eb","cc350ba25947b7f9ec5d11ea8269407c0fd74095","1b06e877c2c12d74336e7532bc0ecf761e5fa5d4")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("ebc93a546bcdf6cc1eb61d7174bcb85407bbd892","d6d32a1f17d48fe695c0778018c0d51626db4a3b","7d66b550ea68a86fcc0958e7c159531d4431b788","d78f353a70adf68371bc10cf869b761bd51484b0","99bed842b5e222411d19f0c5b54478e8cc7ae68f","5df3c882db6be14887182b7439b72a86bd28b83f","aa823148eea6f43d8eb9bf20412402a7739d91c2","c26f04790c6fb7950d89ab1b08207ace01efb536","5265e8edc9b5f7dd00fc772522511b8f3be217e3","ef189737fb7d61b110b9293e8838526dce920127","3a395daaf518be113fcff2e5e48acd9b9c0de69d","5f1553f3af9425ef5d68341e991b6c5ec96a82eb","cc350ba25947b7f9ec5d11ea8269407c0fd74095","1b06e877c2c12d74336e7532bc0ecf761e5fa5d4")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("ebc93a546bcdf6cc1eb61d7174bcb85407bbd892","d6d32a1f17d48fe695c0778018c0d51626db4a3b","7d66b550ea68a86fcc0958e7c159531d4431b788","d78f353a70adf68371bc10cf869b761bd51484b0","99bed842b5e222411d19f0c5b54478e8cc7ae68f","5df3c882db6be14887182b7439b72a86bd28b83f","aa823148eea6f43d8eb9bf20412402a7739d91c2","c26f04790c6fb7950d89ab1b08207ace01efb536","5265e8edc9b5f7dd00fc772522511b8f3be217e3","ef189737fb7d61b110b9293e8838526dce920127","3a395daaf518be113fcff2e5e48acd9b9c0de69d","5f1553f3af9425ef5d68341e991b6c5ec96a82eb","cc350ba25947b7f9ec5d11ea8269407c0fd74095","1b06e877c2c12d74336e7532bc0ecf761e5fa5d4")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("ebc93a546bcdf6cc1eb61d7174bcb85407bbd892","d6d32a1f17d48fe695c0778018c0d51626db4a3b","7d66b550ea68a86fcc0958e7c159531d4431b788","d78f353a70adf68371bc10cf869b761bd51484b0","99bed842b5e222411d19f0c5b54478e8cc7ae68f","5df3c882db6be14887182b7439b72a86bd28b83f","aa823148eea6f43d8eb9bf20412402a7739d91c2","c26f04790c6fb7950d89ab1b08207ace01efb536","5265e8edc9b5f7dd00fc772522511b8f3be217e3","ef189737fb7d61b110b9293e8838526dce920127","3a395daaf518be113fcff2e5e48acd9b9c0de69d","5f1553f3af9425ef5d68341e991b6c5ec96a82eb","cc350ba25947b7f9ec5d11ea8269407c0fd74095","1b06e877c2c12d74336e7532bc0ecf761e5fa5d4")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring64 NOT NULL AND customstring64 IN ("ebc93a546bcdf6cc1eb61d7174bcb85407bbd892","d6d32a1f17d48fe695c0778018c0d51626db4a3b","7d66b550ea68a86fcc0958e7c159531d4431b788","d78f353a70adf68371bc10cf869b761bd51484b0","99bed842b5e222411d19f0c5b54478e8cc7ae68f","5df3c882db6be14887182b7439b72a86bd28b83f","aa823148eea6f43d8eb9bf20412402a7739d91c2","c26f04790c6fb7950d89ab1b08207ace01efb536","5265e8edc9b5f7dd00fc772522511b8f3be217e3","ef189737fb7d61b110b9293e8838526dce920127","3a395daaf518be113fcff2e5e48acd9b9c0de69d","5f1553f3af9425ef5d68341e991b6c5ec96a82eb","cc350ba25947b7f9ec5d11ea8269407c0fd74095","1b06e877c2c12d74336e7532bc0ecf761e5fa5d4")
index=activity AND rg_functionality="O365 General" AND filehash NOT NULL AND filehash IN ("ebc93a546bcdf6cc1eb61d7174bcb85407bbd892","d6d32a1f17d48fe695c0778018c0d51626db4a3b","7d66b550ea68a86fcc0958e7c159531d4431b788","d78f353a70adf68371bc10cf869b761bd51484b0","99bed842b5e222411d19f0c5b54478e8cc7ae68f","5df3c882db6be14887182b7439b72a86bd28b83f","aa823148eea6f43d8eb9bf20412402a7739d91c2","c26f04790c6fb7950d89ab1b08207ace01efb536","5265e8edc9b5f7dd00fc772522511b8f3be217e3","ef189737fb7d61b110b9293e8838526dce920127","3a395daaf518be113fcff2e5e48acd9b9c0de69d","5f1553f3af9425ef5d68341e991b6c5ec96a82eb","cc350ba25947b7f9ec5d11ea8269407c0fd74095","1b06e877c2c12d74336e7532bc0ecf761e5fa5d4")
index=activity AND rg_functionality="O365 General" AND oldfilehash NOT NULL AND oldfilehash IN ("ebc93a546bcdf6cc1eb61d7174bcb85407bbd892","d6d32a1f17d48fe695c0778018c0d51626db4a3b","7d66b550ea68a86fcc0958e7c159531d4431b788","d78f353a70adf68371bc10cf869b761bd51484b0","99bed842b5e222411d19f0c5b54478e8cc7ae68f","5df3c882db6be14887182b7439b72a86bd28b83f","aa823148eea6f43d8eb9bf20412402a7739d91c2","c26f04790c6fb7950d89ab1b08207ace01efb536","5265e8edc9b5f7dd00fc772522511b8f3be217e3","ef189737fb7d61b110b9293e8838526dce920127","3a395daaf518be113fcff2e5e48acd9b9c0de69d","5f1553f3af9425ef5d68341e991b6c5ec96a82eb","cc350ba25947b7f9ec5d11ea8269407c0fd74095","1b06e877c2c12d74336e7532bc0ecf761e5fa5d4")
index=activity AND rg_functionality="O365 General" AND customstring3 NOT NULL AND customstring3 IN ("ebc93a546bcdf6cc1eb61d7174bcb85407bbd892","d6d32a1f17d48fe695c0778018c0d51626db4a3b","7d66b550ea68a86fcc0958e7c159531d4431b788","d78f353a70adf68371bc10cf869b761bd51484b0","99bed842b5e222411d19f0c5b54478e8cc7ae68f","5df3c882db6be14887182b7439b72a86bd28b83f","aa823148eea6f43d8eb9bf20412402a7739d91c2","c26f04790c6fb7950d89ab1b08207ace01efb536","5265e8edc9b5f7dd00fc772522511b8f3be217e3","ef189737fb7d61b110b9293e8838526dce920127","3a395daaf518be113fcff2e5e48acd9b9c0de69d","5f1553f3af9425ef5d68341e991b6c5ec96a82eb","cc350ba25947b7f9ec5d11ea8269407c0fd74095","1b06e877c2c12d74336e7532bc0ecf761e5fa5d4")
index=activity AND rg_functionality="O365 General" AND customstring64 NOT NULL AND customstring64 IN ("ebc93a546bcdf6cc1eb61d7174bcb85407bbd892","d6d32a1f17d48fe695c0778018c0d51626db4a3b","7d66b550ea68a86fcc0958e7c159531d4431b788","d78f353a70adf68371bc10cf869b761bd51484b0","99bed842b5e222411d19f0c5b54478e8cc7ae68f","5df3c882db6be14887182b7439b72a86bd28b83f","aa823148eea6f43d8eb9bf20412402a7739d91c2","c26f04790c6fb7950d89ab1b08207ace01efb536","5265e8edc9b5f7dd00fc772522511b8f3be217e3","ef189737fb7d61b110b9293e8838526dce920127","3a395daaf518be113fcff2e5e48acd9b9c0de69d","5f1553f3af9425ef5d68341e991b6c5ec96a82eb","cc350ba25947b7f9ec5d11ea8269407c0fd74095","1b06e877c2c12d74336e7532bc0ecf761e5fa5d4")
