index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("d2fd0654710c27dcf37b6c1437880020824e161dd0bf28e3a133ed7772","dcfa2800754e5722acf94987bb03e814edcb9acebda37df6da1987bf48","bc747e3bf7b6e02c09f3d18bdd0e64eef62b940b2f16c9c72e647eec85","73170761d6776c0debacfbbc61b6988cb8270a20174bf5c049768a264","1b60097bf1ccb15a952e5bcc3522cf5c162da68c381a76abc2d5985659","aaa647327ba5b855bedea8e889b3fafdc05a6ca75d1cfd98869432006d","7d6959bb7a9482e1caa83b16ee01103d982d47c70c72fdd03708e2b7f","36cc31f0ab65b745f25c7e785df9e72d1c8919d35a1d7bd4ce8050c8c0","3298d203c2acb68c474e5fdad8379181890b4403d6491c523c1373012","0ee1d284ed663073872012c7bde7fac5ca1121403f1a5d2d5411317df2","ffd9f58e5fe8502249c67cad0123ceeeaa6e9f69b4ec9f9e21511809849","dfe6fddc67bdc93b9947430b966da2877fda094edf3e21e6f0ba98a84bc","131da83b521f610819141d5c740313ce46578374abb22ef504a759395","9f393516edf6b8e011df6ee991758480c5b99a0efbfd68347786061f0e0","9585af44c3ff8fd921c713680b0c2b3bbc9d56add848ed62164f7c9b9f2","2f629395fdfa11e713ea8bf11d40f6f240acf2f5fcf9a2ac50b6f7fbc7521c8","7f731cc11f8e4d249142e99a44b9da7a48505ce32c4ee4881041beedd","95477703e789e6182096a09bc98853e0a70b680a4f19fa2bf86cbb9280","0c0e0f9b09b80d87ebc88e2870907b6cacb4cd7703584baf8f2be1fd94","c9c94ac5e1991a7db42c7973e328fceeb6f163d9f644031bdfd4123c7b","aaa6041912a6ba3cf167ecdb90a434a62feaf08639c59705847706b9f4","18051333e658c4816ff3576a2e9d97fe2a1196ac0ea5ed9ba386c46def","5e1e3bf6999126ae4aa52146280fdb913912632e8bac4f54e98c58821a","8317ff6416af8ab6eb35df3529689671a700fdb61a5e6436f4d6ea8ee00","892405573aa34dfc49b37e4c35b655543e88ec1c5e8ffb27ab8d1bbf90")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("d2fd0654710c27dcf37b6c1437880020824e161dd0bf28e3a133ed7772","dcfa2800754e5722acf94987bb03e814edcb9acebda37df6da1987bf48","bc747e3bf7b6e02c09f3d18bdd0e64eef62b940b2f16c9c72e647eec85","73170761d6776c0debacfbbc61b6988cb8270a20174bf5c049768a264","1b60097bf1ccb15a952e5bcc3522cf5c162da68c381a76abc2d5985659","aaa647327ba5b855bedea8e889b3fafdc05a6ca75d1cfd98869432006d","7d6959bb7a9482e1caa83b16ee01103d982d47c70c72fdd03708e2b7f","36cc31f0ab65b745f25c7e785df9e72d1c8919d35a1d7bd4ce8050c8c0","3298d203c2acb68c474e5fdad8379181890b4403d6491c523c1373012","0ee1d284ed663073872012c7bde7fac5ca1121403f1a5d2d5411317df2","ffd9f58e5fe8502249c67cad0123ceeeaa6e9f69b4ec9f9e21511809849","dfe6fddc67bdc93b9947430b966da2877fda094edf3e21e6f0ba98a84bc","131da83b521f610819141d5c740313ce46578374abb22ef504a759395","9f393516edf6b8e011df6ee991758480c5b99a0efbfd68347786061f0e0","9585af44c3ff8fd921c713680b0c2b3bbc9d56add848ed62164f7c9b9f2","2f629395fdfa11e713ea8bf11d40f6f240acf2f5fcf9a2ac50b6f7fbc7521c8","7f731cc11f8e4d249142e99a44b9da7a48505ce32c4ee4881041beedd","95477703e789e6182096a09bc98853e0a70b680a4f19fa2bf86cbb9280","0c0e0f9b09b80d87ebc88e2870907b6cacb4cd7703584baf8f2be1fd94","c9c94ac5e1991a7db42c7973e328fceeb6f163d9f644031bdfd4123c7b","aaa6041912a6ba3cf167ecdb90a434a62feaf08639c59705847706b9f4","18051333e658c4816ff3576a2e9d97fe2a1196ac0ea5ed9ba386c46def","5e1e3bf6999126ae4aa52146280fdb913912632e8bac4f54e98c58821a","8317ff6416af8ab6eb35df3529689671a700fdb61a5e6436f4d6ea8ee00","892405573aa34dfc49b37e4c35b655543e88ec1c5e8ffb27ab8d1bbf90")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("d2fd0654710c27dcf37b6c1437880020824e161dd0bf28e3a133ed7772","dcfa2800754e5722acf94987bb03e814edcb9acebda37df6da1987bf48","bc747e3bf7b6e02c09f3d18bdd0e64eef62b940b2f16c9c72e647eec85","73170761d6776c0debacfbbc61b6988cb8270a20174bf5c049768a264","1b60097bf1ccb15a952e5bcc3522cf5c162da68c381a76abc2d5985659","aaa647327ba5b855bedea8e889b3fafdc05a6ca75d1cfd98869432006d","7d6959bb7a9482e1caa83b16ee01103d982d47c70c72fdd03708e2b7f","36cc31f0ab65b745f25c7e785df9e72d1c8919d35a1d7bd4ce8050c8c0","3298d203c2acb68c474e5fdad8379181890b4403d6491c523c1373012","0ee1d284ed663073872012c7bde7fac5ca1121403f1a5d2d5411317df2","ffd9f58e5fe8502249c67cad0123ceeeaa6e9f69b4ec9f9e21511809849","dfe6fddc67bdc93b9947430b966da2877fda094edf3e21e6f0ba98a84bc","131da83b521f610819141d5c740313ce46578374abb22ef504a759395","9f393516edf6b8e011df6ee991758480c5b99a0efbfd68347786061f0e0","9585af44c3ff8fd921c713680b0c2b3bbc9d56add848ed62164f7c9b9f2","2f629395fdfa11e713ea8bf11d40f6f240acf2f5fcf9a2ac50b6f7fbc7521c8","7f731cc11f8e4d249142e99a44b9da7a48505ce32c4ee4881041beedd","95477703e789e6182096a09bc98853e0a70b680a4f19fa2bf86cbb9280","0c0e0f9b09b80d87ebc88e2870907b6cacb4cd7703584baf8f2be1fd94","c9c94ac5e1991a7db42c7973e328fceeb6f163d9f644031bdfd4123c7b","aaa6041912a6ba3cf167ecdb90a434a62feaf08639c59705847706b9f4","18051333e658c4816ff3576a2e9d97fe2a1196ac0ea5ed9ba386c46def","5e1e3bf6999126ae4aa52146280fdb913912632e8bac4f54e98c58821a","8317ff6416af8ab6eb35df3529689671a700fdb61a5e6436f4d6ea8ee00","892405573aa34dfc49b37e4c35b655543e88ec1c5e8ffb27ab8d1bbf90")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring64 NOT NULL AND customstring64 IN ("d2fd0654710c27dcf37b6c1437880020824e161dd0bf28e3a133ed7772","dcfa2800754e5722acf94987bb03e814edcb9acebda37df6da1987bf48","bc747e3bf7b6e02c09f3d18bdd0e64eef62b940b2f16c9c72e647eec85","73170761d6776c0debacfbbc61b6988cb8270a20174bf5c049768a264","1b60097bf1ccb15a952e5bcc3522cf5c162da68c381a76abc2d5985659","aaa647327ba5b855bedea8e889b3fafdc05a6ca75d1cfd98869432006d","7d6959bb7a9482e1caa83b16ee01103d982d47c70c72fdd03708e2b7f","36cc31f0ab65b745f25c7e785df9e72d1c8919d35a1d7bd4ce8050c8c0","3298d203c2acb68c474e5fdad8379181890b4403d6491c523c1373012","0ee1d284ed663073872012c7bde7fac5ca1121403f1a5d2d5411317df2","ffd9f58e5fe8502249c67cad0123ceeeaa6e9f69b4ec9f9e21511809849","dfe6fddc67bdc93b9947430b966da2877fda094edf3e21e6f0ba98a84bc","131da83b521f610819141d5c740313ce46578374abb22ef504a759395","9f393516edf6b8e011df6ee991758480c5b99a0efbfd68347786061f0e0","9585af44c3ff8fd921c713680b0c2b3bbc9d56add848ed62164f7c9b9f2","2f629395fdfa11e713ea8bf11d40f6f240acf2f5fcf9a2ac50b6f7fbc7521c8","7f731cc11f8e4d249142e99a44b9da7a48505ce32c4ee4881041beedd","95477703e789e6182096a09bc98853e0a70b680a4f19fa2bf86cbb9280","0c0e0f9b09b80d87ebc88e2870907b6cacb4cd7703584baf8f2be1fd94","c9c94ac5e1991a7db42c7973e328fceeb6f163d9f644031bdfd4123c7b","aaa6041912a6ba3cf167ecdb90a434a62feaf08639c59705847706b9f4","18051333e658c4816ff3576a2e9d97fe2a1196ac0ea5ed9ba386c46def","5e1e3bf6999126ae4aa52146280fdb913912632e8bac4f54e98c58821a","8317ff6416af8ab6eb35df3529689671a700fdb61a5e6436f4d6ea8ee00","892405573aa34dfc49b37e4c35b655543e88ec1c5e8ffb27ab8d1bbf90")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("d2fd0654710c27dcf37b6c1437880020824e161dd0bf28e3a133ed7772","dcfa2800754e5722acf94987bb03e814edcb9acebda37df6da1987bf48","bc747e3bf7b6e02c09f3d18bdd0e64eef62b940b2f16c9c72e647eec85","73170761d6776c0debacfbbc61b6988cb8270a20174bf5c049768a264","1b60097bf1ccb15a952e5bcc3522cf5c162da68c381a76abc2d5985659","aaa647327ba5b855bedea8e889b3fafdc05a6ca75d1cfd98869432006d","7d6959bb7a9482e1caa83b16ee01103d982d47c70c72fdd03708e2b7f","36cc31f0ab65b745f25c7e785df9e72d1c8919d35a1d7bd4ce8050c8c0","3298d203c2acb68c474e5fdad8379181890b4403d6491c523c1373012","0ee1d284ed663073872012c7bde7fac5ca1121403f1a5d2d5411317df2","ffd9f58e5fe8502249c67cad0123ceeeaa6e9f69b4ec9f9e21511809849","dfe6fddc67bdc93b9947430b966da2877fda094edf3e21e6f0ba98a84bc","131da83b521f610819141d5c740313ce46578374abb22ef504a759395","9f393516edf6b8e011df6ee991758480c5b99a0efbfd68347786061f0e0","9585af44c3ff8fd921c713680b0c2b3bbc9d56add848ed62164f7c9b9f2","2f629395fdfa11e713ea8bf11d40f6f240acf2f5fcf9a2ac50b6f7fbc7521c8","7f731cc11f8e4d249142e99a44b9da7a48505ce32c4ee4881041beedd","95477703e789e6182096a09bc98853e0a70b680a4f19fa2bf86cbb9280","0c0e0f9b09b80d87ebc88e2870907b6cacb4cd7703584baf8f2be1fd94","c9c94ac5e1991a7db42c7973e328fceeb6f163d9f644031bdfd4123c7b","aaa6041912a6ba3cf167ecdb90a434a62feaf08639c59705847706b9f4","18051333e658c4816ff3576a2e9d97fe2a1196ac0ea5ed9ba386c46def","5e1e3bf6999126ae4aa52146280fdb913912632e8bac4f54e98c58821a","8317ff6416af8ab6eb35df3529689671a700fdb61a5e6436f4d6ea8ee00","892405573aa34dfc49b37e4c35b655543e88ec1c5e8ffb27ab8d1bbf90")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("d2fd0654710c27dcf37b6c1437880020824e161dd0bf28e3a133ed7772","dcfa2800754e5722acf94987bb03e814edcb9acebda37df6da1987bf48","bc747e3bf7b6e02c09f3d18bdd0e64eef62b940b2f16c9c72e647eec85","73170761d6776c0debacfbbc61b6988cb8270a20174bf5c049768a264","1b60097bf1ccb15a952e5bcc3522cf5c162da68c381a76abc2d5985659","aaa647327ba5b855bedea8e889b3fafdc05a6ca75d1cfd98869432006d","7d6959bb7a9482e1caa83b16ee01103d982d47c70c72fdd03708e2b7f","36cc31f0ab65b745f25c7e785df9e72d1c8919d35a1d7bd4ce8050c8c0","3298d203c2acb68c474e5fdad8379181890b4403d6491c523c1373012","0ee1d284ed663073872012c7bde7fac5ca1121403f1a5d2d5411317df2","ffd9f58e5fe8502249c67cad0123ceeeaa6e9f69b4ec9f9e21511809849","dfe6fddc67bdc93b9947430b966da2877fda094edf3e21e6f0ba98a84bc","131da83b521f610819141d5c740313ce46578374abb22ef504a759395","9f393516edf6b8e011df6ee991758480c5b99a0efbfd68347786061f0e0","9585af44c3ff8fd921c713680b0c2b3bbc9d56add848ed62164f7c9b9f2","2f629395fdfa11e713ea8bf11d40f6f240acf2f5fcf9a2ac50b6f7fbc7521c8","7f731cc11f8e4d249142e99a44b9da7a48505ce32c4ee4881041beedd","95477703e789e6182096a09bc98853e0a70b680a4f19fa2bf86cbb9280","0c0e0f9b09b80d87ebc88e2870907b6cacb4cd7703584baf8f2be1fd94","c9c94ac5e1991a7db42c7973e328fceeb6f163d9f644031bdfd4123c7b","aaa6041912a6ba3cf167ecdb90a434a62feaf08639c59705847706b9f4","18051333e658c4816ff3576a2e9d97fe2a1196ac0ea5ed9ba386c46def","5e1e3bf6999126ae4aa52146280fdb913912632e8bac4f54e98c58821a","8317ff6416af8ab6eb35df3529689671a700fdb61a5e6436f4d6ea8ee00","892405573aa34dfc49b37e4c35b655543e88ec1c5e8ffb27ab8d1bbf90")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("d2fd0654710c27dcf37b6c1437880020824e161dd0bf28e3a133ed7772","dcfa2800754e5722acf94987bb03e814edcb9acebda37df6da1987bf48","bc747e3bf7b6e02c09f3d18bdd0e64eef62b940b2f16c9c72e647eec85","73170761d6776c0debacfbbc61b6988cb8270a20174bf5c049768a264","1b60097bf1ccb15a952e5bcc3522cf5c162da68c381a76abc2d5985659","aaa647327ba5b855bedea8e889b3fafdc05a6ca75d1cfd98869432006d","7d6959bb7a9482e1caa83b16ee01103d982d47c70c72fdd03708e2b7f","36cc31f0ab65b745f25c7e785df9e72d1c8919d35a1d7bd4ce8050c8c0","3298d203c2acb68c474e5fdad8379181890b4403d6491c523c1373012","0ee1d284ed663073872012c7bde7fac5ca1121403f1a5d2d5411317df2","ffd9f58e5fe8502249c67cad0123ceeeaa6e9f69b4ec9f9e21511809849","dfe6fddc67bdc93b9947430b966da2877fda094edf3e21e6f0ba98a84bc","131da83b521f610819141d5c740313ce46578374abb22ef504a759395","9f393516edf6b8e011df6ee991758480c5b99a0efbfd68347786061f0e0","9585af44c3ff8fd921c713680b0c2b3bbc9d56add848ed62164f7c9b9f2","2f629395fdfa11e713ea8bf11d40f6f240acf2f5fcf9a2ac50b6f7fbc7521c8","7f731cc11f8e4d249142e99a44b9da7a48505ce32c4ee4881041beedd","95477703e789e6182096a09bc98853e0a70b680a4f19fa2bf86cbb9280","0c0e0f9b09b80d87ebc88e2870907b6cacb4cd7703584baf8f2be1fd94","c9c94ac5e1991a7db42c7973e328fceeb6f163d9f644031bdfd4123c7b","aaa6041912a6ba3cf167ecdb90a434a62feaf08639c59705847706b9f4","18051333e658c4816ff3576a2e9d97fe2a1196ac0ea5ed9ba386c46def","5e1e3bf6999126ae4aa52146280fdb913912632e8bac4f54e98c58821a","8317ff6416af8ab6eb35df3529689671a700fdb61a5e6436f4d6ea8ee00","892405573aa34dfc49b37e4c35b655543e88ec1c5e8ffb27ab8d1bbf90")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("d2fd0654710c27dcf37b6c1437880020824e161dd0bf28e3a133ed7772","dcfa2800754e5722acf94987bb03e814edcb9acebda37df6da1987bf48","bc747e3bf7b6e02c09f3d18bdd0e64eef62b940b2f16c9c72e647eec85","73170761d6776c0debacfbbc61b6988cb8270a20174bf5c049768a264","1b60097bf1ccb15a952e5bcc3522cf5c162da68c381a76abc2d5985659","aaa647327ba5b855bedea8e889b3fafdc05a6ca75d1cfd98869432006d","7d6959bb7a9482e1caa83b16ee01103d982d47c70c72fdd03708e2b7f","36cc31f0ab65b745f25c7e785df9e72d1c8919d35a1d7bd4ce8050c8c0","3298d203c2acb68c474e5fdad8379181890b4403d6491c523c1373012","0ee1d284ed663073872012c7bde7fac5ca1121403f1a5d2d5411317df2","ffd9f58e5fe8502249c67cad0123ceeeaa6e9f69b4ec9f9e21511809849","dfe6fddc67bdc93b9947430b966da2877fda094edf3e21e6f0ba98a84bc","131da83b521f610819141d5c740313ce46578374abb22ef504a759395","9f393516edf6b8e011df6ee991758480c5b99a0efbfd68347786061f0e0","9585af44c3ff8fd921c713680b0c2b3bbc9d56add848ed62164f7c9b9f2","2f629395fdfa11e713ea8bf11d40f6f240acf2f5fcf9a2ac50b6f7fbc7521c8","7f731cc11f8e4d249142e99a44b9da7a48505ce32c4ee4881041beedd","95477703e789e6182096a09bc98853e0a70b680a4f19fa2bf86cbb9280","0c0e0f9b09b80d87ebc88e2870907b6cacb4cd7703584baf8f2be1fd94","c9c94ac5e1991a7db42c7973e328fceeb6f163d9f644031bdfd4123c7b","aaa6041912a6ba3cf167ecdb90a434a62feaf08639c59705847706b9f4","18051333e658c4816ff3576a2e9d97fe2a1196ac0ea5ed9ba386c46def","5e1e3bf6999126ae4aa52146280fdb913912632e8bac4f54e98c58821a","8317ff6416af8ab6eb35df3529689671a700fdb61a5e6436f4d6ea8ee00","892405573aa34dfc49b37e4c35b655543e88ec1c5e8ffb27ab8d1bbf90")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("d2fd0654710c27dcf37b6c1437880020824e161dd0bf28e3a133ed7772","dcfa2800754e5722acf94987bb03e814edcb9acebda37df6da1987bf48","bc747e3bf7b6e02c09f3d18bdd0e64eef62b940b2f16c9c72e647eec85","73170761d6776c0debacfbbc61b6988cb8270a20174bf5c049768a264","1b60097bf1ccb15a952e5bcc3522cf5c162da68c381a76abc2d5985659","aaa647327ba5b855bedea8e889b3fafdc05a6ca75d1cfd98869432006d","7d6959bb7a9482e1caa83b16ee01103d982d47c70c72fdd03708e2b7f","36cc31f0ab65b745f25c7e785df9e72d1c8919d35a1d7bd4ce8050c8c0","3298d203c2acb68c474e5fdad8379181890b4403d6491c523c1373012","0ee1d284ed663073872012c7bde7fac5ca1121403f1a5d2d5411317df2","ffd9f58e5fe8502249c67cad0123ceeeaa6e9f69b4ec9f9e21511809849","dfe6fddc67bdc93b9947430b966da2877fda094edf3e21e6f0ba98a84bc","131da83b521f610819141d5c740313ce46578374abb22ef504a759395","9f393516edf6b8e011df6ee991758480c5b99a0efbfd68347786061f0e0","9585af44c3ff8fd921c713680b0c2b3bbc9d56add848ed62164f7c9b9f2","2f629395fdfa11e713ea8bf11d40f6f240acf2f5fcf9a2ac50b6f7fbc7521c8","7f731cc11f8e4d249142e99a44b9da7a48505ce32c4ee4881041beedd","95477703e789e6182096a09bc98853e0a70b680a4f19fa2bf86cbb9280","0c0e0f9b09b80d87ebc88e2870907b6cacb4cd7703584baf8f2be1fd94","c9c94ac5e1991a7db42c7973e328fceeb6f163d9f644031bdfd4123c7b","aaa6041912a6ba3cf167ecdb90a434a62feaf08639c59705847706b9f4","18051333e658c4816ff3576a2e9d97fe2a1196ac0ea5ed9ba386c46def","5e1e3bf6999126ae4aa52146280fdb913912632e8bac4f54e98c58821a","8317ff6416af8ab6eb35df3529689671a700fdb61a5e6436f4d6ea8ee00","892405573aa34dfc49b37e4c35b655543e88ec1c5e8ffb27ab8d1bbf90")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("d2fd0654710c27dcf37b6c1437880020824e161dd0bf28e3a133ed7772","dcfa2800754e5722acf94987bb03e814edcb9acebda37df6da1987bf48","bc747e3bf7b6e02c09f3d18bdd0e64eef62b940b2f16c9c72e647eec85","73170761d6776c0debacfbbc61b6988cb8270a20174bf5c049768a264","1b60097bf1ccb15a952e5bcc3522cf5c162da68c381a76abc2d5985659","aaa647327ba5b855bedea8e889b3fafdc05a6ca75d1cfd98869432006d","7d6959bb7a9482e1caa83b16ee01103d982d47c70c72fdd03708e2b7f","36cc31f0ab65b745f25c7e785df9e72d1c8919d35a1d7bd4ce8050c8c0","3298d203c2acb68c474e5fdad8379181890b4403d6491c523c1373012","0ee1d284ed663073872012c7bde7fac5ca1121403f1a5d2d5411317df2","ffd9f58e5fe8502249c67cad0123ceeeaa6e9f69b4ec9f9e21511809849","dfe6fddc67bdc93b9947430b966da2877fda094edf3e21e6f0ba98a84bc","131da83b521f610819141d5c740313ce46578374abb22ef504a759395","9f393516edf6b8e011df6ee991758480c5b99a0efbfd68347786061f0e0","9585af44c3ff8fd921c713680b0c2b3bbc9d56add848ed62164f7c9b9f2","2f629395fdfa11e713ea8bf11d40f6f240acf2f5fcf9a2ac50b6f7fbc7521c8","7f731cc11f8e4d249142e99a44b9da7a48505ce32c4ee4881041beedd","95477703e789e6182096a09bc98853e0a70b680a4f19fa2bf86cbb9280","0c0e0f9b09b80d87ebc88e2870907b6cacb4cd7703584baf8f2be1fd94","c9c94ac5e1991a7db42c7973e328fceeb6f163d9f644031bdfd4123c7b","aaa6041912a6ba3cf167ecdb90a434a62feaf08639c59705847706b9f4","18051333e658c4816ff3576a2e9d97fe2a1196ac0ea5ed9ba386c46def","5e1e3bf6999126ae4aa52146280fdb913912632e8bac4f54e98c58821a","8317ff6416af8ab6eb35df3529689671a700fdb61a5e6436f4d6ea8ee00","892405573aa34dfc49b37e4c35b655543e88ec1c5e8ffb27ab8d1bbf90")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("d2fd0654710c27dcf37b6c1437880020824e161dd0bf28e3a133ed7772","dcfa2800754e5722acf94987bb03e814edcb9acebda37df6da1987bf48","bc747e3bf7b6e02c09f3d18bdd0e64eef62b940b2f16c9c72e647eec85","73170761d6776c0debacfbbc61b6988cb8270a20174bf5c049768a264","1b60097bf1ccb15a952e5bcc3522cf5c162da68c381a76abc2d5985659","aaa647327ba5b855bedea8e889b3fafdc05a6ca75d1cfd98869432006d","7d6959bb7a9482e1caa83b16ee01103d982d47c70c72fdd03708e2b7f","36cc31f0ab65b745f25c7e785df9e72d1c8919d35a1d7bd4ce8050c8c0","3298d203c2acb68c474e5fdad8379181890b4403d6491c523c1373012","0ee1d284ed663073872012c7bde7fac5ca1121403f1a5d2d5411317df2","ffd9f58e5fe8502249c67cad0123ceeeaa6e9f69b4ec9f9e21511809849","dfe6fddc67bdc93b9947430b966da2877fda094edf3e21e6f0ba98a84bc","131da83b521f610819141d5c740313ce46578374abb22ef504a759395","9f393516edf6b8e011df6ee991758480c5b99a0efbfd68347786061f0e0","9585af44c3ff8fd921c713680b0c2b3bbc9d56add848ed62164f7c9b9f2","2f629395fdfa11e713ea8bf11d40f6f240acf2f5fcf9a2ac50b6f7fbc7521c8","7f731cc11f8e4d249142e99a44b9da7a48505ce32c4ee4881041beedd","95477703e789e6182096a09bc98853e0a70b680a4f19fa2bf86cbb9280","0c0e0f9b09b80d87ebc88e2870907b6cacb4cd7703584baf8f2be1fd94","c9c94ac5e1991a7db42c7973e328fceeb6f163d9f644031bdfd4123c7b","aaa6041912a6ba3cf167ecdb90a434a62feaf08639c59705847706b9f4","18051333e658c4816ff3576a2e9d97fe2a1196ac0ea5ed9ba386c46def","5e1e3bf6999126ae4aa52146280fdb913912632e8bac4f54e98c58821a","8317ff6416af8ab6eb35df3529689671a700fdb61a5e6436f4d6ea8ee00","892405573aa34dfc49b37e4c35b655543e88ec1c5e8ffb27ab8d1bbf90")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("d2fd0654710c27dcf37b6c1437880020824e161dd0bf28e3a133ed7772","dcfa2800754e5722acf94987bb03e814edcb9acebda37df6da1987bf48","bc747e3bf7b6e02c09f3d18bdd0e64eef62b940b2f16c9c72e647eec85","73170761d6776c0debacfbbc61b6988cb8270a20174bf5c049768a264","1b60097bf1ccb15a952e5bcc3522cf5c162da68c381a76abc2d5985659","aaa647327ba5b855bedea8e889b3fafdc05a6ca75d1cfd98869432006d","7d6959bb7a9482e1caa83b16ee01103d982d47c70c72fdd03708e2b7f","36cc31f0ab65b745f25c7e785df9e72d1c8919d35a1d7bd4ce8050c8c0","3298d203c2acb68c474e5fdad8379181890b4403d6491c523c1373012","0ee1d284ed663073872012c7bde7fac5ca1121403f1a5d2d5411317df2","ffd9f58e5fe8502249c67cad0123ceeeaa6e9f69b4ec9f9e21511809849","dfe6fddc67bdc93b9947430b966da2877fda094edf3e21e6f0ba98a84bc","131da83b521f610819141d5c740313ce46578374abb22ef504a759395","9f393516edf6b8e011df6ee991758480c5b99a0efbfd68347786061f0e0","9585af44c3ff8fd921c713680b0c2b3bbc9d56add848ed62164f7c9b9f2","2f629395fdfa11e713ea8bf11d40f6f240acf2f5fcf9a2ac50b6f7fbc7521c8","7f731cc11f8e4d249142e99a44b9da7a48505ce32c4ee4881041beedd","95477703e789e6182096a09bc98853e0a70b680a4f19fa2bf86cbb9280","0c0e0f9b09b80d87ebc88e2870907b6cacb4cd7703584baf8f2be1fd94","c9c94ac5e1991a7db42c7973e328fceeb6f163d9f644031bdfd4123c7b","aaa6041912a6ba3cf167ecdb90a434a62feaf08639c59705847706b9f4","18051333e658c4816ff3576a2e9d97fe2a1196ac0ea5ed9ba386c46def","5e1e3bf6999126ae4aa52146280fdb913912632e8bac4f54e98c58821a","8317ff6416af8ab6eb35df3529689671a700fdb61a5e6436f4d6ea8ee00","892405573aa34dfc49b37e4c35b655543e88ec1c5e8ffb27ab8d1bbf90")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("d2fd0654710c27dcf37b6c1437880020824e161dd0bf28e3a133ed7772","dcfa2800754e5722acf94987bb03e814edcb9acebda37df6da1987bf48","bc747e3bf7b6e02c09f3d18bdd0e64eef62b940b2f16c9c72e647eec85","73170761d6776c0debacfbbc61b6988cb8270a20174bf5c049768a264","1b60097bf1ccb15a952e5bcc3522cf5c162da68c381a76abc2d5985659","aaa647327ba5b855bedea8e889b3fafdc05a6ca75d1cfd98869432006d","7d6959bb7a9482e1caa83b16ee01103d982d47c70c72fdd03708e2b7f","36cc31f0ab65b745f25c7e785df9e72d1c8919d35a1d7bd4ce8050c8c0","3298d203c2acb68c474e5fdad8379181890b4403d6491c523c1373012","0ee1d284ed663073872012c7bde7fac5ca1121403f1a5d2d5411317df2","ffd9f58e5fe8502249c67cad0123ceeeaa6e9f69b4ec9f9e21511809849","dfe6fddc67bdc93b9947430b966da2877fda094edf3e21e6f0ba98a84bc","131da83b521f610819141d5c740313ce46578374abb22ef504a759395","9f393516edf6b8e011df6ee991758480c5b99a0efbfd68347786061f0e0","9585af44c3ff8fd921c713680b0c2b3bbc9d56add848ed62164f7c9b9f2","2f629395fdfa11e713ea8bf11d40f6f240acf2f5fcf9a2ac50b6f7fbc7521c8","7f731cc11f8e4d249142e99a44b9da7a48505ce32c4ee4881041beedd","95477703e789e6182096a09bc98853e0a70b680a4f19fa2bf86cbb9280","0c0e0f9b09b80d87ebc88e2870907b6cacb4cd7703584baf8f2be1fd94","c9c94ac5e1991a7db42c7973e328fceeb6f163d9f644031bdfd4123c7b","aaa6041912a6ba3cf167ecdb90a434a62feaf08639c59705847706b9f4","18051333e658c4816ff3576a2e9d97fe2a1196ac0ea5ed9ba386c46def","5e1e3bf6999126ae4aa52146280fdb913912632e8bac4f54e98c58821a","8317ff6416af8ab6eb35df3529689671a700fdb61a5e6436f4d6ea8ee00","892405573aa34dfc49b37e4c35b655543e88ec1c5e8ffb27ab8d1bbf90")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("d2fd0654710c27dcf37b6c1437880020824e161dd0bf28e3a133ed7772","dcfa2800754e5722acf94987bb03e814edcb9acebda37df6da1987bf48","bc747e3bf7b6e02c09f3d18bdd0e64eef62b940b2f16c9c72e647eec85","73170761d6776c0debacfbbc61b6988cb8270a20174bf5c049768a264","1b60097bf1ccb15a952e5bcc3522cf5c162da68c381a76abc2d5985659","aaa647327ba5b855bedea8e889b3fafdc05a6ca75d1cfd98869432006d","7d6959bb7a9482e1caa83b16ee01103d982d47c70c72fdd03708e2b7f","36cc31f0ab65b745f25c7e785df9e72d1c8919d35a1d7bd4ce8050c8c0","3298d203c2acb68c474e5fdad8379181890b4403d6491c523c1373012","0ee1d284ed663073872012c7bde7fac5ca1121403f1a5d2d5411317df2","ffd9f58e5fe8502249c67cad0123ceeeaa6e9f69b4ec9f9e21511809849","dfe6fddc67bdc93b9947430b966da2877fda094edf3e21e6f0ba98a84bc","131da83b521f610819141d5c740313ce46578374abb22ef504a759395","9f393516edf6b8e011df6ee991758480c5b99a0efbfd68347786061f0e0","9585af44c3ff8fd921c713680b0c2b3bbc9d56add848ed62164f7c9b9f2","2f629395fdfa11e713ea8bf11d40f6f240acf2f5fcf9a2ac50b6f7fbc7521c8","7f731cc11f8e4d249142e99a44b9da7a48505ce32c4ee4881041beedd","95477703e789e6182096a09bc98853e0a70b680a4f19fa2bf86cbb9280","0c0e0f9b09b80d87ebc88e2870907b6cacb4cd7703584baf8f2be1fd94","c9c94ac5e1991a7db42c7973e328fceeb6f163d9f644031bdfd4123c7b","aaa6041912a6ba3cf167ecdb90a434a62feaf08639c59705847706b9f4","18051333e658c4816ff3576a2e9d97fe2a1196ac0ea5ed9ba386c46def","5e1e3bf6999126ae4aa52146280fdb913912632e8bac4f54e98c58821a","8317ff6416af8ab6eb35df3529689671a700fdb61a5e6436f4d6ea8ee00","892405573aa34dfc49b37e4c35b655543e88ec1c5e8ffb27ab8d1bbf90")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("d2fd0654710c27dcf37b6c1437880020824e161dd0bf28e3a133ed7772","dcfa2800754e5722acf94987bb03e814edcb9acebda37df6da1987bf48","bc747e3bf7b6e02c09f3d18bdd0e64eef62b940b2f16c9c72e647eec85","73170761d6776c0debacfbbc61b6988cb8270a20174bf5c049768a264","1b60097bf1ccb15a952e5bcc3522cf5c162da68c381a76abc2d5985659","aaa647327ba5b855bedea8e889b3fafdc05a6ca75d1cfd98869432006d","7d6959bb7a9482e1caa83b16ee01103d982d47c70c72fdd03708e2b7f","36cc31f0ab65b745f25c7e785df9e72d1c8919d35a1d7bd4ce8050c8c0","3298d203c2acb68c474e5fdad8379181890b4403d6491c523c1373012","0ee1d284ed663073872012c7bde7fac5ca1121403f1a5d2d5411317df2","ffd9f58e5fe8502249c67cad0123ceeeaa6e9f69b4ec9f9e21511809849","dfe6fddc67bdc93b9947430b966da2877fda094edf3e21e6f0ba98a84bc","131da83b521f610819141d5c740313ce46578374abb22ef504a759395","9f393516edf6b8e011df6ee991758480c5b99a0efbfd68347786061f0e0","9585af44c3ff8fd921c713680b0c2b3bbc9d56add848ed62164f7c9b9f2","2f629395fdfa11e713ea8bf11d40f6f240acf2f5fcf9a2ac50b6f7fbc7521c8","7f731cc11f8e4d249142e99a44b9da7a48505ce32c4ee4881041beedd","95477703e789e6182096a09bc98853e0a70b680a4f19fa2bf86cbb9280","0c0e0f9b09b80d87ebc88e2870907b6cacb4cd7703584baf8f2be1fd94","c9c94ac5e1991a7db42c7973e328fceeb6f163d9f644031bdfd4123c7b","aaa6041912a6ba3cf167ecdb90a434a62feaf08639c59705847706b9f4","18051333e658c4816ff3576a2e9d97fe2a1196ac0ea5ed9ba386c46def","5e1e3bf6999126ae4aa52146280fdb913912632e8bac4f54e98c58821a","8317ff6416af8ab6eb35df3529689671a700fdb61a5e6436f4d6ea8ee00","892405573aa34dfc49b37e4c35b655543e88ec1c5e8ffb27ab8d1bbf90")
index=activity AND rg_functionality="Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("d2fd0654710c27dcf37b6c1437880020824e161dd0bf28e3a133ed7772","dcfa2800754e5722acf94987bb03e814edcb9acebda37df6da1987bf48","bc747e3bf7b6e02c09f3d18bdd0e64eef62b940b2f16c9c72e647eec85","73170761d6776c0debacfbbc61b6988cb8270a20174bf5c049768a264","1b60097bf1ccb15a952e5bcc3522cf5c162da68c381a76abc2d5985659","aaa647327ba5b855bedea8e889b3fafdc05a6ca75d1cfd98869432006d","7d6959bb7a9482e1caa83b16ee01103d982d47c70c72fdd03708e2b7f","36cc31f0ab65b745f25c7e785df9e72d1c8919d35a1d7bd4ce8050c8c0","3298d203c2acb68c474e5fdad8379181890b4403d6491c523c1373012","0ee1d284ed663073872012c7bde7fac5ca1121403f1a5d2d5411317df2","ffd9f58e5fe8502249c67cad0123ceeeaa6e9f69b4ec9f9e21511809849","dfe6fddc67bdc93b9947430b966da2877fda094edf3e21e6f0ba98a84bc","131da83b521f610819141d5c740313ce46578374abb22ef504a759395","9f393516edf6b8e011df6ee991758480c5b99a0efbfd68347786061f0e0","9585af44c3ff8fd921c713680b0c2b3bbc9d56add848ed62164f7c9b9f2","2f629395fdfa11e713ea8bf11d40f6f240acf2f5fcf9a2ac50b6f7fbc7521c8","7f731cc11f8e4d249142e99a44b9da7a48505ce32c4ee4881041beedd","95477703e789e6182096a09bc98853e0a70b680a4f19fa2bf86cbb9280","0c0e0f9b09b80d87ebc88e2870907b6cacb4cd7703584baf8f2be1fd94","c9c94ac5e1991a7db42c7973e328fceeb6f163d9f644031bdfd4123c7b","aaa6041912a6ba3cf167ecdb90a434a62feaf08639c59705847706b9f4","18051333e658c4816ff3576a2e9d97fe2a1196ac0ea5ed9ba386c46def","5e1e3bf6999126ae4aa52146280fdb913912632e8bac4f54e98c58821a","8317ff6416af8ab6eb35df3529689671a700fdb61a5e6436f4d6ea8ee00","892405573aa34dfc49b37e4c35b655543e88ec1c5e8ffb27ab8d1bbf90")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("d2fd0654710c27dcf37b6c1437880020824e161dd0bf28e3a133ed7772","dcfa2800754e5722acf94987bb03e814edcb9acebda37df6da1987bf48","bc747e3bf7b6e02c09f3d18bdd0e64eef62b940b2f16c9c72e647eec85","73170761d6776c0debacfbbc61b6988cb8270a20174bf5c049768a264","1b60097bf1ccb15a952e5bcc3522cf5c162da68c381a76abc2d5985659","aaa647327ba5b855bedea8e889b3fafdc05a6ca75d1cfd98869432006d","7d6959bb7a9482e1caa83b16ee01103d982d47c70c72fdd03708e2b7f","36cc31f0ab65b745f25c7e785df9e72d1c8919d35a1d7bd4ce8050c8c0","3298d203c2acb68c474e5fdad8379181890b4403d6491c523c1373012","0ee1d284ed663073872012c7bde7fac5ca1121403f1a5d2d5411317df2","ffd9f58e5fe8502249c67cad0123ceeeaa6e9f69b4ec9f9e21511809849","dfe6fddc67bdc93b9947430b966da2877fda094edf3e21e6f0ba98a84bc","131da83b521f610819141d5c740313ce46578374abb22ef504a759395","9f393516edf6b8e011df6ee991758480c5b99a0efbfd68347786061f0e0","9585af44c3ff8fd921c713680b0c2b3bbc9d56add848ed62164f7c9b9f2","2f629395fdfa11e713ea8bf11d40f6f240acf2f5fcf9a2ac50b6f7fbc7521c8","7f731cc11f8e4d249142e99a44b9da7a48505ce32c4ee4881041beedd","95477703e789e6182096a09bc98853e0a70b680a4f19fa2bf86cbb9280","0c0e0f9b09b80d87ebc88e2870907b6cacb4cd7703584baf8f2be1fd94","c9c94ac5e1991a7db42c7973e328fceeb6f163d9f644031bdfd4123c7b","aaa6041912a6ba3cf167ecdb90a434a62feaf08639c59705847706b9f4","18051333e658c4816ff3576a2e9d97fe2a1196ac0ea5ed9ba386c46def","5e1e3bf6999126ae4aa52146280fdb913912632e8bac4f54e98c58821a","8317ff6416af8ab6eb35df3529689671a700fdb61a5e6436f4d6ea8ee00","892405573aa34dfc49b37e4c35b655543e88ec1c5e8ffb27ab8d1bbf90")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("d2fd0654710c27dcf37b6c1437880020824e161dd0bf28e3a133ed7772","dcfa2800754e5722acf94987bb03e814edcb9acebda37df6da1987bf48","bc747e3bf7b6e02c09f3d18bdd0e64eef62b940b2f16c9c72e647eec85","73170761d6776c0debacfbbc61b6988cb8270a20174bf5c049768a264","1b60097bf1ccb15a952e5bcc3522cf5c162da68c381a76abc2d5985659","aaa647327ba5b855bedea8e889b3fafdc05a6ca75d1cfd98869432006d","7d6959bb7a9482e1caa83b16ee01103d982d47c70c72fdd03708e2b7f","36cc31f0ab65b745f25c7e785df9e72d1c8919d35a1d7bd4ce8050c8c0","3298d203c2acb68c474e5fdad8379181890b4403d6491c523c1373012","0ee1d284ed663073872012c7bde7fac5ca1121403f1a5d2d5411317df2","ffd9f58e5fe8502249c67cad0123ceeeaa6e9f69b4ec9f9e21511809849","dfe6fddc67bdc93b9947430b966da2877fda094edf3e21e6f0ba98a84bc","131da83b521f610819141d5c740313ce46578374abb22ef504a759395","9f393516edf6b8e011df6ee991758480c5b99a0efbfd68347786061f0e0","9585af44c3ff8fd921c713680b0c2b3bbc9d56add848ed62164f7c9b9f2","2f629395fdfa11e713ea8bf11d40f6f240acf2f5fcf9a2ac50b6f7fbc7521c8","7f731cc11f8e4d249142e99a44b9da7a48505ce32c4ee4881041beedd","95477703e789e6182096a09bc98853e0a70b680a4f19fa2bf86cbb9280","0c0e0f9b09b80d87ebc88e2870907b6cacb4cd7703584baf8f2be1fd94","c9c94ac5e1991a7db42c7973e328fceeb6f163d9f644031bdfd4123c7b","aaa6041912a6ba3cf167ecdb90a434a62feaf08639c59705847706b9f4","18051333e658c4816ff3576a2e9d97fe2a1196ac0ea5ed9ba386c46def","5e1e3bf6999126ae4aa52146280fdb913912632e8bac4f54e98c58821a","8317ff6416af8ab6eb35df3529689671a700fdb61a5e6436f4d6ea8ee00","892405573aa34dfc49b37e4c35b655543e88ec1c5e8ffb27ab8d1bbf90")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("d2fd0654710c27dcf37b6c1437880020824e161dd0bf28e3a133ed7772","dcfa2800754e5722acf94987bb03e814edcb9acebda37df6da1987bf48","bc747e3bf7b6e02c09f3d18bdd0e64eef62b940b2f16c9c72e647eec85","73170761d6776c0debacfbbc61b6988cb8270a20174bf5c049768a264","1b60097bf1ccb15a952e5bcc3522cf5c162da68c381a76abc2d5985659","aaa647327ba5b855bedea8e889b3fafdc05a6ca75d1cfd98869432006d","7d6959bb7a9482e1caa83b16ee01103d982d47c70c72fdd03708e2b7f","36cc31f0ab65b745f25c7e785df9e72d1c8919d35a1d7bd4ce8050c8c0","3298d203c2acb68c474e5fdad8379181890b4403d6491c523c1373012","0ee1d284ed663073872012c7bde7fac5ca1121403f1a5d2d5411317df2","ffd9f58e5fe8502249c67cad0123ceeeaa6e9f69b4ec9f9e21511809849","dfe6fddc67bdc93b9947430b966da2877fda094edf3e21e6f0ba98a84bc","131da83b521f610819141d5c740313ce46578374abb22ef504a759395","9f393516edf6b8e011df6ee991758480c5b99a0efbfd68347786061f0e0","9585af44c3ff8fd921c713680b0c2b3bbc9d56add848ed62164f7c9b9f2","2f629395fdfa11e713ea8bf11d40f6f240acf2f5fcf9a2ac50b6f7fbc7521c8","7f731cc11f8e4d249142e99a44b9da7a48505ce32c4ee4881041beedd","95477703e789e6182096a09bc98853e0a70b680a4f19fa2bf86cbb9280","0c0e0f9b09b80d87ebc88e2870907b6cacb4cd7703584baf8f2be1fd94","c9c94ac5e1991a7db42c7973e328fceeb6f163d9f644031bdfd4123c7b","aaa6041912a6ba3cf167ecdb90a434a62feaf08639c59705847706b9f4","18051333e658c4816ff3576a2e9d97fe2a1196ac0ea5ed9ba386c46def","5e1e3bf6999126ae4aa52146280fdb913912632e8bac4f54e98c58821a","8317ff6416af8ab6eb35df3529689671a700fdb61a5e6436f4d6ea8ee00","892405573aa34dfc49b37e4c35b655543e88ec1c5e8ffb27ab8d1bbf90")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("d2fd0654710c27dcf37b6c1437880020824e161dd0bf28e3a133ed7772","dcfa2800754e5722acf94987bb03e814edcb9acebda37df6da1987bf48","bc747e3bf7b6e02c09f3d18bdd0e64eef62b940b2f16c9c72e647eec85","73170761d6776c0debacfbbc61b6988cb8270a20174bf5c049768a264","1b60097bf1ccb15a952e5bcc3522cf5c162da68c381a76abc2d5985659","aaa647327ba5b855bedea8e889b3fafdc05a6ca75d1cfd98869432006d","7d6959bb7a9482e1caa83b16ee01103d982d47c70c72fdd03708e2b7f","36cc31f0ab65b745f25c7e785df9e72d1c8919d35a1d7bd4ce8050c8c0","3298d203c2acb68c474e5fdad8379181890b4403d6491c523c1373012","0ee1d284ed663073872012c7bde7fac5ca1121403f1a5d2d5411317df2","ffd9f58e5fe8502249c67cad0123ceeeaa6e9f69b4ec9f9e21511809849","dfe6fddc67bdc93b9947430b966da2877fda094edf3e21e6f0ba98a84bc","131da83b521f610819141d5c740313ce46578374abb22ef504a759395","9f393516edf6b8e011df6ee991758480c5b99a0efbfd68347786061f0e0","9585af44c3ff8fd921c713680b0c2b3bbc9d56add848ed62164f7c9b9f2","2f629395fdfa11e713ea8bf11d40f6f240acf2f5fcf9a2ac50b6f7fbc7521c8","7f731cc11f8e4d249142e99a44b9da7a48505ce32c4ee4881041beedd","95477703e789e6182096a09bc98853e0a70b680a4f19fa2bf86cbb9280","0c0e0f9b09b80d87ebc88e2870907b6cacb4cd7703584baf8f2be1fd94","c9c94ac5e1991a7db42c7973e328fceeb6f163d9f644031bdfd4123c7b","aaa6041912a6ba3cf167ecdb90a434a62feaf08639c59705847706b9f4","18051333e658c4816ff3576a2e9d97fe2a1196ac0ea5ed9ba386c46def","5e1e3bf6999126ae4aa52146280fdb913912632e8bac4f54e98c58821a","8317ff6416af8ab6eb35df3529689671a700fdb61a5e6436f4d6ea8ee00","892405573aa34dfc49b37e4c35b655543e88ec1c5e8ffb27ab8d1bbf90")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("d2fd0654710c27dcf37b6c1437880020824e161dd0bf28e3a133ed7772","dcfa2800754e5722acf94987bb03e814edcb9acebda37df6da1987bf48","bc747e3bf7b6e02c09f3d18bdd0e64eef62b940b2f16c9c72e647eec85","73170761d6776c0debacfbbc61b6988cb8270a20174bf5c049768a264","1b60097bf1ccb15a952e5bcc3522cf5c162da68c381a76abc2d5985659","aaa647327ba5b855bedea8e889b3fafdc05a6ca75d1cfd98869432006d","7d6959bb7a9482e1caa83b16ee01103d982d47c70c72fdd03708e2b7f","36cc31f0ab65b745f25c7e785df9e72d1c8919d35a1d7bd4ce8050c8c0","3298d203c2acb68c474e5fdad8379181890b4403d6491c523c1373012","0ee1d284ed663073872012c7bde7fac5ca1121403f1a5d2d5411317df2","ffd9f58e5fe8502249c67cad0123ceeeaa6e9f69b4ec9f9e21511809849","dfe6fddc67bdc93b9947430b966da2877fda094edf3e21e6f0ba98a84bc","131da83b521f610819141d5c740313ce46578374abb22ef504a759395","9f393516edf6b8e011df6ee991758480c5b99a0efbfd68347786061f0e0","9585af44c3ff8fd921c713680b0c2b3bbc9d56add848ed62164f7c9b9f2","2f629395fdfa11e713ea8bf11d40f6f240acf2f5fcf9a2ac50b6f7fbc7521c8","7f731cc11f8e4d249142e99a44b9da7a48505ce32c4ee4881041beedd","95477703e789e6182096a09bc98853e0a70b680a4f19fa2bf86cbb9280","0c0e0f9b09b80d87ebc88e2870907b6cacb4cd7703584baf8f2be1fd94","c9c94ac5e1991a7db42c7973e328fceeb6f163d9f644031bdfd4123c7b","aaa6041912a6ba3cf167ecdb90a434a62feaf08639c59705847706b9f4","18051333e658c4816ff3576a2e9d97fe2a1196ac0ea5ed9ba386c46def","5e1e3bf6999126ae4aa52146280fdb913912632e8bac4f54e98c58821a","8317ff6416af8ab6eb35df3529689671a700fdb61a5e6436f4d6ea8ee00","892405573aa34dfc49b37e4c35b655543e88ec1c5e8ffb27ab8d1bbf90")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("d2fd0654710c27dcf37b6c1437880020824e161dd0bf28e3a133ed7772","dcfa2800754e5722acf94987bb03e814edcb9acebda37df6da1987bf48","bc747e3bf7b6e02c09f3d18bdd0e64eef62b940b2f16c9c72e647eec85","73170761d6776c0debacfbbc61b6988cb8270a20174bf5c049768a264","1b60097bf1ccb15a952e5bcc3522cf5c162da68c381a76abc2d5985659","aaa647327ba5b855bedea8e889b3fafdc05a6ca75d1cfd98869432006d","7d6959bb7a9482e1caa83b16ee01103d982d47c70c72fdd03708e2b7f","36cc31f0ab65b745f25c7e785df9e72d1c8919d35a1d7bd4ce8050c8c0","3298d203c2acb68c474e5fdad8379181890b4403d6491c523c1373012","0ee1d284ed663073872012c7bde7fac5ca1121403f1a5d2d5411317df2","ffd9f58e5fe8502249c67cad0123ceeeaa6e9f69b4ec9f9e21511809849","dfe6fddc67bdc93b9947430b966da2877fda094edf3e21e6f0ba98a84bc","131da83b521f610819141d5c740313ce46578374abb22ef504a759395","9f393516edf6b8e011df6ee991758480c5b99a0efbfd68347786061f0e0","9585af44c3ff8fd921c713680b0c2b3bbc9d56add848ed62164f7c9b9f2","2f629395fdfa11e713ea8bf11d40f6f240acf2f5fcf9a2ac50b6f7fbc7521c8","7f731cc11f8e4d249142e99a44b9da7a48505ce32c4ee4881041beedd","95477703e789e6182096a09bc98853e0a70b680a4f19fa2bf86cbb9280","0c0e0f9b09b80d87ebc88e2870907b6cacb4cd7703584baf8f2be1fd94","c9c94ac5e1991a7db42c7973e328fceeb6f163d9f644031bdfd4123c7b","aaa6041912a6ba3cf167ecdb90a434a62feaf08639c59705847706b9f4","18051333e658c4816ff3576a2e9d97fe2a1196ac0ea5ed9ba386c46def","5e1e3bf6999126ae4aa52146280fdb913912632e8bac4f54e98c58821a","8317ff6416af8ab6eb35df3529689671a700fdb61a5e6436f4d6ea8ee00","892405573aa34dfc49b37e4c35b655543e88ec1c5e8ffb27ab8d1bbf90")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("d2fd0654710c27dcf37b6c1437880020824e161dd0bf28e3a133ed7772","dcfa2800754e5722acf94987bb03e814edcb9acebda37df6da1987bf48","bc747e3bf7b6e02c09f3d18bdd0e64eef62b940b2f16c9c72e647eec85","73170761d6776c0debacfbbc61b6988cb8270a20174bf5c049768a264","1b60097bf1ccb15a952e5bcc3522cf5c162da68c381a76abc2d5985659","aaa647327ba5b855bedea8e889b3fafdc05a6ca75d1cfd98869432006d","7d6959bb7a9482e1caa83b16ee01103d982d47c70c72fdd03708e2b7f","36cc31f0ab65b745f25c7e785df9e72d1c8919d35a1d7bd4ce8050c8c0","3298d203c2acb68c474e5fdad8379181890b4403d6491c523c1373012","0ee1d284ed663073872012c7bde7fac5ca1121403f1a5d2d5411317df2","ffd9f58e5fe8502249c67cad0123ceeeaa6e9f69b4ec9f9e21511809849","dfe6fddc67bdc93b9947430b966da2877fda094edf3e21e6f0ba98a84bc","131da83b521f610819141d5c740313ce46578374abb22ef504a759395","9f393516edf6b8e011df6ee991758480c5b99a0efbfd68347786061f0e0","9585af44c3ff8fd921c713680b0c2b3bbc9d56add848ed62164f7c9b9f2","2f629395fdfa11e713ea8bf11d40f6f240acf2f5fcf9a2ac50b6f7fbc7521c8","7f731cc11f8e4d249142e99a44b9da7a48505ce32c4ee4881041beedd","95477703e789e6182096a09bc98853e0a70b680a4f19fa2bf86cbb9280","0c0e0f9b09b80d87ebc88e2870907b6cacb4cd7703584baf8f2be1fd94","c9c94ac5e1991a7db42c7973e328fceeb6f163d9f644031bdfd4123c7b","aaa6041912a6ba3cf167ecdb90a434a62feaf08639c59705847706b9f4","18051333e658c4816ff3576a2e9d97fe2a1196ac0ea5ed9ba386c46def","5e1e3bf6999126ae4aa52146280fdb913912632e8bac4f54e98c58821a","8317ff6416af8ab6eb35df3529689671a700fdb61a5e6436f4d6ea8ee00","892405573aa34dfc49b37e4c35b655543e88ec1c5e8ffb27ab8d1bbf90")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring64 NOT NULL AND customstring64 IN ("d2fd0654710c27dcf37b6c1437880020824e161dd0bf28e3a133ed7772","dcfa2800754e5722acf94987bb03e814edcb9acebda37df6da1987bf48","bc747e3bf7b6e02c09f3d18bdd0e64eef62b940b2f16c9c72e647eec85","73170761d6776c0debacfbbc61b6988cb8270a20174bf5c049768a264","1b60097bf1ccb15a952e5bcc3522cf5c162da68c381a76abc2d5985659","aaa647327ba5b855bedea8e889b3fafdc05a6ca75d1cfd98869432006d","7d6959bb7a9482e1caa83b16ee01103d982d47c70c72fdd03708e2b7f","36cc31f0ab65b745f25c7e785df9e72d1c8919d35a1d7bd4ce8050c8c0","3298d203c2acb68c474e5fdad8379181890b4403d6491c523c1373012","0ee1d284ed663073872012c7bde7fac5ca1121403f1a5d2d5411317df2","ffd9f58e5fe8502249c67cad0123ceeeaa6e9f69b4ec9f9e21511809849","dfe6fddc67bdc93b9947430b966da2877fda094edf3e21e6f0ba98a84bc","131da83b521f610819141d5c740313ce46578374abb22ef504a759395","9f393516edf6b8e011df6ee991758480c5b99a0efbfd68347786061f0e0","9585af44c3ff8fd921c713680b0c2b3bbc9d56add848ed62164f7c9b9f2","2f629395fdfa11e713ea8bf11d40f6f240acf2f5fcf9a2ac50b6f7fbc7521c8","7f731cc11f8e4d249142e99a44b9da7a48505ce32c4ee4881041beedd","95477703e789e6182096a09bc98853e0a70b680a4f19fa2bf86cbb9280","0c0e0f9b09b80d87ebc88e2870907b6cacb4cd7703584baf8f2be1fd94","c9c94ac5e1991a7db42c7973e328fceeb6f163d9f644031bdfd4123c7b","aaa6041912a6ba3cf167ecdb90a434a62feaf08639c59705847706b9f4","18051333e658c4816ff3576a2e9d97fe2a1196ac0ea5ed9ba386c46def","5e1e3bf6999126ae4aa52146280fdb913912632e8bac4f54e98c58821a","8317ff6416af8ab6eb35df3529689671a700fdb61a5e6436f4d6ea8ee00","892405573aa34dfc49b37e4c35b655543e88ec1c5e8ffb27ab8d1bbf90")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("d2fd0654710c27dcf37b6c1437880020824e161dd0bf28e3a133ed7772","dcfa2800754e5722acf94987bb03e814edcb9acebda37df6da1987bf48","bc747e3bf7b6e02c09f3d18bdd0e64eef62b940b2f16c9c72e647eec85","73170761d6776c0debacfbbc61b6988cb8270a20174bf5c049768a264","1b60097bf1ccb15a952e5bcc3522cf5c162da68c381a76abc2d5985659","aaa647327ba5b855bedea8e889b3fafdc05a6ca75d1cfd98869432006d","7d6959bb7a9482e1caa83b16ee01103d982d47c70c72fdd03708e2b7f","36cc31f0ab65b745f25c7e785df9e72d1c8919d35a1d7bd4ce8050c8c0","3298d203c2acb68c474e5fdad8379181890b4403d6491c523c1373012","0ee1d284ed663073872012c7bde7fac5ca1121403f1a5d2d5411317df2","ffd9f58e5fe8502249c67cad0123ceeeaa6e9f69b4ec9f9e21511809849","dfe6fddc67bdc93b9947430b966da2877fda094edf3e21e6f0ba98a84bc","131da83b521f610819141d5c740313ce46578374abb22ef504a759395","9f393516edf6b8e011df6ee991758480c5b99a0efbfd68347786061f0e0","9585af44c3ff8fd921c713680b0c2b3bbc9d56add848ed62164f7c9b9f2","2f629395fdfa11e713ea8bf11d40f6f240acf2f5fcf9a2ac50b6f7fbc7521c8","7f731cc11f8e4d249142e99a44b9da7a48505ce32c4ee4881041beedd","95477703e789e6182096a09bc98853e0a70b680a4f19fa2bf86cbb9280","0c0e0f9b09b80d87ebc88e2870907b6cacb4cd7703584baf8f2be1fd94","c9c94ac5e1991a7db42c7973e328fceeb6f163d9f644031bdfd4123c7b","aaa6041912a6ba3cf167ecdb90a434a62feaf08639c59705847706b9f4","18051333e658c4816ff3576a2e9d97fe2a1196ac0ea5ed9ba386c46def","5e1e3bf6999126ae4aa52146280fdb913912632e8bac4f54e98c58821a","8317ff6416af8ab6eb35df3529689671a700fdb61a5e6436f4d6ea8ee00","892405573aa34dfc49b37e4c35b655543e88ec1c5e8ffb27ab8d1bbf90")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("d2fd0654710c27dcf37b6c1437880020824e161dd0bf28e3a133ed7772","dcfa2800754e5722acf94987bb03e814edcb9acebda37df6da1987bf48","bc747e3bf7b6e02c09f3d18bdd0e64eef62b940b2f16c9c72e647eec85","73170761d6776c0debacfbbc61b6988cb8270a20174bf5c049768a264","1b60097bf1ccb15a952e5bcc3522cf5c162da68c381a76abc2d5985659","aaa647327ba5b855bedea8e889b3fafdc05a6ca75d1cfd98869432006d","7d6959bb7a9482e1caa83b16ee01103d982d47c70c72fdd03708e2b7f","36cc31f0ab65b745f25c7e785df9e72d1c8919d35a1d7bd4ce8050c8c0","3298d203c2acb68c474e5fdad8379181890b4403d6491c523c1373012","0ee1d284ed663073872012c7bde7fac5ca1121403f1a5d2d5411317df2","ffd9f58e5fe8502249c67cad0123ceeeaa6e9f69b4ec9f9e21511809849","dfe6fddc67bdc93b9947430b966da2877fda094edf3e21e6f0ba98a84bc","131da83b521f610819141d5c740313ce46578374abb22ef504a759395","9f393516edf6b8e011df6ee991758480c5b99a0efbfd68347786061f0e0","9585af44c3ff8fd921c713680b0c2b3bbc9d56add848ed62164f7c9b9f2","2f629395fdfa11e713ea8bf11d40f6f240acf2f5fcf9a2ac50b6f7fbc7521c8","7f731cc11f8e4d249142e99a44b9da7a48505ce32c4ee4881041beedd","95477703e789e6182096a09bc98853e0a70b680a4f19fa2bf86cbb9280","0c0e0f9b09b80d87ebc88e2870907b6cacb4cd7703584baf8f2be1fd94","c9c94ac5e1991a7db42c7973e328fceeb6f163d9f644031bdfd4123c7b","aaa6041912a6ba3cf167ecdb90a434a62feaf08639c59705847706b9f4","18051333e658c4816ff3576a2e9d97fe2a1196ac0ea5ed9ba386c46def","5e1e3bf6999126ae4aa52146280fdb913912632e8bac4f54e98c58821a","8317ff6416af8ab6eb35df3529689671a700fdb61a5e6436f4d6ea8ee00","892405573aa34dfc49b37e4c35b655543e88ec1c5e8ffb27ab8d1bbf90")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("d2fd0654710c27dcf37b6c1437880020824e161dd0bf28e3a133ed7772","dcfa2800754e5722acf94987bb03e814edcb9acebda37df6da1987bf48","bc747e3bf7b6e02c09f3d18bdd0e64eef62b940b2f16c9c72e647eec85","73170761d6776c0debacfbbc61b6988cb8270a20174bf5c049768a264","1b60097bf1ccb15a952e5bcc3522cf5c162da68c381a76abc2d5985659","aaa647327ba5b855bedea8e889b3fafdc05a6ca75d1cfd98869432006d","7d6959bb7a9482e1caa83b16ee01103d982d47c70c72fdd03708e2b7f","36cc31f0ab65b745f25c7e785df9e72d1c8919d35a1d7bd4ce8050c8c0","3298d203c2acb68c474e5fdad8379181890b4403d6491c523c1373012","0ee1d284ed663073872012c7bde7fac5ca1121403f1a5d2d5411317df2","ffd9f58e5fe8502249c67cad0123ceeeaa6e9f69b4ec9f9e21511809849","dfe6fddc67bdc93b9947430b966da2877fda094edf3e21e6f0ba98a84bc","131da83b521f610819141d5c740313ce46578374abb22ef504a759395","9f393516edf6b8e011df6ee991758480c5b99a0efbfd68347786061f0e0","9585af44c3ff8fd921c713680b0c2b3bbc9d56add848ed62164f7c9b9f2","2f629395fdfa11e713ea8bf11d40f6f240acf2f5fcf9a2ac50b6f7fbc7521c8","7f731cc11f8e4d249142e99a44b9da7a48505ce32c4ee4881041beedd","95477703e789e6182096a09bc98853e0a70b680a4f19fa2bf86cbb9280","0c0e0f9b09b80d87ebc88e2870907b6cacb4cd7703584baf8f2be1fd94","c9c94ac5e1991a7db42c7973e328fceeb6f163d9f644031bdfd4123c7b","aaa6041912a6ba3cf167ecdb90a434a62feaf08639c59705847706b9f4","18051333e658c4816ff3576a2e9d97fe2a1196ac0ea5ed9ba386c46def","5e1e3bf6999126ae4aa52146280fdb913912632e8bac4f54e98c58821a","8317ff6416af8ab6eb35df3529689671a700fdb61a5e6436f4d6ea8ee00","892405573aa34dfc49b37e4c35b655543e88ec1c5e8ffb27ab8d1bbf90")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring64 NOT NULL AND customstring64 IN ("d2fd0654710c27dcf37b6c1437880020824e161dd0bf28e3a133ed7772","dcfa2800754e5722acf94987bb03e814edcb9acebda37df6da1987bf48","bc747e3bf7b6e02c09f3d18bdd0e64eef62b940b2f16c9c72e647eec85","73170761d6776c0debacfbbc61b6988cb8270a20174bf5c049768a264","1b60097bf1ccb15a952e5bcc3522cf5c162da68c381a76abc2d5985659","aaa647327ba5b855bedea8e889b3fafdc05a6ca75d1cfd98869432006d","7d6959bb7a9482e1caa83b16ee01103d982d47c70c72fdd03708e2b7f","36cc31f0ab65b745f25c7e785df9e72d1c8919d35a1d7bd4ce8050c8c0","3298d203c2acb68c474e5fdad8379181890b4403d6491c523c1373012","0ee1d284ed663073872012c7bde7fac5ca1121403f1a5d2d5411317df2","ffd9f58e5fe8502249c67cad0123ceeeaa6e9f69b4ec9f9e21511809849","dfe6fddc67bdc93b9947430b966da2877fda094edf3e21e6f0ba98a84bc","131da83b521f610819141d5c740313ce46578374abb22ef504a759395","9f393516edf6b8e011df6ee991758480c5b99a0efbfd68347786061f0e0","9585af44c3ff8fd921c713680b0c2b3bbc9d56add848ed62164f7c9b9f2","2f629395fdfa11e713ea8bf11d40f6f240acf2f5fcf9a2ac50b6f7fbc7521c8","7f731cc11f8e4d249142e99a44b9da7a48505ce32c4ee4881041beedd","95477703e789e6182096a09bc98853e0a70b680a4f19fa2bf86cbb9280","0c0e0f9b09b80d87ebc88e2870907b6cacb4cd7703584baf8f2be1fd94","c9c94ac5e1991a7db42c7973e328fceeb6f163d9f644031bdfd4123c7b","aaa6041912a6ba3cf167ecdb90a434a62feaf08639c59705847706b9f4","18051333e658c4816ff3576a2e9d97fe2a1196ac0ea5ed9ba386c46def","5e1e3bf6999126ae4aa52146280fdb913912632e8bac4f54e98c58821a","8317ff6416af8ab6eb35df3529689671a700fdb61a5e6436f4d6ea8ee00","892405573aa34dfc49b37e4c35b655543e88ec1c5e8ffb27ab8d1bbf90")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("d2fd0654710c27dcf37b6c1437880020824e161dd0bf28e3a133ed7772","dcfa2800754e5722acf94987bb03e814edcb9acebda37df6da1987bf48","bc747e3bf7b6e02c09f3d18bdd0e64eef62b940b2f16c9c72e647eec85","73170761d6776c0debacfbbc61b6988cb8270a20174bf5c049768a264","1b60097bf1ccb15a952e5bcc3522cf5c162da68c381a76abc2d5985659","aaa647327ba5b855bedea8e889b3fafdc05a6ca75d1cfd98869432006d","7d6959bb7a9482e1caa83b16ee01103d982d47c70c72fdd03708e2b7f","36cc31f0ab65b745f25c7e785df9e72d1c8919d35a1d7bd4ce8050c8c0","3298d203c2acb68c474e5fdad8379181890b4403d6491c523c1373012","0ee1d284ed663073872012c7bde7fac5ca1121403f1a5d2d5411317df2","ffd9f58e5fe8502249c67cad0123ceeeaa6e9f69b4ec9f9e21511809849","dfe6fddc67bdc93b9947430b966da2877fda094edf3e21e6f0ba98a84bc","131da83b521f610819141d5c740313ce46578374abb22ef504a759395","9f393516edf6b8e011df6ee991758480c5b99a0efbfd68347786061f0e0","9585af44c3ff8fd921c713680b0c2b3bbc9d56add848ed62164f7c9b9f2","2f629395fdfa11e713ea8bf11d40f6f240acf2f5fcf9a2ac50b6f7fbc7521c8","7f731cc11f8e4d249142e99a44b9da7a48505ce32c4ee4881041beedd","95477703e789e6182096a09bc98853e0a70b680a4f19fa2bf86cbb9280","0c0e0f9b09b80d87ebc88e2870907b6cacb4cd7703584baf8f2be1fd94","c9c94ac5e1991a7db42c7973e328fceeb6f163d9f644031bdfd4123c7b","aaa6041912a6ba3cf167ecdb90a434a62feaf08639c59705847706b9f4","18051333e658c4816ff3576a2e9d97fe2a1196ac0ea5ed9ba386c46def","5e1e3bf6999126ae4aa52146280fdb913912632e8bac4f54e98c58821a","8317ff6416af8ab6eb35df3529689671a700fdb61a5e6436f4d6ea8ee00","892405573aa34dfc49b37e4c35b655543e88ec1c5e8ffb27ab8d1bbf90")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("d2fd0654710c27dcf37b6c1437880020824e161dd0bf28e3a133ed7772","dcfa2800754e5722acf94987bb03e814edcb9acebda37df6da1987bf48","bc747e3bf7b6e02c09f3d18bdd0e64eef62b940b2f16c9c72e647eec85","73170761d6776c0debacfbbc61b6988cb8270a20174bf5c049768a264","1b60097bf1ccb15a952e5bcc3522cf5c162da68c381a76abc2d5985659","aaa647327ba5b855bedea8e889b3fafdc05a6ca75d1cfd98869432006d","7d6959bb7a9482e1caa83b16ee01103d982d47c70c72fdd03708e2b7f","36cc31f0ab65b745f25c7e785df9e72d1c8919d35a1d7bd4ce8050c8c0","3298d203c2acb68c474e5fdad8379181890b4403d6491c523c1373012","0ee1d284ed663073872012c7bde7fac5ca1121403f1a5d2d5411317df2","ffd9f58e5fe8502249c67cad0123ceeeaa6e9f69b4ec9f9e21511809849","dfe6fddc67bdc93b9947430b966da2877fda094edf3e21e6f0ba98a84bc","131da83b521f610819141d5c740313ce46578374abb22ef504a759395","9f393516edf6b8e011df6ee991758480c5b99a0efbfd68347786061f0e0","9585af44c3ff8fd921c713680b0c2b3bbc9d56add848ed62164f7c9b9f2","2f629395fdfa11e713ea8bf11d40f6f240acf2f5fcf9a2ac50b6f7fbc7521c8","7f731cc11f8e4d249142e99a44b9da7a48505ce32c4ee4881041beedd","95477703e789e6182096a09bc98853e0a70b680a4f19fa2bf86cbb9280","0c0e0f9b09b80d87ebc88e2870907b6cacb4cd7703584baf8f2be1fd94","c9c94ac5e1991a7db42c7973e328fceeb6f163d9f644031bdfd4123c7b","aaa6041912a6ba3cf167ecdb90a434a62feaf08639c59705847706b9f4","18051333e658c4816ff3576a2e9d97fe2a1196ac0ea5ed9ba386c46def","5e1e3bf6999126ae4aa52146280fdb913912632e8bac4f54e98c58821a","8317ff6416af8ab6eb35df3529689671a700fdb61a5e6436f4d6ea8ee00","892405573aa34dfc49b37e4c35b655543e88ec1c5e8ffb27ab8d1bbf90")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("d2fd0654710c27dcf37b6c1437880020824e161dd0bf28e3a133ed7772","dcfa2800754e5722acf94987bb03e814edcb9acebda37df6da1987bf48","bc747e3bf7b6e02c09f3d18bdd0e64eef62b940b2f16c9c72e647eec85","73170761d6776c0debacfbbc61b6988cb8270a20174bf5c049768a264","1b60097bf1ccb15a952e5bcc3522cf5c162da68c381a76abc2d5985659","aaa647327ba5b855bedea8e889b3fafdc05a6ca75d1cfd98869432006d","7d6959bb7a9482e1caa83b16ee01103d982d47c70c72fdd03708e2b7f","36cc31f0ab65b745f25c7e785df9e72d1c8919d35a1d7bd4ce8050c8c0","3298d203c2acb68c474e5fdad8379181890b4403d6491c523c1373012","0ee1d284ed663073872012c7bde7fac5ca1121403f1a5d2d5411317df2","ffd9f58e5fe8502249c67cad0123ceeeaa6e9f69b4ec9f9e21511809849","dfe6fddc67bdc93b9947430b966da2877fda094edf3e21e6f0ba98a84bc","131da83b521f610819141d5c740313ce46578374abb22ef504a759395","9f393516edf6b8e011df6ee991758480c5b99a0efbfd68347786061f0e0","9585af44c3ff8fd921c713680b0c2b3bbc9d56add848ed62164f7c9b9f2","2f629395fdfa11e713ea8bf11d40f6f240acf2f5fcf9a2ac50b6f7fbc7521c8","7f731cc11f8e4d249142e99a44b9da7a48505ce32c4ee4881041beedd","95477703e789e6182096a09bc98853e0a70b680a4f19fa2bf86cbb9280","0c0e0f9b09b80d87ebc88e2870907b6cacb4cd7703584baf8f2be1fd94","c9c94ac5e1991a7db42c7973e328fceeb6f163d9f644031bdfd4123c7b","aaa6041912a6ba3cf167ecdb90a434a62feaf08639c59705847706b9f4","18051333e658c4816ff3576a2e9d97fe2a1196ac0ea5ed9ba386c46def","5e1e3bf6999126ae4aa52146280fdb913912632e8bac4f54e98c58821a","8317ff6416af8ab6eb35df3529689671a700fdb61a5e6436f4d6ea8ee00","892405573aa34dfc49b37e4c35b655543e88ec1c5e8ffb27ab8d1bbf90")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring64 NOT NULL AND customstring64 IN ("d2fd0654710c27dcf37b6c1437880020824e161dd0bf28e3a133ed7772","dcfa2800754e5722acf94987bb03e814edcb9acebda37df6da1987bf48","bc747e3bf7b6e02c09f3d18bdd0e64eef62b940b2f16c9c72e647eec85","73170761d6776c0debacfbbc61b6988cb8270a20174bf5c049768a264","1b60097bf1ccb15a952e5bcc3522cf5c162da68c381a76abc2d5985659","aaa647327ba5b855bedea8e889b3fafdc05a6ca75d1cfd98869432006d","7d6959bb7a9482e1caa83b16ee01103d982d47c70c72fdd03708e2b7f","36cc31f0ab65b745f25c7e785df9e72d1c8919d35a1d7bd4ce8050c8c0","3298d203c2acb68c474e5fdad8379181890b4403d6491c523c1373012","0ee1d284ed663073872012c7bde7fac5ca1121403f1a5d2d5411317df2","ffd9f58e5fe8502249c67cad0123ceeeaa6e9f69b4ec9f9e21511809849","dfe6fddc67bdc93b9947430b966da2877fda094edf3e21e6f0ba98a84bc","131da83b521f610819141d5c740313ce46578374abb22ef504a759395","9f393516edf6b8e011df6ee991758480c5b99a0efbfd68347786061f0e0","9585af44c3ff8fd921c713680b0c2b3bbc9d56add848ed62164f7c9b9f2","2f629395fdfa11e713ea8bf11d40f6f240acf2f5fcf9a2ac50b6f7fbc7521c8","7f731cc11f8e4d249142e99a44b9da7a48505ce32c4ee4881041beedd","95477703e789e6182096a09bc98853e0a70b680a4f19fa2bf86cbb9280","0c0e0f9b09b80d87ebc88e2870907b6cacb4cd7703584baf8f2be1fd94","c9c94ac5e1991a7db42c7973e328fceeb6f163d9f644031bdfd4123c7b","aaa6041912a6ba3cf167ecdb90a434a62feaf08639c59705847706b9f4","18051333e658c4816ff3576a2e9d97fe2a1196ac0ea5ed9ba386c46def","5e1e3bf6999126ae4aa52146280fdb913912632e8bac4f54e98c58821a","8317ff6416af8ab6eb35df3529689671a700fdb61a5e6436f4d6ea8ee00","892405573aa34dfc49b37e4c35b655543e88ec1c5e8ffb27ab8d1bbf90")
index=activity AND rg_functionality="O365 General" AND filehash NOT NULL AND filehash IN ("d2fd0654710c27dcf37b6c1437880020824e161dd0bf28e3a133ed7772","dcfa2800754e5722acf94987bb03e814edcb9acebda37df6da1987bf48","bc747e3bf7b6e02c09f3d18bdd0e64eef62b940b2f16c9c72e647eec85","73170761d6776c0debacfbbc61b6988cb8270a20174bf5c049768a264","1b60097bf1ccb15a952e5bcc3522cf5c162da68c381a76abc2d5985659","aaa647327ba5b855bedea8e889b3fafdc05a6ca75d1cfd98869432006d","7d6959bb7a9482e1caa83b16ee01103d982d47c70c72fdd03708e2b7f","36cc31f0ab65b745f25c7e785df9e72d1c8919d35a1d7bd4ce8050c8c0","3298d203c2acb68c474e5fdad8379181890b4403d6491c523c1373012","0ee1d284ed663073872012c7bde7fac5ca1121403f1a5d2d5411317df2","ffd9f58e5fe8502249c67cad0123ceeeaa6e9f69b4ec9f9e21511809849","dfe6fddc67bdc93b9947430b966da2877fda094edf3e21e6f0ba98a84bc","131da83b521f610819141d5c740313ce46578374abb22ef504a759395","9f393516edf6b8e011df6ee991758480c5b99a0efbfd68347786061f0e0","9585af44c3ff8fd921c713680b0c2b3bbc9d56add848ed62164f7c9b9f2","2f629395fdfa11e713ea8bf11d40f6f240acf2f5fcf9a2ac50b6f7fbc7521c8","7f731cc11f8e4d249142e99a44b9da7a48505ce32c4ee4881041beedd","95477703e789e6182096a09bc98853e0a70b680a4f19fa2bf86cbb9280","0c0e0f9b09b80d87ebc88e2870907b6cacb4cd7703584baf8f2be1fd94","c9c94ac5e1991a7db42c7973e328fceeb6f163d9f644031bdfd4123c7b","aaa6041912a6ba3cf167ecdb90a434a62feaf08639c59705847706b9f4","18051333e658c4816ff3576a2e9d97fe2a1196ac0ea5ed9ba386c46def","5e1e3bf6999126ae4aa52146280fdb913912632e8bac4f54e98c58821a","8317ff6416af8ab6eb35df3529689671a700fdb61a5e6436f4d6ea8ee00","892405573aa34dfc49b37e4c35b655543e88ec1c5e8ffb27ab8d1bbf90")
index=activity AND rg_functionality="O365 General" AND oldfilehash NOT NULL AND oldfilehash IN ("d2fd0654710c27dcf37b6c1437880020824e161dd0bf28e3a133ed7772","dcfa2800754e5722acf94987bb03e814edcb9acebda37df6da1987bf48","bc747e3bf7b6e02c09f3d18bdd0e64eef62b940b2f16c9c72e647eec85","73170761d6776c0debacfbbc61b6988cb8270a20174bf5c049768a264","1b60097bf1ccb15a952e5bcc3522cf5c162da68c381a76abc2d5985659","aaa647327ba5b855bedea8e889b3fafdc05a6ca75d1cfd98869432006d","7d6959bb7a9482e1caa83b16ee01103d982d47c70c72fdd03708e2b7f","36cc31f0ab65b745f25c7e785df9e72d1c8919d35a1d7bd4ce8050c8c0","3298d203c2acb68c474e5fdad8379181890b4403d6491c523c1373012","0ee1d284ed663073872012c7bde7fac5ca1121403f1a5d2d5411317df2","ffd9f58e5fe8502249c67cad0123ceeeaa6e9f69b4ec9f9e21511809849","dfe6fddc67bdc93b9947430b966da2877fda094edf3e21e6f0ba98a84bc","131da83b521f610819141d5c740313ce46578374abb22ef504a759395","9f393516edf6b8e011df6ee991758480c5b99a0efbfd68347786061f0e0","9585af44c3ff8fd921c713680b0c2b3bbc9d56add848ed62164f7c9b9f2","2f629395fdfa11e713ea8bf11d40f6f240acf2f5fcf9a2ac50b6f7fbc7521c8","7f731cc11f8e4d249142e99a44b9da7a48505ce32c4ee4881041beedd","95477703e789e6182096a09bc98853e0a70b680a4f19fa2bf86cbb9280","0c0e0f9b09b80d87ebc88e2870907b6cacb4cd7703584baf8f2be1fd94","c9c94ac5e1991a7db42c7973e328fceeb6f163d9f644031bdfd4123c7b","aaa6041912a6ba3cf167ecdb90a434a62feaf08639c59705847706b9f4","18051333e658c4816ff3576a2e9d97fe2a1196ac0ea5ed9ba386c46def","5e1e3bf6999126ae4aa52146280fdb913912632e8bac4f54e98c58821a","8317ff6416af8ab6eb35df3529689671a700fdb61a5e6436f4d6ea8ee00","892405573aa34dfc49b37e4c35b655543e88ec1c5e8ffb27ab8d1bbf90")
index=activity AND rg_functionality="O365 General" AND customstring3 NOT NULL AND customstring3 IN ("d2fd0654710c27dcf37b6c1437880020824e161dd0bf28e3a133ed7772","dcfa2800754e5722acf94987bb03e814edcb9acebda37df6da1987bf48","bc747e3bf7b6e02c09f3d18bdd0e64eef62b940b2f16c9c72e647eec85","73170761d6776c0debacfbbc61b6988cb8270a20174bf5c049768a264","1b60097bf1ccb15a952e5bcc3522cf5c162da68c381a76abc2d5985659","aaa647327ba5b855bedea8e889b3fafdc05a6ca75d1cfd98869432006d","7d6959bb7a9482e1caa83b16ee01103d982d47c70c72fdd03708e2b7f","36cc31f0ab65b745f25c7e785df9e72d1c8919d35a1d7bd4ce8050c8c0","3298d203c2acb68c474e5fdad8379181890b4403d6491c523c1373012","0ee1d284ed663073872012c7bde7fac5ca1121403f1a5d2d5411317df2","ffd9f58e5fe8502249c67cad0123ceeeaa6e9f69b4ec9f9e21511809849","dfe6fddc67bdc93b9947430b966da2877fda094edf3e21e6f0ba98a84bc","131da83b521f610819141d5c740313ce46578374abb22ef504a759395","9f393516edf6b8e011df6ee991758480c5b99a0efbfd68347786061f0e0","9585af44c3ff8fd921c713680b0c2b3bbc9d56add848ed62164f7c9b9f2","2f629395fdfa11e713ea8bf11d40f6f240acf2f5fcf9a2ac50b6f7fbc7521c8","7f731cc11f8e4d249142e99a44b9da7a48505ce32c4ee4881041beedd","95477703e789e6182096a09bc98853e0a70b680a4f19fa2bf86cbb9280","0c0e0f9b09b80d87ebc88e2870907b6cacb4cd7703584baf8f2be1fd94","c9c94ac5e1991a7db42c7973e328fceeb6f163d9f644031bdfd4123c7b","aaa6041912a6ba3cf167ecdb90a434a62feaf08639c59705847706b9f4","18051333e658c4816ff3576a2e9d97fe2a1196ac0ea5ed9ba386c46def","5e1e3bf6999126ae4aa52146280fdb913912632e8bac4f54e98c58821a","8317ff6416af8ab6eb35df3529689671a700fdb61a5e6436f4d6ea8ee00","892405573aa34dfc49b37e4c35b655543e88ec1c5e8ffb27ab8d1bbf90")
index=activity AND rg_functionality="O365 General" AND customstring64 NOT NULL AND customstring64 IN ("d2fd0654710c27dcf37b6c1437880020824e161dd0bf28e3a133ed7772","dcfa2800754e5722acf94987bb03e814edcb9acebda37df6da1987bf48","bc747e3bf7b6e02c09f3d18bdd0e64eef62b940b2f16c9c72e647eec85","73170761d6776c0debacfbbc61b6988cb8270a20174bf5c049768a264","1b60097bf1ccb15a952e5bcc3522cf5c162da68c381a76abc2d5985659","aaa647327ba5b855bedea8e889b3fafdc05a6ca75d1cfd98869432006d","7d6959bb7a9482e1caa83b16ee01103d982d47c70c72fdd03708e2b7f","36cc31f0ab65b745f25c7e785df9e72d1c8919d35a1d7bd4ce8050c8c0","3298d203c2acb68c474e5fdad8379181890b4403d6491c523c1373012","0ee1d284ed663073872012c7bde7fac5ca1121403f1a5d2d5411317df2","ffd9f58e5fe8502249c67cad0123ceeeaa6e9f69b4ec9f9e21511809849","dfe6fddc67bdc93b9947430b966da2877fda094edf3e21e6f0ba98a84bc","131da83b521f610819141d5c740313ce46578374abb22ef504a759395","9f393516edf6b8e011df6ee991758480c5b99a0efbfd68347786061f0e0","9585af44c3ff8fd921c713680b0c2b3bbc9d56add848ed62164f7c9b9f2","2f629395fdfa11e713ea8bf11d40f6f240acf2f5fcf9a2ac50b6f7fbc7521c8","7f731cc11f8e4d249142e99a44b9da7a48505ce32c4ee4881041beedd","95477703e789e6182096a09bc98853e0a70b680a4f19fa2bf86cbb9280","0c0e0f9b09b80d87ebc88e2870907b6cacb4cd7703584baf8f2be1fd94","c9c94ac5e1991a7db42c7973e328fceeb6f163d9f644031bdfd4123c7b","aaa6041912a6ba3cf167ecdb90a434a62feaf08639c59705847706b9f4","18051333e658c4816ff3576a2e9d97fe2a1196ac0ea5ed9ba386c46def","5e1e3bf6999126ae4aa52146280fdb913912632e8bac4f54e98c58821a","8317ff6416af8ab6eb35df3529689671a700fdb61a5e6436f4d6ea8ee00","892405573aa34dfc49b37e4c35b655543e88ec1c5e8ffb27ab8d1bbf90")
