index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("0d5b74add9fd68c54d8c7df883fa727d74dacc0bff3c49afd200b914e6051d9a","822e1359b7e7eabc9199a055fd772819176d2e5cae63d0d24787579634d45d42","86680bef3d1e41f369ab60acf8198496a367fbb7183d5f1104230a74d32705b3","d6906cb7f9fb0f9cd12943509a1bb5e9409a4547a18f930b071d5c330e6c97f9","88b0b1d9988fb2a42934f862944be0b32d00cb5e6ffc71e3164fa7c4cacff62d")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("0d5b74add9fd68c54d8c7df883fa727d74dacc0bff3c49afd200b914e6051d9a","822e1359b7e7eabc9199a055fd772819176d2e5cae63d0d24787579634d45d42","86680bef3d1e41f369ab60acf8198496a367fbb7183d5f1104230a74d32705b3","d6906cb7f9fb0f9cd12943509a1bb5e9409a4547a18f930b071d5c330e6c97f9","88b0b1d9988fb2a42934f862944be0b32d00cb5e6ffc71e3164fa7c4cacff62d")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("0d5b74add9fd68c54d8c7df883fa727d74dacc0bff3c49afd200b914e6051d9a","822e1359b7e7eabc9199a055fd772819176d2e5cae63d0d24787579634d45d42","86680bef3d1e41f369ab60acf8198496a367fbb7183d5f1104230a74d32705b3","d6906cb7f9fb0f9cd12943509a1bb5e9409a4547a18f930b071d5c330e6c97f9","88b0b1d9988fb2a42934f862944be0b32d00cb5e6ffc71e3164fa7c4cacff62d")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("0d5b74add9fd68c54d8c7df883fa727d74dacc0bff3c49afd200b914e6051d9a","822e1359b7e7eabc9199a055fd772819176d2e5cae63d0d24787579634d45d42","86680bef3d1e41f369ab60acf8198496a367fbb7183d5f1104230a74d32705b3","d6906cb7f9fb0f9cd12943509a1bb5e9409a4547a18f930b071d5c330e6c97f9","88b0b1d9988fb2a42934f862944be0b32d00cb5e6ffc71e3164fa7c4cacff62d")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("0d5b74add9fd68c54d8c7df883fa727d74dacc0bff3c49afd200b914e6051d9a","822e1359b7e7eabc9199a055fd772819176d2e5cae63d0d24787579634d45d42","86680bef3d1e41f369ab60acf8198496a367fbb7183d5f1104230a74d32705b3","d6906cb7f9fb0f9cd12943509a1bb5e9409a4547a18f930b071d5c330e6c97f9","88b0b1d9988fb2a42934f862944be0b32d00cb5e6ffc71e3164fa7c4cacff62d")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("0d5b74add9fd68c54d8c7df883fa727d74dacc0bff3c49afd200b914e6051d9a","822e1359b7e7eabc9199a055fd772819176d2e5cae63d0d24787579634d45d42","86680bef3d1e41f369ab60acf8198496a367fbb7183d5f1104230a74d32705b3","d6906cb7f9fb0f9cd12943509a1bb5e9409a4547a18f930b071d5c330e6c97f9","88b0b1d9988fb2a42934f862944be0b32d00cb5e6ffc71e3164fa7c4cacff62d")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("0d5b74add9fd68c54d8c7df883fa727d74dacc0bff3c49afd200b914e6051d9a","822e1359b7e7eabc9199a055fd772819176d2e5cae63d0d24787579634d45d42","86680bef3d1e41f369ab60acf8198496a367fbb7183d5f1104230a74d32705b3","d6906cb7f9fb0f9cd12943509a1bb5e9409a4547a18f930b071d5c330e6c97f9","88b0b1d9988fb2a42934f862944be0b32d00cb5e6ffc71e3164fa7c4cacff62d")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("0d5b74add9fd68c54d8c7df883fa727d74dacc0bff3c49afd200b914e6051d9a","822e1359b7e7eabc9199a055fd772819176d2e5cae63d0d24787579634d45d42","86680bef3d1e41f369ab60acf8198496a367fbb7183d5f1104230a74d32705b3","d6906cb7f9fb0f9cd12943509a1bb5e9409a4547a18f930b071d5c330e6c97f9","88b0b1d9988fb2a42934f862944be0b32d00cb5e6ffc71e3164fa7c4cacff62d")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("0d5b74add9fd68c54d8c7df883fa727d74dacc0bff3c49afd200b914e6051d9a","822e1359b7e7eabc9199a055fd772819176d2e5cae63d0d24787579634d45d42","86680bef3d1e41f369ab60acf8198496a367fbb7183d5f1104230a74d32705b3","d6906cb7f9fb0f9cd12943509a1bb5e9409a4547a18f930b071d5c330e6c97f9","88b0b1d9988fb2a42934f862944be0b32d00cb5e6ffc71e3164fa7c4cacff62d")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("0d5b74add9fd68c54d8c7df883fa727d74dacc0bff3c49afd200b914e6051d9a","822e1359b7e7eabc9199a055fd772819176d2e5cae63d0d24787579634d45d42","86680bef3d1e41f369ab60acf8198496a367fbb7183d5f1104230a74d32705b3","d6906cb7f9fb0f9cd12943509a1bb5e9409a4547a18f930b071d5c330e6c97f9","88b0b1d9988fb2a42934f862944be0b32d00cb5e6ffc71e3164fa7c4cacff62d")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("0d5b74add9fd68c54d8c7df883fa727d74dacc0bff3c49afd200b914e6051d9a","822e1359b7e7eabc9199a055fd772819176d2e5cae63d0d24787579634d45d42","86680bef3d1e41f369ab60acf8198496a367fbb7183d5f1104230a74d32705b3","d6906cb7f9fb0f9cd12943509a1bb5e9409a4547a18f930b071d5c330e6c97f9","88b0b1d9988fb2a42934f862944be0b32d00cb5e6ffc71e3164fa7c4cacff62d")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("0d5b74add9fd68c54d8c7df883fa727d74dacc0bff3c49afd200b914e6051d9a","822e1359b7e7eabc9199a055fd772819176d2e5cae63d0d24787579634d45d42","86680bef3d1e41f369ab60acf8198496a367fbb7183d5f1104230a74d32705b3","d6906cb7f9fb0f9cd12943509a1bb5e9409a4547a18f930b071d5c330e6c97f9","88b0b1d9988fb2a42934f862944be0b32d00cb5e6ffc71e3164fa7c4cacff62d")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("0d5b74add9fd68c54d8c7df883fa727d74dacc0bff3c49afd200b914e6051d9a","822e1359b7e7eabc9199a055fd772819176d2e5cae63d0d24787579634d45d42","86680bef3d1e41f369ab60acf8198496a367fbb7183d5f1104230a74d32705b3","d6906cb7f9fb0f9cd12943509a1bb5e9409a4547a18f930b071d5c330e6c97f9","88b0b1d9988fb2a42934f862944be0b32d00cb5e6ffc71e3164fa7c4cacff62d")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("0d5b74add9fd68c54d8c7df883fa727d74dacc0bff3c49afd200b914e6051d9a","822e1359b7e7eabc9199a055fd772819176d2e5cae63d0d24787579634d45d42","86680bef3d1e41f369ab60acf8198496a367fbb7183d5f1104230a74d32705b3","d6906cb7f9fb0f9cd12943509a1bb5e9409a4547a18f930b071d5c330e6c97f9","88b0b1d9988fb2a42934f862944be0b32d00cb5e6ffc71e3164fa7c4cacff62d")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("0d5b74add9fd68c54d8c7df883fa727d74dacc0bff3c49afd200b914e6051d9a","822e1359b7e7eabc9199a055fd772819176d2e5cae63d0d24787579634d45d42","86680bef3d1e41f369ab60acf8198496a367fbb7183d5f1104230a74d32705b3","d6906cb7f9fb0f9cd12943509a1bb5e9409a4547a18f930b071d5c330e6c97f9","88b0b1d9988fb2a42934f862944be0b32d00cb5e6ffc71e3164fa7c4cacff62d")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("0d5b74add9fd68c54d8c7df883fa727d74dacc0bff3c49afd200b914e6051d9a","822e1359b7e7eabc9199a055fd772819176d2e5cae63d0d24787579634d45d42","86680bef3d1e41f369ab60acf8198496a367fbb7183d5f1104230a74d32705b3","d6906cb7f9fb0f9cd12943509a1bb5e9409a4547a18f930b071d5c330e6c97f9","88b0b1d9988fb2a42934f862944be0b32d00cb5e6ffc71e3164fa7c4cacff62d")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("0d5b74add9fd68c54d8c7df883fa727d74dacc0bff3c49afd200b914e6051d9a","822e1359b7e7eabc9199a055fd772819176d2e5cae63d0d24787579634d45d42","86680bef3d1e41f369ab60acf8198496a367fbb7183d5f1104230a74d32705b3","d6906cb7f9fb0f9cd12943509a1bb5e9409a4547a18f930b071d5c330e6c97f9","88b0b1d9988fb2a42934f862944be0b32d00cb5e6ffc71e3164fa7c4cacff62d")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("0d5b74add9fd68c54d8c7df883fa727d74dacc0bff3c49afd200b914e6051d9a","822e1359b7e7eabc9199a055fd772819176d2e5cae63d0d24787579634d45d42","86680bef3d1e41f369ab60acf8198496a367fbb7183d5f1104230a74d32705b3","d6906cb7f9fb0f9cd12943509a1bb5e9409a4547a18f930b071d5c330e6c97f9","88b0b1d9988fb2a42934f862944be0b32d00cb5e6ffc71e3164fa7c4cacff62d")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("0d5b74add9fd68c54d8c7df883fa727d74dacc0bff3c49afd200b914e6051d9a","822e1359b7e7eabc9199a055fd772819176d2e5cae63d0d24787579634d45d42","86680bef3d1e41f369ab60acf8198496a367fbb7183d5f1104230a74d32705b3","d6906cb7f9fb0f9cd12943509a1bb5e9409a4547a18f930b071d5c330e6c97f9","88b0b1d9988fb2a42934f862944be0b32d00cb5e6ffc71e3164fa7c4cacff62d")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("0d5b74add9fd68c54d8c7df883fa727d74dacc0bff3c49afd200b914e6051d9a","822e1359b7e7eabc9199a055fd772819176d2e5cae63d0d24787579634d45d42","86680bef3d1e41f369ab60acf8198496a367fbb7183d5f1104230a74d32705b3","d6906cb7f9fb0f9cd12943509a1bb5e9409a4547a18f930b071d5c330e6c97f9","88b0b1d9988fb2a42934f862944be0b32d00cb5e6ffc71e3164fa7c4cacff62d")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("0d5b74add9fd68c54d8c7df883fa727d74dacc0bff3c49afd200b914e6051d9a","822e1359b7e7eabc9199a055fd772819176d2e5cae63d0d24787579634d45d42","86680bef3d1e41f369ab60acf8198496a367fbb7183d5f1104230a74d32705b3","d6906cb7f9fb0f9cd12943509a1bb5e9409a4547a18f930b071d5c330e6c97f9","88b0b1d9988fb2a42934f862944be0b32d00cb5e6ffc71e3164fa7c4cacff62d")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("0d5b74add9fd68c54d8c7df883fa727d74dacc0bff3c49afd200b914e6051d9a","822e1359b7e7eabc9199a055fd772819176d2e5cae63d0d24787579634d45d42","86680bef3d1e41f369ab60acf8198496a367fbb7183d5f1104230a74d32705b3","d6906cb7f9fb0f9cd12943509a1bb5e9409a4547a18f930b071d5c330e6c97f9","88b0b1d9988fb2a42934f862944be0b32d00cb5e6ffc71e3164fa7c4cacff62d")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("0d5b74add9fd68c54d8c7df883fa727d74dacc0bff3c49afd200b914e6051d9a","822e1359b7e7eabc9199a055fd772819176d2e5cae63d0d24787579634d45d42","86680bef3d1e41f369ab60acf8198496a367fbb7183d5f1104230a74d32705b3","d6906cb7f9fb0f9cd12943509a1bb5e9409a4547a18f930b071d5c330e6c97f9","88b0b1d9988fb2a42934f862944be0b32d00cb5e6ffc71e3164fa7c4cacff62d")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("0d5b74add9fd68c54d8c7df883fa727d74dacc0bff3c49afd200b914e6051d9a","822e1359b7e7eabc9199a055fd772819176d2e5cae63d0d24787579634d45d42","86680bef3d1e41f369ab60acf8198496a367fbb7183d5f1104230a74d32705b3","d6906cb7f9fb0f9cd12943509a1bb5e9409a4547a18f930b071d5c330e6c97f9","88b0b1d9988fb2a42934f862944be0b32d00cb5e6ffc71e3164fa7c4cacff62d")
