index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("1b7411d5d2854c40f66cc933f80f147167e39778f54115b842fc32b4a5d3d483","374147d9a1183af2f4bb249ef4cd55fe3cb584d932bc80102d933809826a6a0f","87c1cb9d609659ce466d16354973ce4dbb8bea8652dbe104a196e42b3a739786","fa5ca2d7c232c7abef7c18d67a2303ac22e1d5f3320c7b6d4a95b56342b38c3b","2baf9b0ff18b826f394498385d0ac66b241cd55c9e35822f50c97ec33ed8df8e","46911b593034e23c7d56b2ebf9a4bb94ef2e2ded7c7b66e20c1d9fd9b1687ad4")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("1b7411d5d2854c40f66cc933f80f147167e39778f54115b842fc32b4a5d3d483","374147d9a1183af2f4bb249ef4cd55fe3cb584d932bc80102d933809826a6a0f","87c1cb9d609659ce466d16354973ce4dbb8bea8652dbe104a196e42b3a739786","fa5ca2d7c232c7abef7c18d67a2303ac22e1d5f3320c7b6d4a95b56342b38c3b","2baf9b0ff18b826f394498385d0ac66b241cd55c9e35822f50c97ec33ed8df8e","46911b593034e23c7d56b2ebf9a4bb94ef2e2ded7c7b66e20c1d9fd9b1687ad4")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("1b7411d5d2854c40f66cc933f80f147167e39778f54115b842fc32b4a5d3d483","374147d9a1183af2f4bb249ef4cd55fe3cb584d932bc80102d933809826a6a0f","87c1cb9d609659ce466d16354973ce4dbb8bea8652dbe104a196e42b3a739786","fa5ca2d7c232c7abef7c18d67a2303ac22e1d5f3320c7b6d4a95b56342b38c3b","2baf9b0ff18b826f394498385d0ac66b241cd55c9e35822f50c97ec33ed8df8e","46911b593034e23c7d56b2ebf9a4bb94ef2e2ded7c7b66e20c1d9fd9b1687ad4")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring64 NOT NULL AND customstring64 IN ("1b7411d5d2854c40f66cc933f80f147167e39778f54115b842fc32b4a5d3d483","374147d9a1183af2f4bb249ef4cd55fe3cb584d932bc80102d933809826a6a0f","87c1cb9d609659ce466d16354973ce4dbb8bea8652dbe104a196e42b3a739786","fa5ca2d7c232c7abef7c18d67a2303ac22e1d5f3320c7b6d4a95b56342b38c3b","2baf9b0ff18b826f394498385d0ac66b241cd55c9e35822f50c97ec33ed8df8e","46911b593034e23c7d56b2ebf9a4bb94ef2e2ded7c7b66e20c1d9fd9b1687ad4")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("1b7411d5d2854c40f66cc933f80f147167e39778f54115b842fc32b4a5d3d483","374147d9a1183af2f4bb249ef4cd55fe3cb584d932bc80102d933809826a6a0f","87c1cb9d609659ce466d16354973ce4dbb8bea8652dbe104a196e42b3a739786","fa5ca2d7c232c7abef7c18d67a2303ac22e1d5f3320c7b6d4a95b56342b38c3b","2baf9b0ff18b826f394498385d0ac66b241cd55c9e35822f50c97ec33ed8df8e","46911b593034e23c7d56b2ebf9a4bb94ef2e2ded7c7b66e20c1d9fd9b1687ad4")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("1b7411d5d2854c40f66cc933f80f147167e39778f54115b842fc32b4a5d3d483","374147d9a1183af2f4bb249ef4cd55fe3cb584d932bc80102d933809826a6a0f","87c1cb9d609659ce466d16354973ce4dbb8bea8652dbe104a196e42b3a739786","fa5ca2d7c232c7abef7c18d67a2303ac22e1d5f3320c7b6d4a95b56342b38c3b","2baf9b0ff18b826f394498385d0ac66b241cd55c9e35822f50c97ec33ed8df8e","46911b593034e23c7d56b2ebf9a4bb94ef2e2ded7c7b66e20c1d9fd9b1687ad4")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("1b7411d5d2854c40f66cc933f80f147167e39778f54115b842fc32b4a5d3d483","374147d9a1183af2f4bb249ef4cd55fe3cb584d932bc80102d933809826a6a0f","87c1cb9d609659ce466d16354973ce4dbb8bea8652dbe104a196e42b3a739786","fa5ca2d7c232c7abef7c18d67a2303ac22e1d5f3320c7b6d4a95b56342b38c3b","2baf9b0ff18b826f394498385d0ac66b241cd55c9e35822f50c97ec33ed8df8e","46911b593034e23c7d56b2ebf9a4bb94ef2e2ded7c7b66e20c1d9fd9b1687ad4")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("1b7411d5d2854c40f66cc933f80f147167e39778f54115b842fc32b4a5d3d483","374147d9a1183af2f4bb249ef4cd55fe3cb584d932bc80102d933809826a6a0f","87c1cb9d609659ce466d16354973ce4dbb8bea8652dbe104a196e42b3a739786","fa5ca2d7c232c7abef7c18d67a2303ac22e1d5f3320c7b6d4a95b56342b38c3b","2baf9b0ff18b826f394498385d0ac66b241cd55c9e35822f50c97ec33ed8df8e","46911b593034e23c7d56b2ebf9a4bb94ef2e2ded7c7b66e20c1d9fd9b1687ad4")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("1b7411d5d2854c40f66cc933f80f147167e39778f54115b842fc32b4a5d3d483","374147d9a1183af2f4bb249ef4cd55fe3cb584d932bc80102d933809826a6a0f","87c1cb9d609659ce466d16354973ce4dbb8bea8652dbe104a196e42b3a739786","fa5ca2d7c232c7abef7c18d67a2303ac22e1d5f3320c7b6d4a95b56342b38c3b","2baf9b0ff18b826f394498385d0ac66b241cd55c9e35822f50c97ec33ed8df8e","46911b593034e23c7d56b2ebf9a4bb94ef2e2ded7c7b66e20c1d9fd9b1687ad4")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("1b7411d5d2854c40f66cc933f80f147167e39778f54115b842fc32b4a5d3d483","374147d9a1183af2f4bb249ef4cd55fe3cb584d932bc80102d933809826a6a0f","87c1cb9d609659ce466d16354973ce4dbb8bea8652dbe104a196e42b3a739786","fa5ca2d7c232c7abef7c18d67a2303ac22e1d5f3320c7b6d4a95b56342b38c3b","2baf9b0ff18b826f394498385d0ac66b241cd55c9e35822f50c97ec33ed8df8e","46911b593034e23c7d56b2ebf9a4bb94ef2e2ded7c7b66e20c1d9fd9b1687ad4")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("1b7411d5d2854c40f66cc933f80f147167e39778f54115b842fc32b4a5d3d483","374147d9a1183af2f4bb249ef4cd55fe3cb584d932bc80102d933809826a6a0f","87c1cb9d609659ce466d16354973ce4dbb8bea8652dbe104a196e42b3a739786","fa5ca2d7c232c7abef7c18d67a2303ac22e1d5f3320c7b6d4a95b56342b38c3b","2baf9b0ff18b826f394498385d0ac66b241cd55c9e35822f50c97ec33ed8df8e","46911b593034e23c7d56b2ebf9a4bb94ef2e2ded7c7b66e20c1d9fd9b1687ad4")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("1b7411d5d2854c40f66cc933f80f147167e39778f54115b842fc32b4a5d3d483","374147d9a1183af2f4bb249ef4cd55fe3cb584d932bc80102d933809826a6a0f","87c1cb9d609659ce466d16354973ce4dbb8bea8652dbe104a196e42b3a739786","fa5ca2d7c232c7abef7c18d67a2303ac22e1d5f3320c7b6d4a95b56342b38c3b","2baf9b0ff18b826f394498385d0ac66b241cd55c9e35822f50c97ec33ed8df8e","46911b593034e23c7d56b2ebf9a4bb94ef2e2ded7c7b66e20c1d9fd9b1687ad4")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("1b7411d5d2854c40f66cc933f80f147167e39778f54115b842fc32b4a5d3d483","374147d9a1183af2f4bb249ef4cd55fe3cb584d932bc80102d933809826a6a0f","87c1cb9d609659ce466d16354973ce4dbb8bea8652dbe104a196e42b3a739786","fa5ca2d7c232c7abef7c18d67a2303ac22e1d5f3320c7b6d4a95b56342b38c3b","2baf9b0ff18b826f394498385d0ac66b241cd55c9e35822f50c97ec33ed8df8e","46911b593034e23c7d56b2ebf9a4bb94ef2e2ded7c7b66e20c1d9fd9b1687ad4")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("1b7411d5d2854c40f66cc933f80f147167e39778f54115b842fc32b4a5d3d483","374147d9a1183af2f4bb249ef4cd55fe3cb584d932bc80102d933809826a6a0f","87c1cb9d609659ce466d16354973ce4dbb8bea8652dbe104a196e42b3a739786","fa5ca2d7c232c7abef7c18d67a2303ac22e1d5f3320c7b6d4a95b56342b38c3b","2baf9b0ff18b826f394498385d0ac66b241cd55c9e35822f50c97ec33ed8df8e","46911b593034e23c7d56b2ebf9a4bb94ef2e2ded7c7b66e20c1d9fd9b1687ad4")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("1b7411d5d2854c40f66cc933f80f147167e39778f54115b842fc32b4a5d3d483","374147d9a1183af2f4bb249ef4cd55fe3cb584d932bc80102d933809826a6a0f","87c1cb9d609659ce466d16354973ce4dbb8bea8652dbe104a196e42b3a739786","fa5ca2d7c232c7abef7c18d67a2303ac22e1d5f3320c7b6d4a95b56342b38c3b","2baf9b0ff18b826f394498385d0ac66b241cd55c9e35822f50c97ec33ed8df8e","46911b593034e23c7d56b2ebf9a4bb94ef2e2ded7c7b66e20c1d9fd9b1687ad4")
index=activity AND rg_functionality="Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("1b7411d5d2854c40f66cc933f80f147167e39778f54115b842fc32b4a5d3d483","374147d9a1183af2f4bb249ef4cd55fe3cb584d932bc80102d933809826a6a0f","87c1cb9d609659ce466d16354973ce4dbb8bea8652dbe104a196e42b3a739786","fa5ca2d7c232c7abef7c18d67a2303ac22e1d5f3320c7b6d4a95b56342b38c3b","2baf9b0ff18b826f394498385d0ac66b241cd55c9e35822f50c97ec33ed8df8e","46911b593034e23c7d56b2ebf9a4bb94ef2e2ded7c7b66e20c1d9fd9b1687ad4")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("1b7411d5d2854c40f66cc933f80f147167e39778f54115b842fc32b4a5d3d483","374147d9a1183af2f4bb249ef4cd55fe3cb584d932bc80102d933809826a6a0f","87c1cb9d609659ce466d16354973ce4dbb8bea8652dbe104a196e42b3a739786","fa5ca2d7c232c7abef7c18d67a2303ac22e1d5f3320c7b6d4a95b56342b38c3b","2baf9b0ff18b826f394498385d0ac66b241cd55c9e35822f50c97ec33ed8df8e","46911b593034e23c7d56b2ebf9a4bb94ef2e2ded7c7b66e20c1d9fd9b1687ad4")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("1b7411d5d2854c40f66cc933f80f147167e39778f54115b842fc32b4a5d3d483","374147d9a1183af2f4bb249ef4cd55fe3cb584d932bc80102d933809826a6a0f","87c1cb9d609659ce466d16354973ce4dbb8bea8652dbe104a196e42b3a739786","fa5ca2d7c232c7abef7c18d67a2303ac22e1d5f3320c7b6d4a95b56342b38c3b","2baf9b0ff18b826f394498385d0ac66b241cd55c9e35822f50c97ec33ed8df8e","46911b593034e23c7d56b2ebf9a4bb94ef2e2ded7c7b66e20c1d9fd9b1687ad4")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("1b7411d5d2854c40f66cc933f80f147167e39778f54115b842fc32b4a5d3d483","374147d9a1183af2f4bb249ef4cd55fe3cb584d932bc80102d933809826a6a0f","87c1cb9d609659ce466d16354973ce4dbb8bea8652dbe104a196e42b3a739786","fa5ca2d7c232c7abef7c18d67a2303ac22e1d5f3320c7b6d4a95b56342b38c3b","2baf9b0ff18b826f394498385d0ac66b241cd55c9e35822f50c97ec33ed8df8e","46911b593034e23c7d56b2ebf9a4bb94ef2e2ded7c7b66e20c1d9fd9b1687ad4")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("1b7411d5d2854c40f66cc933f80f147167e39778f54115b842fc32b4a5d3d483","374147d9a1183af2f4bb249ef4cd55fe3cb584d932bc80102d933809826a6a0f","87c1cb9d609659ce466d16354973ce4dbb8bea8652dbe104a196e42b3a739786","fa5ca2d7c232c7abef7c18d67a2303ac22e1d5f3320c7b6d4a95b56342b38c3b","2baf9b0ff18b826f394498385d0ac66b241cd55c9e35822f50c97ec33ed8df8e","46911b593034e23c7d56b2ebf9a4bb94ef2e2ded7c7b66e20c1d9fd9b1687ad4")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("1b7411d5d2854c40f66cc933f80f147167e39778f54115b842fc32b4a5d3d483","374147d9a1183af2f4bb249ef4cd55fe3cb584d932bc80102d933809826a6a0f","87c1cb9d609659ce466d16354973ce4dbb8bea8652dbe104a196e42b3a739786","fa5ca2d7c232c7abef7c18d67a2303ac22e1d5f3320c7b6d4a95b56342b38c3b","2baf9b0ff18b826f394498385d0ac66b241cd55c9e35822f50c97ec33ed8df8e","46911b593034e23c7d56b2ebf9a4bb94ef2e2ded7c7b66e20c1d9fd9b1687ad4")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("1b7411d5d2854c40f66cc933f80f147167e39778f54115b842fc32b4a5d3d483","374147d9a1183af2f4bb249ef4cd55fe3cb584d932bc80102d933809826a6a0f","87c1cb9d609659ce466d16354973ce4dbb8bea8652dbe104a196e42b3a739786","fa5ca2d7c232c7abef7c18d67a2303ac22e1d5f3320c7b6d4a95b56342b38c3b","2baf9b0ff18b826f394498385d0ac66b241cd55c9e35822f50c97ec33ed8df8e","46911b593034e23c7d56b2ebf9a4bb94ef2e2ded7c7b66e20c1d9fd9b1687ad4")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("1b7411d5d2854c40f66cc933f80f147167e39778f54115b842fc32b4a5d3d483","374147d9a1183af2f4bb249ef4cd55fe3cb584d932bc80102d933809826a6a0f","87c1cb9d609659ce466d16354973ce4dbb8bea8652dbe104a196e42b3a739786","fa5ca2d7c232c7abef7c18d67a2303ac22e1d5f3320c7b6d4a95b56342b38c3b","2baf9b0ff18b826f394498385d0ac66b241cd55c9e35822f50c97ec33ed8df8e","46911b593034e23c7d56b2ebf9a4bb94ef2e2ded7c7b66e20c1d9fd9b1687ad4")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring64 NOT NULL AND customstring64 IN ("1b7411d5d2854c40f66cc933f80f147167e39778f54115b842fc32b4a5d3d483","374147d9a1183af2f4bb249ef4cd55fe3cb584d932bc80102d933809826a6a0f","87c1cb9d609659ce466d16354973ce4dbb8bea8652dbe104a196e42b3a739786","fa5ca2d7c232c7abef7c18d67a2303ac22e1d5f3320c7b6d4a95b56342b38c3b","2baf9b0ff18b826f394498385d0ac66b241cd55c9e35822f50c97ec33ed8df8e","46911b593034e23c7d56b2ebf9a4bb94ef2e2ded7c7b66e20c1d9fd9b1687ad4")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("1b7411d5d2854c40f66cc933f80f147167e39778f54115b842fc32b4a5d3d483","374147d9a1183af2f4bb249ef4cd55fe3cb584d932bc80102d933809826a6a0f","87c1cb9d609659ce466d16354973ce4dbb8bea8652dbe104a196e42b3a739786","fa5ca2d7c232c7abef7c18d67a2303ac22e1d5f3320c7b6d4a95b56342b38c3b","2baf9b0ff18b826f394498385d0ac66b241cd55c9e35822f50c97ec33ed8df8e","46911b593034e23c7d56b2ebf9a4bb94ef2e2ded7c7b66e20c1d9fd9b1687ad4")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("1b7411d5d2854c40f66cc933f80f147167e39778f54115b842fc32b4a5d3d483","374147d9a1183af2f4bb249ef4cd55fe3cb584d932bc80102d933809826a6a0f","87c1cb9d609659ce466d16354973ce4dbb8bea8652dbe104a196e42b3a739786","fa5ca2d7c232c7abef7c18d67a2303ac22e1d5f3320c7b6d4a95b56342b38c3b","2baf9b0ff18b826f394498385d0ac66b241cd55c9e35822f50c97ec33ed8df8e","46911b593034e23c7d56b2ebf9a4bb94ef2e2ded7c7b66e20c1d9fd9b1687ad4")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("1b7411d5d2854c40f66cc933f80f147167e39778f54115b842fc32b4a5d3d483","374147d9a1183af2f4bb249ef4cd55fe3cb584d932bc80102d933809826a6a0f","87c1cb9d609659ce466d16354973ce4dbb8bea8652dbe104a196e42b3a739786","fa5ca2d7c232c7abef7c18d67a2303ac22e1d5f3320c7b6d4a95b56342b38c3b","2baf9b0ff18b826f394498385d0ac66b241cd55c9e35822f50c97ec33ed8df8e","46911b593034e23c7d56b2ebf9a4bb94ef2e2ded7c7b66e20c1d9fd9b1687ad4")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring64 NOT NULL AND customstring64 IN ("1b7411d5d2854c40f66cc933f80f147167e39778f54115b842fc32b4a5d3d483","374147d9a1183af2f4bb249ef4cd55fe3cb584d932bc80102d933809826a6a0f","87c1cb9d609659ce466d16354973ce4dbb8bea8652dbe104a196e42b3a739786","fa5ca2d7c232c7abef7c18d67a2303ac22e1d5f3320c7b6d4a95b56342b38c3b","2baf9b0ff18b826f394498385d0ac66b241cd55c9e35822f50c97ec33ed8df8e","46911b593034e23c7d56b2ebf9a4bb94ef2e2ded7c7b66e20c1d9fd9b1687ad4")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("1b7411d5d2854c40f66cc933f80f147167e39778f54115b842fc32b4a5d3d483","374147d9a1183af2f4bb249ef4cd55fe3cb584d932bc80102d933809826a6a0f","87c1cb9d609659ce466d16354973ce4dbb8bea8652dbe104a196e42b3a739786","fa5ca2d7c232c7abef7c18d67a2303ac22e1d5f3320c7b6d4a95b56342b38c3b","2baf9b0ff18b826f394498385d0ac66b241cd55c9e35822f50c97ec33ed8df8e","46911b593034e23c7d56b2ebf9a4bb94ef2e2ded7c7b66e20c1d9fd9b1687ad4")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("1b7411d5d2854c40f66cc933f80f147167e39778f54115b842fc32b4a5d3d483","374147d9a1183af2f4bb249ef4cd55fe3cb584d932bc80102d933809826a6a0f","87c1cb9d609659ce466d16354973ce4dbb8bea8652dbe104a196e42b3a739786","fa5ca2d7c232c7abef7c18d67a2303ac22e1d5f3320c7b6d4a95b56342b38c3b","2baf9b0ff18b826f394498385d0ac66b241cd55c9e35822f50c97ec33ed8df8e","46911b593034e23c7d56b2ebf9a4bb94ef2e2ded7c7b66e20c1d9fd9b1687ad4")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("1b7411d5d2854c40f66cc933f80f147167e39778f54115b842fc32b4a5d3d483","374147d9a1183af2f4bb249ef4cd55fe3cb584d932bc80102d933809826a6a0f","87c1cb9d609659ce466d16354973ce4dbb8bea8652dbe104a196e42b3a739786","fa5ca2d7c232c7abef7c18d67a2303ac22e1d5f3320c7b6d4a95b56342b38c3b","2baf9b0ff18b826f394498385d0ac66b241cd55c9e35822f50c97ec33ed8df8e","46911b593034e23c7d56b2ebf9a4bb94ef2e2ded7c7b66e20c1d9fd9b1687ad4")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring64 NOT NULL AND customstring64 IN ("1b7411d5d2854c40f66cc933f80f147167e39778f54115b842fc32b4a5d3d483","374147d9a1183af2f4bb249ef4cd55fe3cb584d932bc80102d933809826a6a0f","87c1cb9d609659ce466d16354973ce4dbb8bea8652dbe104a196e42b3a739786","fa5ca2d7c232c7abef7c18d67a2303ac22e1d5f3320c7b6d4a95b56342b38c3b","2baf9b0ff18b826f394498385d0ac66b241cd55c9e35822f50c97ec33ed8df8e","46911b593034e23c7d56b2ebf9a4bb94ef2e2ded7c7b66e20c1d9fd9b1687ad4")
