index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("7ee1fd53457c9a73308ae98c01722aa2b9170ef1","b5d2e0fbd6cd0f6a679fbf95e588c6a2dfd4d5dd","d0c1662ce239e4d288048c0e3324ec52962f6ddda77da0cb7af9c1d9c2f1e2eb","07136cf4b61c53db7a802ff1e34d36b818ad077b","26d5748ffe6bd95e3fee6ce184d388a1a681006dc23a0f08d53c083c593c193b","63e86d50bd3e28b2f19d86114f589ff12c85cebba208e05ece896bcf4dce2aa2")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("7ee1fd53457c9a73308ae98c01722aa2b9170ef1","b5d2e0fbd6cd0f6a679fbf95e588c6a2dfd4d5dd","d0c1662ce239e4d288048c0e3324ec52962f6ddda77da0cb7af9c1d9c2f1e2eb","07136cf4b61c53db7a802ff1e34d36b818ad077b","26d5748ffe6bd95e3fee6ce184d388a1a681006dc23a0f08d53c083c593c193b","63e86d50bd3e28b2f19d86114f589ff12c85cebba208e05ece896bcf4dce2aa2")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("7ee1fd53457c9a73308ae98c01722aa2b9170ef1","b5d2e0fbd6cd0f6a679fbf95e588c6a2dfd4d5dd","d0c1662ce239e4d288048c0e3324ec52962f6ddda77da0cb7af9c1d9c2f1e2eb","07136cf4b61c53db7a802ff1e34d36b818ad077b","26d5748ffe6bd95e3fee6ce184d388a1a681006dc23a0f08d53c083c593c193b","63e86d50bd3e28b2f19d86114f589ff12c85cebba208e05ece896bcf4dce2aa2")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring64 NOT NULL AND customstring64 IN ("7ee1fd53457c9a73308ae98c01722aa2b9170ef1","b5d2e0fbd6cd0f6a679fbf95e588c6a2dfd4d5dd","d0c1662ce239e4d288048c0e3324ec52962f6ddda77da0cb7af9c1d9c2f1e2eb","07136cf4b61c53db7a802ff1e34d36b818ad077b","26d5748ffe6bd95e3fee6ce184d388a1a681006dc23a0f08d53c083c593c193b","63e86d50bd3e28b2f19d86114f589ff12c85cebba208e05ece896bcf4dce2aa2")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("7ee1fd53457c9a73308ae98c01722aa2b9170ef1","b5d2e0fbd6cd0f6a679fbf95e588c6a2dfd4d5dd","d0c1662ce239e4d288048c0e3324ec52962f6ddda77da0cb7af9c1d9c2f1e2eb","07136cf4b61c53db7a802ff1e34d36b818ad077b","26d5748ffe6bd95e3fee6ce184d388a1a681006dc23a0f08d53c083c593c193b","63e86d50bd3e28b2f19d86114f589ff12c85cebba208e05ece896bcf4dce2aa2")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("7ee1fd53457c9a73308ae98c01722aa2b9170ef1","b5d2e0fbd6cd0f6a679fbf95e588c6a2dfd4d5dd","d0c1662ce239e4d288048c0e3324ec52962f6ddda77da0cb7af9c1d9c2f1e2eb","07136cf4b61c53db7a802ff1e34d36b818ad077b","26d5748ffe6bd95e3fee6ce184d388a1a681006dc23a0f08d53c083c593c193b","63e86d50bd3e28b2f19d86114f589ff12c85cebba208e05ece896bcf4dce2aa2")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("7ee1fd53457c9a73308ae98c01722aa2b9170ef1","b5d2e0fbd6cd0f6a679fbf95e588c6a2dfd4d5dd","d0c1662ce239e4d288048c0e3324ec52962f6ddda77da0cb7af9c1d9c2f1e2eb","07136cf4b61c53db7a802ff1e34d36b818ad077b","26d5748ffe6bd95e3fee6ce184d388a1a681006dc23a0f08d53c083c593c193b","63e86d50bd3e28b2f19d86114f589ff12c85cebba208e05ece896bcf4dce2aa2")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("7ee1fd53457c9a73308ae98c01722aa2b9170ef1","b5d2e0fbd6cd0f6a679fbf95e588c6a2dfd4d5dd","d0c1662ce239e4d288048c0e3324ec52962f6ddda77da0cb7af9c1d9c2f1e2eb","07136cf4b61c53db7a802ff1e34d36b818ad077b","26d5748ffe6bd95e3fee6ce184d388a1a681006dc23a0f08d53c083c593c193b","63e86d50bd3e28b2f19d86114f589ff12c85cebba208e05ece896bcf4dce2aa2")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("7ee1fd53457c9a73308ae98c01722aa2b9170ef1","b5d2e0fbd6cd0f6a679fbf95e588c6a2dfd4d5dd","d0c1662ce239e4d288048c0e3324ec52962f6ddda77da0cb7af9c1d9c2f1e2eb","07136cf4b61c53db7a802ff1e34d36b818ad077b","26d5748ffe6bd95e3fee6ce184d388a1a681006dc23a0f08d53c083c593c193b","63e86d50bd3e28b2f19d86114f589ff12c85cebba208e05ece896bcf4dce2aa2")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("7ee1fd53457c9a73308ae98c01722aa2b9170ef1","b5d2e0fbd6cd0f6a679fbf95e588c6a2dfd4d5dd","d0c1662ce239e4d288048c0e3324ec52962f6ddda77da0cb7af9c1d9c2f1e2eb","07136cf4b61c53db7a802ff1e34d36b818ad077b","26d5748ffe6bd95e3fee6ce184d388a1a681006dc23a0f08d53c083c593c193b","63e86d50bd3e28b2f19d86114f589ff12c85cebba208e05ece896bcf4dce2aa2")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("7ee1fd53457c9a73308ae98c01722aa2b9170ef1","b5d2e0fbd6cd0f6a679fbf95e588c6a2dfd4d5dd","d0c1662ce239e4d288048c0e3324ec52962f6ddda77da0cb7af9c1d9c2f1e2eb","07136cf4b61c53db7a802ff1e34d36b818ad077b","26d5748ffe6bd95e3fee6ce184d388a1a681006dc23a0f08d53c083c593c193b","63e86d50bd3e28b2f19d86114f589ff12c85cebba208e05ece896bcf4dce2aa2")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("7ee1fd53457c9a73308ae98c01722aa2b9170ef1","b5d2e0fbd6cd0f6a679fbf95e588c6a2dfd4d5dd","d0c1662ce239e4d288048c0e3324ec52962f6ddda77da0cb7af9c1d9c2f1e2eb","07136cf4b61c53db7a802ff1e34d36b818ad077b","26d5748ffe6bd95e3fee6ce184d388a1a681006dc23a0f08d53c083c593c193b","63e86d50bd3e28b2f19d86114f589ff12c85cebba208e05ece896bcf4dce2aa2")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("7ee1fd53457c9a73308ae98c01722aa2b9170ef1","b5d2e0fbd6cd0f6a679fbf95e588c6a2dfd4d5dd","d0c1662ce239e4d288048c0e3324ec52962f6ddda77da0cb7af9c1d9c2f1e2eb","07136cf4b61c53db7a802ff1e34d36b818ad077b","26d5748ffe6bd95e3fee6ce184d388a1a681006dc23a0f08d53c083c593c193b","63e86d50bd3e28b2f19d86114f589ff12c85cebba208e05ece896bcf4dce2aa2")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("7ee1fd53457c9a73308ae98c01722aa2b9170ef1","b5d2e0fbd6cd0f6a679fbf95e588c6a2dfd4d5dd","d0c1662ce239e4d288048c0e3324ec52962f6ddda77da0cb7af9c1d9c2f1e2eb","07136cf4b61c53db7a802ff1e34d36b818ad077b","26d5748ffe6bd95e3fee6ce184d388a1a681006dc23a0f08d53c083c593c193b","63e86d50bd3e28b2f19d86114f589ff12c85cebba208e05ece896bcf4dce2aa2")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("7ee1fd53457c9a73308ae98c01722aa2b9170ef1","b5d2e0fbd6cd0f6a679fbf95e588c6a2dfd4d5dd","d0c1662ce239e4d288048c0e3324ec52962f6ddda77da0cb7af9c1d9c2f1e2eb","07136cf4b61c53db7a802ff1e34d36b818ad077b","26d5748ffe6bd95e3fee6ce184d388a1a681006dc23a0f08d53c083c593c193b","63e86d50bd3e28b2f19d86114f589ff12c85cebba208e05ece896bcf4dce2aa2")
index=activity AND rg_functionality="Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("7ee1fd53457c9a73308ae98c01722aa2b9170ef1","b5d2e0fbd6cd0f6a679fbf95e588c6a2dfd4d5dd","d0c1662ce239e4d288048c0e3324ec52962f6ddda77da0cb7af9c1d9c2f1e2eb","07136cf4b61c53db7a802ff1e34d36b818ad077b","26d5748ffe6bd95e3fee6ce184d388a1a681006dc23a0f08d53c083c593c193b","63e86d50bd3e28b2f19d86114f589ff12c85cebba208e05ece896bcf4dce2aa2")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("7ee1fd53457c9a73308ae98c01722aa2b9170ef1","b5d2e0fbd6cd0f6a679fbf95e588c6a2dfd4d5dd","d0c1662ce239e4d288048c0e3324ec52962f6ddda77da0cb7af9c1d9c2f1e2eb","07136cf4b61c53db7a802ff1e34d36b818ad077b","26d5748ffe6bd95e3fee6ce184d388a1a681006dc23a0f08d53c083c593c193b","63e86d50bd3e28b2f19d86114f589ff12c85cebba208e05ece896bcf4dce2aa2")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("7ee1fd53457c9a73308ae98c01722aa2b9170ef1","b5d2e0fbd6cd0f6a679fbf95e588c6a2dfd4d5dd","d0c1662ce239e4d288048c0e3324ec52962f6ddda77da0cb7af9c1d9c2f1e2eb","07136cf4b61c53db7a802ff1e34d36b818ad077b","26d5748ffe6bd95e3fee6ce184d388a1a681006dc23a0f08d53c083c593c193b","63e86d50bd3e28b2f19d86114f589ff12c85cebba208e05ece896bcf4dce2aa2")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("7ee1fd53457c9a73308ae98c01722aa2b9170ef1","b5d2e0fbd6cd0f6a679fbf95e588c6a2dfd4d5dd","d0c1662ce239e4d288048c0e3324ec52962f6ddda77da0cb7af9c1d9c2f1e2eb","07136cf4b61c53db7a802ff1e34d36b818ad077b","26d5748ffe6bd95e3fee6ce184d388a1a681006dc23a0f08d53c083c593c193b","63e86d50bd3e28b2f19d86114f589ff12c85cebba208e05ece896bcf4dce2aa2")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("7ee1fd53457c9a73308ae98c01722aa2b9170ef1","b5d2e0fbd6cd0f6a679fbf95e588c6a2dfd4d5dd","d0c1662ce239e4d288048c0e3324ec52962f6ddda77da0cb7af9c1d9c2f1e2eb","07136cf4b61c53db7a802ff1e34d36b818ad077b","26d5748ffe6bd95e3fee6ce184d388a1a681006dc23a0f08d53c083c593c193b","63e86d50bd3e28b2f19d86114f589ff12c85cebba208e05ece896bcf4dce2aa2")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("7ee1fd53457c9a73308ae98c01722aa2b9170ef1","b5d2e0fbd6cd0f6a679fbf95e588c6a2dfd4d5dd","d0c1662ce239e4d288048c0e3324ec52962f6ddda77da0cb7af9c1d9c2f1e2eb","07136cf4b61c53db7a802ff1e34d36b818ad077b","26d5748ffe6bd95e3fee6ce184d388a1a681006dc23a0f08d53c083c593c193b","63e86d50bd3e28b2f19d86114f589ff12c85cebba208e05ece896bcf4dce2aa2")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("7ee1fd53457c9a73308ae98c01722aa2b9170ef1","b5d2e0fbd6cd0f6a679fbf95e588c6a2dfd4d5dd","d0c1662ce239e4d288048c0e3324ec52962f6ddda77da0cb7af9c1d9c2f1e2eb","07136cf4b61c53db7a802ff1e34d36b818ad077b","26d5748ffe6bd95e3fee6ce184d388a1a681006dc23a0f08d53c083c593c193b","63e86d50bd3e28b2f19d86114f589ff12c85cebba208e05ece896bcf4dce2aa2")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("7ee1fd53457c9a73308ae98c01722aa2b9170ef1","b5d2e0fbd6cd0f6a679fbf95e588c6a2dfd4d5dd","d0c1662ce239e4d288048c0e3324ec52962f6ddda77da0cb7af9c1d9c2f1e2eb","07136cf4b61c53db7a802ff1e34d36b818ad077b","26d5748ffe6bd95e3fee6ce184d388a1a681006dc23a0f08d53c083c593c193b","63e86d50bd3e28b2f19d86114f589ff12c85cebba208e05ece896bcf4dce2aa2")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring64 NOT NULL AND customstring64 IN ("7ee1fd53457c9a73308ae98c01722aa2b9170ef1","b5d2e0fbd6cd0f6a679fbf95e588c6a2dfd4d5dd","d0c1662ce239e4d288048c0e3324ec52962f6ddda77da0cb7af9c1d9c2f1e2eb","07136cf4b61c53db7a802ff1e34d36b818ad077b","26d5748ffe6bd95e3fee6ce184d388a1a681006dc23a0f08d53c083c593c193b","63e86d50bd3e28b2f19d86114f589ff12c85cebba208e05ece896bcf4dce2aa2")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("7ee1fd53457c9a73308ae98c01722aa2b9170ef1","b5d2e0fbd6cd0f6a679fbf95e588c6a2dfd4d5dd","d0c1662ce239e4d288048c0e3324ec52962f6ddda77da0cb7af9c1d9c2f1e2eb","07136cf4b61c53db7a802ff1e34d36b818ad077b","26d5748ffe6bd95e3fee6ce184d388a1a681006dc23a0f08d53c083c593c193b","63e86d50bd3e28b2f19d86114f589ff12c85cebba208e05ece896bcf4dce2aa2")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("7ee1fd53457c9a73308ae98c01722aa2b9170ef1","b5d2e0fbd6cd0f6a679fbf95e588c6a2dfd4d5dd","d0c1662ce239e4d288048c0e3324ec52962f6ddda77da0cb7af9c1d9c2f1e2eb","07136cf4b61c53db7a802ff1e34d36b818ad077b","26d5748ffe6bd95e3fee6ce184d388a1a681006dc23a0f08d53c083c593c193b","63e86d50bd3e28b2f19d86114f589ff12c85cebba208e05ece896bcf4dce2aa2")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("7ee1fd53457c9a73308ae98c01722aa2b9170ef1","b5d2e0fbd6cd0f6a679fbf95e588c6a2dfd4d5dd","d0c1662ce239e4d288048c0e3324ec52962f6ddda77da0cb7af9c1d9c2f1e2eb","07136cf4b61c53db7a802ff1e34d36b818ad077b","26d5748ffe6bd95e3fee6ce184d388a1a681006dc23a0f08d53c083c593c193b","63e86d50bd3e28b2f19d86114f589ff12c85cebba208e05ece896bcf4dce2aa2")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring64 NOT NULL AND customstring64 IN ("7ee1fd53457c9a73308ae98c01722aa2b9170ef1","b5d2e0fbd6cd0f6a679fbf95e588c6a2dfd4d5dd","d0c1662ce239e4d288048c0e3324ec52962f6ddda77da0cb7af9c1d9c2f1e2eb","07136cf4b61c53db7a802ff1e34d36b818ad077b","26d5748ffe6bd95e3fee6ce184d388a1a681006dc23a0f08d53c083c593c193b","63e86d50bd3e28b2f19d86114f589ff12c85cebba208e05ece896bcf4dce2aa2")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("7ee1fd53457c9a73308ae98c01722aa2b9170ef1","b5d2e0fbd6cd0f6a679fbf95e588c6a2dfd4d5dd","d0c1662ce239e4d288048c0e3324ec52962f6ddda77da0cb7af9c1d9c2f1e2eb","07136cf4b61c53db7a802ff1e34d36b818ad077b","26d5748ffe6bd95e3fee6ce184d388a1a681006dc23a0f08d53c083c593c193b","63e86d50bd3e28b2f19d86114f589ff12c85cebba208e05ece896bcf4dce2aa2")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("7ee1fd53457c9a73308ae98c01722aa2b9170ef1","b5d2e0fbd6cd0f6a679fbf95e588c6a2dfd4d5dd","d0c1662ce239e4d288048c0e3324ec52962f6ddda77da0cb7af9c1d9c2f1e2eb","07136cf4b61c53db7a802ff1e34d36b818ad077b","26d5748ffe6bd95e3fee6ce184d388a1a681006dc23a0f08d53c083c593c193b","63e86d50bd3e28b2f19d86114f589ff12c85cebba208e05ece896bcf4dce2aa2")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("7ee1fd53457c9a73308ae98c01722aa2b9170ef1","b5d2e0fbd6cd0f6a679fbf95e588c6a2dfd4d5dd","d0c1662ce239e4d288048c0e3324ec52962f6ddda77da0cb7af9c1d9c2f1e2eb","07136cf4b61c53db7a802ff1e34d36b818ad077b","26d5748ffe6bd95e3fee6ce184d388a1a681006dc23a0f08d53c083c593c193b","63e86d50bd3e28b2f19d86114f589ff12c85cebba208e05ece896bcf4dce2aa2")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring64 NOT NULL AND customstring64 IN ("7ee1fd53457c9a73308ae98c01722aa2b9170ef1","b5d2e0fbd6cd0f6a679fbf95e588c6a2dfd4d5dd","d0c1662ce239e4d288048c0e3324ec52962f6ddda77da0cb7af9c1d9c2f1e2eb","07136cf4b61c53db7a802ff1e34d36b818ad077b","26d5748ffe6bd95e3fee6ce184d388a1a681006dc23a0f08d53c083c593c193b","63e86d50bd3e28b2f19d86114f589ff12c85cebba208e05ece896bcf4dce2aa2")
index=activity AND rg_functionality="O365 General" AND filehash NOT NULL AND filehash IN ("7ee1fd53457c9a73308ae98c01722aa2b9170ef1","b5d2e0fbd6cd0f6a679fbf95e588c6a2dfd4d5dd","d0c1662ce239e4d288048c0e3324ec52962f6ddda77da0cb7af9c1d9c2f1e2eb","07136cf4b61c53db7a802ff1e34d36b818ad077b","26d5748ffe6bd95e3fee6ce184d388a1a681006dc23a0f08d53c083c593c193b","63e86d50bd3e28b2f19d86114f589ff12c85cebba208e05ece896bcf4dce2aa2")
index=activity AND rg_functionality="O365 General" AND oldfilehash NOT NULL AND oldfilehash IN ("7ee1fd53457c9a73308ae98c01722aa2b9170ef1","b5d2e0fbd6cd0f6a679fbf95e588c6a2dfd4d5dd","d0c1662ce239e4d288048c0e3324ec52962f6ddda77da0cb7af9c1d9c2f1e2eb","07136cf4b61c53db7a802ff1e34d36b818ad077b","26d5748ffe6bd95e3fee6ce184d388a1a681006dc23a0f08d53c083c593c193b","63e86d50bd3e28b2f19d86114f589ff12c85cebba208e05ece896bcf4dce2aa2")
index=activity AND rg_functionality="O365 General" AND customstring3 NOT NULL AND customstring3 IN ("7ee1fd53457c9a73308ae98c01722aa2b9170ef1","b5d2e0fbd6cd0f6a679fbf95e588c6a2dfd4d5dd","d0c1662ce239e4d288048c0e3324ec52962f6ddda77da0cb7af9c1d9c2f1e2eb","07136cf4b61c53db7a802ff1e34d36b818ad077b","26d5748ffe6bd95e3fee6ce184d388a1a681006dc23a0f08d53c083c593c193b","63e86d50bd3e28b2f19d86114f589ff12c85cebba208e05ece896bcf4dce2aa2")
index=activity AND rg_functionality="O365 General" AND customstring64 NOT NULL AND customstring64 IN ("7ee1fd53457c9a73308ae98c01722aa2b9170ef1","b5d2e0fbd6cd0f6a679fbf95e588c6a2dfd4d5dd","d0c1662ce239e4d288048c0e3324ec52962f6ddda77da0cb7af9c1d9c2f1e2eb","07136cf4b61c53db7a802ff1e34d36b818ad077b","26d5748ffe6bd95e3fee6ce184d388a1a681006dc23a0f08d53c083c593c193b","63e86d50bd3e28b2f19d86114f589ff12c85cebba208e05ece896bcf4dce2aa2")
