index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("f92297c4efabba98befeb992a009462d1aba6f3c3a11210a7c054ff5377f0753","7ef2c0d2ace70fedfe5cd919ad3959c56e7e9177dcc0ee770a4af7f84da544f1","06431a5d8f6262cc3db39d911a920f793fa6c648be94daf789c11cc5514d0c3d","1c5b9409243bfb81a5924881cc05f63a301a3a7ce214830c7a83aeb2485cc5c3","cb4c7037c7620e4ce3f8f43161b0ec67018c09e71ae4cea3018104153fbed286","5815a6f7976e993fcdf9e024f4667049ec5a921b7b93c8c8c0e5d779c8b72fcc","240e7bd805bd7f2d17217dd4cebc03ac37ee60b7fb1264655cfd087749db647a","9854750f3880c7cee3281d8c33292ca82d0d288963f0f2771d938c06ccaffaa9","ce56b011ac4663a40f0ba606c98c08aaf7caf6a45765aa930258fe2837b12181","cc6ae9670e38244e439711b1698f0db3cff000b79bec7f47bc4aa5ab1f6177c0","00d88009fa50bfab849593291cce20f8b2f2e2cf2428d9728e06c69fced55ed5","6753933cd54e4eba497c48d63c7418a8946b4b6c44170105d489d29f1fe11494","f1289e7229ace984027f29cf8e2dd8fdd19b0c4b488da31ff411ee95305eaecc","fa2ebcdfce8bbe4245ed77b43d39e22c0c7593ca3f65be3fd0ccdf7ee02130a9","76d0133d738876f314ae792d0cf949710b66266ba0cebefbd98ce40c64a9b15b","5678196f512f8a531c7d85af8df4f40c7a5f9c27331b361bb1a1c46d317a77d8","6bab11d9561482777757f16c069ebef3f1cd6885dbef55306ffde30037a41d48","50fe8a981a7d4824f0b297f37804b65672ed4484e198e7c324260a34941ddac7","1ec4d60738a671f00089a86eeba6cb13750bce589e84fd177707718a4cc7d8f1")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("f92297c4efabba98befeb992a009462d1aba6f3c3a11210a7c054ff5377f0753","7ef2c0d2ace70fedfe5cd919ad3959c56e7e9177dcc0ee770a4af7f84da544f1","06431a5d8f6262cc3db39d911a920f793fa6c648be94daf789c11cc5514d0c3d","1c5b9409243bfb81a5924881cc05f63a301a3a7ce214830c7a83aeb2485cc5c3","cb4c7037c7620e4ce3f8f43161b0ec67018c09e71ae4cea3018104153fbed286","5815a6f7976e993fcdf9e024f4667049ec5a921b7b93c8c8c0e5d779c8b72fcc","240e7bd805bd7f2d17217dd4cebc03ac37ee60b7fb1264655cfd087749db647a","9854750f3880c7cee3281d8c33292ca82d0d288963f0f2771d938c06ccaffaa9","ce56b011ac4663a40f0ba606c98c08aaf7caf6a45765aa930258fe2837b12181","cc6ae9670e38244e439711b1698f0db3cff000b79bec7f47bc4aa5ab1f6177c0","00d88009fa50bfab849593291cce20f8b2f2e2cf2428d9728e06c69fced55ed5","6753933cd54e4eba497c48d63c7418a8946b4b6c44170105d489d29f1fe11494","f1289e7229ace984027f29cf8e2dd8fdd19b0c4b488da31ff411ee95305eaecc","fa2ebcdfce8bbe4245ed77b43d39e22c0c7593ca3f65be3fd0ccdf7ee02130a9","76d0133d738876f314ae792d0cf949710b66266ba0cebefbd98ce40c64a9b15b","5678196f512f8a531c7d85af8df4f40c7a5f9c27331b361bb1a1c46d317a77d8","6bab11d9561482777757f16c069ebef3f1cd6885dbef55306ffde30037a41d48","50fe8a981a7d4824f0b297f37804b65672ed4484e198e7c324260a34941ddac7","1ec4d60738a671f00089a86eeba6cb13750bce589e84fd177707718a4cc7d8f1")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("f92297c4efabba98befeb992a009462d1aba6f3c3a11210a7c054ff5377f0753","7ef2c0d2ace70fedfe5cd919ad3959c56e7e9177dcc0ee770a4af7f84da544f1","06431a5d8f6262cc3db39d911a920f793fa6c648be94daf789c11cc5514d0c3d","1c5b9409243bfb81a5924881cc05f63a301a3a7ce214830c7a83aeb2485cc5c3","cb4c7037c7620e4ce3f8f43161b0ec67018c09e71ae4cea3018104153fbed286","5815a6f7976e993fcdf9e024f4667049ec5a921b7b93c8c8c0e5d779c8b72fcc","240e7bd805bd7f2d17217dd4cebc03ac37ee60b7fb1264655cfd087749db647a","9854750f3880c7cee3281d8c33292ca82d0d288963f0f2771d938c06ccaffaa9","ce56b011ac4663a40f0ba606c98c08aaf7caf6a45765aa930258fe2837b12181","cc6ae9670e38244e439711b1698f0db3cff000b79bec7f47bc4aa5ab1f6177c0","00d88009fa50bfab849593291cce20f8b2f2e2cf2428d9728e06c69fced55ed5","6753933cd54e4eba497c48d63c7418a8946b4b6c44170105d489d29f1fe11494","f1289e7229ace984027f29cf8e2dd8fdd19b0c4b488da31ff411ee95305eaecc","fa2ebcdfce8bbe4245ed77b43d39e22c0c7593ca3f65be3fd0ccdf7ee02130a9","76d0133d738876f314ae792d0cf949710b66266ba0cebefbd98ce40c64a9b15b","5678196f512f8a531c7d85af8df4f40c7a5f9c27331b361bb1a1c46d317a77d8","6bab11d9561482777757f16c069ebef3f1cd6885dbef55306ffde30037a41d48","50fe8a981a7d4824f0b297f37804b65672ed4484e198e7c324260a34941ddac7","1ec4d60738a671f00089a86eeba6cb13750bce589e84fd177707718a4cc7d8f1")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring64 NOT NULL AND customstring64 IN ("f92297c4efabba98befeb992a009462d1aba6f3c3a11210a7c054ff5377f0753","7ef2c0d2ace70fedfe5cd919ad3959c56e7e9177dcc0ee770a4af7f84da544f1","06431a5d8f6262cc3db39d911a920f793fa6c648be94daf789c11cc5514d0c3d","1c5b9409243bfb81a5924881cc05f63a301a3a7ce214830c7a83aeb2485cc5c3","cb4c7037c7620e4ce3f8f43161b0ec67018c09e71ae4cea3018104153fbed286","5815a6f7976e993fcdf9e024f4667049ec5a921b7b93c8c8c0e5d779c8b72fcc","240e7bd805bd7f2d17217dd4cebc03ac37ee60b7fb1264655cfd087749db647a","9854750f3880c7cee3281d8c33292ca82d0d288963f0f2771d938c06ccaffaa9","ce56b011ac4663a40f0ba606c98c08aaf7caf6a45765aa930258fe2837b12181","cc6ae9670e38244e439711b1698f0db3cff000b79bec7f47bc4aa5ab1f6177c0","00d88009fa50bfab849593291cce20f8b2f2e2cf2428d9728e06c69fced55ed5","6753933cd54e4eba497c48d63c7418a8946b4b6c44170105d489d29f1fe11494","f1289e7229ace984027f29cf8e2dd8fdd19b0c4b488da31ff411ee95305eaecc","fa2ebcdfce8bbe4245ed77b43d39e22c0c7593ca3f65be3fd0ccdf7ee02130a9","76d0133d738876f314ae792d0cf949710b66266ba0cebefbd98ce40c64a9b15b","5678196f512f8a531c7d85af8df4f40c7a5f9c27331b361bb1a1c46d317a77d8","6bab11d9561482777757f16c069ebef3f1cd6885dbef55306ffde30037a41d48","50fe8a981a7d4824f0b297f37804b65672ed4484e198e7c324260a34941ddac7","1ec4d60738a671f00089a86eeba6cb13750bce589e84fd177707718a4cc7d8f1")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("f92297c4efabba98befeb992a009462d1aba6f3c3a11210a7c054ff5377f0753","7ef2c0d2ace70fedfe5cd919ad3959c56e7e9177dcc0ee770a4af7f84da544f1","06431a5d8f6262cc3db39d911a920f793fa6c648be94daf789c11cc5514d0c3d","1c5b9409243bfb81a5924881cc05f63a301a3a7ce214830c7a83aeb2485cc5c3","cb4c7037c7620e4ce3f8f43161b0ec67018c09e71ae4cea3018104153fbed286","5815a6f7976e993fcdf9e024f4667049ec5a921b7b93c8c8c0e5d779c8b72fcc","240e7bd805bd7f2d17217dd4cebc03ac37ee60b7fb1264655cfd087749db647a","9854750f3880c7cee3281d8c33292ca82d0d288963f0f2771d938c06ccaffaa9","ce56b011ac4663a40f0ba606c98c08aaf7caf6a45765aa930258fe2837b12181","cc6ae9670e38244e439711b1698f0db3cff000b79bec7f47bc4aa5ab1f6177c0","00d88009fa50bfab849593291cce20f8b2f2e2cf2428d9728e06c69fced55ed5","6753933cd54e4eba497c48d63c7418a8946b4b6c44170105d489d29f1fe11494","f1289e7229ace984027f29cf8e2dd8fdd19b0c4b488da31ff411ee95305eaecc","fa2ebcdfce8bbe4245ed77b43d39e22c0c7593ca3f65be3fd0ccdf7ee02130a9","76d0133d738876f314ae792d0cf949710b66266ba0cebefbd98ce40c64a9b15b","5678196f512f8a531c7d85af8df4f40c7a5f9c27331b361bb1a1c46d317a77d8","6bab11d9561482777757f16c069ebef3f1cd6885dbef55306ffde30037a41d48","50fe8a981a7d4824f0b297f37804b65672ed4484e198e7c324260a34941ddac7","1ec4d60738a671f00089a86eeba6cb13750bce589e84fd177707718a4cc7d8f1")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("f92297c4efabba98befeb992a009462d1aba6f3c3a11210a7c054ff5377f0753","7ef2c0d2ace70fedfe5cd919ad3959c56e7e9177dcc0ee770a4af7f84da544f1","06431a5d8f6262cc3db39d911a920f793fa6c648be94daf789c11cc5514d0c3d","1c5b9409243bfb81a5924881cc05f63a301a3a7ce214830c7a83aeb2485cc5c3","cb4c7037c7620e4ce3f8f43161b0ec67018c09e71ae4cea3018104153fbed286","5815a6f7976e993fcdf9e024f4667049ec5a921b7b93c8c8c0e5d779c8b72fcc","240e7bd805bd7f2d17217dd4cebc03ac37ee60b7fb1264655cfd087749db647a","9854750f3880c7cee3281d8c33292ca82d0d288963f0f2771d938c06ccaffaa9","ce56b011ac4663a40f0ba606c98c08aaf7caf6a45765aa930258fe2837b12181","cc6ae9670e38244e439711b1698f0db3cff000b79bec7f47bc4aa5ab1f6177c0","00d88009fa50bfab849593291cce20f8b2f2e2cf2428d9728e06c69fced55ed5","6753933cd54e4eba497c48d63c7418a8946b4b6c44170105d489d29f1fe11494","f1289e7229ace984027f29cf8e2dd8fdd19b0c4b488da31ff411ee95305eaecc","fa2ebcdfce8bbe4245ed77b43d39e22c0c7593ca3f65be3fd0ccdf7ee02130a9","76d0133d738876f314ae792d0cf949710b66266ba0cebefbd98ce40c64a9b15b","5678196f512f8a531c7d85af8df4f40c7a5f9c27331b361bb1a1c46d317a77d8","6bab11d9561482777757f16c069ebef3f1cd6885dbef55306ffde30037a41d48","50fe8a981a7d4824f0b297f37804b65672ed4484e198e7c324260a34941ddac7","1ec4d60738a671f00089a86eeba6cb13750bce589e84fd177707718a4cc7d8f1")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("f92297c4efabba98befeb992a009462d1aba6f3c3a11210a7c054ff5377f0753","7ef2c0d2ace70fedfe5cd919ad3959c56e7e9177dcc0ee770a4af7f84da544f1","06431a5d8f6262cc3db39d911a920f793fa6c648be94daf789c11cc5514d0c3d","1c5b9409243bfb81a5924881cc05f63a301a3a7ce214830c7a83aeb2485cc5c3","cb4c7037c7620e4ce3f8f43161b0ec67018c09e71ae4cea3018104153fbed286","5815a6f7976e993fcdf9e024f4667049ec5a921b7b93c8c8c0e5d779c8b72fcc","240e7bd805bd7f2d17217dd4cebc03ac37ee60b7fb1264655cfd087749db647a","9854750f3880c7cee3281d8c33292ca82d0d288963f0f2771d938c06ccaffaa9","ce56b011ac4663a40f0ba606c98c08aaf7caf6a45765aa930258fe2837b12181","cc6ae9670e38244e439711b1698f0db3cff000b79bec7f47bc4aa5ab1f6177c0","00d88009fa50bfab849593291cce20f8b2f2e2cf2428d9728e06c69fced55ed5","6753933cd54e4eba497c48d63c7418a8946b4b6c44170105d489d29f1fe11494","f1289e7229ace984027f29cf8e2dd8fdd19b0c4b488da31ff411ee95305eaecc","fa2ebcdfce8bbe4245ed77b43d39e22c0c7593ca3f65be3fd0ccdf7ee02130a9","76d0133d738876f314ae792d0cf949710b66266ba0cebefbd98ce40c64a9b15b","5678196f512f8a531c7d85af8df4f40c7a5f9c27331b361bb1a1c46d317a77d8","6bab11d9561482777757f16c069ebef3f1cd6885dbef55306ffde30037a41d48","50fe8a981a7d4824f0b297f37804b65672ed4484e198e7c324260a34941ddac7","1ec4d60738a671f00089a86eeba6cb13750bce589e84fd177707718a4cc7d8f1")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("f92297c4efabba98befeb992a009462d1aba6f3c3a11210a7c054ff5377f0753","7ef2c0d2ace70fedfe5cd919ad3959c56e7e9177dcc0ee770a4af7f84da544f1","06431a5d8f6262cc3db39d911a920f793fa6c648be94daf789c11cc5514d0c3d","1c5b9409243bfb81a5924881cc05f63a301a3a7ce214830c7a83aeb2485cc5c3","cb4c7037c7620e4ce3f8f43161b0ec67018c09e71ae4cea3018104153fbed286","5815a6f7976e993fcdf9e024f4667049ec5a921b7b93c8c8c0e5d779c8b72fcc","240e7bd805bd7f2d17217dd4cebc03ac37ee60b7fb1264655cfd087749db647a","9854750f3880c7cee3281d8c33292ca82d0d288963f0f2771d938c06ccaffaa9","ce56b011ac4663a40f0ba606c98c08aaf7caf6a45765aa930258fe2837b12181","cc6ae9670e38244e439711b1698f0db3cff000b79bec7f47bc4aa5ab1f6177c0","00d88009fa50bfab849593291cce20f8b2f2e2cf2428d9728e06c69fced55ed5","6753933cd54e4eba497c48d63c7418a8946b4b6c44170105d489d29f1fe11494","f1289e7229ace984027f29cf8e2dd8fdd19b0c4b488da31ff411ee95305eaecc","fa2ebcdfce8bbe4245ed77b43d39e22c0c7593ca3f65be3fd0ccdf7ee02130a9","76d0133d738876f314ae792d0cf949710b66266ba0cebefbd98ce40c64a9b15b","5678196f512f8a531c7d85af8df4f40c7a5f9c27331b361bb1a1c46d317a77d8","6bab11d9561482777757f16c069ebef3f1cd6885dbef55306ffde30037a41d48","50fe8a981a7d4824f0b297f37804b65672ed4484e198e7c324260a34941ddac7","1ec4d60738a671f00089a86eeba6cb13750bce589e84fd177707718a4cc7d8f1")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("f92297c4efabba98befeb992a009462d1aba6f3c3a11210a7c054ff5377f0753","7ef2c0d2ace70fedfe5cd919ad3959c56e7e9177dcc0ee770a4af7f84da544f1","06431a5d8f6262cc3db39d911a920f793fa6c648be94daf789c11cc5514d0c3d","1c5b9409243bfb81a5924881cc05f63a301a3a7ce214830c7a83aeb2485cc5c3","cb4c7037c7620e4ce3f8f43161b0ec67018c09e71ae4cea3018104153fbed286","5815a6f7976e993fcdf9e024f4667049ec5a921b7b93c8c8c0e5d779c8b72fcc","240e7bd805bd7f2d17217dd4cebc03ac37ee60b7fb1264655cfd087749db647a","9854750f3880c7cee3281d8c33292ca82d0d288963f0f2771d938c06ccaffaa9","ce56b011ac4663a40f0ba606c98c08aaf7caf6a45765aa930258fe2837b12181","cc6ae9670e38244e439711b1698f0db3cff000b79bec7f47bc4aa5ab1f6177c0","00d88009fa50bfab849593291cce20f8b2f2e2cf2428d9728e06c69fced55ed5","6753933cd54e4eba497c48d63c7418a8946b4b6c44170105d489d29f1fe11494","f1289e7229ace984027f29cf8e2dd8fdd19b0c4b488da31ff411ee95305eaecc","fa2ebcdfce8bbe4245ed77b43d39e22c0c7593ca3f65be3fd0ccdf7ee02130a9","76d0133d738876f314ae792d0cf949710b66266ba0cebefbd98ce40c64a9b15b","5678196f512f8a531c7d85af8df4f40c7a5f9c27331b361bb1a1c46d317a77d8","6bab11d9561482777757f16c069ebef3f1cd6885dbef55306ffde30037a41d48","50fe8a981a7d4824f0b297f37804b65672ed4484e198e7c324260a34941ddac7","1ec4d60738a671f00089a86eeba6cb13750bce589e84fd177707718a4cc7d8f1")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("f92297c4efabba98befeb992a009462d1aba6f3c3a11210a7c054ff5377f0753","7ef2c0d2ace70fedfe5cd919ad3959c56e7e9177dcc0ee770a4af7f84da544f1","06431a5d8f6262cc3db39d911a920f793fa6c648be94daf789c11cc5514d0c3d","1c5b9409243bfb81a5924881cc05f63a301a3a7ce214830c7a83aeb2485cc5c3","cb4c7037c7620e4ce3f8f43161b0ec67018c09e71ae4cea3018104153fbed286","5815a6f7976e993fcdf9e024f4667049ec5a921b7b93c8c8c0e5d779c8b72fcc","240e7bd805bd7f2d17217dd4cebc03ac37ee60b7fb1264655cfd087749db647a","9854750f3880c7cee3281d8c33292ca82d0d288963f0f2771d938c06ccaffaa9","ce56b011ac4663a40f0ba606c98c08aaf7caf6a45765aa930258fe2837b12181","cc6ae9670e38244e439711b1698f0db3cff000b79bec7f47bc4aa5ab1f6177c0","00d88009fa50bfab849593291cce20f8b2f2e2cf2428d9728e06c69fced55ed5","6753933cd54e4eba497c48d63c7418a8946b4b6c44170105d489d29f1fe11494","f1289e7229ace984027f29cf8e2dd8fdd19b0c4b488da31ff411ee95305eaecc","fa2ebcdfce8bbe4245ed77b43d39e22c0c7593ca3f65be3fd0ccdf7ee02130a9","76d0133d738876f314ae792d0cf949710b66266ba0cebefbd98ce40c64a9b15b","5678196f512f8a531c7d85af8df4f40c7a5f9c27331b361bb1a1c46d317a77d8","6bab11d9561482777757f16c069ebef3f1cd6885dbef55306ffde30037a41d48","50fe8a981a7d4824f0b297f37804b65672ed4484e198e7c324260a34941ddac7","1ec4d60738a671f00089a86eeba6cb13750bce589e84fd177707718a4cc7d8f1")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("f92297c4efabba98befeb992a009462d1aba6f3c3a11210a7c054ff5377f0753","7ef2c0d2ace70fedfe5cd919ad3959c56e7e9177dcc0ee770a4af7f84da544f1","06431a5d8f6262cc3db39d911a920f793fa6c648be94daf789c11cc5514d0c3d","1c5b9409243bfb81a5924881cc05f63a301a3a7ce214830c7a83aeb2485cc5c3","cb4c7037c7620e4ce3f8f43161b0ec67018c09e71ae4cea3018104153fbed286","5815a6f7976e993fcdf9e024f4667049ec5a921b7b93c8c8c0e5d779c8b72fcc","240e7bd805bd7f2d17217dd4cebc03ac37ee60b7fb1264655cfd087749db647a","9854750f3880c7cee3281d8c33292ca82d0d288963f0f2771d938c06ccaffaa9","ce56b011ac4663a40f0ba606c98c08aaf7caf6a45765aa930258fe2837b12181","cc6ae9670e38244e439711b1698f0db3cff000b79bec7f47bc4aa5ab1f6177c0","00d88009fa50bfab849593291cce20f8b2f2e2cf2428d9728e06c69fced55ed5","6753933cd54e4eba497c48d63c7418a8946b4b6c44170105d489d29f1fe11494","f1289e7229ace984027f29cf8e2dd8fdd19b0c4b488da31ff411ee95305eaecc","fa2ebcdfce8bbe4245ed77b43d39e22c0c7593ca3f65be3fd0ccdf7ee02130a9","76d0133d738876f314ae792d0cf949710b66266ba0cebefbd98ce40c64a9b15b","5678196f512f8a531c7d85af8df4f40c7a5f9c27331b361bb1a1c46d317a77d8","6bab11d9561482777757f16c069ebef3f1cd6885dbef55306ffde30037a41d48","50fe8a981a7d4824f0b297f37804b65672ed4484e198e7c324260a34941ddac7","1ec4d60738a671f00089a86eeba6cb13750bce589e84fd177707718a4cc7d8f1")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("f92297c4efabba98befeb992a009462d1aba6f3c3a11210a7c054ff5377f0753","7ef2c0d2ace70fedfe5cd919ad3959c56e7e9177dcc0ee770a4af7f84da544f1","06431a5d8f6262cc3db39d911a920f793fa6c648be94daf789c11cc5514d0c3d","1c5b9409243bfb81a5924881cc05f63a301a3a7ce214830c7a83aeb2485cc5c3","cb4c7037c7620e4ce3f8f43161b0ec67018c09e71ae4cea3018104153fbed286","5815a6f7976e993fcdf9e024f4667049ec5a921b7b93c8c8c0e5d779c8b72fcc","240e7bd805bd7f2d17217dd4cebc03ac37ee60b7fb1264655cfd087749db647a","9854750f3880c7cee3281d8c33292ca82d0d288963f0f2771d938c06ccaffaa9","ce56b011ac4663a40f0ba606c98c08aaf7caf6a45765aa930258fe2837b12181","cc6ae9670e38244e439711b1698f0db3cff000b79bec7f47bc4aa5ab1f6177c0","00d88009fa50bfab849593291cce20f8b2f2e2cf2428d9728e06c69fced55ed5","6753933cd54e4eba497c48d63c7418a8946b4b6c44170105d489d29f1fe11494","f1289e7229ace984027f29cf8e2dd8fdd19b0c4b488da31ff411ee95305eaecc","fa2ebcdfce8bbe4245ed77b43d39e22c0c7593ca3f65be3fd0ccdf7ee02130a9","76d0133d738876f314ae792d0cf949710b66266ba0cebefbd98ce40c64a9b15b","5678196f512f8a531c7d85af8df4f40c7a5f9c27331b361bb1a1c46d317a77d8","6bab11d9561482777757f16c069ebef3f1cd6885dbef55306ffde30037a41d48","50fe8a981a7d4824f0b297f37804b65672ed4484e198e7c324260a34941ddac7","1ec4d60738a671f00089a86eeba6cb13750bce589e84fd177707718a4cc7d8f1")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("f92297c4efabba98befeb992a009462d1aba6f3c3a11210a7c054ff5377f0753","7ef2c0d2ace70fedfe5cd919ad3959c56e7e9177dcc0ee770a4af7f84da544f1","06431a5d8f6262cc3db39d911a920f793fa6c648be94daf789c11cc5514d0c3d","1c5b9409243bfb81a5924881cc05f63a301a3a7ce214830c7a83aeb2485cc5c3","cb4c7037c7620e4ce3f8f43161b0ec67018c09e71ae4cea3018104153fbed286","5815a6f7976e993fcdf9e024f4667049ec5a921b7b93c8c8c0e5d779c8b72fcc","240e7bd805bd7f2d17217dd4cebc03ac37ee60b7fb1264655cfd087749db647a","9854750f3880c7cee3281d8c33292ca82d0d288963f0f2771d938c06ccaffaa9","ce56b011ac4663a40f0ba606c98c08aaf7caf6a45765aa930258fe2837b12181","cc6ae9670e38244e439711b1698f0db3cff000b79bec7f47bc4aa5ab1f6177c0","00d88009fa50bfab849593291cce20f8b2f2e2cf2428d9728e06c69fced55ed5","6753933cd54e4eba497c48d63c7418a8946b4b6c44170105d489d29f1fe11494","f1289e7229ace984027f29cf8e2dd8fdd19b0c4b488da31ff411ee95305eaecc","fa2ebcdfce8bbe4245ed77b43d39e22c0c7593ca3f65be3fd0ccdf7ee02130a9","76d0133d738876f314ae792d0cf949710b66266ba0cebefbd98ce40c64a9b15b","5678196f512f8a531c7d85af8df4f40c7a5f9c27331b361bb1a1c46d317a77d8","6bab11d9561482777757f16c069ebef3f1cd6885dbef55306ffde30037a41d48","50fe8a981a7d4824f0b297f37804b65672ed4484e198e7c324260a34941ddac7","1ec4d60738a671f00089a86eeba6cb13750bce589e84fd177707718a4cc7d8f1")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("f92297c4efabba98befeb992a009462d1aba6f3c3a11210a7c054ff5377f0753","7ef2c0d2ace70fedfe5cd919ad3959c56e7e9177dcc0ee770a4af7f84da544f1","06431a5d8f6262cc3db39d911a920f793fa6c648be94daf789c11cc5514d0c3d","1c5b9409243bfb81a5924881cc05f63a301a3a7ce214830c7a83aeb2485cc5c3","cb4c7037c7620e4ce3f8f43161b0ec67018c09e71ae4cea3018104153fbed286","5815a6f7976e993fcdf9e024f4667049ec5a921b7b93c8c8c0e5d779c8b72fcc","240e7bd805bd7f2d17217dd4cebc03ac37ee60b7fb1264655cfd087749db647a","9854750f3880c7cee3281d8c33292ca82d0d288963f0f2771d938c06ccaffaa9","ce56b011ac4663a40f0ba606c98c08aaf7caf6a45765aa930258fe2837b12181","cc6ae9670e38244e439711b1698f0db3cff000b79bec7f47bc4aa5ab1f6177c0","00d88009fa50bfab849593291cce20f8b2f2e2cf2428d9728e06c69fced55ed5","6753933cd54e4eba497c48d63c7418a8946b4b6c44170105d489d29f1fe11494","f1289e7229ace984027f29cf8e2dd8fdd19b0c4b488da31ff411ee95305eaecc","fa2ebcdfce8bbe4245ed77b43d39e22c0c7593ca3f65be3fd0ccdf7ee02130a9","76d0133d738876f314ae792d0cf949710b66266ba0cebefbd98ce40c64a9b15b","5678196f512f8a531c7d85af8df4f40c7a5f9c27331b361bb1a1c46d317a77d8","6bab11d9561482777757f16c069ebef3f1cd6885dbef55306ffde30037a41d48","50fe8a981a7d4824f0b297f37804b65672ed4484e198e7c324260a34941ddac7","1ec4d60738a671f00089a86eeba6cb13750bce589e84fd177707718a4cc7d8f1")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("f92297c4efabba98befeb992a009462d1aba6f3c3a11210a7c054ff5377f0753","7ef2c0d2ace70fedfe5cd919ad3959c56e7e9177dcc0ee770a4af7f84da544f1","06431a5d8f6262cc3db39d911a920f793fa6c648be94daf789c11cc5514d0c3d","1c5b9409243bfb81a5924881cc05f63a301a3a7ce214830c7a83aeb2485cc5c3","cb4c7037c7620e4ce3f8f43161b0ec67018c09e71ae4cea3018104153fbed286","5815a6f7976e993fcdf9e024f4667049ec5a921b7b93c8c8c0e5d779c8b72fcc","240e7bd805bd7f2d17217dd4cebc03ac37ee60b7fb1264655cfd087749db647a","9854750f3880c7cee3281d8c33292ca82d0d288963f0f2771d938c06ccaffaa9","ce56b011ac4663a40f0ba606c98c08aaf7caf6a45765aa930258fe2837b12181","cc6ae9670e38244e439711b1698f0db3cff000b79bec7f47bc4aa5ab1f6177c0","00d88009fa50bfab849593291cce20f8b2f2e2cf2428d9728e06c69fced55ed5","6753933cd54e4eba497c48d63c7418a8946b4b6c44170105d489d29f1fe11494","f1289e7229ace984027f29cf8e2dd8fdd19b0c4b488da31ff411ee95305eaecc","fa2ebcdfce8bbe4245ed77b43d39e22c0c7593ca3f65be3fd0ccdf7ee02130a9","76d0133d738876f314ae792d0cf949710b66266ba0cebefbd98ce40c64a9b15b","5678196f512f8a531c7d85af8df4f40c7a5f9c27331b361bb1a1c46d317a77d8","6bab11d9561482777757f16c069ebef3f1cd6885dbef55306ffde30037a41d48","50fe8a981a7d4824f0b297f37804b65672ed4484e198e7c324260a34941ddac7","1ec4d60738a671f00089a86eeba6cb13750bce589e84fd177707718a4cc7d8f1")
index=activity AND rg_functionality="Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("f92297c4efabba98befeb992a009462d1aba6f3c3a11210a7c054ff5377f0753","7ef2c0d2ace70fedfe5cd919ad3959c56e7e9177dcc0ee770a4af7f84da544f1","06431a5d8f6262cc3db39d911a920f793fa6c648be94daf789c11cc5514d0c3d","1c5b9409243bfb81a5924881cc05f63a301a3a7ce214830c7a83aeb2485cc5c3","cb4c7037c7620e4ce3f8f43161b0ec67018c09e71ae4cea3018104153fbed286","5815a6f7976e993fcdf9e024f4667049ec5a921b7b93c8c8c0e5d779c8b72fcc","240e7bd805bd7f2d17217dd4cebc03ac37ee60b7fb1264655cfd087749db647a","9854750f3880c7cee3281d8c33292ca82d0d288963f0f2771d938c06ccaffaa9","ce56b011ac4663a40f0ba606c98c08aaf7caf6a45765aa930258fe2837b12181","cc6ae9670e38244e439711b1698f0db3cff000b79bec7f47bc4aa5ab1f6177c0","00d88009fa50bfab849593291cce20f8b2f2e2cf2428d9728e06c69fced55ed5","6753933cd54e4eba497c48d63c7418a8946b4b6c44170105d489d29f1fe11494","f1289e7229ace984027f29cf8e2dd8fdd19b0c4b488da31ff411ee95305eaecc","fa2ebcdfce8bbe4245ed77b43d39e22c0c7593ca3f65be3fd0ccdf7ee02130a9","76d0133d738876f314ae792d0cf949710b66266ba0cebefbd98ce40c64a9b15b","5678196f512f8a531c7d85af8df4f40c7a5f9c27331b361bb1a1c46d317a77d8","6bab11d9561482777757f16c069ebef3f1cd6885dbef55306ffde30037a41d48","50fe8a981a7d4824f0b297f37804b65672ed4484e198e7c324260a34941ddac7","1ec4d60738a671f00089a86eeba6cb13750bce589e84fd177707718a4cc7d8f1")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("f92297c4efabba98befeb992a009462d1aba6f3c3a11210a7c054ff5377f0753","7ef2c0d2ace70fedfe5cd919ad3959c56e7e9177dcc0ee770a4af7f84da544f1","06431a5d8f6262cc3db39d911a920f793fa6c648be94daf789c11cc5514d0c3d","1c5b9409243bfb81a5924881cc05f63a301a3a7ce214830c7a83aeb2485cc5c3","cb4c7037c7620e4ce3f8f43161b0ec67018c09e71ae4cea3018104153fbed286","5815a6f7976e993fcdf9e024f4667049ec5a921b7b93c8c8c0e5d779c8b72fcc","240e7bd805bd7f2d17217dd4cebc03ac37ee60b7fb1264655cfd087749db647a","9854750f3880c7cee3281d8c33292ca82d0d288963f0f2771d938c06ccaffaa9","ce56b011ac4663a40f0ba606c98c08aaf7caf6a45765aa930258fe2837b12181","cc6ae9670e38244e439711b1698f0db3cff000b79bec7f47bc4aa5ab1f6177c0","00d88009fa50bfab849593291cce20f8b2f2e2cf2428d9728e06c69fced55ed5","6753933cd54e4eba497c48d63c7418a8946b4b6c44170105d489d29f1fe11494","f1289e7229ace984027f29cf8e2dd8fdd19b0c4b488da31ff411ee95305eaecc","fa2ebcdfce8bbe4245ed77b43d39e22c0c7593ca3f65be3fd0ccdf7ee02130a9","76d0133d738876f314ae792d0cf949710b66266ba0cebefbd98ce40c64a9b15b","5678196f512f8a531c7d85af8df4f40c7a5f9c27331b361bb1a1c46d317a77d8","6bab11d9561482777757f16c069ebef3f1cd6885dbef55306ffde30037a41d48","50fe8a981a7d4824f0b297f37804b65672ed4484e198e7c324260a34941ddac7","1ec4d60738a671f00089a86eeba6cb13750bce589e84fd177707718a4cc7d8f1")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("f92297c4efabba98befeb992a009462d1aba6f3c3a11210a7c054ff5377f0753","7ef2c0d2ace70fedfe5cd919ad3959c56e7e9177dcc0ee770a4af7f84da544f1","06431a5d8f6262cc3db39d911a920f793fa6c648be94daf789c11cc5514d0c3d","1c5b9409243bfb81a5924881cc05f63a301a3a7ce214830c7a83aeb2485cc5c3","cb4c7037c7620e4ce3f8f43161b0ec67018c09e71ae4cea3018104153fbed286","5815a6f7976e993fcdf9e024f4667049ec5a921b7b93c8c8c0e5d779c8b72fcc","240e7bd805bd7f2d17217dd4cebc03ac37ee60b7fb1264655cfd087749db647a","9854750f3880c7cee3281d8c33292ca82d0d288963f0f2771d938c06ccaffaa9","ce56b011ac4663a40f0ba606c98c08aaf7caf6a45765aa930258fe2837b12181","cc6ae9670e38244e439711b1698f0db3cff000b79bec7f47bc4aa5ab1f6177c0","00d88009fa50bfab849593291cce20f8b2f2e2cf2428d9728e06c69fced55ed5","6753933cd54e4eba497c48d63c7418a8946b4b6c44170105d489d29f1fe11494","f1289e7229ace984027f29cf8e2dd8fdd19b0c4b488da31ff411ee95305eaecc","fa2ebcdfce8bbe4245ed77b43d39e22c0c7593ca3f65be3fd0ccdf7ee02130a9","76d0133d738876f314ae792d0cf949710b66266ba0cebefbd98ce40c64a9b15b","5678196f512f8a531c7d85af8df4f40c7a5f9c27331b361bb1a1c46d317a77d8","6bab11d9561482777757f16c069ebef3f1cd6885dbef55306ffde30037a41d48","50fe8a981a7d4824f0b297f37804b65672ed4484e198e7c324260a34941ddac7","1ec4d60738a671f00089a86eeba6cb13750bce589e84fd177707718a4cc7d8f1")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("f92297c4efabba98befeb992a009462d1aba6f3c3a11210a7c054ff5377f0753","7ef2c0d2ace70fedfe5cd919ad3959c56e7e9177dcc0ee770a4af7f84da544f1","06431a5d8f6262cc3db39d911a920f793fa6c648be94daf789c11cc5514d0c3d","1c5b9409243bfb81a5924881cc05f63a301a3a7ce214830c7a83aeb2485cc5c3","cb4c7037c7620e4ce3f8f43161b0ec67018c09e71ae4cea3018104153fbed286","5815a6f7976e993fcdf9e024f4667049ec5a921b7b93c8c8c0e5d779c8b72fcc","240e7bd805bd7f2d17217dd4cebc03ac37ee60b7fb1264655cfd087749db647a","9854750f3880c7cee3281d8c33292ca82d0d288963f0f2771d938c06ccaffaa9","ce56b011ac4663a40f0ba606c98c08aaf7caf6a45765aa930258fe2837b12181","cc6ae9670e38244e439711b1698f0db3cff000b79bec7f47bc4aa5ab1f6177c0","00d88009fa50bfab849593291cce20f8b2f2e2cf2428d9728e06c69fced55ed5","6753933cd54e4eba497c48d63c7418a8946b4b6c44170105d489d29f1fe11494","f1289e7229ace984027f29cf8e2dd8fdd19b0c4b488da31ff411ee95305eaecc","fa2ebcdfce8bbe4245ed77b43d39e22c0c7593ca3f65be3fd0ccdf7ee02130a9","76d0133d738876f314ae792d0cf949710b66266ba0cebefbd98ce40c64a9b15b","5678196f512f8a531c7d85af8df4f40c7a5f9c27331b361bb1a1c46d317a77d8","6bab11d9561482777757f16c069ebef3f1cd6885dbef55306ffde30037a41d48","50fe8a981a7d4824f0b297f37804b65672ed4484e198e7c324260a34941ddac7","1ec4d60738a671f00089a86eeba6cb13750bce589e84fd177707718a4cc7d8f1")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("f92297c4efabba98befeb992a009462d1aba6f3c3a11210a7c054ff5377f0753","7ef2c0d2ace70fedfe5cd919ad3959c56e7e9177dcc0ee770a4af7f84da544f1","06431a5d8f6262cc3db39d911a920f793fa6c648be94daf789c11cc5514d0c3d","1c5b9409243bfb81a5924881cc05f63a301a3a7ce214830c7a83aeb2485cc5c3","cb4c7037c7620e4ce3f8f43161b0ec67018c09e71ae4cea3018104153fbed286","5815a6f7976e993fcdf9e024f4667049ec5a921b7b93c8c8c0e5d779c8b72fcc","240e7bd805bd7f2d17217dd4cebc03ac37ee60b7fb1264655cfd087749db647a","9854750f3880c7cee3281d8c33292ca82d0d288963f0f2771d938c06ccaffaa9","ce56b011ac4663a40f0ba606c98c08aaf7caf6a45765aa930258fe2837b12181","cc6ae9670e38244e439711b1698f0db3cff000b79bec7f47bc4aa5ab1f6177c0","00d88009fa50bfab849593291cce20f8b2f2e2cf2428d9728e06c69fced55ed5","6753933cd54e4eba497c48d63c7418a8946b4b6c44170105d489d29f1fe11494","f1289e7229ace984027f29cf8e2dd8fdd19b0c4b488da31ff411ee95305eaecc","fa2ebcdfce8bbe4245ed77b43d39e22c0c7593ca3f65be3fd0ccdf7ee02130a9","76d0133d738876f314ae792d0cf949710b66266ba0cebefbd98ce40c64a9b15b","5678196f512f8a531c7d85af8df4f40c7a5f9c27331b361bb1a1c46d317a77d8","6bab11d9561482777757f16c069ebef3f1cd6885dbef55306ffde30037a41d48","50fe8a981a7d4824f0b297f37804b65672ed4484e198e7c324260a34941ddac7","1ec4d60738a671f00089a86eeba6cb13750bce589e84fd177707718a4cc7d8f1")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("f92297c4efabba98befeb992a009462d1aba6f3c3a11210a7c054ff5377f0753","7ef2c0d2ace70fedfe5cd919ad3959c56e7e9177dcc0ee770a4af7f84da544f1","06431a5d8f6262cc3db39d911a920f793fa6c648be94daf789c11cc5514d0c3d","1c5b9409243bfb81a5924881cc05f63a301a3a7ce214830c7a83aeb2485cc5c3","cb4c7037c7620e4ce3f8f43161b0ec67018c09e71ae4cea3018104153fbed286","5815a6f7976e993fcdf9e024f4667049ec5a921b7b93c8c8c0e5d779c8b72fcc","240e7bd805bd7f2d17217dd4cebc03ac37ee60b7fb1264655cfd087749db647a","9854750f3880c7cee3281d8c33292ca82d0d288963f0f2771d938c06ccaffaa9","ce56b011ac4663a40f0ba606c98c08aaf7caf6a45765aa930258fe2837b12181","cc6ae9670e38244e439711b1698f0db3cff000b79bec7f47bc4aa5ab1f6177c0","00d88009fa50bfab849593291cce20f8b2f2e2cf2428d9728e06c69fced55ed5","6753933cd54e4eba497c48d63c7418a8946b4b6c44170105d489d29f1fe11494","f1289e7229ace984027f29cf8e2dd8fdd19b0c4b488da31ff411ee95305eaecc","fa2ebcdfce8bbe4245ed77b43d39e22c0c7593ca3f65be3fd0ccdf7ee02130a9","76d0133d738876f314ae792d0cf949710b66266ba0cebefbd98ce40c64a9b15b","5678196f512f8a531c7d85af8df4f40c7a5f9c27331b361bb1a1c46d317a77d8","6bab11d9561482777757f16c069ebef3f1cd6885dbef55306ffde30037a41d48","50fe8a981a7d4824f0b297f37804b65672ed4484e198e7c324260a34941ddac7","1ec4d60738a671f00089a86eeba6cb13750bce589e84fd177707718a4cc7d8f1")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("f92297c4efabba98befeb992a009462d1aba6f3c3a11210a7c054ff5377f0753","7ef2c0d2ace70fedfe5cd919ad3959c56e7e9177dcc0ee770a4af7f84da544f1","06431a5d8f6262cc3db39d911a920f793fa6c648be94daf789c11cc5514d0c3d","1c5b9409243bfb81a5924881cc05f63a301a3a7ce214830c7a83aeb2485cc5c3","cb4c7037c7620e4ce3f8f43161b0ec67018c09e71ae4cea3018104153fbed286","5815a6f7976e993fcdf9e024f4667049ec5a921b7b93c8c8c0e5d779c8b72fcc","240e7bd805bd7f2d17217dd4cebc03ac37ee60b7fb1264655cfd087749db647a","9854750f3880c7cee3281d8c33292ca82d0d288963f0f2771d938c06ccaffaa9","ce56b011ac4663a40f0ba606c98c08aaf7caf6a45765aa930258fe2837b12181","cc6ae9670e38244e439711b1698f0db3cff000b79bec7f47bc4aa5ab1f6177c0","00d88009fa50bfab849593291cce20f8b2f2e2cf2428d9728e06c69fced55ed5","6753933cd54e4eba497c48d63c7418a8946b4b6c44170105d489d29f1fe11494","f1289e7229ace984027f29cf8e2dd8fdd19b0c4b488da31ff411ee95305eaecc","fa2ebcdfce8bbe4245ed77b43d39e22c0c7593ca3f65be3fd0ccdf7ee02130a9","76d0133d738876f314ae792d0cf949710b66266ba0cebefbd98ce40c64a9b15b","5678196f512f8a531c7d85af8df4f40c7a5f9c27331b361bb1a1c46d317a77d8","6bab11d9561482777757f16c069ebef3f1cd6885dbef55306ffde30037a41d48","50fe8a981a7d4824f0b297f37804b65672ed4484e198e7c324260a34941ddac7","1ec4d60738a671f00089a86eeba6cb13750bce589e84fd177707718a4cc7d8f1")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("f92297c4efabba98befeb992a009462d1aba6f3c3a11210a7c054ff5377f0753","7ef2c0d2ace70fedfe5cd919ad3959c56e7e9177dcc0ee770a4af7f84da544f1","06431a5d8f6262cc3db39d911a920f793fa6c648be94daf789c11cc5514d0c3d","1c5b9409243bfb81a5924881cc05f63a301a3a7ce214830c7a83aeb2485cc5c3","cb4c7037c7620e4ce3f8f43161b0ec67018c09e71ae4cea3018104153fbed286","5815a6f7976e993fcdf9e024f4667049ec5a921b7b93c8c8c0e5d779c8b72fcc","240e7bd805bd7f2d17217dd4cebc03ac37ee60b7fb1264655cfd087749db647a","9854750f3880c7cee3281d8c33292ca82d0d288963f0f2771d938c06ccaffaa9","ce56b011ac4663a40f0ba606c98c08aaf7caf6a45765aa930258fe2837b12181","cc6ae9670e38244e439711b1698f0db3cff000b79bec7f47bc4aa5ab1f6177c0","00d88009fa50bfab849593291cce20f8b2f2e2cf2428d9728e06c69fced55ed5","6753933cd54e4eba497c48d63c7418a8946b4b6c44170105d489d29f1fe11494","f1289e7229ace984027f29cf8e2dd8fdd19b0c4b488da31ff411ee95305eaecc","fa2ebcdfce8bbe4245ed77b43d39e22c0c7593ca3f65be3fd0ccdf7ee02130a9","76d0133d738876f314ae792d0cf949710b66266ba0cebefbd98ce40c64a9b15b","5678196f512f8a531c7d85af8df4f40c7a5f9c27331b361bb1a1c46d317a77d8","6bab11d9561482777757f16c069ebef3f1cd6885dbef55306ffde30037a41d48","50fe8a981a7d4824f0b297f37804b65672ed4484e198e7c324260a34941ddac7","1ec4d60738a671f00089a86eeba6cb13750bce589e84fd177707718a4cc7d8f1")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring64 NOT NULL AND customstring64 IN ("f92297c4efabba98befeb992a009462d1aba6f3c3a11210a7c054ff5377f0753","7ef2c0d2ace70fedfe5cd919ad3959c56e7e9177dcc0ee770a4af7f84da544f1","06431a5d8f6262cc3db39d911a920f793fa6c648be94daf789c11cc5514d0c3d","1c5b9409243bfb81a5924881cc05f63a301a3a7ce214830c7a83aeb2485cc5c3","cb4c7037c7620e4ce3f8f43161b0ec67018c09e71ae4cea3018104153fbed286","5815a6f7976e993fcdf9e024f4667049ec5a921b7b93c8c8c0e5d779c8b72fcc","240e7bd805bd7f2d17217dd4cebc03ac37ee60b7fb1264655cfd087749db647a","9854750f3880c7cee3281d8c33292ca82d0d288963f0f2771d938c06ccaffaa9","ce56b011ac4663a40f0ba606c98c08aaf7caf6a45765aa930258fe2837b12181","cc6ae9670e38244e439711b1698f0db3cff000b79bec7f47bc4aa5ab1f6177c0","00d88009fa50bfab849593291cce20f8b2f2e2cf2428d9728e06c69fced55ed5","6753933cd54e4eba497c48d63c7418a8946b4b6c44170105d489d29f1fe11494","f1289e7229ace984027f29cf8e2dd8fdd19b0c4b488da31ff411ee95305eaecc","fa2ebcdfce8bbe4245ed77b43d39e22c0c7593ca3f65be3fd0ccdf7ee02130a9","76d0133d738876f314ae792d0cf949710b66266ba0cebefbd98ce40c64a9b15b","5678196f512f8a531c7d85af8df4f40c7a5f9c27331b361bb1a1c46d317a77d8","6bab11d9561482777757f16c069ebef3f1cd6885dbef55306ffde30037a41d48","50fe8a981a7d4824f0b297f37804b65672ed4484e198e7c324260a34941ddac7","1ec4d60738a671f00089a86eeba6cb13750bce589e84fd177707718a4cc7d8f1")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("f92297c4efabba98befeb992a009462d1aba6f3c3a11210a7c054ff5377f0753","7ef2c0d2ace70fedfe5cd919ad3959c56e7e9177dcc0ee770a4af7f84da544f1","06431a5d8f6262cc3db39d911a920f793fa6c648be94daf789c11cc5514d0c3d","1c5b9409243bfb81a5924881cc05f63a301a3a7ce214830c7a83aeb2485cc5c3","cb4c7037c7620e4ce3f8f43161b0ec67018c09e71ae4cea3018104153fbed286","5815a6f7976e993fcdf9e024f4667049ec5a921b7b93c8c8c0e5d779c8b72fcc","240e7bd805bd7f2d17217dd4cebc03ac37ee60b7fb1264655cfd087749db647a","9854750f3880c7cee3281d8c33292ca82d0d288963f0f2771d938c06ccaffaa9","ce56b011ac4663a40f0ba606c98c08aaf7caf6a45765aa930258fe2837b12181","cc6ae9670e38244e439711b1698f0db3cff000b79bec7f47bc4aa5ab1f6177c0","00d88009fa50bfab849593291cce20f8b2f2e2cf2428d9728e06c69fced55ed5","6753933cd54e4eba497c48d63c7418a8946b4b6c44170105d489d29f1fe11494","f1289e7229ace984027f29cf8e2dd8fdd19b0c4b488da31ff411ee95305eaecc","fa2ebcdfce8bbe4245ed77b43d39e22c0c7593ca3f65be3fd0ccdf7ee02130a9","76d0133d738876f314ae792d0cf949710b66266ba0cebefbd98ce40c64a9b15b","5678196f512f8a531c7d85af8df4f40c7a5f9c27331b361bb1a1c46d317a77d8","6bab11d9561482777757f16c069ebef3f1cd6885dbef55306ffde30037a41d48","50fe8a981a7d4824f0b297f37804b65672ed4484e198e7c324260a34941ddac7","1ec4d60738a671f00089a86eeba6cb13750bce589e84fd177707718a4cc7d8f1")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("f92297c4efabba98befeb992a009462d1aba6f3c3a11210a7c054ff5377f0753","7ef2c0d2ace70fedfe5cd919ad3959c56e7e9177dcc0ee770a4af7f84da544f1","06431a5d8f6262cc3db39d911a920f793fa6c648be94daf789c11cc5514d0c3d","1c5b9409243bfb81a5924881cc05f63a301a3a7ce214830c7a83aeb2485cc5c3","cb4c7037c7620e4ce3f8f43161b0ec67018c09e71ae4cea3018104153fbed286","5815a6f7976e993fcdf9e024f4667049ec5a921b7b93c8c8c0e5d779c8b72fcc","240e7bd805bd7f2d17217dd4cebc03ac37ee60b7fb1264655cfd087749db647a","9854750f3880c7cee3281d8c33292ca82d0d288963f0f2771d938c06ccaffaa9","ce56b011ac4663a40f0ba606c98c08aaf7caf6a45765aa930258fe2837b12181","cc6ae9670e38244e439711b1698f0db3cff000b79bec7f47bc4aa5ab1f6177c0","00d88009fa50bfab849593291cce20f8b2f2e2cf2428d9728e06c69fced55ed5","6753933cd54e4eba497c48d63c7418a8946b4b6c44170105d489d29f1fe11494","f1289e7229ace984027f29cf8e2dd8fdd19b0c4b488da31ff411ee95305eaecc","fa2ebcdfce8bbe4245ed77b43d39e22c0c7593ca3f65be3fd0ccdf7ee02130a9","76d0133d738876f314ae792d0cf949710b66266ba0cebefbd98ce40c64a9b15b","5678196f512f8a531c7d85af8df4f40c7a5f9c27331b361bb1a1c46d317a77d8","6bab11d9561482777757f16c069ebef3f1cd6885dbef55306ffde30037a41d48","50fe8a981a7d4824f0b297f37804b65672ed4484e198e7c324260a34941ddac7","1ec4d60738a671f00089a86eeba6cb13750bce589e84fd177707718a4cc7d8f1")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("f92297c4efabba98befeb992a009462d1aba6f3c3a11210a7c054ff5377f0753","7ef2c0d2ace70fedfe5cd919ad3959c56e7e9177dcc0ee770a4af7f84da544f1","06431a5d8f6262cc3db39d911a920f793fa6c648be94daf789c11cc5514d0c3d","1c5b9409243bfb81a5924881cc05f63a301a3a7ce214830c7a83aeb2485cc5c3","cb4c7037c7620e4ce3f8f43161b0ec67018c09e71ae4cea3018104153fbed286","5815a6f7976e993fcdf9e024f4667049ec5a921b7b93c8c8c0e5d779c8b72fcc","240e7bd805bd7f2d17217dd4cebc03ac37ee60b7fb1264655cfd087749db647a","9854750f3880c7cee3281d8c33292ca82d0d288963f0f2771d938c06ccaffaa9","ce56b011ac4663a40f0ba606c98c08aaf7caf6a45765aa930258fe2837b12181","cc6ae9670e38244e439711b1698f0db3cff000b79bec7f47bc4aa5ab1f6177c0","00d88009fa50bfab849593291cce20f8b2f2e2cf2428d9728e06c69fced55ed5","6753933cd54e4eba497c48d63c7418a8946b4b6c44170105d489d29f1fe11494","f1289e7229ace984027f29cf8e2dd8fdd19b0c4b488da31ff411ee95305eaecc","fa2ebcdfce8bbe4245ed77b43d39e22c0c7593ca3f65be3fd0ccdf7ee02130a9","76d0133d738876f314ae792d0cf949710b66266ba0cebefbd98ce40c64a9b15b","5678196f512f8a531c7d85af8df4f40c7a5f9c27331b361bb1a1c46d317a77d8","6bab11d9561482777757f16c069ebef3f1cd6885dbef55306ffde30037a41d48","50fe8a981a7d4824f0b297f37804b65672ed4484e198e7c324260a34941ddac7","1ec4d60738a671f00089a86eeba6cb13750bce589e84fd177707718a4cc7d8f1")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring64 NOT NULL AND customstring64 IN ("f92297c4efabba98befeb992a009462d1aba6f3c3a11210a7c054ff5377f0753","7ef2c0d2ace70fedfe5cd919ad3959c56e7e9177dcc0ee770a4af7f84da544f1","06431a5d8f6262cc3db39d911a920f793fa6c648be94daf789c11cc5514d0c3d","1c5b9409243bfb81a5924881cc05f63a301a3a7ce214830c7a83aeb2485cc5c3","cb4c7037c7620e4ce3f8f43161b0ec67018c09e71ae4cea3018104153fbed286","5815a6f7976e993fcdf9e024f4667049ec5a921b7b93c8c8c0e5d779c8b72fcc","240e7bd805bd7f2d17217dd4cebc03ac37ee60b7fb1264655cfd087749db647a","9854750f3880c7cee3281d8c33292ca82d0d288963f0f2771d938c06ccaffaa9","ce56b011ac4663a40f0ba606c98c08aaf7caf6a45765aa930258fe2837b12181","cc6ae9670e38244e439711b1698f0db3cff000b79bec7f47bc4aa5ab1f6177c0","00d88009fa50bfab849593291cce20f8b2f2e2cf2428d9728e06c69fced55ed5","6753933cd54e4eba497c48d63c7418a8946b4b6c44170105d489d29f1fe11494","f1289e7229ace984027f29cf8e2dd8fdd19b0c4b488da31ff411ee95305eaecc","fa2ebcdfce8bbe4245ed77b43d39e22c0c7593ca3f65be3fd0ccdf7ee02130a9","76d0133d738876f314ae792d0cf949710b66266ba0cebefbd98ce40c64a9b15b","5678196f512f8a531c7d85af8df4f40c7a5f9c27331b361bb1a1c46d317a77d8","6bab11d9561482777757f16c069ebef3f1cd6885dbef55306ffde30037a41d48","50fe8a981a7d4824f0b297f37804b65672ed4484e198e7c324260a34941ddac7","1ec4d60738a671f00089a86eeba6cb13750bce589e84fd177707718a4cc7d8f1")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("f92297c4efabba98befeb992a009462d1aba6f3c3a11210a7c054ff5377f0753","7ef2c0d2ace70fedfe5cd919ad3959c56e7e9177dcc0ee770a4af7f84da544f1","06431a5d8f6262cc3db39d911a920f793fa6c648be94daf789c11cc5514d0c3d","1c5b9409243bfb81a5924881cc05f63a301a3a7ce214830c7a83aeb2485cc5c3","cb4c7037c7620e4ce3f8f43161b0ec67018c09e71ae4cea3018104153fbed286","5815a6f7976e993fcdf9e024f4667049ec5a921b7b93c8c8c0e5d779c8b72fcc","240e7bd805bd7f2d17217dd4cebc03ac37ee60b7fb1264655cfd087749db647a","9854750f3880c7cee3281d8c33292ca82d0d288963f0f2771d938c06ccaffaa9","ce56b011ac4663a40f0ba606c98c08aaf7caf6a45765aa930258fe2837b12181","cc6ae9670e38244e439711b1698f0db3cff000b79bec7f47bc4aa5ab1f6177c0","00d88009fa50bfab849593291cce20f8b2f2e2cf2428d9728e06c69fced55ed5","6753933cd54e4eba497c48d63c7418a8946b4b6c44170105d489d29f1fe11494","f1289e7229ace984027f29cf8e2dd8fdd19b0c4b488da31ff411ee95305eaecc","fa2ebcdfce8bbe4245ed77b43d39e22c0c7593ca3f65be3fd0ccdf7ee02130a9","76d0133d738876f314ae792d0cf949710b66266ba0cebefbd98ce40c64a9b15b","5678196f512f8a531c7d85af8df4f40c7a5f9c27331b361bb1a1c46d317a77d8","6bab11d9561482777757f16c069ebef3f1cd6885dbef55306ffde30037a41d48","50fe8a981a7d4824f0b297f37804b65672ed4484e198e7c324260a34941ddac7","1ec4d60738a671f00089a86eeba6cb13750bce589e84fd177707718a4cc7d8f1")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("f92297c4efabba98befeb992a009462d1aba6f3c3a11210a7c054ff5377f0753","7ef2c0d2ace70fedfe5cd919ad3959c56e7e9177dcc0ee770a4af7f84da544f1","06431a5d8f6262cc3db39d911a920f793fa6c648be94daf789c11cc5514d0c3d","1c5b9409243bfb81a5924881cc05f63a301a3a7ce214830c7a83aeb2485cc5c3","cb4c7037c7620e4ce3f8f43161b0ec67018c09e71ae4cea3018104153fbed286","5815a6f7976e993fcdf9e024f4667049ec5a921b7b93c8c8c0e5d779c8b72fcc","240e7bd805bd7f2d17217dd4cebc03ac37ee60b7fb1264655cfd087749db647a","9854750f3880c7cee3281d8c33292ca82d0d288963f0f2771d938c06ccaffaa9","ce56b011ac4663a40f0ba606c98c08aaf7caf6a45765aa930258fe2837b12181","cc6ae9670e38244e439711b1698f0db3cff000b79bec7f47bc4aa5ab1f6177c0","00d88009fa50bfab849593291cce20f8b2f2e2cf2428d9728e06c69fced55ed5","6753933cd54e4eba497c48d63c7418a8946b4b6c44170105d489d29f1fe11494","f1289e7229ace984027f29cf8e2dd8fdd19b0c4b488da31ff411ee95305eaecc","fa2ebcdfce8bbe4245ed77b43d39e22c0c7593ca3f65be3fd0ccdf7ee02130a9","76d0133d738876f314ae792d0cf949710b66266ba0cebefbd98ce40c64a9b15b","5678196f512f8a531c7d85af8df4f40c7a5f9c27331b361bb1a1c46d317a77d8","6bab11d9561482777757f16c069ebef3f1cd6885dbef55306ffde30037a41d48","50fe8a981a7d4824f0b297f37804b65672ed4484e198e7c324260a34941ddac7","1ec4d60738a671f00089a86eeba6cb13750bce589e84fd177707718a4cc7d8f1")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("f92297c4efabba98befeb992a009462d1aba6f3c3a11210a7c054ff5377f0753","7ef2c0d2ace70fedfe5cd919ad3959c56e7e9177dcc0ee770a4af7f84da544f1","06431a5d8f6262cc3db39d911a920f793fa6c648be94daf789c11cc5514d0c3d","1c5b9409243bfb81a5924881cc05f63a301a3a7ce214830c7a83aeb2485cc5c3","cb4c7037c7620e4ce3f8f43161b0ec67018c09e71ae4cea3018104153fbed286","5815a6f7976e993fcdf9e024f4667049ec5a921b7b93c8c8c0e5d779c8b72fcc","240e7bd805bd7f2d17217dd4cebc03ac37ee60b7fb1264655cfd087749db647a","9854750f3880c7cee3281d8c33292ca82d0d288963f0f2771d938c06ccaffaa9","ce56b011ac4663a40f0ba606c98c08aaf7caf6a45765aa930258fe2837b12181","cc6ae9670e38244e439711b1698f0db3cff000b79bec7f47bc4aa5ab1f6177c0","00d88009fa50bfab849593291cce20f8b2f2e2cf2428d9728e06c69fced55ed5","6753933cd54e4eba497c48d63c7418a8946b4b6c44170105d489d29f1fe11494","f1289e7229ace984027f29cf8e2dd8fdd19b0c4b488da31ff411ee95305eaecc","fa2ebcdfce8bbe4245ed77b43d39e22c0c7593ca3f65be3fd0ccdf7ee02130a9","76d0133d738876f314ae792d0cf949710b66266ba0cebefbd98ce40c64a9b15b","5678196f512f8a531c7d85af8df4f40c7a5f9c27331b361bb1a1c46d317a77d8","6bab11d9561482777757f16c069ebef3f1cd6885dbef55306ffde30037a41d48","50fe8a981a7d4824f0b297f37804b65672ed4484e198e7c324260a34941ddac7","1ec4d60738a671f00089a86eeba6cb13750bce589e84fd177707718a4cc7d8f1")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring64 NOT NULL AND customstring64 IN ("f92297c4efabba98befeb992a009462d1aba6f3c3a11210a7c054ff5377f0753","7ef2c0d2ace70fedfe5cd919ad3959c56e7e9177dcc0ee770a4af7f84da544f1","06431a5d8f6262cc3db39d911a920f793fa6c648be94daf789c11cc5514d0c3d","1c5b9409243bfb81a5924881cc05f63a301a3a7ce214830c7a83aeb2485cc5c3","cb4c7037c7620e4ce3f8f43161b0ec67018c09e71ae4cea3018104153fbed286","5815a6f7976e993fcdf9e024f4667049ec5a921b7b93c8c8c0e5d779c8b72fcc","240e7bd805bd7f2d17217dd4cebc03ac37ee60b7fb1264655cfd087749db647a","9854750f3880c7cee3281d8c33292ca82d0d288963f0f2771d938c06ccaffaa9","ce56b011ac4663a40f0ba606c98c08aaf7caf6a45765aa930258fe2837b12181","cc6ae9670e38244e439711b1698f0db3cff000b79bec7f47bc4aa5ab1f6177c0","00d88009fa50bfab849593291cce20f8b2f2e2cf2428d9728e06c69fced55ed5","6753933cd54e4eba497c48d63c7418a8946b4b6c44170105d489d29f1fe11494","f1289e7229ace984027f29cf8e2dd8fdd19b0c4b488da31ff411ee95305eaecc","fa2ebcdfce8bbe4245ed77b43d39e22c0c7593ca3f65be3fd0ccdf7ee02130a9","76d0133d738876f314ae792d0cf949710b66266ba0cebefbd98ce40c64a9b15b","5678196f512f8a531c7d85af8df4f40c7a5f9c27331b361bb1a1c46d317a77d8","6bab11d9561482777757f16c069ebef3f1cd6885dbef55306ffde30037a41d48","50fe8a981a7d4824f0b297f37804b65672ed4484e198e7c324260a34941ddac7","1ec4d60738a671f00089a86eeba6cb13750bce589e84fd177707718a4cc7d8f1")
index=activity AND rg_functionality="Endpoint Management Systems" AND requesturl NOT NULL AND requesturl IN ("https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbalfothzfrv9dvu9iufdnlxhpzg8xrxfycku_zt1bm1qwv2q/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufrlnnfwazddnhp2yy1seku_zt1ssfzjsk4/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbaffnudzlzzhhukzin0xvmunpq2yzee5vvfu_zt1wz2liaum/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufriznpnvu14tmjjbkm2q0k_zt1wzellsje/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbdtjtetf4adz0ofhnujjnem1zog5oundvltzcp2u9akhiqzz5/root/content")
index=activity AND rg_functionality="Endpoint Management Systems" AND Message NOT NULL AND Message IN ("https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbalfothzfrv9dvu9iufdnlxhpzg8xrxfycku_zt1bm1qwv2q/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufrlnnfwazddnhp2yy1seku_zt1ssfzjsk4/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbaffnudzlzzhhukzin0xvmunpq2yzee5vvfu_zt1wz2liaum/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufriznpnvu14tmjjbkm2q0k_zt1wzellsje/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbdtjtetf4adz0ofhnujjnem1zog5oundvltzcp2u9akhiqzz5/root/content")
index=activity AND rg_functionality="Endpoint Management Systems" AND Requestcontext NOT NULL AND Requestcontext IN ("https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbalfothzfrv9dvu9iufdnlxhpzg8xrxfycku_zt1bm1qwv2q/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufrlnnfwazddnhp2yy1seku_zt1ssfzjsk4/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbaffnudzlzzhhukzin0xvmunpq2yzee5vvfu_zt1wz2liaum/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufriznpnvu14tmjjbkm2q0k_zt1wzellsje/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbdtjtetf4adz0ofhnujjnem1zog5oundvltzcp2u9akhiqzz5/root/content")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbalfothzfrv9dvu9iufdnlxhpzg8xrxfycku_zt1bm1qwv2q/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufrlnnfwazddnhp2yy1seku_zt1ssfzjsk4/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbaffnudzlzzhhukzin0xvmunpq2yzee5vvfu_zt1wz2liaum/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufriznpnvu14tmjjbkm2q0k_zt1wzellsje/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbdtjtetf4adz0ofhnujjnem1zog5oundvltzcp2u9akhiqzz5/root/content")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND requesturl NOT NULL AND requesturl IN ("https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbalfothzfrv9dvu9iufdnlxhpzg8xrxfycku_zt1bm1qwv2q/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufrlnnfwazddnhp2yy1seku_zt1ssfzjsk4/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbaffnudzlzzhhukzin0xvmunpq2yzee5vvfu_zt1wz2liaum/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufriznpnvu14tmjjbkm2q0k_zt1wzellsje/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbdtjtetf4adz0ofhnujjnem1zog5oundvltzcp2u9akhiqzz5/root/content")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND Message NOT NULL AND Message IN ("https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbalfothzfrv9dvu9iufdnlxhpzg8xrxfycku_zt1bm1qwv2q/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufrlnnfwazddnhp2yy1seku_zt1ssfzjsk4/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbaffnudzlzzhhukzin0xvmunpq2yzee5vvfu_zt1wz2liaum/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufriznpnvu14tmjjbkm2q0k_zt1wzellsje/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbdtjtetf4adz0ofhnujjnem1zog5oundvltzcp2u9akhiqzz5/root/content")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND Requestcontext NOT NULL AND Requestcontext IN ("https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbalfothzfrv9dvu9iufdnlxhpzg8xrxfycku_zt1bm1qwv2q/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufrlnnfwazddnhp2yy1seku_zt1ssfzjsk4/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbaffnudzlzzhhukzin0xvmunpq2yzee5vvfu_zt1wz2liaum/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufriznpnvu14tmjjbkm2q0k_zt1wzellsje/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbdtjtetf4adz0ofhnujjnem1zog5oundvltzcp2u9akhiqzz5/root/content")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbalfothzfrv9dvu9iufdnlxhpzg8xrxfycku_zt1bm1qwv2q/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufrlnnfwazddnhp2yy1seku_zt1ssfzjsk4/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbaffnudzlzzhhukzin0xvmunpq2yzee5vvfu_zt1wz2liaum/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufriznpnvu14tmjjbkm2q0k_zt1wzellsje/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbdtjtetf4adz0ofhnujjnem1zog5oundvltzcp2u9akhiqzz5/root/content")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND requesturl NOT NULL AND requesturl IN ("https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbalfothzfrv9dvu9iufdnlxhpzg8xrxfycku_zt1bm1qwv2q/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufrlnnfwazddnhp2yy1seku_zt1ssfzjsk4/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbaffnudzlzzhhukzin0xvmunpq2yzee5vvfu_zt1wz2liaum/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufriznpnvu14tmjjbkm2q0k_zt1wzellsje/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbdtjtetf4adz0ofhnujjnem1zog5oundvltzcp2u9akhiqzz5/root/content")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND Message NOT NULL AND Message IN ("https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbalfothzfrv9dvu9iufdnlxhpzg8xrxfycku_zt1bm1qwv2q/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufrlnnfwazddnhp2yy1seku_zt1ssfzjsk4/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbaffnudzlzzhhukzin0xvmunpq2yzee5vvfu_zt1wz2liaum/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufriznpnvu14tmjjbkm2q0k_zt1wzellsje/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbdtjtetf4adz0ofhnujjnem1zog5oundvltzcp2u9akhiqzz5/root/content")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND Requestcontext NOT NULL AND Requestcontext IN ("https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbalfothzfrv9dvu9iufdnlxhpzg8xrxfycku_zt1bm1qwv2q/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufrlnnfwazddnhp2yy1seku_zt1ssfzjsk4/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbaffnudzlzzhhukzin0xvmunpq2yzee5vvfu_zt1wz2liaum/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufriznpnvu14tmjjbkm2q0k_zt1wzellsje/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbdtjtetf4adz0ofhnujjnem1zog5oundvltzcp2u9akhiqzz5/root/content")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbalfothzfrv9dvu9iufdnlxhpzg8xrxfycku_zt1bm1qwv2q/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufrlnnfwazddnhp2yy1seku_zt1ssfzjsk4/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbaffnudzlzzhhukzin0xvmunpq2yzee5vvfu_zt1wz2liaum/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufriznpnvu14tmjjbkm2q0k_zt1wzellsje/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbdtjtetf4adz0ofhnujjnem1zog5oundvltzcp2u9akhiqzz5/root/content")
index=activity AND rg_functionality="Email / Email Security" AND requesturl NOT NULL AND requesturl IN ("https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbalfothzfrv9dvu9iufdnlxhpzg8xrxfycku_zt1bm1qwv2q/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufrlnnfwazddnhp2yy1seku_zt1ssfzjsk4/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbaffnudzlzzhhukzin0xvmunpq2yzee5vvfu_zt1wz2liaum/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufriznpnvu14tmjjbkm2q0k_zt1wzellsje/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbdtjtetf4adz0ofhnujjnem1zog5oundvltzcp2u9akhiqzz5/root/content")
index=activity AND rg_functionality="Email / Email Security" AND Message NOT NULL AND Message IN ("https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbalfothzfrv9dvu9iufdnlxhpzg8xrxfycku_zt1bm1qwv2q/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufrlnnfwazddnhp2yy1seku_zt1ssfzjsk4/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbaffnudzlzzhhukzin0xvmunpq2yzee5vvfu_zt1wz2liaum/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufriznpnvu14tmjjbkm2q0k_zt1wzellsje/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbdtjtetf4adz0ofhnujjnem1zog5oundvltzcp2u9akhiqzz5/root/content")
index=activity AND rg_functionality="Email / Email Security" AND Requestcontext NOT NULL AND Requestcontext IN ("https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbalfothzfrv9dvu9iufdnlxhpzg8xrxfycku_zt1bm1qwv2q/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufrlnnfwazddnhp2yy1seku_zt1ssfzjsk4/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbaffnudzlzzhhukzin0xvmunpq2yzee5vvfu_zt1wz2liaum/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufriznpnvu14tmjjbkm2q0k_zt1wzellsje/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbdtjtetf4adz0ofhnujjnem1zog5oundvltzcp2u9akhiqzz5/root/content")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbalfothzfrv9dvu9iufdnlxhpzg8xrxfycku_zt1bm1qwv2q/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufrlnnfwazddnhp2yy1seku_zt1ssfzjsk4/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbaffnudzlzzhhukzin0xvmunpq2yzee5vvfu_zt1wz2liaum/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufriznpnvu14tmjjbkm2q0k_zt1wzellsje/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbdtjtetf4adz0ofhnujjnem1zog5oundvltzcp2u9akhiqzz5/root/content")
index=activity AND rg_functionality="Cloud Email / Email Security" AND requesturl NOT NULL AND requesturl IN ("https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbalfothzfrv9dvu9iufdnlxhpzg8xrxfycku_zt1bm1qwv2q/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufrlnnfwazddnhp2yy1seku_zt1ssfzjsk4/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbaffnudzlzzhhukzin0xvmunpq2yzee5vvfu_zt1wz2liaum/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufriznpnvu14tmjjbkm2q0k_zt1wzellsje/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbdtjtetf4adz0ofhnujjnem1zog5oundvltzcp2u9akhiqzz5/root/content")
index=activity AND rg_functionality="Cloud Email / Email Security" AND Message NOT NULL AND Message IN ("https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbalfothzfrv9dvu9iufdnlxhpzg8xrxfycku_zt1bm1qwv2q/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufrlnnfwazddnhp2yy1seku_zt1ssfzjsk4/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbaffnudzlzzhhukzin0xvmunpq2yzee5vvfu_zt1wz2liaum/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufriznpnvu14tmjjbkm2q0k_zt1wzellsje/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbdtjtetf4adz0ofhnujjnem1zog5oundvltzcp2u9akhiqzz5/root/content")
index=activity AND rg_functionality="Cloud Email / Email Security" AND Requestcontext NOT NULL AND Requestcontext IN ("https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbalfothzfrv9dvu9iufdnlxhpzg8xrxfycku_zt1bm1qwv2q/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufrlnnfwazddnhp2yy1seku_zt1ssfzjsk4/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbaffnudzlzzhhukzin0xvmunpq2yzee5vvfu_zt1wz2liaum/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufriznpnvu14tmjjbkm2q0k_zt1wzellsje/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbdtjtetf4adz0ofhnujjnem1zog5oundvltzcp2u9akhiqzz5/root/content")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbalfothzfrv9dvu9iufdnlxhpzg8xrxfycku_zt1bm1qwv2q/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufrlnnfwazddnhp2yy1seku_zt1ssfzjsk4/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbaffnudzlzzhhukzin0xvmunpq2yzee5vvfu_zt1wz2liaum/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufriznpnvu14tmjjbkm2q0k_zt1wzellsje/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbdtjtetf4adz0ofhnujjnem1zog5oundvltzcp2u9akhiqzz5/root/content")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND requesturl NOT NULL AND requesturl IN ("https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbalfothzfrv9dvu9iufdnlxhpzg8xrxfycku_zt1bm1qwv2q/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufrlnnfwazddnhp2yy1seku_zt1ssfzjsk4/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbaffnudzlzzhhukzin0xvmunpq2yzee5vvfu_zt1wz2liaum/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufriznpnvu14tmjjbkm2q0k_zt1wzellsje/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbdtjtetf4adz0ofhnujjnem1zog5oundvltzcp2u9akhiqzz5/root/content")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND Message NOT NULL AND Message IN ("https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbalfothzfrv9dvu9iufdnlxhpzg8xrxfycku_zt1bm1qwv2q/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufrlnnfwazddnhp2yy1seku_zt1ssfzjsk4/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbaffnudzlzzhhukzin0xvmunpq2yzee5vvfu_zt1wz2liaum/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufriznpnvu14tmjjbkm2q0k_zt1wzellsje/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbdtjtetf4adz0ofhnujjnem1zog5oundvltzcp2u9akhiqzz5/root/content")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND Requestcontext NOT NULL AND Requestcontext IN ("https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbalfothzfrv9dvu9iufdnlxhpzg8xrxfycku_zt1bm1qwv2q/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufrlnnfwazddnhp2yy1seku_zt1ssfzjsk4/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbaffnudzlzzhhukzin0xvmunpq2yzee5vvfu_zt1wz2liaum/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufriznpnvu14tmjjbkm2q0k_zt1wzellsje/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbdtjtetf4adz0ofhnujjnem1zog5oundvltzcp2u9akhiqzz5/root/content")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbalfothzfrv9dvu9iufdnlxhpzg8xrxfycku_zt1bm1qwv2q/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufrlnnfwazddnhp2yy1seku_zt1ssfzjsk4/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbaffnudzlzzhhukzin0xvmunpq2yzee5vvfu_zt1wz2liaum/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufriznpnvu14tmjjbkm2q0k_zt1wzellsje/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbdtjtetf4adz0ofhnujjnem1zog5oundvltzcp2u9akhiqzz5/root/content")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND requesturl NOT NULL AND requesturl IN ("https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbalfothzfrv9dvu9iufdnlxhpzg8xrxfycku_zt1bm1qwv2q/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufrlnnfwazddnhp2yy1seku_zt1ssfzjsk4/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbaffnudzlzzhhukzin0xvmunpq2yzee5vvfu_zt1wz2liaum/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufriznpnvu14tmjjbkm2q0k_zt1wzellsje/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbdtjtetf4adz0ofhnujjnem1zog5oundvltzcp2u9akhiqzz5/root/content")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND Message NOT NULL AND Message IN ("https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbalfothzfrv9dvu9iufdnlxhpzg8xrxfycku_zt1bm1qwv2q/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufrlnnfwazddnhp2yy1seku_zt1ssfzjsk4/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbaffnudzlzzhhukzin0xvmunpq2yzee5vvfu_zt1wz2liaum/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufriznpnvu14tmjjbkm2q0k_zt1wzellsje/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbdtjtetf4adz0ofhnujjnem1zog5oundvltzcp2u9akhiqzz5/root/content")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND Requestcontext NOT NULL AND Requestcontext IN ("https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbalfothzfrv9dvu9iufdnlxhpzg8xrxfycku_zt1bm1qwv2q/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufrlnnfwazddnhp2yy1seku_zt1ssfzjsk4/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbaffnudzlzzhhukzin0xvmunpq2yzee5vvfu_zt1wz2liaum/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufriznpnvu14tmjjbkm2q0k_zt1wzellsje/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbdtjtetf4adz0ofhnujjnem1zog5oundvltzcp2u9akhiqzz5/root/content")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbalfothzfrv9dvu9iufdnlxhpzg8xrxfycku_zt1bm1qwv2q/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufrlnnfwazddnhp2yy1seku_zt1ssfzjsk4/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbaffnudzlzzhhukzin0xvmunpq2yzee5vvfu_zt1wz2liaum/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufriznpnvu14tmjjbkm2q0k_zt1wzellsje/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbdtjtetf4adz0ofhnujjnem1zog5oundvltzcp2u9akhiqzz5/root/content")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND requesturl NOT NULL AND requesturl IN ("https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbalfothzfrv9dvu9iufdnlxhpzg8xrxfycku_zt1bm1qwv2q/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufrlnnfwazddnhp2yy1seku_zt1ssfzjsk4/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbaffnudzlzzhhukzin0xvmunpq2yzee5vvfu_zt1wz2liaum/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufriznpnvu14tmjjbkm2q0k_zt1wzellsje/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbdtjtetf4adz0ofhnujjnem1zog5oundvltzcp2u9akhiqzz5/root/content")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND Message NOT NULL AND Message IN ("https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbalfothzfrv9dvu9iufdnlxhpzg8xrxfycku_zt1bm1qwv2q/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufrlnnfwazddnhp2yy1seku_zt1ssfzjsk4/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbaffnudzlzzhhukzin0xvmunpq2yzee5vvfu_zt1wz2liaum/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufriznpnvu14tmjjbkm2q0k_zt1wzellsje/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbdtjtetf4adz0ofhnujjnem1zog5oundvltzcp2u9akhiqzz5/root/content")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND Requestcontext NOT NULL AND Requestcontext IN ("https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbalfothzfrv9dvu9iufdnlxhpzg8xrxfycku_zt1bm1qwv2q/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufrlnnfwazddnhp2yy1seku_zt1ssfzjsk4/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbaffnudzlzzhhukzin0xvmunpq2yzee5vvfu_zt1wz2liaum/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufriznpnvu14tmjjbkm2q0k_zt1wzellsje/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbdtjtetf4adz0ofhnujjnem1zog5oundvltzcp2u9akhiqzz5/root/content")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbalfothzfrv9dvu9iufdnlxhpzg8xrxfycku_zt1bm1qwv2q/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufrlnnfwazddnhp2yy1seku_zt1ssfzjsk4/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbaffnudzlzzhhukzin0xvmunpq2yzee5vvfu_zt1wz2liaum/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufriznpnvu14tmjjbkm2q0k_zt1wzellsje/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbdtjtetf4adz0ofhnujjnem1zog5oundvltzcp2u9akhiqzz5/root/content")
index=activity AND rg_functionality="Web Proxy" AND requesturl NOT NULL AND requesturl IN ("https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbalfothzfrv9dvu9iufdnlxhpzg8xrxfycku_zt1bm1qwv2q/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufrlnnfwazddnhp2yy1seku_zt1ssfzjsk4/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbaffnudzlzzhhukzin0xvmunpq2yzee5vvfu_zt1wz2liaum/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufriznpnvu14tmjjbkm2q0k_zt1wzellsje/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbdtjtetf4adz0ofhnujjnem1zog5oundvltzcp2u9akhiqzz5/root/content")
index=activity AND rg_functionality="Web Proxy" AND Message NOT NULL AND Message IN ("https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbalfothzfrv9dvu9iufdnlxhpzg8xrxfycku_zt1bm1qwv2q/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufrlnnfwazddnhp2yy1seku_zt1ssfzjsk4/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbaffnudzlzzhhukzin0xvmunpq2yzee5vvfu_zt1wz2liaum/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufriznpnvu14tmjjbkm2q0k_zt1wzellsje/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbdtjtetf4adz0ofhnujjnem1zog5oundvltzcp2u9akhiqzz5/root/content")
index=activity AND rg_functionality="Web Proxy" AND Requestcontext NOT NULL AND Requestcontext IN ("https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbalfothzfrv9dvu9iufdnlxhpzg8xrxfycku_zt1bm1qwv2q/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufrlnnfwazddnhp2yy1seku_zt1ssfzjsk4/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbaffnudzlzzhhukzin0xvmunpq2yzee5vvfu_zt1wz2liaum/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufriznpnvu14tmjjbkm2q0k_zt1wzellsje/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbdtjtetf4adz0ofhnujjnem1zog5oundvltzcp2u9akhiqzz5/root/content")
index=activity AND rg_functionality="Web Proxy" AND customstring3 NOT NULL AND customstring3 IN ("https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbalfothzfrv9dvu9iufdnlxhpzg8xrxfycku_zt1bm1qwv2q/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufrlnnfwazddnhp2yy1seku_zt1ssfzjsk4/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbaffnudzlzzhhukzin0xvmunpq2yzee5vvfu_zt1wz2liaum/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufriznpnvu14tmjjbkm2q0k_zt1wzellsje/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbdtjtetf4adz0ofhnujjnem1zog5oundvltzcp2u9akhiqzz5/root/content")
index=activity AND rg_functionality="Next Generation Firewall" AND requesturl NOT NULL AND requesturl IN ("https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbalfothzfrv9dvu9iufdnlxhpzg8xrxfycku_zt1bm1qwv2q/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufrlnnfwazddnhp2yy1seku_zt1ssfzjsk4/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbaffnudzlzzhhukzin0xvmunpq2yzee5vvfu_zt1wz2liaum/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufriznpnvu14tmjjbkm2q0k_zt1wzellsje/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbdtjtetf4adz0ofhnujjnem1zog5oundvltzcp2u9akhiqzz5/root/content")
index=activity AND rg_functionality="Next Generation Firewall" AND Message NOT NULL AND Message IN ("https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbalfothzfrv9dvu9iufdnlxhpzg8xrxfycku_zt1bm1qwv2q/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufrlnnfwazddnhp2yy1seku_zt1ssfzjsk4/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbaffnudzlzzhhukzin0xvmunpq2yzee5vvfu_zt1wz2liaum/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufriznpnvu14tmjjbkm2q0k_zt1wzellsje/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbdtjtetf4adz0ofhnujjnem1zog5oundvltzcp2u9akhiqzz5/root/content")
index=activity AND rg_functionality="Next Generation Firewall" AND Requestcontext NOT NULL AND Requestcontext IN ("https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbalfothzfrv9dvu9iufdnlxhpzg8xrxfycku_zt1bm1qwv2q/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufrlnnfwazddnhp2yy1seku_zt1ssfzjsk4/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbaffnudzlzzhhukzin0xvmunpq2yzee5vvfu_zt1wz2liaum/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufriznpnvu14tmjjbkm2q0k_zt1wzellsje/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbdtjtetf4adz0ofhnujjnem1zog5oundvltzcp2u9akhiqzz5/root/content")
index=activity AND rg_functionality="Next Generation Firewall" AND customstring3 NOT NULL AND customstring3 IN ("https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbalfothzfrv9dvu9iufdnlxhpzg8xrxfycku_zt1bm1qwv2q/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufrlnnfwazddnhp2yy1seku_zt1ssfzjsk4/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbaffnudzlzzhhukzin0xvmunpq2yzee5vvfu_zt1wz2liaum/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufriznpnvu14tmjjbkm2q0k_zt1wzellsje/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbdtjtetf4adz0ofhnujjnem1zog5oundvltzcp2u9akhiqzz5/root/content")
index=activity AND rg_functionality="Flow" AND requesturl NOT NULL AND requesturl IN ("https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbalfothzfrv9dvu9iufdnlxhpzg8xrxfycku_zt1bm1qwv2q/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufrlnnfwazddnhp2yy1seku_zt1ssfzjsk4/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbaffnudzlzzhhukzin0xvmunpq2yzee5vvfu_zt1wz2liaum/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufriznpnvu14tmjjbkm2q0k_zt1wzellsje/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbdtjtetf4adz0ofhnujjnem1zog5oundvltzcp2u9akhiqzz5/root/content")
index=activity AND rg_functionality="Flow" AND Message NOT NULL AND Message IN ("https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbalfothzfrv9dvu9iufdnlxhpzg8xrxfycku_zt1bm1qwv2q/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufrlnnfwazddnhp2yy1seku_zt1ssfzjsk4/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbaffnudzlzzhhukzin0xvmunpq2yzee5vvfu_zt1wz2liaum/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufriznpnvu14tmjjbkm2q0k_zt1wzellsje/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbdtjtetf4adz0ofhnujjnem1zog5oundvltzcp2u9akhiqzz5/root/content")
index=activity AND rg_functionality="Flow" AND Requestcontext NOT NULL AND Requestcontext IN ("https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbalfothzfrv9dvu9iufdnlxhpzg8xrxfycku_zt1bm1qwv2q/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufrlnnfwazddnhp2yy1seku_zt1ssfzjsk4/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbaffnudzlzzhhukzin0xvmunpq2yzee5vvfu_zt1wz2liaum/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufriznpnvu14tmjjbkm2q0k_zt1wzellsje/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbdtjtetf4adz0ofhnujjnem1zog5oundvltzcp2u9akhiqzz5/root/content")
index=activity AND rg_functionality="Flow" AND customstring3 NOT NULL AND customstring3 IN ("https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbalfothzfrv9dvu9iufdnlxhpzg8xrxfycku_zt1bm1qwv2q/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufrlnnfwazddnhp2yy1seku_zt1ssfzjsk4/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbaffnudzlzzhhukzin0xvmunpq2yzee5vvfu_zt1wz2liaum/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufriznpnvu14tmjjbkm2q0k_zt1wzellsje/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbdtjtetf4adz0ofhnujjnem1zog5oundvltzcp2u9akhiqzz5/root/content")
index=activity AND rg_functionality="Web Server" AND requesturl NOT NULL AND requesturl IN ("https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbalfothzfrv9dvu9iufdnlxhpzg8xrxfycku_zt1bm1qwv2q/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufrlnnfwazddnhp2yy1seku_zt1ssfzjsk4/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbaffnudzlzzhhukzin0xvmunpq2yzee5vvfu_zt1wz2liaum/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufriznpnvu14tmjjbkm2q0k_zt1wzellsje/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbdtjtetf4adz0ofhnujjnem1zog5oundvltzcp2u9akhiqzz5/root/content")
index=activity AND rg_functionality="Web Server" AND Message NOT NULL AND Message IN ("https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbalfothzfrv9dvu9iufdnlxhpzg8xrxfycku_zt1bm1qwv2q/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufrlnnfwazddnhp2yy1seku_zt1ssfzjsk4/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbaffnudzlzzhhukzin0xvmunpq2yzee5vvfu_zt1wz2liaum/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufriznpnvu14tmjjbkm2q0k_zt1wzellsje/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbdtjtetf4adz0ofhnujjnem1zog5oundvltzcp2u9akhiqzz5/root/content")
index=activity AND rg_functionality="Web Server" AND Requestcontext NOT NULL AND Requestcontext IN ("https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbalfothzfrv9dvu9iufdnlxhpzg8xrxfycku_zt1bm1qwv2q/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufrlnnfwazddnhp2yy1seku_zt1ssfzjsk4/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbaffnudzlzzhhukzin0xvmunpq2yzee5vvfu_zt1wz2liaum/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufriznpnvu14tmjjbkm2q0k_zt1wzellsje/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbdtjtetf4adz0ofhnujjnem1zog5oundvltzcp2u9akhiqzz5/root/content")
index=activity AND rg_functionality="Web Server" AND customstring3 NOT NULL AND customstring3 IN ("https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbalfothzfrv9dvu9iufdnlxhpzg8xrxfycku_zt1bm1qwv2q/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufrlnnfwazddnhp2yy1seku_zt1ssfzjsk4/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbaffnudzlzzhhukzin0xvmunpq2yzee5vvfu_zt1wz2liaum/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufriznpnvu14tmjjbkm2q0k_zt1wzellsje/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbdtjtetf4adz0ofhnujjnem1zog5oundvltzcp2u9akhiqzz5/root/content")
index=activity AND rg_functionality="Email / Email Security" AND requesturl NOT NULL AND requesturl IN ("https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbalfothzfrv9dvu9iufdnlxhpzg8xrxfycku_zt1bm1qwv2q/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufrlnnfwazddnhp2yy1seku_zt1ssfzjsk4/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbaffnudzlzzhhukzin0xvmunpq2yzee5vvfu_zt1wz2liaum/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufriznpnvu14tmjjbkm2q0k_zt1wzellsje/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbdtjtetf4adz0ofhnujjnem1zog5oundvltzcp2u9akhiqzz5/root/content")
index=activity AND rg_functionality="Email / Email Security" AND Message NOT NULL AND Message IN ("https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbalfothzfrv9dvu9iufdnlxhpzg8xrxfycku_zt1bm1qwv2q/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufrlnnfwazddnhp2yy1seku_zt1ssfzjsk4/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbaffnudzlzzhhukzin0xvmunpq2yzee5vvfu_zt1wz2liaum/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufriznpnvu14tmjjbkm2q0k_zt1wzellsje/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbdtjtetf4adz0ofhnujjnem1zog5oundvltzcp2u9akhiqzz5/root/content")
index=activity AND rg_functionality="Email / Email Security" AND Requestcontext NOT NULL AND Requestcontext IN ("https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbalfothzfrv9dvu9iufdnlxhpzg8xrxfycku_zt1bm1qwv2q/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufrlnnfwazddnhp2yy1seku_zt1ssfzjsk4/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbaffnudzlzzhhukzin0xvmunpq2yzee5vvfu_zt1wz2liaum/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufriznpnvu14tmjjbkm2q0k_zt1wzellsje/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbdtjtetf4adz0ofhnujjnem1zog5oundvltzcp2u9akhiqzz5/root/content")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbalfothzfrv9dvu9iufdnlxhpzg8xrxfycku_zt1bm1qwv2q/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufrlnnfwazddnhp2yy1seku_zt1ssfzjsk4/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbaffnudzlzzhhukzin0xvmunpq2yzee5vvfu_zt1wz2liaum/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufriznpnvu14tmjjbkm2q0k_zt1wzellsje/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbdtjtetf4adz0ofhnujjnem1zog5oundvltzcp2u9akhiqzz5/root/content")
index=activity AND rg_functionality="Cloud Email / Email Security" AND requesturl NOT NULL AND requesturl IN ("https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbalfothzfrv9dvu9iufdnlxhpzg8xrxfycku_zt1bm1qwv2q/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufrlnnfwazddnhp2yy1seku_zt1ssfzjsk4/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbaffnudzlzzhhukzin0xvmunpq2yzee5vvfu_zt1wz2liaum/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufriznpnvu14tmjjbkm2q0k_zt1wzellsje/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbdtjtetf4adz0ofhnujjnem1zog5oundvltzcp2u9akhiqzz5/root/content")
index=activity AND rg_functionality="Cloud Email / Email Security" AND Message NOT NULL AND Message IN ("https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbalfothzfrv9dvu9iufdnlxhpzg8xrxfycku_zt1bm1qwv2q/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufrlnnfwazddnhp2yy1seku_zt1ssfzjsk4/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbaffnudzlzzhhukzin0xvmunpq2yzee5vvfu_zt1wz2liaum/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufriznpnvu14tmjjbkm2q0k_zt1wzellsje/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbdtjtetf4adz0ofhnujjnem1zog5oundvltzcp2u9akhiqzz5/root/content")
index=activity AND rg_functionality="Cloud Email / Email Security" AND Requestcontext NOT NULL AND Requestcontext IN ("https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbalfothzfrv9dvu9iufdnlxhpzg8xrxfycku_zt1bm1qwv2q/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufrlnnfwazddnhp2yy1seku_zt1ssfzjsk4/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbaffnudzlzzhhukzin0xvmunpq2yzee5vvfu_zt1wz2liaum/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufriznpnvu14tmjjbkm2q0k_zt1wzellsje/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbdtjtetf4adz0ofhnujjnem1zog5oundvltzcp2u9akhiqzz5/root/content")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbalfothzfrv9dvu9iufdnlxhpzg8xrxfycku_zt1bm1qwv2q/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufrlnnfwazddnhp2yy1seku_zt1ssfzjsk4/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbaffnudzlzzhhukzin0xvmunpq2yzee5vvfu_zt1wz2liaum/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufriznpnvu14tmjjbkm2q0k_zt1wzellsje/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbdtjtetf4adz0ofhnujjnem1zog5oundvltzcp2u9akhiqzz5/root/content")
index=activity AND rg_functionality="Web Application Firewall" AND requesturl NOT NULL AND requesturl IN ("https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbalfothzfrv9dvu9iufdnlxhpzg8xrxfycku_zt1bm1qwv2q/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufrlnnfwazddnhp2yy1seku_zt1ssfzjsk4/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbaffnudzlzzhhukzin0xvmunpq2yzee5vvfu_zt1wz2liaum/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufriznpnvu14tmjjbkm2q0k_zt1wzellsje/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbdtjtetf4adz0ofhnujjnem1zog5oundvltzcp2u9akhiqzz5/root/content")
index=activity AND rg_functionality="Web Application Firewall" AND Message NOT NULL AND Message IN ("https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbalfothzfrv9dvu9iufdnlxhpzg8xrxfycku_zt1bm1qwv2q/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufrlnnfwazddnhp2yy1seku_zt1ssfzjsk4/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbaffnudzlzzhhukzin0xvmunpq2yzee5vvfu_zt1wz2liaum/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufriznpnvu14tmjjbkm2q0k_zt1wzellsje/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbdtjtetf4adz0ofhnujjnem1zog5oundvltzcp2u9akhiqzz5/root/content")
index=activity AND rg_functionality="Web Application Firewall" AND Requestcontext NOT NULL AND Requestcontext IN ("https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbalfothzfrv9dvu9iufdnlxhpzg8xrxfycku_zt1bm1qwv2q/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufrlnnfwazddnhp2yy1seku_zt1ssfzjsk4/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbaffnudzlzzhhukzin0xvmunpq2yzee5vvfu_zt1wz2liaum/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufriznpnvu14tmjjbkm2q0k_zt1wzellsje/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbdtjtetf4adz0ofhnujjnem1zog5oundvltzcp2u9akhiqzz5/root/content")
index=activity AND rg_functionality="Web Application Firewall" AND customstring3 NOT NULL AND customstring3 IN ("https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbalfothzfrv9dvu9iufdnlxhpzg8xrxfycku_zt1bm1qwv2q/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufrlnnfwazddnhp2yy1seku_zt1ssfzjsk4/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbaffnudzlzzhhukzin0xvmunpq2yzee5vvfu_zt1wz2liaum/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufriznpnvu14tmjjbkm2q0k_zt1wzellsje/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbdtjtetf4adz0ofhnujjnem1zog5oundvltzcp2u9akhiqzz5/root/content")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND requesturl NOT NULL AND requesturl IN ("https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbalfothzfrv9dvu9iufdnlxhpzg8xrxfycku_zt1bm1qwv2q/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufrlnnfwazddnhp2yy1seku_zt1ssfzjsk4/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbaffnudzlzzhhukzin0xvmunpq2yzee5vvfu_zt1wz2liaum/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufriznpnvu14tmjjbkm2q0k_zt1wzellsje/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbdtjtetf4adz0ofhnujjnem1zog5oundvltzcp2u9akhiqzz5/root/content")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND Message NOT NULL AND Message IN ("https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbalfothzfrv9dvu9iufdnlxhpzg8xrxfycku_zt1bm1qwv2q/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufrlnnfwazddnhp2yy1seku_zt1ssfzjsk4/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbaffnudzlzzhhukzin0xvmunpq2yzee5vvfu_zt1wz2liaum/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufriznpnvu14tmjjbkm2q0k_zt1wzellsje/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbdtjtetf4adz0ofhnujjnem1zog5oundvltzcp2u9akhiqzz5/root/content")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND Requestcontext NOT NULL AND Requestcontext IN ("https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbalfothzfrv9dvu9iufdnlxhpzg8xrxfycku_zt1bm1qwv2q/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufrlnnfwazddnhp2yy1seku_zt1ssfzjsk4/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbaffnudzlzzhhukzin0xvmunpq2yzee5vvfu_zt1wz2liaum/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufriznpnvu14tmjjbkm2q0k_zt1wzellsje/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbdtjtetf4adz0ofhnujjnem1zog5oundvltzcp2u9akhiqzz5/root/content")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbalfothzfrv9dvu9iufdnlxhpzg8xrxfycku_zt1bm1qwv2q/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufrlnnfwazddnhp2yy1seku_zt1ssfzjsk4/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbaffnudzlzzhhukzin0xvmunpq2yzee5vvfu_zt1wz2liaum/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufriznpnvu14tmjjbkm2q0k_zt1wzellsje/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbdtjtetf4adz0ofhnujjnem1zog5oundvltzcp2u9akhiqzz5/root/content")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND requesturl NOT NULL AND requesturl IN ("https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbalfothzfrv9dvu9iufdnlxhpzg8xrxfycku_zt1bm1qwv2q/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufrlnnfwazddnhp2yy1seku_zt1ssfzjsk4/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbaffnudzlzzhhukzin0xvmunpq2yzee5vvfu_zt1wz2liaum/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufriznpnvu14tmjjbkm2q0k_zt1wzellsje/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbdtjtetf4adz0ofhnujjnem1zog5oundvltzcp2u9akhiqzz5/root/content")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND Message NOT NULL AND Message IN ("https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbalfothzfrv9dvu9iufdnlxhpzg8xrxfycku_zt1bm1qwv2q/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufrlnnfwazddnhp2yy1seku_zt1ssfzjsk4/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbaffnudzlzzhhukzin0xvmunpq2yzee5vvfu_zt1wz2liaum/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufriznpnvu14tmjjbkm2q0k_zt1wzellsje/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbdtjtetf4adz0ofhnujjnem1zog5oundvltzcp2u9akhiqzz5/root/content")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND Requestcontext NOT NULL AND Requestcontext IN ("https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbalfothzfrv9dvu9iufdnlxhpzg8xrxfycku_zt1bm1qwv2q/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufrlnnfwazddnhp2yy1seku_zt1ssfzjsk4/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbaffnudzlzzhhukzin0xvmunpq2yzee5vvfu_zt1wz2liaum/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufriznpnvu14tmjjbkm2q0k_zt1wzellsje/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbdtjtetf4adz0ofhnujjnem1zog5oundvltzcp2u9akhiqzz5/root/content")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND customstring3 NOT NULL AND customstring3 IN ("https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbalfothzfrv9dvu9iufdnlxhpzg8xrxfycku_zt1bm1qwv2q/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufrlnnfwazddnhp2yy1seku_zt1ssfzjsk4/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbaffnudzlzzhhukzin0xvmunpq2yzee5vvfu_zt1wz2liaum/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufriznpnvu14tmjjbkm2q0k_zt1wzellsje/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbdtjtetf4adz0ofhnujjnem1zog5oundvltzcp2u9akhiqzz5/root/content")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND requesturl NOT NULL AND requesturl IN ("https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbalfothzfrv9dvu9iufdnlxhpzg8xrxfycku_zt1bm1qwv2q/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufrlnnfwazddnhp2yy1seku_zt1ssfzjsk4/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbaffnudzlzzhhukzin0xvmunpq2yzee5vvfu_zt1wz2liaum/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufriznpnvu14tmjjbkm2q0k_zt1wzellsje/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbdtjtetf4adz0ofhnujjnem1zog5oundvltzcp2u9akhiqzz5/root/content")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND Message NOT NULL AND Message IN ("https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbalfothzfrv9dvu9iufdnlxhpzg8xrxfycku_zt1bm1qwv2q/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufrlnnfwazddnhp2yy1seku_zt1ssfzjsk4/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbaffnudzlzzhhukzin0xvmunpq2yzee5vvfu_zt1wz2liaum/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufriznpnvu14tmjjbkm2q0k_zt1wzellsje/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbdtjtetf4adz0ofhnujjnem1zog5oundvltzcp2u9akhiqzz5/root/content")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND Requestcontext NOT NULL AND Requestcontext IN ("https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbalfothzfrv9dvu9iufdnlxhpzg8xrxfycku_zt1bm1qwv2q/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufrlnnfwazddnhp2yy1seku_zt1ssfzjsk4/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbaffnudzlzzhhukzin0xvmunpq2yzee5vvfu_zt1wz2liaum/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufriznpnvu14tmjjbkm2q0k_zt1wzellsje/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbdtjtetf4adz0ofhnujjnem1zog5oundvltzcp2u9akhiqzz5/root/content")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND customstring3 NOT NULL AND customstring3 IN ("https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbalfothzfrv9dvu9iufdnlxhpzg8xrxfycku_zt1bm1qwv2q/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufrlnnfwazddnhp2yy1seku_zt1ssfzjsk4/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbaffnudzlzzhhukzin0xvmunpq2yzee5vvfu_zt1wz2liaum/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufriznpnvu14tmjjbkm2q0k_zt1wzellsje/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbdtjtetf4adz0ofhnujjnem1zog5oundvltzcp2u9akhiqzz5/root/content")
index=activity AND rg_functionality="Cloud Application Security Broker" AND requesturl NOT NULL AND requesturl IN ("https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbalfothzfrv9dvu9iufdnlxhpzg8xrxfycku_zt1bm1qwv2q/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufrlnnfwazddnhp2yy1seku_zt1ssfzjsk4/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbaffnudzlzzhhukzin0xvmunpq2yzee5vvfu_zt1wz2liaum/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufriznpnvu14tmjjbkm2q0k_zt1wzellsje/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbdtjtetf4adz0ofhnujjnem1zog5oundvltzcp2u9akhiqzz5/root/content")
index=activity AND rg_functionality="Cloud Application Security Broker" AND Message NOT NULL AND Message IN ("https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbalfothzfrv9dvu9iufdnlxhpzg8xrxfycku_zt1bm1qwv2q/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufrlnnfwazddnhp2yy1seku_zt1ssfzjsk4/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbaffnudzlzzhhukzin0xvmunpq2yzee5vvfu_zt1wz2liaum/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufriznpnvu14tmjjbkm2q0k_zt1wzellsje/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbdtjtetf4adz0ofhnujjnem1zog5oundvltzcp2u9akhiqzz5/root/content")
index=activity AND rg_functionality="Cloud Application Security Broker" AND Requestcontext NOT NULL AND Requestcontext IN ("https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbalfothzfrv9dvu9iufdnlxhpzg8xrxfycku_zt1bm1qwv2q/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufrlnnfwazddnhp2yy1seku_zt1ssfzjsk4/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbaffnudzlzzhhukzin0xvmunpq2yzee5vvfu_zt1wz2liaum/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufriznpnvu14tmjjbkm2q0k_zt1wzellsje/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbdtjtetf4adz0ofhnujjnem1zog5oundvltzcp2u9akhiqzz5/root/content")
index=activity AND rg_functionality="Cloud Application Security Broker" AND customstring3 NOT NULL AND customstring3 IN ("https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbalfothzfrv9dvu9iufdnlxhpzg8xrxfycku_zt1bm1qwv2q/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufrlnnfwazddnhp2yy1seku_zt1ssfzjsk4/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbaffnudzlzzhhukzin0xvmunpq2yzee5vvfu_zt1wz2liaum/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufriznpnvu14tmjjbkm2q0k_zt1wzellsje/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbdtjtetf4adz0ofhnujjnem1zog5oundvltzcp2u9akhiqzz5/root/content")
index=activity AND rg_functionality="Source Code Repository" AND requesturl NOT NULL AND requesturl IN ("https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbalfothzfrv9dvu9iufdnlxhpzg8xrxfycku_zt1bm1qwv2q/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufrlnnfwazddnhp2yy1seku_zt1ssfzjsk4/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbaffnudzlzzhhukzin0xvmunpq2yzee5vvfu_zt1wz2liaum/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufriznpnvu14tmjjbkm2q0k_zt1wzellsje/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbdtjtetf4adz0ofhnujjnem1zog5oundvltzcp2u9akhiqzz5/root/content")
index=activity AND rg_functionality="Source Code Repository" AND Message NOT NULL AND Message IN ("https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbalfothzfrv9dvu9iufdnlxhpzg8xrxfycku_zt1bm1qwv2q/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufrlnnfwazddnhp2yy1seku_zt1ssfzjsk4/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbaffnudzlzzhhukzin0xvmunpq2yzee5vvfu_zt1wz2liaum/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufriznpnvu14tmjjbkm2q0k_zt1wzellsje/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbdtjtetf4adz0ofhnujjnem1zog5oundvltzcp2u9akhiqzz5/root/content")
index=activity AND rg_functionality="Source Code Repository" AND Requestcontext NOT NULL AND Requestcontext IN ("https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbalfothzfrv9dvu9iufdnlxhpzg8xrxfycku_zt1bm1qwv2q/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufrlnnfwazddnhp2yy1seku_zt1ssfzjsk4/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbaffnudzlzzhhukzin0xvmunpq2yzee5vvfu_zt1wz2liaum/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufriznpnvu14tmjjbkm2q0k_zt1wzellsje/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbdtjtetf4adz0ofhnujjnem1zog5oundvltzcp2u9akhiqzz5/root/content")
index=activity AND rg_functionality="Source Code Repository" AND customstring3 NOT NULL AND customstring3 IN ("https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbalfothzfrv9dvu9iufdnlxhpzg8xrxfycku_zt1bm1qwv2q/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufrlnnfwazddnhp2yy1seku_zt1ssfzjsk4/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbaffnudzlzzhhukzin0xvmunpq2yzee5vvfu_zt1wz2liaum/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufriznpnvu14tmjjbkm2q0k_zt1wzellsje/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbdtjtetf4adz0ofhnujjnem1zog5oundvltzcp2u9akhiqzz5/root/content")
index=activity AND rg_functionality="Authentication / VPN" AND requesturl NOT NULL AND requesturl IN ("https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbalfothzfrv9dvu9iufdnlxhpzg8xrxfycku_zt1bm1qwv2q/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufrlnnfwazddnhp2yy1seku_zt1ssfzjsk4/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbaffnudzlzzhhukzin0xvmunpq2yzee5vvfu_zt1wz2liaum/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufriznpnvu14tmjjbkm2q0k_zt1wzellsje/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbdtjtetf4adz0ofhnujjnem1zog5oundvltzcp2u9akhiqzz5/root/content")
index=activity AND rg_functionality="Authentication / VPN" AND Message NOT NULL AND Message IN ("https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbalfothzfrv9dvu9iufdnlxhpzg8xrxfycku_zt1bm1qwv2q/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufrlnnfwazddnhp2yy1seku_zt1ssfzjsk4/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbaffnudzlzzhhukzin0xvmunpq2yzee5vvfu_zt1wz2liaum/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufriznpnvu14tmjjbkm2q0k_zt1wzellsje/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbdtjtetf4adz0ofhnujjnem1zog5oundvltzcp2u9akhiqzz5/root/content")
index=activity AND rg_functionality="Authentication / VPN" AND Requestcontext NOT NULL AND Requestcontext IN ("https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbalfothzfrv9dvu9iufdnlxhpzg8xrxfycku_zt1bm1qwv2q/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufrlnnfwazddnhp2yy1seku_zt1ssfzjsk4/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbaffnudzlzzhhukzin0xvmunpq2yzee5vvfu_zt1wz2liaum/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufriznpnvu14tmjjbkm2q0k_zt1wzellsje/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbdtjtetf4adz0ofhnujjnem1zog5oundvltzcp2u9akhiqzz5/root/content")
index=activity AND rg_functionality="Authentication / VPN" AND customstring3 NOT NULL AND customstring3 IN ("https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbalfothzfrv9dvu9iufdnlxhpzg8xrxfycku_zt1bm1qwv2q/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufrlnnfwazddnhp2yy1seku_zt1ssfzjsk4/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbaffnudzlzzhhukzin0xvmunpq2yzee5vvfu_zt1wz2liaum/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufriznpnvu14tmjjbkm2q0k_zt1wzellsje/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbdtjtetf4adz0ofhnujjnem1zog5oundvltzcp2u9akhiqzz5/root/content")
index=activity AND rg_functionality="Cloud Content Management System" AND requesturl NOT NULL AND requesturl IN ("https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbalfothzfrv9dvu9iufdnlxhpzg8xrxfycku_zt1bm1qwv2q/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufrlnnfwazddnhp2yy1seku_zt1ssfzjsk4/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbaffnudzlzzhhukzin0xvmunpq2yzee5vvfu_zt1wz2liaum/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufriznpnvu14tmjjbkm2q0k_zt1wzellsje/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbdtjtetf4adz0ofhnujjnem1zog5oundvltzcp2u9akhiqzz5/root/content")
index=activity AND rg_functionality="Cloud Content Management System" AND Message NOT NULL AND Message IN ("https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbalfothzfrv9dvu9iufdnlxhpzg8xrxfycku_zt1bm1qwv2q/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufrlnnfwazddnhp2yy1seku_zt1ssfzjsk4/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbaffnudzlzzhhukzin0xvmunpq2yzee5vvfu_zt1wz2liaum/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufriznpnvu14tmjjbkm2q0k_zt1wzellsje/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbdtjtetf4adz0ofhnujjnem1zog5oundvltzcp2u9akhiqzz5/root/content")
index=activity AND rg_functionality="Cloud Content Management System" AND Requestcontext NOT NULL AND Requestcontext IN ("https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbalfothzfrv9dvu9iufdnlxhpzg8xrxfycku_zt1bm1qwv2q/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufrlnnfwazddnhp2yy1seku_zt1ssfzjsk4/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbaffnudzlzzhhukzin0xvmunpq2yzee5vvfu_zt1wz2liaum/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufriznpnvu14tmjjbkm2q0k_zt1wzellsje/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbdtjtetf4adz0ofhnujjnem1zog5oundvltzcp2u9akhiqzz5/root/content")
index=activity AND rg_functionality="Cloud Content Management System" AND customstring3 NOT NULL AND customstring3 IN ("https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbalfothzfrv9dvu9iufdnlxhpzg8xrxfycku_zt1bm1qwv2q/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufrlnnfwazddnhp2yy1seku_zt1ssfzjsk4/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbaffnudzlzzhhukzin0xvmunpq2yzee5vvfu_zt1wz2liaum/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufriznpnvu14tmjjbkm2q0k_zt1wzellsje/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbdtjtetf4adz0ofhnujjnem1zog5oundvltzcp2u9akhiqzz5/root/content")
index=activity AND rg_functionality="Cloud Services / Applications" AND requesturl NOT NULL AND requesturl IN ("https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbalfothzfrv9dvu9iufdnlxhpzg8xrxfycku_zt1bm1qwv2q/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufrlnnfwazddnhp2yy1seku_zt1ssfzjsk4/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbaffnudzlzzhhukzin0xvmunpq2yzee5vvfu_zt1wz2liaum/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufriznpnvu14tmjjbkm2q0k_zt1wzellsje/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbdtjtetf4adz0ofhnujjnem1zog5oundvltzcp2u9akhiqzz5/root/content")
index=activity AND rg_functionality="Cloud Services / Applications" AND Message NOT NULL AND Message IN ("https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbalfothzfrv9dvu9iufdnlxhpzg8xrxfycku_zt1bm1qwv2q/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufrlnnfwazddnhp2yy1seku_zt1ssfzjsk4/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbaffnudzlzzhhukzin0xvmunpq2yzee5vvfu_zt1wz2liaum/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufriznpnvu14tmjjbkm2q0k_zt1wzellsje/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbdtjtetf4adz0ofhnujjnem1zog5oundvltzcp2u9akhiqzz5/root/content")
index=activity AND rg_functionality="Cloud Services / Applications" AND Requestcontext NOT NULL AND Requestcontext IN ("https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbalfothzfrv9dvu9iufdnlxhpzg8xrxfycku_zt1bm1qwv2q/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufrlnnfwazddnhp2yy1seku_zt1ssfzjsk4/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbaffnudzlzzhhukzin0xvmunpq2yzee5vvfu_zt1wz2liaum/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufriznpnvu14tmjjbkm2q0k_zt1wzellsje/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbdtjtetf4adz0ofhnujjnem1zog5oundvltzcp2u9akhiqzz5/root/content")
index=activity AND rg_functionality="Cloud Services / Applications" AND customstring3 NOT NULL AND customstring3 IN ("https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbalfothzfrv9dvu9iufdnlxhpzg8xrxfycku_zt1bm1qwv2q/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufrlnnfwazddnhp2yy1seku_zt1ssfzjsk4/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbaffnudzlzzhhukzin0xvmunpq2yzee5vvfu_zt1wz2liaum/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufriznpnvu14tmjjbkm2q0k_zt1wzellsje/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbdtjtetf4adz0ofhnujjnem1zog5oundvltzcp2u9akhiqzz5/root/content")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND requesturl NOT NULL AND requesturl IN ("https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbalfothzfrv9dvu9iufdnlxhpzg8xrxfycku_zt1bm1qwv2q/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufrlnnfwazddnhp2yy1seku_zt1ssfzjsk4/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbaffnudzlzzhhukzin0xvmunpq2yzee5vvfu_zt1wz2liaum/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufriznpnvu14tmjjbkm2q0k_zt1wzellsje/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbdtjtetf4adz0ofhnujjnem1zog5oundvltzcp2u9akhiqzz5/root/content")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND Message NOT NULL AND Message IN ("https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbalfothzfrv9dvu9iufdnlxhpzg8xrxfycku_zt1bm1qwv2q/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufrlnnfwazddnhp2yy1seku_zt1ssfzjsk4/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbaffnudzlzzhhukzin0xvmunpq2yzee5vvfu_zt1wz2liaum/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufriznpnvu14tmjjbkm2q0k_zt1wzellsje/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbdtjtetf4adz0ofhnujjnem1zog5oundvltzcp2u9akhiqzz5/root/content")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND Requestcontext NOT NULL AND Requestcontext IN ("https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbalfothzfrv9dvu9iufdnlxhpzg8xrxfycku_zt1bm1qwv2q/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufrlnnfwazddnhp2yy1seku_zt1ssfzjsk4/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbaffnudzlzzhhukzin0xvmunpq2yzee5vvfu_zt1wz2liaum/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufriznpnvu14tmjjbkm2q0k_zt1wzellsje/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbdtjtetf4adz0ofhnujjnem1zog5oundvltzcp2u9akhiqzz5/root/content")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbalfothzfrv9dvu9iufdnlxhpzg8xrxfycku_zt1bm1qwv2q/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufrlnnfwazddnhp2yy1seku_zt1ssfzjsk4/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbaffnudzlzzhhukzin0xvmunpq2yzee5vvfu_zt1wz2liaum/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufriznpnvu14tmjjbkm2q0k_zt1wzellsje/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbdtjtetf4adz0ofhnujjnem1zog5oundvltzcp2u9akhiqzz5/root/content")
index=activity AND rg_functionality="Web Application Firewall" AND requesturl NOT NULL AND requesturl IN ("https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbalfothzfrv9dvu9iufdnlxhpzg8xrxfycku_zt1bm1qwv2q/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufrlnnfwazddnhp2yy1seku_zt1ssfzjsk4/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbaffnudzlzzhhukzin0xvmunpq2yzee5vvfu_zt1wz2liaum/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufriznpnvu14tmjjbkm2q0k_zt1wzellsje/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbdtjtetf4adz0ofhnujjnem1zog5oundvltzcp2u9akhiqzz5/root/content")
index=activity AND rg_functionality="Web Application Firewall" AND Message NOT NULL AND Message IN ("https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbalfothzfrv9dvu9iufdnlxhpzg8xrxfycku_zt1bm1qwv2q/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufrlnnfwazddnhp2yy1seku_zt1ssfzjsk4/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbaffnudzlzzhhukzin0xvmunpq2yzee5vvfu_zt1wz2liaum/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufriznpnvu14tmjjbkm2q0k_zt1wzellsje/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbdtjtetf4adz0ofhnujjnem1zog5oundvltzcp2u9akhiqzz5/root/content")
index=activity AND rg_functionality="Web Application Firewall" AND Requestcontext NOT NULL AND Requestcontext IN ("https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbalfothzfrv9dvu9iufdnlxhpzg8xrxfycku_zt1bm1qwv2q/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufrlnnfwazddnhp2yy1seku_zt1ssfzjsk4/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbaffnudzlzzhhukzin0xvmunpq2yzee5vvfu_zt1wz2liaum/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufriznpnvu14tmjjbkm2q0k_zt1wzellsje/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbdtjtetf4adz0ofhnujjnem1zog5oundvltzcp2u9akhiqzz5/root/content")
index=activity AND rg_functionality="Web Application Firewall" AND customstring3 NOT NULL AND customstring3 IN ("https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbalfothzfrv9dvu9iufdnlxhpzg8xrxfycku_zt1bm1qwv2q/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufrlnnfwazddnhp2yy1seku_zt1ssfzjsk4/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbaffnudzlzzhhukzin0xvmunpq2yzee5vvfu_zt1wz2liaum/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufriznpnvu14tmjjbkm2q0k_zt1wzellsje/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbdtjtetf4adz0ofhnujjnem1zog5oundvltzcp2u9akhiqzz5/root/content")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND requesturl NOT NULL AND requesturl IN ("https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbalfothzfrv9dvu9iufdnlxhpzg8xrxfycku_zt1bm1qwv2q/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufrlnnfwazddnhp2yy1seku_zt1ssfzjsk4/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbaffnudzlzzhhukzin0xvmunpq2yzee5vvfu_zt1wz2liaum/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufriznpnvu14tmjjbkm2q0k_zt1wzellsje/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbdtjtetf4adz0ofhnujjnem1zog5oundvltzcp2u9akhiqzz5/root/content")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND Message NOT NULL AND Message IN ("https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbalfothzfrv9dvu9iufdnlxhpzg8xrxfycku_zt1bm1qwv2q/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufrlnnfwazddnhp2yy1seku_zt1ssfzjsk4/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbaffnudzlzzhhukzin0xvmunpq2yzee5vvfu_zt1wz2liaum/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufriznpnvu14tmjjbkm2q0k_zt1wzellsje/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbdtjtetf4adz0ofhnujjnem1zog5oundvltzcp2u9akhiqzz5/root/content")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND Requestcontext NOT NULL AND Requestcontext IN ("https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbalfothzfrv9dvu9iufdnlxhpzg8xrxfycku_zt1bm1qwv2q/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufrlnnfwazddnhp2yy1seku_zt1ssfzjsk4/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbaffnudzlzzhhukzin0xvmunpq2yzee5vvfu_zt1wz2liaum/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufriznpnvu14tmjjbkm2q0k_zt1wzellsje/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbdtjtetf4adz0ofhnujjnem1zog5oundvltzcp2u9akhiqzz5/root/content")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND customstring3 NOT NULL AND customstring3 IN ("https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbalfothzfrv9dvu9iufdnlxhpzg8xrxfycku_zt1bm1qwv2q/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufrlnnfwazddnhp2yy1seku_zt1ssfzjsk4/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbaffnudzlzzhhukzin0xvmunpq2yzee5vvfu_zt1wz2liaum/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl2kvcyfbafhfwexku05nufriznpnvu14tmjjbkm2q0k_zt1wzellsje/root/content","https://api.onedrive.com/v1.0/shares/u!ahr0chm6ly8xzhj2lm1zl3uvcyfbdtjtetf4adz0ofhnujjnem1zog5oundvltzcp2u9akhiqzz5/root/content")
