index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("3634d1333e958412814806a5d65f1d82536d94cac21ec44b8aba137921ae3709","5828ab3abf72c93838a03fb5a9ca271ddbb66ad4b3a950668a22cd8f37ac9b04","6c5e51e7aeb1836d801424f20ffd56734cdc35a75ae3cca88002f94c40949a27","23186719325c87eb4e17aae0db502e78fb24598e97c8a9c151d7c347e72c0331","a7a02c6f5073133added3bfc9c67ca385168ba35469752fcddf5e1ed5fcef1ce","35c64a2111c0b8e728ee82db3d727319720e612e9a3dfe85d445f5b90fc1485a","84f8e3f996cf907f71ee4823c1bc91a82589c5e4fcd98a9084e51b02ad3515dd","a86fe93e1a4c451c11b628f622b80770f40254de4a050bbe8e4caae7ef89dfa4")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("3634d1333e958412814806a5d65f1d82536d94cac21ec44b8aba137921ae3709","5828ab3abf72c93838a03fb5a9ca271ddbb66ad4b3a950668a22cd8f37ac9b04","6c5e51e7aeb1836d801424f20ffd56734cdc35a75ae3cca88002f94c40949a27","23186719325c87eb4e17aae0db502e78fb24598e97c8a9c151d7c347e72c0331","a7a02c6f5073133added3bfc9c67ca385168ba35469752fcddf5e1ed5fcef1ce","35c64a2111c0b8e728ee82db3d727319720e612e9a3dfe85d445f5b90fc1485a","84f8e3f996cf907f71ee4823c1bc91a82589c5e4fcd98a9084e51b02ad3515dd","a86fe93e1a4c451c11b628f622b80770f40254de4a050bbe8e4caae7ef89dfa4")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("3634d1333e958412814806a5d65f1d82536d94cac21ec44b8aba137921ae3709","5828ab3abf72c93838a03fb5a9ca271ddbb66ad4b3a950668a22cd8f37ac9b04","6c5e51e7aeb1836d801424f20ffd56734cdc35a75ae3cca88002f94c40949a27","23186719325c87eb4e17aae0db502e78fb24598e97c8a9c151d7c347e72c0331","a7a02c6f5073133added3bfc9c67ca385168ba35469752fcddf5e1ed5fcef1ce","35c64a2111c0b8e728ee82db3d727319720e612e9a3dfe85d445f5b90fc1485a","84f8e3f996cf907f71ee4823c1bc91a82589c5e4fcd98a9084e51b02ad3515dd","a86fe93e1a4c451c11b628f622b80770f40254de4a050bbe8e4caae7ef89dfa4")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring64 NOT NULL AND customstring64 IN ("3634d1333e958412814806a5d65f1d82536d94cac21ec44b8aba137921ae3709","5828ab3abf72c93838a03fb5a9ca271ddbb66ad4b3a950668a22cd8f37ac9b04","6c5e51e7aeb1836d801424f20ffd56734cdc35a75ae3cca88002f94c40949a27","23186719325c87eb4e17aae0db502e78fb24598e97c8a9c151d7c347e72c0331","a7a02c6f5073133added3bfc9c67ca385168ba35469752fcddf5e1ed5fcef1ce","35c64a2111c0b8e728ee82db3d727319720e612e9a3dfe85d445f5b90fc1485a","84f8e3f996cf907f71ee4823c1bc91a82589c5e4fcd98a9084e51b02ad3515dd","a86fe93e1a4c451c11b628f622b80770f40254de4a050bbe8e4caae7ef89dfa4")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("3634d1333e958412814806a5d65f1d82536d94cac21ec44b8aba137921ae3709","5828ab3abf72c93838a03fb5a9ca271ddbb66ad4b3a950668a22cd8f37ac9b04","6c5e51e7aeb1836d801424f20ffd56734cdc35a75ae3cca88002f94c40949a27","23186719325c87eb4e17aae0db502e78fb24598e97c8a9c151d7c347e72c0331","a7a02c6f5073133added3bfc9c67ca385168ba35469752fcddf5e1ed5fcef1ce","35c64a2111c0b8e728ee82db3d727319720e612e9a3dfe85d445f5b90fc1485a","84f8e3f996cf907f71ee4823c1bc91a82589c5e4fcd98a9084e51b02ad3515dd","a86fe93e1a4c451c11b628f622b80770f40254de4a050bbe8e4caae7ef89dfa4")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("3634d1333e958412814806a5d65f1d82536d94cac21ec44b8aba137921ae3709","5828ab3abf72c93838a03fb5a9ca271ddbb66ad4b3a950668a22cd8f37ac9b04","6c5e51e7aeb1836d801424f20ffd56734cdc35a75ae3cca88002f94c40949a27","23186719325c87eb4e17aae0db502e78fb24598e97c8a9c151d7c347e72c0331","a7a02c6f5073133added3bfc9c67ca385168ba35469752fcddf5e1ed5fcef1ce","35c64a2111c0b8e728ee82db3d727319720e612e9a3dfe85d445f5b90fc1485a","84f8e3f996cf907f71ee4823c1bc91a82589c5e4fcd98a9084e51b02ad3515dd","a86fe93e1a4c451c11b628f622b80770f40254de4a050bbe8e4caae7ef89dfa4")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("3634d1333e958412814806a5d65f1d82536d94cac21ec44b8aba137921ae3709","5828ab3abf72c93838a03fb5a9ca271ddbb66ad4b3a950668a22cd8f37ac9b04","6c5e51e7aeb1836d801424f20ffd56734cdc35a75ae3cca88002f94c40949a27","23186719325c87eb4e17aae0db502e78fb24598e97c8a9c151d7c347e72c0331","a7a02c6f5073133added3bfc9c67ca385168ba35469752fcddf5e1ed5fcef1ce","35c64a2111c0b8e728ee82db3d727319720e612e9a3dfe85d445f5b90fc1485a","84f8e3f996cf907f71ee4823c1bc91a82589c5e4fcd98a9084e51b02ad3515dd","a86fe93e1a4c451c11b628f622b80770f40254de4a050bbe8e4caae7ef89dfa4")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("3634d1333e958412814806a5d65f1d82536d94cac21ec44b8aba137921ae3709","5828ab3abf72c93838a03fb5a9ca271ddbb66ad4b3a950668a22cd8f37ac9b04","6c5e51e7aeb1836d801424f20ffd56734cdc35a75ae3cca88002f94c40949a27","23186719325c87eb4e17aae0db502e78fb24598e97c8a9c151d7c347e72c0331","a7a02c6f5073133added3bfc9c67ca385168ba35469752fcddf5e1ed5fcef1ce","35c64a2111c0b8e728ee82db3d727319720e612e9a3dfe85d445f5b90fc1485a","84f8e3f996cf907f71ee4823c1bc91a82589c5e4fcd98a9084e51b02ad3515dd","a86fe93e1a4c451c11b628f622b80770f40254de4a050bbe8e4caae7ef89dfa4")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("3634d1333e958412814806a5d65f1d82536d94cac21ec44b8aba137921ae3709","5828ab3abf72c93838a03fb5a9ca271ddbb66ad4b3a950668a22cd8f37ac9b04","6c5e51e7aeb1836d801424f20ffd56734cdc35a75ae3cca88002f94c40949a27","23186719325c87eb4e17aae0db502e78fb24598e97c8a9c151d7c347e72c0331","a7a02c6f5073133added3bfc9c67ca385168ba35469752fcddf5e1ed5fcef1ce","35c64a2111c0b8e728ee82db3d727319720e612e9a3dfe85d445f5b90fc1485a","84f8e3f996cf907f71ee4823c1bc91a82589c5e4fcd98a9084e51b02ad3515dd","a86fe93e1a4c451c11b628f622b80770f40254de4a050bbe8e4caae7ef89dfa4")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("3634d1333e958412814806a5d65f1d82536d94cac21ec44b8aba137921ae3709","5828ab3abf72c93838a03fb5a9ca271ddbb66ad4b3a950668a22cd8f37ac9b04","6c5e51e7aeb1836d801424f20ffd56734cdc35a75ae3cca88002f94c40949a27","23186719325c87eb4e17aae0db502e78fb24598e97c8a9c151d7c347e72c0331","a7a02c6f5073133added3bfc9c67ca385168ba35469752fcddf5e1ed5fcef1ce","35c64a2111c0b8e728ee82db3d727319720e612e9a3dfe85d445f5b90fc1485a","84f8e3f996cf907f71ee4823c1bc91a82589c5e4fcd98a9084e51b02ad3515dd","a86fe93e1a4c451c11b628f622b80770f40254de4a050bbe8e4caae7ef89dfa4")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("3634d1333e958412814806a5d65f1d82536d94cac21ec44b8aba137921ae3709","5828ab3abf72c93838a03fb5a9ca271ddbb66ad4b3a950668a22cd8f37ac9b04","6c5e51e7aeb1836d801424f20ffd56734cdc35a75ae3cca88002f94c40949a27","23186719325c87eb4e17aae0db502e78fb24598e97c8a9c151d7c347e72c0331","a7a02c6f5073133added3bfc9c67ca385168ba35469752fcddf5e1ed5fcef1ce","35c64a2111c0b8e728ee82db3d727319720e612e9a3dfe85d445f5b90fc1485a","84f8e3f996cf907f71ee4823c1bc91a82589c5e4fcd98a9084e51b02ad3515dd","a86fe93e1a4c451c11b628f622b80770f40254de4a050bbe8e4caae7ef89dfa4")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("3634d1333e958412814806a5d65f1d82536d94cac21ec44b8aba137921ae3709","5828ab3abf72c93838a03fb5a9ca271ddbb66ad4b3a950668a22cd8f37ac9b04","6c5e51e7aeb1836d801424f20ffd56734cdc35a75ae3cca88002f94c40949a27","23186719325c87eb4e17aae0db502e78fb24598e97c8a9c151d7c347e72c0331","a7a02c6f5073133added3bfc9c67ca385168ba35469752fcddf5e1ed5fcef1ce","35c64a2111c0b8e728ee82db3d727319720e612e9a3dfe85d445f5b90fc1485a","84f8e3f996cf907f71ee4823c1bc91a82589c5e4fcd98a9084e51b02ad3515dd","a86fe93e1a4c451c11b628f622b80770f40254de4a050bbe8e4caae7ef89dfa4")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("3634d1333e958412814806a5d65f1d82536d94cac21ec44b8aba137921ae3709","5828ab3abf72c93838a03fb5a9ca271ddbb66ad4b3a950668a22cd8f37ac9b04","6c5e51e7aeb1836d801424f20ffd56734cdc35a75ae3cca88002f94c40949a27","23186719325c87eb4e17aae0db502e78fb24598e97c8a9c151d7c347e72c0331","a7a02c6f5073133added3bfc9c67ca385168ba35469752fcddf5e1ed5fcef1ce","35c64a2111c0b8e728ee82db3d727319720e612e9a3dfe85d445f5b90fc1485a","84f8e3f996cf907f71ee4823c1bc91a82589c5e4fcd98a9084e51b02ad3515dd","a86fe93e1a4c451c11b628f622b80770f40254de4a050bbe8e4caae7ef89dfa4")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("3634d1333e958412814806a5d65f1d82536d94cac21ec44b8aba137921ae3709","5828ab3abf72c93838a03fb5a9ca271ddbb66ad4b3a950668a22cd8f37ac9b04","6c5e51e7aeb1836d801424f20ffd56734cdc35a75ae3cca88002f94c40949a27","23186719325c87eb4e17aae0db502e78fb24598e97c8a9c151d7c347e72c0331","a7a02c6f5073133added3bfc9c67ca385168ba35469752fcddf5e1ed5fcef1ce","35c64a2111c0b8e728ee82db3d727319720e612e9a3dfe85d445f5b90fc1485a","84f8e3f996cf907f71ee4823c1bc91a82589c5e4fcd98a9084e51b02ad3515dd","a86fe93e1a4c451c11b628f622b80770f40254de4a050bbe8e4caae7ef89dfa4")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("3634d1333e958412814806a5d65f1d82536d94cac21ec44b8aba137921ae3709","5828ab3abf72c93838a03fb5a9ca271ddbb66ad4b3a950668a22cd8f37ac9b04","6c5e51e7aeb1836d801424f20ffd56734cdc35a75ae3cca88002f94c40949a27","23186719325c87eb4e17aae0db502e78fb24598e97c8a9c151d7c347e72c0331","a7a02c6f5073133added3bfc9c67ca385168ba35469752fcddf5e1ed5fcef1ce","35c64a2111c0b8e728ee82db3d727319720e612e9a3dfe85d445f5b90fc1485a","84f8e3f996cf907f71ee4823c1bc91a82589c5e4fcd98a9084e51b02ad3515dd","a86fe93e1a4c451c11b628f622b80770f40254de4a050bbe8e4caae7ef89dfa4")
index=activity AND rg_functionality="Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("3634d1333e958412814806a5d65f1d82536d94cac21ec44b8aba137921ae3709","5828ab3abf72c93838a03fb5a9ca271ddbb66ad4b3a950668a22cd8f37ac9b04","6c5e51e7aeb1836d801424f20ffd56734cdc35a75ae3cca88002f94c40949a27","23186719325c87eb4e17aae0db502e78fb24598e97c8a9c151d7c347e72c0331","a7a02c6f5073133added3bfc9c67ca385168ba35469752fcddf5e1ed5fcef1ce","35c64a2111c0b8e728ee82db3d727319720e612e9a3dfe85d445f5b90fc1485a","84f8e3f996cf907f71ee4823c1bc91a82589c5e4fcd98a9084e51b02ad3515dd","a86fe93e1a4c451c11b628f622b80770f40254de4a050bbe8e4caae7ef89dfa4")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("3634d1333e958412814806a5d65f1d82536d94cac21ec44b8aba137921ae3709","5828ab3abf72c93838a03fb5a9ca271ddbb66ad4b3a950668a22cd8f37ac9b04","6c5e51e7aeb1836d801424f20ffd56734cdc35a75ae3cca88002f94c40949a27","23186719325c87eb4e17aae0db502e78fb24598e97c8a9c151d7c347e72c0331","a7a02c6f5073133added3bfc9c67ca385168ba35469752fcddf5e1ed5fcef1ce","35c64a2111c0b8e728ee82db3d727319720e612e9a3dfe85d445f5b90fc1485a","84f8e3f996cf907f71ee4823c1bc91a82589c5e4fcd98a9084e51b02ad3515dd","a86fe93e1a4c451c11b628f622b80770f40254de4a050bbe8e4caae7ef89dfa4")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("3634d1333e958412814806a5d65f1d82536d94cac21ec44b8aba137921ae3709","5828ab3abf72c93838a03fb5a9ca271ddbb66ad4b3a950668a22cd8f37ac9b04","6c5e51e7aeb1836d801424f20ffd56734cdc35a75ae3cca88002f94c40949a27","23186719325c87eb4e17aae0db502e78fb24598e97c8a9c151d7c347e72c0331","a7a02c6f5073133added3bfc9c67ca385168ba35469752fcddf5e1ed5fcef1ce","35c64a2111c0b8e728ee82db3d727319720e612e9a3dfe85d445f5b90fc1485a","84f8e3f996cf907f71ee4823c1bc91a82589c5e4fcd98a9084e51b02ad3515dd","a86fe93e1a4c451c11b628f622b80770f40254de4a050bbe8e4caae7ef89dfa4")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("3634d1333e958412814806a5d65f1d82536d94cac21ec44b8aba137921ae3709","5828ab3abf72c93838a03fb5a9ca271ddbb66ad4b3a950668a22cd8f37ac9b04","6c5e51e7aeb1836d801424f20ffd56734cdc35a75ae3cca88002f94c40949a27","23186719325c87eb4e17aae0db502e78fb24598e97c8a9c151d7c347e72c0331","a7a02c6f5073133added3bfc9c67ca385168ba35469752fcddf5e1ed5fcef1ce","35c64a2111c0b8e728ee82db3d727319720e612e9a3dfe85d445f5b90fc1485a","84f8e3f996cf907f71ee4823c1bc91a82589c5e4fcd98a9084e51b02ad3515dd","a86fe93e1a4c451c11b628f622b80770f40254de4a050bbe8e4caae7ef89dfa4")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("3634d1333e958412814806a5d65f1d82536d94cac21ec44b8aba137921ae3709","5828ab3abf72c93838a03fb5a9ca271ddbb66ad4b3a950668a22cd8f37ac9b04","6c5e51e7aeb1836d801424f20ffd56734cdc35a75ae3cca88002f94c40949a27","23186719325c87eb4e17aae0db502e78fb24598e97c8a9c151d7c347e72c0331","a7a02c6f5073133added3bfc9c67ca385168ba35469752fcddf5e1ed5fcef1ce","35c64a2111c0b8e728ee82db3d727319720e612e9a3dfe85d445f5b90fc1485a","84f8e3f996cf907f71ee4823c1bc91a82589c5e4fcd98a9084e51b02ad3515dd","a86fe93e1a4c451c11b628f622b80770f40254de4a050bbe8e4caae7ef89dfa4")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("3634d1333e958412814806a5d65f1d82536d94cac21ec44b8aba137921ae3709","5828ab3abf72c93838a03fb5a9ca271ddbb66ad4b3a950668a22cd8f37ac9b04","6c5e51e7aeb1836d801424f20ffd56734cdc35a75ae3cca88002f94c40949a27","23186719325c87eb4e17aae0db502e78fb24598e97c8a9c151d7c347e72c0331","a7a02c6f5073133added3bfc9c67ca385168ba35469752fcddf5e1ed5fcef1ce","35c64a2111c0b8e728ee82db3d727319720e612e9a3dfe85d445f5b90fc1485a","84f8e3f996cf907f71ee4823c1bc91a82589c5e4fcd98a9084e51b02ad3515dd","a86fe93e1a4c451c11b628f622b80770f40254de4a050bbe8e4caae7ef89dfa4")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("3634d1333e958412814806a5d65f1d82536d94cac21ec44b8aba137921ae3709","5828ab3abf72c93838a03fb5a9ca271ddbb66ad4b3a950668a22cd8f37ac9b04","6c5e51e7aeb1836d801424f20ffd56734cdc35a75ae3cca88002f94c40949a27","23186719325c87eb4e17aae0db502e78fb24598e97c8a9c151d7c347e72c0331","a7a02c6f5073133added3bfc9c67ca385168ba35469752fcddf5e1ed5fcef1ce","35c64a2111c0b8e728ee82db3d727319720e612e9a3dfe85d445f5b90fc1485a","84f8e3f996cf907f71ee4823c1bc91a82589c5e4fcd98a9084e51b02ad3515dd","a86fe93e1a4c451c11b628f622b80770f40254de4a050bbe8e4caae7ef89dfa4")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("3634d1333e958412814806a5d65f1d82536d94cac21ec44b8aba137921ae3709","5828ab3abf72c93838a03fb5a9ca271ddbb66ad4b3a950668a22cd8f37ac9b04","6c5e51e7aeb1836d801424f20ffd56734cdc35a75ae3cca88002f94c40949a27","23186719325c87eb4e17aae0db502e78fb24598e97c8a9c151d7c347e72c0331","a7a02c6f5073133added3bfc9c67ca385168ba35469752fcddf5e1ed5fcef1ce","35c64a2111c0b8e728ee82db3d727319720e612e9a3dfe85d445f5b90fc1485a","84f8e3f996cf907f71ee4823c1bc91a82589c5e4fcd98a9084e51b02ad3515dd","a86fe93e1a4c451c11b628f622b80770f40254de4a050bbe8e4caae7ef89dfa4")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring64 NOT NULL AND customstring64 IN ("3634d1333e958412814806a5d65f1d82536d94cac21ec44b8aba137921ae3709","5828ab3abf72c93838a03fb5a9ca271ddbb66ad4b3a950668a22cd8f37ac9b04","6c5e51e7aeb1836d801424f20ffd56734cdc35a75ae3cca88002f94c40949a27","23186719325c87eb4e17aae0db502e78fb24598e97c8a9c151d7c347e72c0331","a7a02c6f5073133added3bfc9c67ca385168ba35469752fcddf5e1ed5fcef1ce","35c64a2111c0b8e728ee82db3d727319720e612e9a3dfe85d445f5b90fc1485a","84f8e3f996cf907f71ee4823c1bc91a82589c5e4fcd98a9084e51b02ad3515dd","a86fe93e1a4c451c11b628f622b80770f40254de4a050bbe8e4caae7ef89dfa4")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("3634d1333e958412814806a5d65f1d82536d94cac21ec44b8aba137921ae3709","5828ab3abf72c93838a03fb5a9ca271ddbb66ad4b3a950668a22cd8f37ac9b04","6c5e51e7aeb1836d801424f20ffd56734cdc35a75ae3cca88002f94c40949a27","23186719325c87eb4e17aae0db502e78fb24598e97c8a9c151d7c347e72c0331","a7a02c6f5073133added3bfc9c67ca385168ba35469752fcddf5e1ed5fcef1ce","35c64a2111c0b8e728ee82db3d727319720e612e9a3dfe85d445f5b90fc1485a","84f8e3f996cf907f71ee4823c1bc91a82589c5e4fcd98a9084e51b02ad3515dd","a86fe93e1a4c451c11b628f622b80770f40254de4a050bbe8e4caae7ef89dfa4")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("3634d1333e958412814806a5d65f1d82536d94cac21ec44b8aba137921ae3709","5828ab3abf72c93838a03fb5a9ca271ddbb66ad4b3a950668a22cd8f37ac9b04","6c5e51e7aeb1836d801424f20ffd56734cdc35a75ae3cca88002f94c40949a27","23186719325c87eb4e17aae0db502e78fb24598e97c8a9c151d7c347e72c0331","a7a02c6f5073133added3bfc9c67ca385168ba35469752fcddf5e1ed5fcef1ce","35c64a2111c0b8e728ee82db3d727319720e612e9a3dfe85d445f5b90fc1485a","84f8e3f996cf907f71ee4823c1bc91a82589c5e4fcd98a9084e51b02ad3515dd","a86fe93e1a4c451c11b628f622b80770f40254de4a050bbe8e4caae7ef89dfa4")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("3634d1333e958412814806a5d65f1d82536d94cac21ec44b8aba137921ae3709","5828ab3abf72c93838a03fb5a9ca271ddbb66ad4b3a950668a22cd8f37ac9b04","6c5e51e7aeb1836d801424f20ffd56734cdc35a75ae3cca88002f94c40949a27","23186719325c87eb4e17aae0db502e78fb24598e97c8a9c151d7c347e72c0331","a7a02c6f5073133added3bfc9c67ca385168ba35469752fcddf5e1ed5fcef1ce","35c64a2111c0b8e728ee82db3d727319720e612e9a3dfe85d445f5b90fc1485a","84f8e3f996cf907f71ee4823c1bc91a82589c5e4fcd98a9084e51b02ad3515dd","a86fe93e1a4c451c11b628f622b80770f40254de4a050bbe8e4caae7ef89dfa4")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring64 NOT NULL AND customstring64 IN ("3634d1333e958412814806a5d65f1d82536d94cac21ec44b8aba137921ae3709","5828ab3abf72c93838a03fb5a9ca271ddbb66ad4b3a950668a22cd8f37ac9b04","6c5e51e7aeb1836d801424f20ffd56734cdc35a75ae3cca88002f94c40949a27","23186719325c87eb4e17aae0db502e78fb24598e97c8a9c151d7c347e72c0331","a7a02c6f5073133added3bfc9c67ca385168ba35469752fcddf5e1ed5fcef1ce","35c64a2111c0b8e728ee82db3d727319720e612e9a3dfe85d445f5b90fc1485a","84f8e3f996cf907f71ee4823c1bc91a82589c5e4fcd98a9084e51b02ad3515dd","a86fe93e1a4c451c11b628f622b80770f40254de4a050bbe8e4caae7ef89dfa4")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("3634d1333e958412814806a5d65f1d82536d94cac21ec44b8aba137921ae3709","5828ab3abf72c93838a03fb5a9ca271ddbb66ad4b3a950668a22cd8f37ac9b04","6c5e51e7aeb1836d801424f20ffd56734cdc35a75ae3cca88002f94c40949a27","23186719325c87eb4e17aae0db502e78fb24598e97c8a9c151d7c347e72c0331","a7a02c6f5073133added3bfc9c67ca385168ba35469752fcddf5e1ed5fcef1ce","35c64a2111c0b8e728ee82db3d727319720e612e9a3dfe85d445f5b90fc1485a","84f8e3f996cf907f71ee4823c1bc91a82589c5e4fcd98a9084e51b02ad3515dd","a86fe93e1a4c451c11b628f622b80770f40254de4a050bbe8e4caae7ef89dfa4")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("3634d1333e958412814806a5d65f1d82536d94cac21ec44b8aba137921ae3709","5828ab3abf72c93838a03fb5a9ca271ddbb66ad4b3a950668a22cd8f37ac9b04","6c5e51e7aeb1836d801424f20ffd56734cdc35a75ae3cca88002f94c40949a27","23186719325c87eb4e17aae0db502e78fb24598e97c8a9c151d7c347e72c0331","a7a02c6f5073133added3bfc9c67ca385168ba35469752fcddf5e1ed5fcef1ce","35c64a2111c0b8e728ee82db3d727319720e612e9a3dfe85d445f5b90fc1485a","84f8e3f996cf907f71ee4823c1bc91a82589c5e4fcd98a9084e51b02ad3515dd","a86fe93e1a4c451c11b628f622b80770f40254de4a050bbe8e4caae7ef89dfa4")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("3634d1333e958412814806a5d65f1d82536d94cac21ec44b8aba137921ae3709","5828ab3abf72c93838a03fb5a9ca271ddbb66ad4b3a950668a22cd8f37ac9b04","6c5e51e7aeb1836d801424f20ffd56734cdc35a75ae3cca88002f94c40949a27","23186719325c87eb4e17aae0db502e78fb24598e97c8a9c151d7c347e72c0331","a7a02c6f5073133added3bfc9c67ca385168ba35469752fcddf5e1ed5fcef1ce","35c64a2111c0b8e728ee82db3d727319720e612e9a3dfe85d445f5b90fc1485a","84f8e3f996cf907f71ee4823c1bc91a82589c5e4fcd98a9084e51b02ad3515dd","a86fe93e1a4c451c11b628f622b80770f40254de4a050bbe8e4caae7ef89dfa4")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring64 NOT NULL AND customstring64 IN ("3634d1333e958412814806a5d65f1d82536d94cac21ec44b8aba137921ae3709","5828ab3abf72c93838a03fb5a9ca271ddbb66ad4b3a950668a22cd8f37ac9b04","6c5e51e7aeb1836d801424f20ffd56734cdc35a75ae3cca88002f94c40949a27","23186719325c87eb4e17aae0db502e78fb24598e97c8a9c151d7c347e72c0331","a7a02c6f5073133added3bfc9c67ca385168ba35469752fcddf5e1ed5fcef1ce","35c64a2111c0b8e728ee82db3d727319720e612e9a3dfe85d445f5b90fc1485a","84f8e3f996cf907f71ee4823c1bc91a82589c5e4fcd98a9084e51b02ad3515dd","a86fe93e1a4c451c11b628f622b80770f40254de4a050bbe8e4caae7ef89dfa4")
index=activity AND rg_functionality="O365 General" AND filehash NOT NULL AND filehash IN ("3634d1333e958412814806a5d65f1d82536d94cac21ec44b8aba137921ae3709","5828ab3abf72c93838a03fb5a9ca271ddbb66ad4b3a950668a22cd8f37ac9b04","6c5e51e7aeb1836d801424f20ffd56734cdc35a75ae3cca88002f94c40949a27","23186719325c87eb4e17aae0db502e78fb24598e97c8a9c151d7c347e72c0331","a7a02c6f5073133added3bfc9c67ca385168ba35469752fcddf5e1ed5fcef1ce","35c64a2111c0b8e728ee82db3d727319720e612e9a3dfe85d445f5b90fc1485a","84f8e3f996cf907f71ee4823c1bc91a82589c5e4fcd98a9084e51b02ad3515dd","a86fe93e1a4c451c11b628f622b80770f40254de4a050bbe8e4caae7ef89dfa4")
index=activity AND rg_functionality="O365 General" AND oldfilehash NOT NULL AND oldfilehash IN ("3634d1333e958412814806a5d65f1d82536d94cac21ec44b8aba137921ae3709","5828ab3abf72c93838a03fb5a9ca271ddbb66ad4b3a950668a22cd8f37ac9b04","6c5e51e7aeb1836d801424f20ffd56734cdc35a75ae3cca88002f94c40949a27","23186719325c87eb4e17aae0db502e78fb24598e97c8a9c151d7c347e72c0331","a7a02c6f5073133added3bfc9c67ca385168ba35469752fcddf5e1ed5fcef1ce","35c64a2111c0b8e728ee82db3d727319720e612e9a3dfe85d445f5b90fc1485a","84f8e3f996cf907f71ee4823c1bc91a82589c5e4fcd98a9084e51b02ad3515dd","a86fe93e1a4c451c11b628f622b80770f40254de4a050bbe8e4caae7ef89dfa4")
index=activity AND rg_functionality="O365 General" AND customstring3 NOT NULL AND customstring3 IN ("3634d1333e958412814806a5d65f1d82536d94cac21ec44b8aba137921ae3709","5828ab3abf72c93838a03fb5a9ca271ddbb66ad4b3a950668a22cd8f37ac9b04","6c5e51e7aeb1836d801424f20ffd56734cdc35a75ae3cca88002f94c40949a27","23186719325c87eb4e17aae0db502e78fb24598e97c8a9c151d7c347e72c0331","a7a02c6f5073133added3bfc9c67ca385168ba35469752fcddf5e1ed5fcef1ce","35c64a2111c0b8e728ee82db3d727319720e612e9a3dfe85d445f5b90fc1485a","84f8e3f996cf907f71ee4823c1bc91a82589c5e4fcd98a9084e51b02ad3515dd","a86fe93e1a4c451c11b628f622b80770f40254de4a050bbe8e4caae7ef89dfa4")
index=activity AND rg_functionality="O365 General" AND customstring64 NOT NULL AND customstring64 IN ("3634d1333e958412814806a5d65f1d82536d94cac21ec44b8aba137921ae3709","5828ab3abf72c93838a03fb5a9ca271ddbb66ad4b3a950668a22cd8f37ac9b04","6c5e51e7aeb1836d801424f20ffd56734cdc35a75ae3cca88002f94c40949a27","23186719325c87eb4e17aae0db502e78fb24598e97c8a9c151d7c347e72c0331","a7a02c6f5073133added3bfc9c67ca385168ba35469752fcddf5e1ed5fcef1ce","35c64a2111c0b8e728ee82db3d727319720e612e9a3dfe85d445f5b90fc1485a","84f8e3f996cf907f71ee4823c1bc91a82589c5e4fcd98a9084e51b02ad3515dd","a86fe93e1a4c451c11b628f622b80770f40254de4a050bbe8e4caae7ef89dfa4")
