index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("d42dfbeba20624a190cf903d28ac5ef5e6ff0f5c120e0f8e14909fec30871134","a8da877ebc4bdefbbe1b5454c448880f36ffad46d6d50083d586eee2da5a31ab","8783eb00acb3196a270c9be1e06d4841bf1686c7f7fc6e009d6172daf0172fc6","7a234d1a2415834290a3a9c7274aadb7253dcfe24edb10b22f1a4a33fd027a08","c6224a579fcef3b67c02dabe55cc486a476e10f7ab9181a91c839fa3de0876fd","8b76c48088a56532f73389933737af0cbe7a404e639ec51136090c7d8c8207c9","48053356188dd419c6212e8adb1d5156460339f07838f2c00357cfd1b4a05278","da480b19c68c2dee819f7b06dbfdba0637fea2c165f3190c2a4994570c3dae2a","910b6f3087b1d5342a2681376c367b53e30cf21dd9409fb1000ffb60893a7051","de099bf0297de8e2fad37acc55c6b0456d1fd98a6fc1fbc381759e82a4e207c3","ee8f394d9e192c453d47a0c57261a03921dcbb97248a67427cb6fc6d8833c8a0","a29c97cb43cd16fad9276e161017ae654eb9cc989081c7584f8f14a3795deb0e","154186b5e0f5fae753a1f90c93a7150927bd03017e55f44abf21a5a08b7ec4ba","38700a77355cdcc7804c53fa95072cd44835ac775fb6d16f8bd345e8ab13d353","576560ada2906c22ca777ac51ed6f2b99086b94bbe44d86b82abe7d77736ba6a","9419a0087f6fc8bccf318d7a2c9f9e709c81df651ab6ba65c10f28c4a34257a7","cd6ad1e880396edc3cdcceba996dd424e96f4961e4884aee52717069537553e8","33e8b5ea7a0900f2d4b56369fda2d29a06a586ddc0c9fd85fc17ea967f83f45d","1af5f9b2b22282891adb17fb9283b47b7ba7a9439fef22cfba0320155dff3ae9")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("d42dfbeba20624a190cf903d28ac5ef5e6ff0f5c120e0f8e14909fec30871134","a8da877ebc4bdefbbe1b5454c448880f36ffad46d6d50083d586eee2da5a31ab","8783eb00acb3196a270c9be1e06d4841bf1686c7f7fc6e009d6172daf0172fc6","7a234d1a2415834290a3a9c7274aadb7253dcfe24edb10b22f1a4a33fd027a08","c6224a579fcef3b67c02dabe55cc486a476e10f7ab9181a91c839fa3de0876fd","8b76c48088a56532f73389933737af0cbe7a404e639ec51136090c7d8c8207c9","48053356188dd419c6212e8adb1d5156460339f07838f2c00357cfd1b4a05278","da480b19c68c2dee819f7b06dbfdba0637fea2c165f3190c2a4994570c3dae2a","910b6f3087b1d5342a2681376c367b53e30cf21dd9409fb1000ffb60893a7051","de099bf0297de8e2fad37acc55c6b0456d1fd98a6fc1fbc381759e82a4e207c3","ee8f394d9e192c453d47a0c57261a03921dcbb97248a67427cb6fc6d8833c8a0","a29c97cb43cd16fad9276e161017ae654eb9cc989081c7584f8f14a3795deb0e","154186b5e0f5fae753a1f90c93a7150927bd03017e55f44abf21a5a08b7ec4ba","38700a77355cdcc7804c53fa95072cd44835ac775fb6d16f8bd345e8ab13d353","576560ada2906c22ca777ac51ed6f2b99086b94bbe44d86b82abe7d77736ba6a","9419a0087f6fc8bccf318d7a2c9f9e709c81df651ab6ba65c10f28c4a34257a7","cd6ad1e880396edc3cdcceba996dd424e96f4961e4884aee52717069537553e8","33e8b5ea7a0900f2d4b56369fda2d29a06a586ddc0c9fd85fc17ea967f83f45d","1af5f9b2b22282891adb17fb9283b47b7ba7a9439fef22cfba0320155dff3ae9")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("d42dfbeba20624a190cf903d28ac5ef5e6ff0f5c120e0f8e14909fec30871134","a8da877ebc4bdefbbe1b5454c448880f36ffad46d6d50083d586eee2da5a31ab","8783eb00acb3196a270c9be1e06d4841bf1686c7f7fc6e009d6172daf0172fc6","7a234d1a2415834290a3a9c7274aadb7253dcfe24edb10b22f1a4a33fd027a08","c6224a579fcef3b67c02dabe55cc486a476e10f7ab9181a91c839fa3de0876fd","8b76c48088a56532f73389933737af0cbe7a404e639ec51136090c7d8c8207c9","48053356188dd419c6212e8adb1d5156460339f07838f2c00357cfd1b4a05278","da480b19c68c2dee819f7b06dbfdba0637fea2c165f3190c2a4994570c3dae2a","910b6f3087b1d5342a2681376c367b53e30cf21dd9409fb1000ffb60893a7051","de099bf0297de8e2fad37acc55c6b0456d1fd98a6fc1fbc381759e82a4e207c3","ee8f394d9e192c453d47a0c57261a03921dcbb97248a67427cb6fc6d8833c8a0","a29c97cb43cd16fad9276e161017ae654eb9cc989081c7584f8f14a3795deb0e","154186b5e0f5fae753a1f90c93a7150927bd03017e55f44abf21a5a08b7ec4ba","38700a77355cdcc7804c53fa95072cd44835ac775fb6d16f8bd345e8ab13d353","576560ada2906c22ca777ac51ed6f2b99086b94bbe44d86b82abe7d77736ba6a","9419a0087f6fc8bccf318d7a2c9f9e709c81df651ab6ba65c10f28c4a34257a7","cd6ad1e880396edc3cdcceba996dd424e96f4961e4884aee52717069537553e8","33e8b5ea7a0900f2d4b56369fda2d29a06a586ddc0c9fd85fc17ea967f83f45d","1af5f9b2b22282891adb17fb9283b47b7ba7a9439fef22cfba0320155dff3ae9")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("d42dfbeba20624a190cf903d28ac5ef5e6ff0f5c120e0f8e14909fec30871134","a8da877ebc4bdefbbe1b5454c448880f36ffad46d6d50083d586eee2da5a31ab","8783eb00acb3196a270c9be1e06d4841bf1686c7f7fc6e009d6172daf0172fc6","7a234d1a2415834290a3a9c7274aadb7253dcfe24edb10b22f1a4a33fd027a08","c6224a579fcef3b67c02dabe55cc486a476e10f7ab9181a91c839fa3de0876fd","8b76c48088a56532f73389933737af0cbe7a404e639ec51136090c7d8c8207c9","48053356188dd419c6212e8adb1d5156460339f07838f2c00357cfd1b4a05278","da480b19c68c2dee819f7b06dbfdba0637fea2c165f3190c2a4994570c3dae2a","910b6f3087b1d5342a2681376c367b53e30cf21dd9409fb1000ffb60893a7051","de099bf0297de8e2fad37acc55c6b0456d1fd98a6fc1fbc381759e82a4e207c3","ee8f394d9e192c453d47a0c57261a03921dcbb97248a67427cb6fc6d8833c8a0","a29c97cb43cd16fad9276e161017ae654eb9cc989081c7584f8f14a3795deb0e","154186b5e0f5fae753a1f90c93a7150927bd03017e55f44abf21a5a08b7ec4ba","38700a77355cdcc7804c53fa95072cd44835ac775fb6d16f8bd345e8ab13d353","576560ada2906c22ca777ac51ed6f2b99086b94bbe44d86b82abe7d77736ba6a","9419a0087f6fc8bccf318d7a2c9f9e709c81df651ab6ba65c10f28c4a34257a7","cd6ad1e880396edc3cdcceba996dd424e96f4961e4884aee52717069537553e8","33e8b5ea7a0900f2d4b56369fda2d29a06a586ddc0c9fd85fc17ea967f83f45d","1af5f9b2b22282891adb17fb9283b47b7ba7a9439fef22cfba0320155dff3ae9")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("d42dfbeba20624a190cf903d28ac5ef5e6ff0f5c120e0f8e14909fec30871134","a8da877ebc4bdefbbe1b5454c448880f36ffad46d6d50083d586eee2da5a31ab","8783eb00acb3196a270c9be1e06d4841bf1686c7f7fc6e009d6172daf0172fc6","7a234d1a2415834290a3a9c7274aadb7253dcfe24edb10b22f1a4a33fd027a08","c6224a579fcef3b67c02dabe55cc486a476e10f7ab9181a91c839fa3de0876fd","8b76c48088a56532f73389933737af0cbe7a404e639ec51136090c7d8c8207c9","48053356188dd419c6212e8adb1d5156460339f07838f2c00357cfd1b4a05278","da480b19c68c2dee819f7b06dbfdba0637fea2c165f3190c2a4994570c3dae2a","910b6f3087b1d5342a2681376c367b53e30cf21dd9409fb1000ffb60893a7051","de099bf0297de8e2fad37acc55c6b0456d1fd98a6fc1fbc381759e82a4e207c3","ee8f394d9e192c453d47a0c57261a03921dcbb97248a67427cb6fc6d8833c8a0","a29c97cb43cd16fad9276e161017ae654eb9cc989081c7584f8f14a3795deb0e","154186b5e0f5fae753a1f90c93a7150927bd03017e55f44abf21a5a08b7ec4ba","38700a77355cdcc7804c53fa95072cd44835ac775fb6d16f8bd345e8ab13d353","576560ada2906c22ca777ac51ed6f2b99086b94bbe44d86b82abe7d77736ba6a","9419a0087f6fc8bccf318d7a2c9f9e709c81df651ab6ba65c10f28c4a34257a7","cd6ad1e880396edc3cdcceba996dd424e96f4961e4884aee52717069537553e8","33e8b5ea7a0900f2d4b56369fda2d29a06a586ddc0c9fd85fc17ea967f83f45d","1af5f9b2b22282891adb17fb9283b47b7ba7a9439fef22cfba0320155dff3ae9")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("d42dfbeba20624a190cf903d28ac5ef5e6ff0f5c120e0f8e14909fec30871134","a8da877ebc4bdefbbe1b5454c448880f36ffad46d6d50083d586eee2da5a31ab","8783eb00acb3196a270c9be1e06d4841bf1686c7f7fc6e009d6172daf0172fc6","7a234d1a2415834290a3a9c7274aadb7253dcfe24edb10b22f1a4a33fd027a08","c6224a579fcef3b67c02dabe55cc486a476e10f7ab9181a91c839fa3de0876fd","8b76c48088a56532f73389933737af0cbe7a404e639ec51136090c7d8c8207c9","48053356188dd419c6212e8adb1d5156460339f07838f2c00357cfd1b4a05278","da480b19c68c2dee819f7b06dbfdba0637fea2c165f3190c2a4994570c3dae2a","910b6f3087b1d5342a2681376c367b53e30cf21dd9409fb1000ffb60893a7051","de099bf0297de8e2fad37acc55c6b0456d1fd98a6fc1fbc381759e82a4e207c3","ee8f394d9e192c453d47a0c57261a03921dcbb97248a67427cb6fc6d8833c8a0","a29c97cb43cd16fad9276e161017ae654eb9cc989081c7584f8f14a3795deb0e","154186b5e0f5fae753a1f90c93a7150927bd03017e55f44abf21a5a08b7ec4ba","38700a77355cdcc7804c53fa95072cd44835ac775fb6d16f8bd345e8ab13d353","576560ada2906c22ca777ac51ed6f2b99086b94bbe44d86b82abe7d77736ba6a","9419a0087f6fc8bccf318d7a2c9f9e709c81df651ab6ba65c10f28c4a34257a7","cd6ad1e880396edc3cdcceba996dd424e96f4961e4884aee52717069537553e8","33e8b5ea7a0900f2d4b56369fda2d29a06a586ddc0c9fd85fc17ea967f83f45d","1af5f9b2b22282891adb17fb9283b47b7ba7a9439fef22cfba0320155dff3ae9")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("d42dfbeba20624a190cf903d28ac5ef5e6ff0f5c120e0f8e14909fec30871134","a8da877ebc4bdefbbe1b5454c448880f36ffad46d6d50083d586eee2da5a31ab","8783eb00acb3196a270c9be1e06d4841bf1686c7f7fc6e009d6172daf0172fc6","7a234d1a2415834290a3a9c7274aadb7253dcfe24edb10b22f1a4a33fd027a08","c6224a579fcef3b67c02dabe55cc486a476e10f7ab9181a91c839fa3de0876fd","8b76c48088a56532f73389933737af0cbe7a404e639ec51136090c7d8c8207c9","48053356188dd419c6212e8adb1d5156460339f07838f2c00357cfd1b4a05278","da480b19c68c2dee819f7b06dbfdba0637fea2c165f3190c2a4994570c3dae2a","910b6f3087b1d5342a2681376c367b53e30cf21dd9409fb1000ffb60893a7051","de099bf0297de8e2fad37acc55c6b0456d1fd98a6fc1fbc381759e82a4e207c3","ee8f394d9e192c453d47a0c57261a03921dcbb97248a67427cb6fc6d8833c8a0","a29c97cb43cd16fad9276e161017ae654eb9cc989081c7584f8f14a3795deb0e","154186b5e0f5fae753a1f90c93a7150927bd03017e55f44abf21a5a08b7ec4ba","38700a77355cdcc7804c53fa95072cd44835ac775fb6d16f8bd345e8ab13d353","576560ada2906c22ca777ac51ed6f2b99086b94bbe44d86b82abe7d77736ba6a","9419a0087f6fc8bccf318d7a2c9f9e709c81df651ab6ba65c10f28c4a34257a7","cd6ad1e880396edc3cdcceba996dd424e96f4961e4884aee52717069537553e8","33e8b5ea7a0900f2d4b56369fda2d29a06a586ddc0c9fd85fc17ea967f83f45d","1af5f9b2b22282891adb17fb9283b47b7ba7a9439fef22cfba0320155dff3ae9")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("d42dfbeba20624a190cf903d28ac5ef5e6ff0f5c120e0f8e14909fec30871134","a8da877ebc4bdefbbe1b5454c448880f36ffad46d6d50083d586eee2da5a31ab","8783eb00acb3196a270c9be1e06d4841bf1686c7f7fc6e009d6172daf0172fc6","7a234d1a2415834290a3a9c7274aadb7253dcfe24edb10b22f1a4a33fd027a08","c6224a579fcef3b67c02dabe55cc486a476e10f7ab9181a91c839fa3de0876fd","8b76c48088a56532f73389933737af0cbe7a404e639ec51136090c7d8c8207c9","48053356188dd419c6212e8adb1d5156460339f07838f2c00357cfd1b4a05278","da480b19c68c2dee819f7b06dbfdba0637fea2c165f3190c2a4994570c3dae2a","910b6f3087b1d5342a2681376c367b53e30cf21dd9409fb1000ffb60893a7051","de099bf0297de8e2fad37acc55c6b0456d1fd98a6fc1fbc381759e82a4e207c3","ee8f394d9e192c453d47a0c57261a03921dcbb97248a67427cb6fc6d8833c8a0","a29c97cb43cd16fad9276e161017ae654eb9cc989081c7584f8f14a3795deb0e","154186b5e0f5fae753a1f90c93a7150927bd03017e55f44abf21a5a08b7ec4ba","38700a77355cdcc7804c53fa95072cd44835ac775fb6d16f8bd345e8ab13d353","576560ada2906c22ca777ac51ed6f2b99086b94bbe44d86b82abe7d77736ba6a","9419a0087f6fc8bccf318d7a2c9f9e709c81df651ab6ba65c10f28c4a34257a7","cd6ad1e880396edc3cdcceba996dd424e96f4961e4884aee52717069537553e8","33e8b5ea7a0900f2d4b56369fda2d29a06a586ddc0c9fd85fc17ea967f83f45d","1af5f9b2b22282891adb17fb9283b47b7ba7a9439fef22cfba0320155dff3ae9")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("d42dfbeba20624a190cf903d28ac5ef5e6ff0f5c120e0f8e14909fec30871134","a8da877ebc4bdefbbe1b5454c448880f36ffad46d6d50083d586eee2da5a31ab","8783eb00acb3196a270c9be1e06d4841bf1686c7f7fc6e009d6172daf0172fc6","7a234d1a2415834290a3a9c7274aadb7253dcfe24edb10b22f1a4a33fd027a08","c6224a579fcef3b67c02dabe55cc486a476e10f7ab9181a91c839fa3de0876fd","8b76c48088a56532f73389933737af0cbe7a404e639ec51136090c7d8c8207c9","48053356188dd419c6212e8adb1d5156460339f07838f2c00357cfd1b4a05278","da480b19c68c2dee819f7b06dbfdba0637fea2c165f3190c2a4994570c3dae2a","910b6f3087b1d5342a2681376c367b53e30cf21dd9409fb1000ffb60893a7051","de099bf0297de8e2fad37acc55c6b0456d1fd98a6fc1fbc381759e82a4e207c3","ee8f394d9e192c453d47a0c57261a03921dcbb97248a67427cb6fc6d8833c8a0","a29c97cb43cd16fad9276e161017ae654eb9cc989081c7584f8f14a3795deb0e","154186b5e0f5fae753a1f90c93a7150927bd03017e55f44abf21a5a08b7ec4ba","38700a77355cdcc7804c53fa95072cd44835ac775fb6d16f8bd345e8ab13d353","576560ada2906c22ca777ac51ed6f2b99086b94bbe44d86b82abe7d77736ba6a","9419a0087f6fc8bccf318d7a2c9f9e709c81df651ab6ba65c10f28c4a34257a7","cd6ad1e880396edc3cdcceba996dd424e96f4961e4884aee52717069537553e8","33e8b5ea7a0900f2d4b56369fda2d29a06a586ddc0c9fd85fc17ea967f83f45d","1af5f9b2b22282891adb17fb9283b47b7ba7a9439fef22cfba0320155dff3ae9")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("d42dfbeba20624a190cf903d28ac5ef5e6ff0f5c120e0f8e14909fec30871134","a8da877ebc4bdefbbe1b5454c448880f36ffad46d6d50083d586eee2da5a31ab","8783eb00acb3196a270c9be1e06d4841bf1686c7f7fc6e009d6172daf0172fc6","7a234d1a2415834290a3a9c7274aadb7253dcfe24edb10b22f1a4a33fd027a08","c6224a579fcef3b67c02dabe55cc486a476e10f7ab9181a91c839fa3de0876fd","8b76c48088a56532f73389933737af0cbe7a404e639ec51136090c7d8c8207c9","48053356188dd419c6212e8adb1d5156460339f07838f2c00357cfd1b4a05278","da480b19c68c2dee819f7b06dbfdba0637fea2c165f3190c2a4994570c3dae2a","910b6f3087b1d5342a2681376c367b53e30cf21dd9409fb1000ffb60893a7051","de099bf0297de8e2fad37acc55c6b0456d1fd98a6fc1fbc381759e82a4e207c3","ee8f394d9e192c453d47a0c57261a03921dcbb97248a67427cb6fc6d8833c8a0","a29c97cb43cd16fad9276e161017ae654eb9cc989081c7584f8f14a3795deb0e","154186b5e0f5fae753a1f90c93a7150927bd03017e55f44abf21a5a08b7ec4ba","38700a77355cdcc7804c53fa95072cd44835ac775fb6d16f8bd345e8ab13d353","576560ada2906c22ca777ac51ed6f2b99086b94bbe44d86b82abe7d77736ba6a","9419a0087f6fc8bccf318d7a2c9f9e709c81df651ab6ba65c10f28c4a34257a7","cd6ad1e880396edc3cdcceba996dd424e96f4961e4884aee52717069537553e8","33e8b5ea7a0900f2d4b56369fda2d29a06a586ddc0c9fd85fc17ea967f83f45d","1af5f9b2b22282891adb17fb9283b47b7ba7a9439fef22cfba0320155dff3ae9")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("d42dfbeba20624a190cf903d28ac5ef5e6ff0f5c120e0f8e14909fec30871134","a8da877ebc4bdefbbe1b5454c448880f36ffad46d6d50083d586eee2da5a31ab","8783eb00acb3196a270c9be1e06d4841bf1686c7f7fc6e009d6172daf0172fc6","7a234d1a2415834290a3a9c7274aadb7253dcfe24edb10b22f1a4a33fd027a08","c6224a579fcef3b67c02dabe55cc486a476e10f7ab9181a91c839fa3de0876fd","8b76c48088a56532f73389933737af0cbe7a404e639ec51136090c7d8c8207c9","48053356188dd419c6212e8adb1d5156460339f07838f2c00357cfd1b4a05278","da480b19c68c2dee819f7b06dbfdba0637fea2c165f3190c2a4994570c3dae2a","910b6f3087b1d5342a2681376c367b53e30cf21dd9409fb1000ffb60893a7051","de099bf0297de8e2fad37acc55c6b0456d1fd98a6fc1fbc381759e82a4e207c3","ee8f394d9e192c453d47a0c57261a03921dcbb97248a67427cb6fc6d8833c8a0","a29c97cb43cd16fad9276e161017ae654eb9cc989081c7584f8f14a3795deb0e","154186b5e0f5fae753a1f90c93a7150927bd03017e55f44abf21a5a08b7ec4ba","38700a77355cdcc7804c53fa95072cd44835ac775fb6d16f8bd345e8ab13d353","576560ada2906c22ca777ac51ed6f2b99086b94bbe44d86b82abe7d77736ba6a","9419a0087f6fc8bccf318d7a2c9f9e709c81df651ab6ba65c10f28c4a34257a7","cd6ad1e880396edc3cdcceba996dd424e96f4961e4884aee52717069537553e8","33e8b5ea7a0900f2d4b56369fda2d29a06a586ddc0c9fd85fc17ea967f83f45d","1af5f9b2b22282891adb17fb9283b47b7ba7a9439fef22cfba0320155dff3ae9")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("d42dfbeba20624a190cf903d28ac5ef5e6ff0f5c120e0f8e14909fec30871134","a8da877ebc4bdefbbe1b5454c448880f36ffad46d6d50083d586eee2da5a31ab","8783eb00acb3196a270c9be1e06d4841bf1686c7f7fc6e009d6172daf0172fc6","7a234d1a2415834290a3a9c7274aadb7253dcfe24edb10b22f1a4a33fd027a08","c6224a579fcef3b67c02dabe55cc486a476e10f7ab9181a91c839fa3de0876fd","8b76c48088a56532f73389933737af0cbe7a404e639ec51136090c7d8c8207c9","48053356188dd419c6212e8adb1d5156460339f07838f2c00357cfd1b4a05278","da480b19c68c2dee819f7b06dbfdba0637fea2c165f3190c2a4994570c3dae2a","910b6f3087b1d5342a2681376c367b53e30cf21dd9409fb1000ffb60893a7051","de099bf0297de8e2fad37acc55c6b0456d1fd98a6fc1fbc381759e82a4e207c3","ee8f394d9e192c453d47a0c57261a03921dcbb97248a67427cb6fc6d8833c8a0","a29c97cb43cd16fad9276e161017ae654eb9cc989081c7584f8f14a3795deb0e","154186b5e0f5fae753a1f90c93a7150927bd03017e55f44abf21a5a08b7ec4ba","38700a77355cdcc7804c53fa95072cd44835ac775fb6d16f8bd345e8ab13d353","576560ada2906c22ca777ac51ed6f2b99086b94bbe44d86b82abe7d77736ba6a","9419a0087f6fc8bccf318d7a2c9f9e709c81df651ab6ba65c10f28c4a34257a7","cd6ad1e880396edc3cdcceba996dd424e96f4961e4884aee52717069537553e8","33e8b5ea7a0900f2d4b56369fda2d29a06a586ddc0c9fd85fc17ea967f83f45d","1af5f9b2b22282891adb17fb9283b47b7ba7a9439fef22cfba0320155dff3ae9")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("d42dfbeba20624a190cf903d28ac5ef5e6ff0f5c120e0f8e14909fec30871134","a8da877ebc4bdefbbe1b5454c448880f36ffad46d6d50083d586eee2da5a31ab","8783eb00acb3196a270c9be1e06d4841bf1686c7f7fc6e009d6172daf0172fc6","7a234d1a2415834290a3a9c7274aadb7253dcfe24edb10b22f1a4a33fd027a08","c6224a579fcef3b67c02dabe55cc486a476e10f7ab9181a91c839fa3de0876fd","8b76c48088a56532f73389933737af0cbe7a404e639ec51136090c7d8c8207c9","48053356188dd419c6212e8adb1d5156460339f07838f2c00357cfd1b4a05278","da480b19c68c2dee819f7b06dbfdba0637fea2c165f3190c2a4994570c3dae2a","910b6f3087b1d5342a2681376c367b53e30cf21dd9409fb1000ffb60893a7051","de099bf0297de8e2fad37acc55c6b0456d1fd98a6fc1fbc381759e82a4e207c3","ee8f394d9e192c453d47a0c57261a03921dcbb97248a67427cb6fc6d8833c8a0","a29c97cb43cd16fad9276e161017ae654eb9cc989081c7584f8f14a3795deb0e","154186b5e0f5fae753a1f90c93a7150927bd03017e55f44abf21a5a08b7ec4ba","38700a77355cdcc7804c53fa95072cd44835ac775fb6d16f8bd345e8ab13d353","576560ada2906c22ca777ac51ed6f2b99086b94bbe44d86b82abe7d77736ba6a","9419a0087f6fc8bccf318d7a2c9f9e709c81df651ab6ba65c10f28c4a34257a7","cd6ad1e880396edc3cdcceba996dd424e96f4961e4884aee52717069537553e8","33e8b5ea7a0900f2d4b56369fda2d29a06a586ddc0c9fd85fc17ea967f83f45d","1af5f9b2b22282891adb17fb9283b47b7ba7a9439fef22cfba0320155dff3ae9")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("d42dfbeba20624a190cf903d28ac5ef5e6ff0f5c120e0f8e14909fec30871134","a8da877ebc4bdefbbe1b5454c448880f36ffad46d6d50083d586eee2da5a31ab","8783eb00acb3196a270c9be1e06d4841bf1686c7f7fc6e009d6172daf0172fc6","7a234d1a2415834290a3a9c7274aadb7253dcfe24edb10b22f1a4a33fd027a08","c6224a579fcef3b67c02dabe55cc486a476e10f7ab9181a91c839fa3de0876fd","8b76c48088a56532f73389933737af0cbe7a404e639ec51136090c7d8c8207c9","48053356188dd419c6212e8adb1d5156460339f07838f2c00357cfd1b4a05278","da480b19c68c2dee819f7b06dbfdba0637fea2c165f3190c2a4994570c3dae2a","910b6f3087b1d5342a2681376c367b53e30cf21dd9409fb1000ffb60893a7051","de099bf0297de8e2fad37acc55c6b0456d1fd98a6fc1fbc381759e82a4e207c3","ee8f394d9e192c453d47a0c57261a03921dcbb97248a67427cb6fc6d8833c8a0","a29c97cb43cd16fad9276e161017ae654eb9cc989081c7584f8f14a3795deb0e","154186b5e0f5fae753a1f90c93a7150927bd03017e55f44abf21a5a08b7ec4ba","38700a77355cdcc7804c53fa95072cd44835ac775fb6d16f8bd345e8ab13d353","576560ada2906c22ca777ac51ed6f2b99086b94bbe44d86b82abe7d77736ba6a","9419a0087f6fc8bccf318d7a2c9f9e709c81df651ab6ba65c10f28c4a34257a7","cd6ad1e880396edc3cdcceba996dd424e96f4961e4884aee52717069537553e8","33e8b5ea7a0900f2d4b56369fda2d29a06a586ddc0c9fd85fc17ea967f83f45d","1af5f9b2b22282891adb17fb9283b47b7ba7a9439fef22cfba0320155dff3ae9")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("d42dfbeba20624a190cf903d28ac5ef5e6ff0f5c120e0f8e14909fec30871134","a8da877ebc4bdefbbe1b5454c448880f36ffad46d6d50083d586eee2da5a31ab","8783eb00acb3196a270c9be1e06d4841bf1686c7f7fc6e009d6172daf0172fc6","7a234d1a2415834290a3a9c7274aadb7253dcfe24edb10b22f1a4a33fd027a08","c6224a579fcef3b67c02dabe55cc486a476e10f7ab9181a91c839fa3de0876fd","8b76c48088a56532f73389933737af0cbe7a404e639ec51136090c7d8c8207c9","48053356188dd419c6212e8adb1d5156460339f07838f2c00357cfd1b4a05278","da480b19c68c2dee819f7b06dbfdba0637fea2c165f3190c2a4994570c3dae2a","910b6f3087b1d5342a2681376c367b53e30cf21dd9409fb1000ffb60893a7051","de099bf0297de8e2fad37acc55c6b0456d1fd98a6fc1fbc381759e82a4e207c3","ee8f394d9e192c453d47a0c57261a03921dcbb97248a67427cb6fc6d8833c8a0","a29c97cb43cd16fad9276e161017ae654eb9cc989081c7584f8f14a3795deb0e","154186b5e0f5fae753a1f90c93a7150927bd03017e55f44abf21a5a08b7ec4ba","38700a77355cdcc7804c53fa95072cd44835ac775fb6d16f8bd345e8ab13d353","576560ada2906c22ca777ac51ed6f2b99086b94bbe44d86b82abe7d77736ba6a","9419a0087f6fc8bccf318d7a2c9f9e709c81df651ab6ba65c10f28c4a34257a7","cd6ad1e880396edc3cdcceba996dd424e96f4961e4884aee52717069537553e8","33e8b5ea7a0900f2d4b56369fda2d29a06a586ddc0c9fd85fc17ea967f83f45d","1af5f9b2b22282891adb17fb9283b47b7ba7a9439fef22cfba0320155dff3ae9")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("d42dfbeba20624a190cf903d28ac5ef5e6ff0f5c120e0f8e14909fec30871134","a8da877ebc4bdefbbe1b5454c448880f36ffad46d6d50083d586eee2da5a31ab","8783eb00acb3196a270c9be1e06d4841bf1686c7f7fc6e009d6172daf0172fc6","7a234d1a2415834290a3a9c7274aadb7253dcfe24edb10b22f1a4a33fd027a08","c6224a579fcef3b67c02dabe55cc486a476e10f7ab9181a91c839fa3de0876fd","8b76c48088a56532f73389933737af0cbe7a404e639ec51136090c7d8c8207c9","48053356188dd419c6212e8adb1d5156460339f07838f2c00357cfd1b4a05278","da480b19c68c2dee819f7b06dbfdba0637fea2c165f3190c2a4994570c3dae2a","910b6f3087b1d5342a2681376c367b53e30cf21dd9409fb1000ffb60893a7051","de099bf0297de8e2fad37acc55c6b0456d1fd98a6fc1fbc381759e82a4e207c3","ee8f394d9e192c453d47a0c57261a03921dcbb97248a67427cb6fc6d8833c8a0","a29c97cb43cd16fad9276e161017ae654eb9cc989081c7584f8f14a3795deb0e","154186b5e0f5fae753a1f90c93a7150927bd03017e55f44abf21a5a08b7ec4ba","38700a77355cdcc7804c53fa95072cd44835ac775fb6d16f8bd345e8ab13d353","576560ada2906c22ca777ac51ed6f2b99086b94bbe44d86b82abe7d77736ba6a","9419a0087f6fc8bccf318d7a2c9f9e709c81df651ab6ba65c10f28c4a34257a7","cd6ad1e880396edc3cdcceba996dd424e96f4961e4884aee52717069537553e8","33e8b5ea7a0900f2d4b56369fda2d29a06a586ddc0c9fd85fc17ea967f83f45d","1af5f9b2b22282891adb17fb9283b47b7ba7a9439fef22cfba0320155dff3ae9")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("d42dfbeba20624a190cf903d28ac5ef5e6ff0f5c120e0f8e14909fec30871134","a8da877ebc4bdefbbe1b5454c448880f36ffad46d6d50083d586eee2da5a31ab","8783eb00acb3196a270c9be1e06d4841bf1686c7f7fc6e009d6172daf0172fc6","7a234d1a2415834290a3a9c7274aadb7253dcfe24edb10b22f1a4a33fd027a08","c6224a579fcef3b67c02dabe55cc486a476e10f7ab9181a91c839fa3de0876fd","8b76c48088a56532f73389933737af0cbe7a404e639ec51136090c7d8c8207c9","48053356188dd419c6212e8adb1d5156460339f07838f2c00357cfd1b4a05278","da480b19c68c2dee819f7b06dbfdba0637fea2c165f3190c2a4994570c3dae2a","910b6f3087b1d5342a2681376c367b53e30cf21dd9409fb1000ffb60893a7051","de099bf0297de8e2fad37acc55c6b0456d1fd98a6fc1fbc381759e82a4e207c3","ee8f394d9e192c453d47a0c57261a03921dcbb97248a67427cb6fc6d8833c8a0","a29c97cb43cd16fad9276e161017ae654eb9cc989081c7584f8f14a3795deb0e","154186b5e0f5fae753a1f90c93a7150927bd03017e55f44abf21a5a08b7ec4ba","38700a77355cdcc7804c53fa95072cd44835ac775fb6d16f8bd345e8ab13d353","576560ada2906c22ca777ac51ed6f2b99086b94bbe44d86b82abe7d77736ba6a","9419a0087f6fc8bccf318d7a2c9f9e709c81df651ab6ba65c10f28c4a34257a7","cd6ad1e880396edc3cdcceba996dd424e96f4961e4884aee52717069537553e8","33e8b5ea7a0900f2d4b56369fda2d29a06a586ddc0c9fd85fc17ea967f83f45d","1af5f9b2b22282891adb17fb9283b47b7ba7a9439fef22cfba0320155dff3ae9")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("d42dfbeba20624a190cf903d28ac5ef5e6ff0f5c120e0f8e14909fec30871134","a8da877ebc4bdefbbe1b5454c448880f36ffad46d6d50083d586eee2da5a31ab","8783eb00acb3196a270c9be1e06d4841bf1686c7f7fc6e009d6172daf0172fc6","7a234d1a2415834290a3a9c7274aadb7253dcfe24edb10b22f1a4a33fd027a08","c6224a579fcef3b67c02dabe55cc486a476e10f7ab9181a91c839fa3de0876fd","8b76c48088a56532f73389933737af0cbe7a404e639ec51136090c7d8c8207c9","48053356188dd419c6212e8adb1d5156460339f07838f2c00357cfd1b4a05278","da480b19c68c2dee819f7b06dbfdba0637fea2c165f3190c2a4994570c3dae2a","910b6f3087b1d5342a2681376c367b53e30cf21dd9409fb1000ffb60893a7051","de099bf0297de8e2fad37acc55c6b0456d1fd98a6fc1fbc381759e82a4e207c3","ee8f394d9e192c453d47a0c57261a03921dcbb97248a67427cb6fc6d8833c8a0","a29c97cb43cd16fad9276e161017ae654eb9cc989081c7584f8f14a3795deb0e","154186b5e0f5fae753a1f90c93a7150927bd03017e55f44abf21a5a08b7ec4ba","38700a77355cdcc7804c53fa95072cd44835ac775fb6d16f8bd345e8ab13d353","576560ada2906c22ca777ac51ed6f2b99086b94bbe44d86b82abe7d77736ba6a","9419a0087f6fc8bccf318d7a2c9f9e709c81df651ab6ba65c10f28c4a34257a7","cd6ad1e880396edc3cdcceba996dd424e96f4961e4884aee52717069537553e8","33e8b5ea7a0900f2d4b56369fda2d29a06a586ddc0c9fd85fc17ea967f83f45d","1af5f9b2b22282891adb17fb9283b47b7ba7a9439fef22cfba0320155dff3ae9")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("d42dfbeba20624a190cf903d28ac5ef5e6ff0f5c120e0f8e14909fec30871134","a8da877ebc4bdefbbe1b5454c448880f36ffad46d6d50083d586eee2da5a31ab","8783eb00acb3196a270c9be1e06d4841bf1686c7f7fc6e009d6172daf0172fc6","7a234d1a2415834290a3a9c7274aadb7253dcfe24edb10b22f1a4a33fd027a08","c6224a579fcef3b67c02dabe55cc486a476e10f7ab9181a91c839fa3de0876fd","8b76c48088a56532f73389933737af0cbe7a404e639ec51136090c7d8c8207c9","48053356188dd419c6212e8adb1d5156460339f07838f2c00357cfd1b4a05278","da480b19c68c2dee819f7b06dbfdba0637fea2c165f3190c2a4994570c3dae2a","910b6f3087b1d5342a2681376c367b53e30cf21dd9409fb1000ffb60893a7051","de099bf0297de8e2fad37acc55c6b0456d1fd98a6fc1fbc381759e82a4e207c3","ee8f394d9e192c453d47a0c57261a03921dcbb97248a67427cb6fc6d8833c8a0","a29c97cb43cd16fad9276e161017ae654eb9cc989081c7584f8f14a3795deb0e","154186b5e0f5fae753a1f90c93a7150927bd03017e55f44abf21a5a08b7ec4ba","38700a77355cdcc7804c53fa95072cd44835ac775fb6d16f8bd345e8ab13d353","576560ada2906c22ca777ac51ed6f2b99086b94bbe44d86b82abe7d77736ba6a","9419a0087f6fc8bccf318d7a2c9f9e709c81df651ab6ba65c10f28c4a34257a7","cd6ad1e880396edc3cdcceba996dd424e96f4961e4884aee52717069537553e8","33e8b5ea7a0900f2d4b56369fda2d29a06a586ddc0c9fd85fc17ea967f83f45d","1af5f9b2b22282891adb17fb9283b47b7ba7a9439fef22cfba0320155dff3ae9")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("d42dfbeba20624a190cf903d28ac5ef5e6ff0f5c120e0f8e14909fec30871134","a8da877ebc4bdefbbe1b5454c448880f36ffad46d6d50083d586eee2da5a31ab","8783eb00acb3196a270c9be1e06d4841bf1686c7f7fc6e009d6172daf0172fc6","7a234d1a2415834290a3a9c7274aadb7253dcfe24edb10b22f1a4a33fd027a08","c6224a579fcef3b67c02dabe55cc486a476e10f7ab9181a91c839fa3de0876fd","8b76c48088a56532f73389933737af0cbe7a404e639ec51136090c7d8c8207c9","48053356188dd419c6212e8adb1d5156460339f07838f2c00357cfd1b4a05278","da480b19c68c2dee819f7b06dbfdba0637fea2c165f3190c2a4994570c3dae2a","910b6f3087b1d5342a2681376c367b53e30cf21dd9409fb1000ffb60893a7051","de099bf0297de8e2fad37acc55c6b0456d1fd98a6fc1fbc381759e82a4e207c3","ee8f394d9e192c453d47a0c57261a03921dcbb97248a67427cb6fc6d8833c8a0","a29c97cb43cd16fad9276e161017ae654eb9cc989081c7584f8f14a3795deb0e","154186b5e0f5fae753a1f90c93a7150927bd03017e55f44abf21a5a08b7ec4ba","38700a77355cdcc7804c53fa95072cd44835ac775fb6d16f8bd345e8ab13d353","576560ada2906c22ca777ac51ed6f2b99086b94bbe44d86b82abe7d77736ba6a","9419a0087f6fc8bccf318d7a2c9f9e709c81df651ab6ba65c10f28c4a34257a7","cd6ad1e880396edc3cdcceba996dd424e96f4961e4884aee52717069537553e8","33e8b5ea7a0900f2d4b56369fda2d29a06a586ddc0c9fd85fc17ea967f83f45d","1af5f9b2b22282891adb17fb9283b47b7ba7a9439fef22cfba0320155dff3ae9")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("d42dfbeba20624a190cf903d28ac5ef5e6ff0f5c120e0f8e14909fec30871134","a8da877ebc4bdefbbe1b5454c448880f36ffad46d6d50083d586eee2da5a31ab","8783eb00acb3196a270c9be1e06d4841bf1686c7f7fc6e009d6172daf0172fc6","7a234d1a2415834290a3a9c7274aadb7253dcfe24edb10b22f1a4a33fd027a08","c6224a579fcef3b67c02dabe55cc486a476e10f7ab9181a91c839fa3de0876fd","8b76c48088a56532f73389933737af0cbe7a404e639ec51136090c7d8c8207c9","48053356188dd419c6212e8adb1d5156460339f07838f2c00357cfd1b4a05278","da480b19c68c2dee819f7b06dbfdba0637fea2c165f3190c2a4994570c3dae2a","910b6f3087b1d5342a2681376c367b53e30cf21dd9409fb1000ffb60893a7051","de099bf0297de8e2fad37acc55c6b0456d1fd98a6fc1fbc381759e82a4e207c3","ee8f394d9e192c453d47a0c57261a03921dcbb97248a67427cb6fc6d8833c8a0","a29c97cb43cd16fad9276e161017ae654eb9cc989081c7584f8f14a3795deb0e","154186b5e0f5fae753a1f90c93a7150927bd03017e55f44abf21a5a08b7ec4ba","38700a77355cdcc7804c53fa95072cd44835ac775fb6d16f8bd345e8ab13d353","576560ada2906c22ca777ac51ed6f2b99086b94bbe44d86b82abe7d77736ba6a","9419a0087f6fc8bccf318d7a2c9f9e709c81df651ab6ba65c10f28c4a34257a7","cd6ad1e880396edc3cdcceba996dd424e96f4961e4884aee52717069537553e8","33e8b5ea7a0900f2d4b56369fda2d29a06a586ddc0c9fd85fc17ea967f83f45d","1af5f9b2b22282891adb17fb9283b47b7ba7a9439fef22cfba0320155dff3ae9")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("d42dfbeba20624a190cf903d28ac5ef5e6ff0f5c120e0f8e14909fec30871134","a8da877ebc4bdefbbe1b5454c448880f36ffad46d6d50083d586eee2da5a31ab","8783eb00acb3196a270c9be1e06d4841bf1686c7f7fc6e009d6172daf0172fc6","7a234d1a2415834290a3a9c7274aadb7253dcfe24edb10b22f1a4a33fd027a08","c6224a579fcef3b67c02dabe55cc486a476e10f7ab9181a91c839fa3de0876fd","8b76c48088a56532f73389933737af0cbe7a404e639ec51136090c7d8c8207c9","48053356188dd419c6212e8adb1d5156460339f07838f2c00357cfd1b4a05278","da480b19c68c2dee819f7b06dbfdba0637fea2c165f3190c2a4994570c3dae2a","910b6f3087b1d5342a2681376c367b53e30cf21dd9409fb1000ffb60893a7051","de099bf0297de8e2fad37acc55c6b0456d1fd98a6fc1fbc381759e82a4e207c3","ee8f394d9e192c453d47a0c57261a03921dcbb97248a67427cb6fc6d8833c8a0","a29c97cb43cd16fad9276e161017ae654eb9cc989081c7584f8f14a3795deb0e","154186b5e0f5fae753a1f90c93a7150927bd03017e55f44abf21a5a08b7ec4ba","38700a77355cdcc7804c53fa95072cd44835ac775fb6d16f8bd345e8ab13d353","576560ada2906c22ca777ac51ed6f2b99086b94bbe44d86b82abe7d77736ba6a","9419a0087f6fc8bccf318d7a2c9f9e709c81df651ab6ba65c10f28c4a34257a7","cd6ad1e880396edc3cdcceba996dd424e96f4961e4884aee52717069537553e8","33e8b5ea7a0900f2d4b56369fda2d29a06a586ddc0c9fd85fc17ea967f83f45d","1af5f9b2b22282891adb17fb9283b47b7ba7a9439fef22cfba0320155dff3ae9")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("d42dfbeba20624a190cf903d28ac5ef5e6ff0f5c120e0f8e14909fec30871134","a8da877ebc4bdefbbe1b5454c448880f36ffad46d6d50083d586eee2da5a31ab","8783eb00acb3196a270c9be1e06d4841bf1686c7f7fc6e009d6172daf0172fc6","7a234d1a2415834290a3a9c7274aadb7253dcfe24edb10b22f1a4a33fd027a08","c6224a579fcef3b67c02dabe55cc486a476e10f7ab9181a91c839fa3de0876fd","8b76c48088a56532f73389933737af0cbe7a404e639ec51136090c7d8c8207c9","48053356188dd419c6212e8adb1d5156460339f07838f2c00357cfd1b4a05278","da480b19c68c2dee819f7b06dbfdba0637fea2c165f3190c2a4994570c3dae2a","910b6f3087b1d5342a2681376c367b53e30cf21dd9409fb1000ffb60893a7051","de099bf0297de8e2fad37acc55c6b0456d1fd98a6fc1fbc381759e82a4e207c3","ee8f394d9e192c453d47a0c57261a03921dcbb97248a67427cb6fc6d8833c8a0","a29c97cb43cd16fad9276e161017ae654eb9cc989081c7584f8f14a3795deb0e","154186b5e0f5fae753a1f90c93a7150927bd03017e55f44abf21a5a08b7ec4ba","38700a77355cdcc7804c53fa95072cd44835ac775fb6d16f8bd345e8ab13d353","576560ada2906c22ca777ac51ed6f2b99086b94bbe44d86b82abe7d77736ba6a","9419a0087f6fc8bccf318d7a2c9f9e709c81df651ab6ba65c10f28c4a34257a7","cd6ad1e880396edc3cdcceba996dd424e96f4961e4884aee52717069537553e8","33e8b5ea7a0900f2d4b56369fda2d29a06a586ddc0c9fd85fc17ea967f83f45d","1af5f9b2b22282891adb17fb9283b47b7ba7a9439fef22cfba0320155dff3ae9")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("d42dfbeba20624a190cf903d28ac5ef5e6ff0f5c120e0f8e14909fec30871134","a8da877ebc4bdefbbe1b5454c448880f36ffad46d6d50083d586eee2da5a31ab","8783eb00acb3196a270c9be1e06d4841bf1686c7f7fc6e009d6172daf0172fc6","7a234d1a2415834290a3a9c7274aadb7253dcfe24edb10b22f1a4a33fd027a08","c6224a579fcef3b67c02dabe55cc486a476e10f7ab9181a91c839fa3de0876fd","8b76c48088a56532f73389933737af0cbe7a404e639ec51136090c7d8c8207c9","48053356188dd419c6212e8adb1d5156460339f07838f2c00357cfd1b4a05278","da480b19c68c2dee819f7b06dbfdba0637fea2c165f3190c2a4994570c3dae2a","910b6f3087b1d5342a2681376c367b53e30cf21dd9409fb1000ffb60893a7051","de099bf0297de8e2fad37acc55c6b0456d1fd98a6fc1fbc381759e82a4e207c3","ee8f394d9e192c453d47a0c57261a03921dcbb97248a67427cb6fc6d8833c8a0","a29c97cb43cd16fad9276e161017ae654eb9cc989081c7584f8f14a3795deb0e","154186b5e0f5fae753a1f90c93a7150927bd03017e55f44abf21a5a08b7ec4ba","38700a77355cdcc7804c53fa95072cd44835ac775fb6d16f8bd345e8ab13d353","576560ada2906c22ca777ac51ed6f2b99086b94bbe44d86b82abe7d77736ba6a","9419a0087f6fc8bccf318d7a2c9f9e709c81df651ab6ba65c10f28c4a34257a7","cd6ad1e880396edc3cdcceba996dd424e96f4961e4884aee52717069537553e8","33e8b5ea7a0900f2d4b56369fda2d29a06a586ddc0c9fd85fc17ea967f83f45d","1af5f9b2b22282891adb17fb9283b47b7ba7a9439fef22cfba0320155dff3ae9")
index=activity AND rg_functionality="Endpoint Management Systems" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "physiciansofficenews.com" OR destinationhostname CONTAINS "thechinastyle.com" OR destinationhostname CONTAINS "divorceradio.com")
index=activity AND rg_functionality="Endpoint Management Systems" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "physiciansofficenews.com" OR sourcentdomain CONTAINS "thechinastyle.com" OR sourcentdomain CONTAINS "divorceradio.com")
index=activity AND rg_functionality="Endpoint Management Systems" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "physiciansofficenews.com" OR sourcehostname CONTAINS "thechinastyle.com" OR sourcehostname CONTAINS "divorceradio.com")
index=activity AND rg_functionality="Endpoint Management Systems" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "physiciansofficenews.com" OR destinationntdomain CONTAINS "thechinastyle.com" OR destinationntdomain CONTAINS "divorceradio.com")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "physiciansofficenews.com" OR destinationhostname CONTAINS "thechinastyle.com" OR destinationhostname CONTAINS "divorceradio.com")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "physiciansofficenews.com" OR sourcentdomain CONTAINS "thechinastyle.com" OR sourcentdomain CONTAINS "divorceradio.com")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "physiciansofficenews.com" OR sourcehostname CONTAINS "thechinastyle.com" OR sourcehostname CONTAINS "divorceradio.com")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "physiciansofficenews.com" OR destinationntdomain CONTAINS "thechinastyle.com" OR destinationntdomain CONTAINS "divorceradio.com")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "physiciansofficenews.com" OR destinationhostname CONTAINS "thechinastyle.com" OR destinationhostname CONTAINS "divorceradio.com")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "physiciansofficenews.com" OR sourcentdomain CONTAINS "thechinastyle.com" OR sourcentdomain CONTAINS "divorceradio.com")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "physiciansofficenews.com" OR sourcehostname CONTAINS "thechinastyle.com" OR sourcehostname CONTAINS "divorceradio.com")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "physiciansofficenews.com" OR destinationntdomain CONTAINS "thechinastyle.com" OR destinationntdomain CONTAINS "divorceradio.com")
index=activity AND rg_functionality="Email / Email Security" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "physiciansofficenews.com" OR destinationhostname CONTAINS "thechinastyle.com" OR destinationhostname CONTAINS "divorceradio.com")
index=activity AND rg_functionality="Email / Email Security" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "physiciansofficenews.com" OR sourcentdomain CONTAINS "thechinastyle.com" OR sourcentdomain CONTAINS "divorceradio.com")
index=activity AND rg_functionality="Email / Email Security" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "physiciansofficenews.com" OR sourcehostname CONTAINS "thechinastyle.com" OR sourcehostname CONTAINS "divorceradio.com")
index=activity AND rg_functionality="Email / Email Security" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "physiciansofficenews.com" OR destinationntdomain CONTAINS "thechinastyle.com" OR destinationntdomain CONTAINS "divorceradio.com")
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "physiciansofficenews.com" OR destinationhostname CONTAINS "thechinastyle.com" OR destinationhostname CONTAINS "divorceradio.com")
index=activity AND rg_functionality="Cloud Email / Email Security" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "physiciansofficenews.com" OR sourcentdomain CONTAINS "thechinastyle.com" OR sourcentdomain CONTAINS "divorceradio.com")
index=activity AND rg_functionality="Cloud Email / Email Security" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "physiciansofficenews.com" OR sourcehostname CONTAINS "thechinastyle.com" OR sourcehostname CONTAINS "divorceradio.com")
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "physiciansofficenews.com" OR destinationntdomain CONTAINS "thechinastyle.com" OR destinationntdomain CONTAINS "divorceradio.com")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "physiciansofficenews.com" OR destinationhostname CONTAINS "thechinastyle.com" OR destinationhostname CONTAINS "divorceradio.com")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "physiciansofficenews.com" OR sourcentdomain CONTAINS "thechinastyle.com" OR sourcentdomain CONTAINS "divorceradio.com")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "physiciansofficenews.com" OR sourcehostname CONTAINS "thechinastyle.com" OR sourcehostname CONTAINS "divorceradio.com")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "physiciansofficenews.com" OR destinationntdomain CONTAINS "thechinastyle.com" OR destinationntdomain CONTAINS "divorceradio.com")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "physiciansofficenews.com" OR destinationhostname CONTAINS "thechinastyle.com" OR destinationhostname CONTAINS "divorceradio.com")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "physiciansofficenews.com" OR sourcentdomain CONTAINS "thechinastyle.com" OR sourcentdomain CONTAINS "divorceradio.com")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "physiciansofficenews.com" OR sourcehostname CONTAINS "thechinastyle.com" OR sourcehostname CONTAINS "divorceradio.com")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "physiciansofficenews.com" OR destinationntdomain CONTAINS "thechinastyle.com" OR destinationntdomain CONTAINS "divorceradio.com")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "physiciansofficenews.com" OR destinationhostname CONTAINS "thechinastyle.com" OR destinationhostname CONTAINS "divorceradio.com")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "physiciansofficenews.com" OR sourcentdomain CONTAINS "thechinastyle.com" OR sourcentdomain CONTAINS "divorceradio.com")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "physiciansofficenews.com" OR sourcehostname CONTAINS "thechinastyle.com" OR sourcehostname CONTAINS "divorceradio.com")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "physiciansofficenews.com" OR destinationntdomain CONTAINS "thechinastyle.com" OR destinationntdomain CONTAINS "divorceradio.com")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "physiciansofficenews.com" OR destinationhostname CONTAINS "thechinastyle.com" OR destinationhostname CONTAINS "divorceradio.com")
index=activity AND rg_functionality="Next Generation Firewall" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "physiciansofficenews.com" OR sourcentdomain CONTAINS "thechinastyle.com" OR sourcentdomain CONTAINS "divorceradio.com")
index=activity AND rg_functionality="Next Generation Firewall" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "physiciansofficenews.com" OR sourcehostname CONTAINS "thechinastyle.com" OR sourcehostname CONTAINS "divorceradio.com")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "physiciansofficenews.com" OR destinationntdomain CONTAINS "thechinastyle.com" OR destinationntdomain CONTAINS "divorceradio.com")
index=activity AND rg_functionality="Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "physiciansofficenews.com" OR destinationhostname CONTAINS "thechinastyle.com" OR destinationhostname CONTAINS "divorceradio.com")
index=activity AND rg_functionality="Firewall" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "physiciansofficenews.com" OR sourcentdomain CONTAINS "thechinastyle.com" OR sourcentdomain CONTAINS "divorceradio.com")
index=activity AND rg_functionality="Firewall" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "physiciansofficenews.com" OR sourcehostname CONTAINS "thechinastyle.com" OR sourcehostname CONTAINS "divorceradio.com")
index=activity AND rg_functionality="Firewall" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "physiciansofficenews.com" OR destinationntdomain CONTAINS "thechinastyle.com" OR destinationntdomain CONTAINS "divorceradio.com")
index=activity AND rg_functionality="Web Proxy" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "physiciansofficenews.com" OR destinationhostname CONTAINS "thechinastyle.com" OR destinationhostname CONTAINS "divorceradio.com")
index=activity AND rg_functionality="Web Proxy" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "physiciansofficenews.com" OR sourcentdomain CONTAINS "thechinastyle.com" OR sourcentdomain CONTAINS "divorceradio.com")
index=activity AND rg_functionality="Web Proxy" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "physiciansofficenews.com" OR sourcehostname CONTAINS "thechinastyle.com" OR sourcehostname CONTAINS "divorceradio.com")
index=activity AND rg_functionality="Web Proxy" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "physiciansofficenews.com" OR destinationntdomain CONTAINS "thechinastyle.com" OR destinationntdomain CONTAINS "divorceradio.com")
index=activity AND rg_functionality="Flow" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "physiciansofficenews.com" OR destinationhostname CONTAINS "thechinastyle.com" OR destinationhostname CONTAINS "divorceradio.com")
index=activity AND rg_functionality="Flow" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "physiciansofficenews.com" OR sourcentdomain CONTAINS "thechinastyle.com" OR sourcentdomain CONTAINS "divorceradio.com")
index=activity AND rg_functionality="Flow" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "physiciansofficenews.com" OR sourcehostname CONTAINS "thechinastyle.com" OR sourcehostname CONTAINS "divorceradio.com")
index=activity AND rg_functionality="Flow" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "physiciansofficenews.com" OR destinationntdomain CONTAINS "thechinastyle.com" OR destinationntdomain CONTAINS "divorceradio.com")
index=activity AND rg_functionality="Web Server" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "physiciansofficenews.com" OR destinationhostname CONTAINS "thechinastyle.com" OR destinationhostname CONTAINS "divorceradio.com")
index=activity AND rg_functionality="Web Server" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "physiciansofficenews.com" OR sourcentdomain CONTAINS "thechinastyle.com" OR sourcentdomain CONTAINS "divorceradio.com")
index=activity AND rg_functionality="Web Server" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "physiciansofficenews.com" OR sourcehostname CONTAINS "thechinastyle.com" OR sourcehostname CONTAINS "divorceradio.com")
index=activity AND rg_functionality="Web Server" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "physiciansofficenews.com" OR destinationntdomain CONTAINS "thechinastyle.com" OR destinationntdomain CONTAINS "divorceradio.com")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "physiciansofficenews.com" OR destinationhostname CONTAINS "thechinastyle.com" OR destinationhostname CONTAINS "divorceradio.com")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "physiciansofficenews.com" OR sourcentdomain CONTAINS "thechinastyle.com" OR sourcentdomain CONTAINS "divorceradio.com")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "physiciansofficenews.com" OR sourcehostname CONTAINS "thechinastyle.com" OR sourcehostname CONTAINS "divorceradio.com")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "physiciansofficenews.com" OR destinationntdomain CONTAINS "thechinastyle.com" OR destinationntdomain CONTAINS "divorceradio.com")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "physiciansofficenews.com" OR destinationhostname CONTAINS "thechinastyle.com" OR destinationhostname CONTAINS "divorceradio.com")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "physiciansofficenews.com" OR sourcentdomain CONTAINS "thechinastyle.com" OR sourcentdomain CONTAINS "divorceradio.com")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "physiciansofficenews.com" OR sourcehostname CONTAINS "thechinastyle.com" OR sourcehostname CONTAINS "divorceradio.com")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "physiciansofficenews.com" OR destinationntdomain CONTAINS "thechinastyle.com" OR destinationntdomain CONTAINS "divorceradio.com")
index=activity AND rg_functionality="Web Application Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "physiciansofficenews.com" OR destinationhostname CONTAINS "thechinastyle.com" OR destinationhostname CONTAINS "divorceradio.com")
index=activity AND rg_functionality="Web Application Firewall" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "physiciansofficenews.com" OR sourcentdomain CONTAINS "thechinastyle.com" OR sourcentdomain CONTAINS "divorceradio.com")
index=activity AND rg_functionality="Web Application Firewall" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "physiciansofficenews.com" OR sourcehostname CONTAINS "thechinastyle.com" OR sourcehostname CONTAINS "divorceradio.com")
index=activity AND rg_functionality="Web Application Firewall" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "physiciansofficenews.com" OR destinationntdomain CONTAINS "thechinastyle.com" OR destinationntdomain CONTAINS "divorceradio.com")
index=activity AND rg_functionality="Endpoint management systems" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "physiciansofficenews.com" OR destinationhostname CONTAINS "thechinastyle.com" OR destinationhostname CONTAINS "divorceradio.com")
index=activity AND rg_functionality="Endpoint management systems" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "physiciansofficenews.com" OR sourcentdomain CONTAINS "thechinastyle.com" OR sourcentdomain CONTAINS "divorceradio.com")
index=activity AND rg_functionality="Endpoint management systems" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "physiciansofficenews.com" OR sourcehostname CONTAINS "thechinastyle.com" OR sourcehostname CONTAINS "divorceradio.com")
index=activity AND rg_functionality="Endpoint management systems" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "physiciansofficenews.com" OR destinationntdomain CONTAINS "thechinastyle.com" OR destinationntdomain CONTAINS "divorceradio.com")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "physiciansofficenews.com" OR destinationhostname CONTAINS "thechinastyle.com" OR destinationhostname CONTAINS "divorceradio.com")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "physiciansofficenews.com" OR sourcentdomain CONTAINS "thechinastyle.com" OR sourcentdomain CONTAINS "divorceradio.com")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "physiciansofficenews.com" OR sourcehostname CONTAINS "thechinastyle.com" OR sourcehostname CONTAINS "divorceradio.com")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "physiciansofficenews.com" OR destinationntdomain CONTAINS "thechinastyle.com" OR destinationntdomain CONTAINS "divorceradio.com")
index=activity AND rg_functionality="Cloud Application Audit" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "physiciansofficenews.com" OR destinationhostname CONTAINS "thechinastyle.com" OR destinationhostname CONTAINS "divorceradio.com")
index=activity AND rg_functionality="Cloud Application Audit" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "physiciansofficenews.com" OR sourcentdomain CONTAINS "thechinastyle.com" OR sourcentdomain CONTAINS "divorceradio.com")
index=activity AND rg_functionality="Cloud Application Audit" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "physiciansofficenews.com" OR sourcehostname CONTAINS "thechinastyle.com" OR sourcehostname CONTAINS "divorceradio.com")
index=activity AND rg_functionality="Cloud Application Audit" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "physiciansofficenews.com" OR destinationntdomain CONTAINS "thechinastyle.com" OR destinationntdomain CONTAINS "divorceradio.com")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "physiciansofficenews.com" OR destinationhostname CONTAINS "thechinastyle.com" OR destinationhostname CONTAINS "divorceradio.com")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "physiciansofficenews.com" OR sourcentdomain CONTAINS "thechinastyle.com" OR sourcentdomain CONTAINS "divorceradio.com")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "physiciansofficenews.com" OR sourcehostname CONTAINS "thechinastyle.com" OR sourcehostname CONTAINS "divorceradio.com")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "physiciansofficenews.com" OR destinationntdomain CONTAINS "thechinastyle.com" OR destinationntdomain CONTAINS "divorceradio.com")
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "physiciansofficenews.com" OR destinationhostname CONTAINS "thechinastyle.com" OR destinationhostname CONTAINS "divorceradio.com")
index=activity AND rg_functionality="Unix / Linux / AIX" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "physiciansofficenews.com" OR sourcentdomain CONTAINS "thechinastyle.com" OR sourcentdomain CONTAINS "divorceradio.com")
index=activity AND rg_functionality="Unix / Linux / AIX" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "physiciansofficenews.com" OR sourcehostname CONTAINS "thechinastyle.com" OR sourcehostname CONTAINS "divorceradio.com")
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "physiciansofficenews.com" OR destinationntdomain CONTAINS "thechinastyle.com" OR destinationntdomain CONTAINS "divorceradio.com")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "physiciansofficenews.com" OR destinationhostname CONTAINS "thechinastyle.com" OR destinationhostname CONTAINS "divorceradio.com")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "physiciansofficenews.com" OR sourcentdomain CONTAINS "thechinastyle.com" OR sourcentdomain CONTAINS "divorceradio.com")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "physiciansofficenews.com" OR sourcehostname CONTAINS "thechinastyle.com" OR sourcehostname CONTAINS "divorceradio.com")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "physiciansofficenews.com" OR destinationntdomain CONTAINS "thechinastyle.com" OR destinationntdomain CONTAINS "divorceradio.com")
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "physiciansofficenews.com" OR destinationhostname CONTAINS "thechinastyle.com" OR destinationhostname CONTAINS "divorceradio.com")
index=activity AND rg_functionality="Cloud Application Security Broker" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "physiciansofficenews.com" OR sourcentdomain CONTAINS "thechinastyle.com" OR sourcentdomain CONTAINS "divorceradio.com")
index=activity AND rg_functionality="Cloud Application Security Broker" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "physiciansofficenews.com" OR sourcehostname CONTAINS "thechinastyle.com" OR sourcehostname CONTAINS "divorceradio.com")
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "physiciansofficenews.com" OR destinationntdomain CONTAINS "thechinastyle.com" OR destinationntdomain CONTAINS "divorceradio.com")
index=activity AND rg_functionality="Source Code Repository" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "physiciansofficenews.com" OR destinationhostname CONTAINS "thechinastyle.com" OR destinationhostname CONTAINS "divorceradio.com")
index=activity AND rg_functionality="Source Code Repository" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "physiciansofficenews.com" OR sourcentdomain CONTAINS "thechinastyle.com" OR sourcentdomain CONTAINS "divorceradio.com")
index=activity AND rg_functionality="Source Code Repository" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "physiciansofficenews.com" OR sourcehostname CONTAINS "thechinastyle.com" OR sourcehostname CONTAINS "divorceradio.com")
index=activity AND rg_functionality="Source Code Repository" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "physiciansofficenews.com" OR destinationntdomain CONTAINS "thechinastyle.com" OR destinationntdomain CONTAINS "divorceradio.com")
