index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("fe8400a81be3de95807396ffa1539e6818c8c586bd8a17d833a573aa5d7b433b","46d7d74deaa27eaad25c97fa302d128a1c8d58058ce4cc95fd6055acbc9b959","a89b471528737b91046fc42527bf84008b067908ccc1bf4318135476c290de61","55ad68ee73fa288698cd3b885196d0d02cdfd417563d247f617bca288243bf44","15a3cd9fc6f3e89fc4901be19b15069ccef0dcdd8071b4900448bf2ab374c002","24a8660ebdf54094d8e787486f19b2823f3bc4382f5ace764429a6b7e48025ea","fced9291b4339c4fe3a1abfe5878d210a500afa7e1fa4a3be8613a6791c02b8e","4f0494cf85322d540e9cb87295af1247377bcb65b09254900b7ca29f6f46508f","fced9291b4339c4fe3a1abfe5878d210a500afa7e1fa4a3be8613a6791c02b8e","9ce88cc6fd2e3d298b97592d431c301d994f9c4ed7a7886c225e167bce29c046","99744720b128c6ac678a1d6e0fad0e69f159c1606428e91e7d2b7695cc353a80","06a0a243811e9c4738a9d413597659ca8d07b00f640b74adc9cb351c179b3268")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("fe8400a81be3de95807396ffa1539e6818c8c586bd8a17d833a573aa5d7b433b","46d7d74deaa27eaad25c97fa302d128a1c8d58058ce4cc95fd6055acbc9b959","a89b471528737b91046fc42527bf84008b067908ccc1bf4318135476c290de61","55ad68ee73fa288698cd3b885196d0d02cdfd417563d247f617bca288243bf44","15a3cd9fc6f3e89fc4901be19b15069ccef0dcdd8071b4900448bf2ab374c002","24a8660ebdf54094d8e787486f19b2823f3bc4382f5ace764429a6b7e48025ea","fced9291b4339c4fe3a1abfe5878d210a500afa7e1fa4a3be8613a6791c02b8e","4f0494cf85322d540e9cb87295af1247377bcb65b09254900b7ca29f6f46508f","fced9291b4339c4fe3a1abfe5878d210a500afa7e1fa4a3be8613a6791c02b8e","9ce88cc6fd2e3d298b97592d431c301d994f9c4ed7a7886c225e167bce29c046","99744720b128c6ac678a1d6e0fad0e69f159c1606428e91e7d2b7695cc353a80","06a0a243811e9c4738a9d413597659ca8d07b00f640b74adc9cb351c179b3268")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("fe8400a81be3de95807396ffa1539e6818c8c586bd8a17d833a573aa5d7b433b","46d7d74deaa27eaad25c97fa302d128a1c8d58058ce4cc95fd6055acbc9b959","a89b471528737b91046fc42527bf84008b067908ccc1bf4318135476c290de61","55ad68ee73fa288698cd3b885196d0d02cdfd417563d247f617bca288243bf44","15a3cd9fc6f3e89fc4901be19b15069ccef0dcdd8071b4900448bf2ab374c002","24a8660ebdf54094d8e787486f19b2823f3bc4382f5ace764429a6b7e48025ea","fced9291b4339c4fe3a1abfe5878d210a500afa7e1fa4a3be8613a6791c02b8e","4f0494cf85322d540e9cb87295af1247377bcb65b09254900b7ca29f6f46508f","fced9291b4339c4fe3a1abfe5878d210a500afa7e1fa4a3be8613a6791c02b8e","9ce88cc6fd2e3d298b97592d431c301d994f9c4ed7a7886c225e167bce29c046","99744720b128c6ac678a1d6e0fad0e69f159c1606428e91e7d2b7695cc353a80","06a0a243811e9c4738a9d413597659ca8d07b00f640b74adc9cb351c179b3268")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring64 NOT NULL AND customstring64 IN ("fe8400a81be3de95807396ffa1539e6818c8c586bd8a17d833a573aa5d7b433b","46d7d74deaa27eaad25c97fa302d128a1c8d58058ce4cc95fd6055acbc9b959","a89b471528737b91046fc42527bf84008b067908ccc1bf4318135476c290de61","55ad68ee73fa288698cd3b885196d0d02cdfd417563d247f617bca288243bf44","15a3cd9fc6f3e89fc4901be19b15069ccef0dcdd8071b4900448bf2ab374c002","24a8660ebdf54094d8e787486f19b2823f3bc4382f5ace764429a6b7e48025ea","fced9291b4339c4fe3a1abfe5878d210a500afa7e1fa4a3be8613a6791c02b8e","4f0494cf85322d540e9cb87295af1247377bcb65b09254900b7ca29f6f46508f","fced9291b4339c4fe3a1abfe5878d210a500afa7e1fa4a3be8613a6791c02b8e","9ce88cc6fd2e3d298b97592d431c301d994f9c4ed7a7886c225e167bce29c046","99744720b128c6ac678a1d6e0fad0e69f159c1606428e91e7d2b7695cc353a80","06a0a243811e9c4738a9d413597659ca8d07b00f640b74adc9cb351c179b3268")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("fe8400a81be3de95807396ffa1539e6818c8c586bd8a17d833a573aa5d7b433b","46d7d74deaa27eaad25c97fa302d128a1c8d58058ce4cc95fd6055acbc9b959","a89b471528737b91046fc42527bf84008b067908ccc1bf4318135476c290de61","55ad68ee73fa288698cd3b885196d0d02cdfd417563d247f617bca288243bf44","15a3cd9fc6f3e89fc4901be19b15069ccef0dcdd8071b4900448bf2ab374c002","24a8660ebdf54094d8e787486f19b2823f3bc4382f5ace764429a6b7e48025ea","fced9291b4339c4fe3a1abfe5878d210a500afa7e1fa4a3be8613a6791c02b8e","4f0494cf85322d540e9cb87295af1247377bcb65b09254900b7ca29f6f46508f","fced9291b4339c4fe3a1abfe5878d210a500afa7e1fa4a3be8613a6791c02b8e","9ce88cc6fd2e3d298b97592d431c301d994f9c4ed7a7886c225e167bce29c046","99744720b128c6ac678a1d6e0fad0e69f159c1606428e91e7d2b7695cc353a80","06a0a243811e9c4738a9d413597659ca8d07b00f640b74adc9cb351c179b3268")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("fe8400a81be3de95807396ffa1539e6818c8c586bd8a17d833a573aa5d7b433b","46d7d74deaa27eaad25c97fa302d128a1c8d58058ce4cc95fd6055acbc9b959","a89b471528737b91046fc42527bf84008b067908ccc1bf4318135476c290de61","55ad68ee73fa288698cd3b885196d0d02cdfd417563d247f617bca288243bf44","15a3cd9fc6f3e89fc4901be19b15069ccef0dcdd8071b4900448bf2ab374c002","24a8660ebdf54094d8e787486f19b2823f3bc4382f5ace764429a6b7e48025ea","fced9291b4339c4fe3a1abfe5878d210a500afa7e1fa4a3be8613a6791c02b8e","4f0494cf85322d540e9cb87295af1247377bcb65b09254900b7ca29f6f46508f","fced9291b4339c4fe3a1abfe5878d210a500afa7e1fa4a3be8613a6791c02b8e","9ce88cc6fd2e3d298b97592d431c301d994f9c4ed7a7886c225e167bce29c046","99744720b128c6ac678a1d6e0fad0e69f159c1606428e91e7d2b7695cc353a80","06a0a243811e9c4738a9d413597659ca8d07b00f640b74adc9cb351c179b3268")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("fe8400a81be3de95807396ffa1539e6818c8c586bd8a17d833a573aa5d7b433b","46d7d74deaa27eaad25c97fa302d128a1c8d58058ce4cc95fd6055acbc9b959","a89b471528737b91046fc42527bf84008b067908ccc1bf4318135476c290de61","55ad68ee73fa288698cd3b885196d0d02cdfd417563d247f617bca288243bf44","15a3cd9fc6f3e89fc4901be19b15069ccef0dcdd8071b4900448bf2ab374c002","24a8660ebdf54094d8e787486f19b2823f3bc4382f5ace764429a6b7e48025ea","fced9291b4339c4fe3a1abfe5878d210a500afa7e1fa4a3be8613a6791c02b8e","4f0494cf85322d540e9cb87295af1247377bcb65b09254900b7ca29f6f46508f","fced9291b4339c4fe3a1abfe5878d210a500afa7e1fa4a3be8613a6791c02b8e","9ce88cc6fd2e3d298b97592d431c301d994f9c4ed7a7886c225e167bce29c046","99744720b128c6ac678a1d6e0fad0e69f159c1606428e91e7d2b7695cc353a80","06a0a243811e9c4738a9d413597659ca8d07b00f640b74adc9cb351c179b3268")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("fe8400a81be3de95807396ffa1539e6818c8c586bd8a17d833a573aa5d7b433b","46d7d74deaa27eaad25c97fa302d128a1c8d58058ce4cc95fd6055acbc9b959","a89b471528737b91046fc42527bf84008b067908ccc1bf4318135476c290de61","55ad68ee73fa288698cd3b885196d0d02cdfd417563d247f617bca288243bf44","15a3cd9fc6f3e89fc4901be19b15069ccef0dcdd8071b4900448bf2ab374c002","24a8660ebdf54094d8e787486f19b2823f3bc4382f5ace764429a6b7e48025ea","fced9291b4339c4fe3a1abfe5878d210a500afa7e1fa4a3be8613a6791c02b8e","4f0494cf85322d540e9cb87295af1247377bcb65b09254900b7ca29f6f46508f","fced9291b4339c4fe3a1abfe5878d210a500afa7e1fa4a3be8613a6791c02b8e","9ce88cc6fd2e3d298b97592d431c301d994f9c4ed7a7886c225e167bce29c046","99744720b128c6ac678a1d6e0fad0e69f159c1606428e91e7d2b7695cc353a80","06a0a243811e9c4738a9d413597659ca8d07b00f640b74adc9cb351c179b3268")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("fe8400a81be3de95807396ffa1539e6818c8c586bd8a17d833a573aa5d7b433b","46d7d74deaa27eaad25c97fa302d128a1c8d58058ce4cc95fd6055acbc9b959","a89b471528737b91046fc42527bf84008b067908ccc1bf4318135476c290de61","55ad68ee73fa288698cd3b885196d0d02cdfd417563d247f617bca288243bf44","15a3cd9fc6f3e89fc4901be19b15069ccef0dcdd8071b4900448bf2ab374c002","24a8660ebdf54094d8e787486f19b2823f3bc4382f5ace764429a6b7e48025ea","fced9291b4339c4fe3a1abfe5878d210a500afa7e1fa4a3be8613a6791c02b8e","4f0494cf85322d540e9cb87295af1247377bcb65b09254900b7ca29f6f46508f","fced9291b4339c4fe3a1abfe5878d210a500afa7e1fa4a3be8613a6791c02b8e","9ce88cc6fd2e3d298b97592d431c301d994f9c4ed7a7886c225e167bce29c046","99744720b128c6ac678a1d6e0fad0e69f159c1606428e91e7d2b7695cc353a80","06a0a243811e9c4738a9d413597659ca8d07b00f640b74adc9cb351c179b3268")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("fe8400a81be3de95807396ffa1539e6818c8c586bd8a17d833a573aa5d7b433b","46d7d74deaa27eaad25c97fa302d128a1c8d58058ce4cc95fd6055acbc9b959","a89b471528737b91046fc42527bf84008b067908ccc1bf4318135476c290de61","55ad68ee73fa288698cd3b885196d0d02cdfd417563d247f617bca288243bf44","15a3cd9fc6f3e89fc4901be19b15069ccef0dcdd8071b4900448bf2ab374c002","24a8660ebdf54094d8e787486f19b2823f3bc4382f5ace764429a6b7e48025ea","fced9291b4339c4fe3a1abfe5878d210a500afa7e1fa4a3be8613a6791c02b8e","4f0494cf85322d540e9cb87295af1247377bcb65b09254900b7ca29f6f46508f","fced9291b4339c4fe3a1abfe5878d210a500afa7e1fa4a3be8613a6791c02b8e","9ce88cc6fd2e3d298b97592d431c301d994f9c4ed7a7886c225e167bce29c046","99744720b128c6ac678a1d6e0fad0e69f159c1606428e91e7d2b7695cc353a80","06a0a243811e9c4738a9d413597659ca8d07b00f640b74adc9cb351c179b3268")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("fe8400a81be3de95807396ffa1539e6818c8c586bd8a17d833a573aa5d7b433b","46d7d74deaa27eaad25c97fa302d128a1c8d58058ce4cc95fd6055acbc9b959","a89b471528737b91046fc42527bf84008b067908ccc1bf4318135476c290de61","55ad68ee73fa288698cd3b885196d0d02cdfd417563d247f617bca288243bf44","15a3cd9fc6f3e89fc4901be19b15069ccef0dcdd8071b4900448bf2ab374c002","24a8660ebdf54094d8e787486f19b2823f3bc4382f5ace764429a6b7e48025ea","fced9291b4339c4fe3a1abfe5878d210a500afa7e1fa4a3be8613a6791c02b8e","4f0494cf85322d540e9cb87295af1247377bcb65b09254900b7ca29f6f46508f","fced9291b4339c4fe3a1abfe5878d210a500afa7e1fa4a3be8613a6791c02b8e","9ce88cc6fd2e3d298b97592d431c301d994f9c4ed7a7886c225e167bce29c046","99744720b128c6ac678a1d6e0fad0e69f159c1606428e91e7d2b7695cc353a80","06a0a243811e9c4738a9d413597659ca8d07b00f640b74adc9cb351c179b3268")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("fe8400a81be3de95807396ffa1539e6818c8c586bd8a17d833a573aa5d7b433b","46d7d74deaa27eaad25c97fa302d128a1c8d58058ce4cc95fd6055acbc9b959","a89b471528737b91046fc42527bf84008b067908ccc1bf4318135476c290de61","55ad68ee73fa288698cd3b885196d0d02cdfd417563d247f617bca288243bf44","15a3cd9fc6f3e89fc4901be19b15069ccef0dcdd8071b4900448bf2ab374c002","24a8660ebdf54094d8e787486f19b2823f3bc4382f5ace764429a6b7e48025ea","fced9291b4339c4fe3a1abfe5878d210a500afa7e1fa4a3be8613a6791c02b8e","4f0494cf85322d540e9cb87295af1247377bcb65b09254900b7ca29f6f46508f","fced9291b4339c4fe3a1abfe5878d210a500afa7e1fa4a3be8613a6791c02b8e","9ce88cc6fd2e3d298b97592d431c301d994f9c4ed7a7886c225e167bce29c046","99744720b128c6ac678a1d6e0fad0e69f159c1606428e91e7d2b7695cc353a80","06a0a243811e9c4738a9d413597659ca8d07b00f640b74adc9cb351c179b3268")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("fe8400a81be3de95807396ffa1539e6818c8c586bd8a17d833a573aa5d7b433b","46d7d74deaa27eaad25c97fa302d128a1c8d58058ce4cc95fd6055acbc9b959","a89b471528737b91046fc42527bf84008b067908ccc1bf4318135476c290de61","55ad68ee73fa288698cd3b885196d0d02cdfd417563d247f617bca288243bf44","15a3cd9fc6f3e89fc4901be19b15069ccef0dcdd8071b4900448bf2ab374c002","24a8660ebdf54094d8e787486f19b2823f3bc4382f5ace764429a6b7e48025ea","fced9291b4339c4fe3a1abfe5878d210a500afa7e1fa4a3be8613a6791c02b8e","4f0494cf85322d540e9cb87295af1247377bcb65b09254900b7ca29f6f46508f","fced9291b4339c4fe3a1abfe5878d210a500afa7e1fa4a3be8613a6791c02b8e","9ce88cc6fd2e3d298b97592d431c301d994f9c4ed7a7886c225e167bce29c046","99744720b128c6ac678a1d6e0fad0e69f159c1606428e91e7d2b7695cc353a80","06a0a243811e9c4738a9d413597659ca8d07b00f640b74adc9cb351c179b3268")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("fe8400a81be3de95807396ffa1539e6818c8c586bd8a17d833a573aa5d7b433b","46d7d74deaa27eaad25c97fa302d128a1c8d58058ce4cc95fd6055acbc9b959","a89b471528737b91046fc42527bf84008b067908ccc1bf4318135476c290de61","55ad68ee73fa288698cd3b885196d0d02cdfd417563d247f617bca288243bf44","15a3cd9fc6f3e89fc4901be19b15069ccef0dcdd8071b4900448bf2ab374c002","24a8660ebdf54094d8e787486f19b2823f3bc4382f5ace764429a6b7e48025ea","fced9291b4339c4fe3a1abfe5878d210a500afa7e1fa4a3be8613a6791c02b8e","4f0494cf85322d540e9cb87295af1247377bcb65b09254900b7ca29f6f46508f","fced9291b4339c4fe3a1abfe5878d210a500afa7e1fa4a3be8613a6791c02b8e","9ce88cc6fd2e3d298b97592d431c301d994f9c4ed7a7886c225e167bce29c046","99744720b128c6ac678a1d6e0fad0e69f159c1606428e91e7d2b7695cc353a80","06a0a243811e9c4738a9d413597659ca8d07b00f640b74adc9cb351c179b3268")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("fe8400a81be3de95807396ffa1539e6818c8c586bd8a17d833a573aa5d7b433b","46d7d74deaa27eaad25c97fa302d128a1c8d58058ce4cc95fd6055acbc9b959","a89b471528737b91046fc42527bf84008b067908ccc1bf4318135476c290de61","55ad68ee73fa288698cd3b885196d0d02cdfd417563d247f617bca288243bf44","15a3cd9fc6f3e89fc4901be19b15069ccef0dcdd8071b4900448bf2ab374c002","24a8660ebdf54094d8e787486f19b2823f3bc4382f5ace764429a6b7e48025ea","fced9291b4339c4fe3a1abfe5878d210a500afa7e1fa4a3be8613a6791c02b8e","4f0494cf85322d540e9cb87295af1247377bcb65b09254900b7ca29f6f46508f","fced9291b4339c4fe3a1abfe5878d210a500afa7e1fa4a3be8613a6791c02b8e","9ce88cc6fd2e3d298b97592d431c301d994f9c4ed7a7886c225e167bce29c046","99744720b128c6ac678a1d6e0fad0e69f159c1606428e91e7d2b7695cc353a80","06a0a243811e9c4738a9d413597659ca8d07b00f640b74adc9cb351c179b3268")
index=activity AND rg_functionality="Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("fe8400a81be3de95807396ffa1539e6818c8c586bd8a17d833a573aa5d7b433b","46d7d74deaa27eaad25c97fa302d128a1c8d58058ce4cc95fd6055acbc9b959","a89b471528737b91046fc42527bf84008b067908ccc1bf4318135476c290de61","55ad68ee73fa288698cd3b885196d0d02cdfd417563d247f617bca288243bf44","15a3cd9fc6f3e89fc4901be19b15069ccef0dcdd8071b4900448bf2ab374c002","24a8660ebdf54094d8e787486f19b2823f3bc4382f5ace764429a6b7e48025ea","fced9291b4339c4fe3a1abfe5878d210a500afa7e1fa4a3be8613a6791c02b8e","4f0494cf85322d540e9cb87295af1247377bcb65b09254900b7ca29f6f46508f","fced9291b4339c4fe3a1abfe5878d210a500afa7e1fa4a3be8613a6791c02b8e","9ce88cc6fd2e3d298b97592d431c301d994f9c4ed7a7886c225e167bce29c046","99744720b128c6ac678a1d6e0fad0e69f159c1606428e91e7d2b7695cc353a80","06a0a243811e9c4738a9d413597659ca8d07b00f640b74adc9cb351c179b3268")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("fe8400a81be3de95807396ffa1539e6818c8c586bd8a17d833a573aa5d7b433b","46d7d74deaa27eaad25c97fa302d128a1c8d58058ce4cc95fd6055acbc9b959","a89b471528737b91046fc42527bf84008b067908ccc1bf4318135476c290de61","55ad68ee73fa288698cd3b885196d0d02cdfd417563d247f617bca288243bf44","15a3cd9fc6f3e89fc4901be19b15069ccef0dcdd8071b4900448bf2ab374c002","24a8660ebdf54094d8e787486f19b2823f3bc4382f5ace764429a6b7e48025ea","fced9291b4339c4fe3a1abfe5878d210a500afa7e1fa4a3be8613a6791c02b8e","4f0494cf85322d540e9cb87295af1247377bcb65b09254900b7ca29f6f46508f","fced9291b4339c4fe3a1abfe5878d210a500afa7e1fa4a3be8613a6791c02b8e","9ce88cc6fd2e3d298b97592d431c301d994f9c4ed7a7886c225e167bce29c046","99744720b128c6ac678a1d6e0fad0e69f159c1606428e91e7d2b7695cc353a80","06a0a243811e9c4738a9d413597659ca8d07b00f640b74adc9cb351c179b3268")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("fe8400a81be3de95807396ffa1539e6818c8c586bd8a17d833a573aa5d7b433b","46d7d74deaa27eaad25c97fa302d128a1c8d58058ce4cc95fd6055acbc9b959","a89b471528737b91046fc42527bf84008b067908ccc1bf4318135476c290de61","55ad68ee73fa288698cd3b885196d0d02cdfd417563d247f617bca288243bf44","15a3cd9fc6f3e89fc4901be19b15069ccef0dcdd8071b4900448bf2ab374c002","24a8660ebdf54094d8e787486f19b2823f3bc4382f5ace764429a6b7e48025ea","fced9291b4339c4fe3a1abfe5878d210a500afa7e1fa4a3be8613a6791c02b8e","4f0494cf85322d540e9cb87295af1247377bcb65b09254900b7ca29f6f46508f","fced9291b4339c4fe3a1abfe5878d210a500afa7e1fa4a3be8613a6791c02b8e","9ce88cc6fd2e3d298b97592d431c301d994f9c4ed7a7886c225e167bce29c046","99744720b128c6ac678a1d6e0fad0e69f159c1606428e91e7d2b7695cc353a80","06a0a243811e9c4738a9d413597659ca8d07b00f640b74adc9cb351c179b3268")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("fe8400a81be3de95807396ffa1539e6818c8c586bd8a17d833a573aa5d7b433b","46d7d74deaa27eaad25c97fa302d128a1c8d58058ce4cc95fd6055acbc9b959","a89b471528737b91046fc42527bf84008b067908ccc1bf4318135476c290de61","55ad68ee73fa288698cd3b885196d0d02cdfd417563d247f617bca288243bf44","15a3cd9fc6f3e89fc4901be19b15069ccef0dcdd8071b4900448bf2ab374c002","24a8660ebdf54094d8e787486f19b2823f3bc4382f5ace764429a6b7e48025ea","fced9291b4339c4fe3a1abfe5878d210a500afa7e1fa4a3be8613a6791c02b8e","4f0494cf85322d540e9cb87295af1247377bcb65b09254900b7ca29f6f46508f","fced9291b4339c4fe3a1abfe5878d210a500afa7e1fa4a3be8613a6791c02b8e","9ce88cc6fd2e3d298b97592d431c301d994f9c4ed7a7886c225e167bce29c046","99744720b128c6ac678a1d6e0fad0e69f159c1606428e91e7d2b7695cc353a80","06a0a243811e9c4738a9d413597659ca8d07b00f640b74adc9cb351c179b3268")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("fe8400a81be3de95807396ffa1539e6818c8c586bd8a17d833a573aa5d7b433b","46d7d74deaa27eaad25c97fa302d128a1c8d58058ce4cc95fd6055acbc9b959","a89b471528737b91046fc42527bf84008b067908ccc1bf4318135476c290de61","55ad68ee73fa288698cd3b885196d0d02cdfd417563d247f617bca288243bf44","15a3cd9fc6f3e89fc4901be19b15069ccef0dcdd8071b4900448bf2ab374c002","24a8660ebdf54094d8e787486f19b2823f3bc4382f5ace764429a6b7e48025ea","fced9291b4339c4fe3a1abfe5878d210a500afa7e1fa4a3be8613a6791c02b8e","4f0494cf85322d540e9cb87295af1247377bcb65b09254900b7ca29f6f46508f","fced9291b4339c4fe3a1abfe5878d210a500afa7e1fa4a3be8613a6791c02b8e","9ce88cc6fd2e3d298b97592d431c301d994f9c4ed7a7886c225e167bce29c046","99744720b128c6ac678a1d6e0fad0e69f159c1606428e91e7d2b7695cc353a80","06a0a243811e9c4738a9d413597659ca8d07b00f640b74adc9cb351c179b3268")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("fe8400a81be3de95807396ffa1539e6818c8c586bd8a17d833a573aa5d7b433b","46d7d74deaa27eaad25c97fa302d128a1c8d58058ce4cc95fd6055acbc9b959","a89b471528737b91046fc42527bf84008b067908ccc1bf4318135476c290de61","55ad68ee73fa288698cd3b885196d0d02cdfd417563d247f617bca288243bf44","15a3cd9fc6f3e89fc4901be19b15069ccef0dcdd8071b4900448bf2ab374c002","24a8660ebdf54094d8e787486f19b2823f3bc4382f5ace764429a6b7e48025ea","fced9291b4339c4fe3a1abfe5878d210a500afa7e1fa4a3be8613a6791c02b8e","4f0494cf85322d540e9cb87295af1247377bcb65b09254900b7ca29f6f46508f","fced9291b4339c4fe3a1abfe5878d210a500afa7e1fa4a3be8613a6791c02b8e","9ce88cc6fd2e3d298b97592d431c301d994f9c4ed7a7886c225e167bce29c046","99744720b128c6ac678a1d6e0fad0e69f159c1606428e91e7d2b7695cc353a80","06a0a243811e9c4738a9d413597659ca8d07b00f640b74adc9cb351c179b3268")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("fe8400a81be3de95807396ffa1539e6818c8c586bd8a17d833a573aa5d7b433b","46d7d74deaa27eaad25c97fa302d128a1c8d58058ce4cc95fd6055acbc9b959","a89b471528737b91046fc42527bf84008b067908ccc1bf4318135476c290de61","55ad68ee73fa288698cd3b885196d0d02cdfd417563d247f617bca288243bf44","15a3cd9fc6f3e89fc4901be19b15069ccef0dcdd8071b4900448bf2ab374c002","24a8660ebdf54094d8e787486f19b2823f3bc4382f5ace764429a6b7e48025ea","fced9291b4339c4fe3a1abfe5878d210a500afa7e1fa4a3be8613a6791c02b8e","4f0494cf85322d540e9cb87295af1247377bcb65b09254900b7ca29f6f46508f","fced9291b4339c4fe3a1abfe5878d210a500afa7e1fa4a3be8613a6791c02b8e","9ce88cc6fd2e3d298b97592d431c301d994f9c4ed7a7886c225e167bce29c046","99744720b128c6ac678a1d6e0fad0e69f159c1606428e91e7d2b7695cc353a80","06a0a243811e9c4738a9d413597659ca8d07b00f640b74adc9cb351c179b3268")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("fe8400a81be3de95807396ffa1539e6818c8c586bd8a17d833a573aa5d7b433b","46d7d74deaa27eaad25c97fa302d128a1c8d58058ce4cc95fd6055acbc9b959","a89b471528737b91046fc42527bf84008b067908ccc1bf4318135476c290de61","55ad68ee73fa288698cd3b885196d0d02cdfd417563d247f617bca288243bf44","15a3cd9fc6f3e89fc4901be19b15069ccef0dcdd8071b4900448bf2ab374c002","24a8660ebdf54094d8e787486f19b2823f3bc4382f5ace764429a6b7e48025ea","fced9291b4339c4fe3a1abfe5878d210a500afa7e1fa4a3be8613a6791c02b8e","4f0494cf85322d540e9cb87295af1247377bcb65b09254900b7ca29f6f46508f","fced9291b4339c4fe3a1abfe5878d210a500afa7e1fa4a3be8613a6791c02b8e","9ce88cc6fd2e3d298b97592d431c301d994f9c4ed7a7886c225e167bce29c046","99744720b128c6ac678a1d6e0fad0e69f159c1606428e91e7d2b7695cc353a80","06a0a243811e9c4738a9d413597659ca8d07b00f640b74adc9cb351c179b3268")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring64 NOT NULL AND customstring64 IN ("fe8400a81be3de95807396ffa1539e6818c8c586bd8a17d833a573aa5d7b433b","46d7d74deaa27eaad25c97fa302d128a1c8d58058ce4cc95fd6055acbc9b959","a89b471528737b91046fc42527bf84008b067908ccc1bf4318135476c290de61","55ad68ee73fa288698cd3b885196d0d02cdfd417563d247f617bca288243bf44","15a3cd9fc6f3e89fc4901be19b15069ccef0dcdd8071b4900448bf2ab374c002","24a8660ebdf54094d8e787486f19b2823f3bc4382f5ace764429a6b7e48025ea","fced9291b4339c4fe3a1abfe5878d210a500afa7e1fa4a3be8613a6791c02b8e","4f0494cf85322d540e9cb87295af1247377bcb65b09254900b7ca29f6f46508f","fced9291b4339c4fe3a1abfe5878d210a500afa7e1fa4a3be8613a6791c02b8e","9ce88cc6fd2e3d298b97592d431c301d994f9c4ed7a7886c225e167bce29c046","99744720b128c6ac678a1d6e0fad0e69f159c1606428e91e7d2b7695cc353a80","06a0a243811e9c4738a9d413597659ca8d07b00f640b74adc9cb351c179b3268")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("fe8400a81be3de95807396ffa1539e6818c8c586bd8a17d833a573aa5d7b433b","46d7d74deaa27eaad25c97fa302d128a1c8d58058ce4cc95fd6055acbc9b959","a89b471528737b91046fc42527bf84008b067908ccc1bf4318135476c290de61","55ad68ee73fa288698cd3b885196d0d02cdfd417563d247f617bca288243bf44","15a3cd9fc6f3e89fc4901be19b15069ccef0dcdd8071b4900448bf2ab374c002","24a8660ebdf54094d8e787486f19b2823f3bc4382f5ace764429a6b7e48025ea","fced9291b4339c4fe3a1abfe5878d210a500afa7e1fa4a3be8613a6791c02b8e","4f0494cf85322d540e9cb87295af1247377bcb65b09254900b7ca29f6f46508f","fced9291b4339c4fe3a1abfe5878d210a500afa7e1fa4a3be8613a6791c02b8e","9ce88cc6fd2e3d298b97592d431c301d994f9c4ed7a7886c225e167bce29c046","99744720b128c6ac678a1d6e0fad0e69f159c1606428e91e7d2b7695cc353a80","06a0a243811e9c4738a9d413597659ca8d07b00f640b74adc9cb351c179b3268")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("fe8400a81be3de95807396ffa1539e6818c8c586bd8a17d833a573aa5d7b433b","46d7d74deaa27eaad25c97fa302d128a1c8d58058ce4cc95fd6055acbc9b959","a89b471528737b91046fc42527bf84008b067908ccc1bf4318135476c290de61","55ad68ee73fa288698cd3b885196d0d02cdfd417563d247f617bca288243bf44","15a3cd9fc6f3e89fc4901be19b15069ccef0dcdd8071b4900448bf2ab374c002","24a8660ebdf54094d8e787486f19b2823f3bc4382f5ace764429a6b7e48025ea","fced9291b4339c4fe3a1abfe5878d210a500afa7e1fa4a3be8613a6791c02b8e","4f0494cf85322d540e9cb87295af1247377bcb65b09254900b7ca29f6f46508f","fced9291b4339c4fe3a1abfe5878d210a500afa7e1fa4a3be8613a6791c02b8e","9ce88cc6fd2e3d298b97592d431c301d994f9c4ed7a7886c225e167bce29c046","99744720b128c6ac678a1d6e0fad0e69f159c1606428e91e7d2b7695cc353a80","06a0a243811e9c4738a9d413597659ca8d07b00f640b74adc9cb351c179b3268")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("fe8400a81be3de95807396ffa1539e6818c8c586bd8a17d833a573aa5d7b433b","46d7d74deaa27eaad25c97fa302d128a1c8d58058ce4cc95fd6055acbc9b959","a89b471528737b91046fc42527bf84008b067908ccc1bf4318135476c290de61","55ad68ee73fa288698cd3b885196d0d02cdfd417563d247f617bca288243bf44","15a3cd9fc6f3e89fc4901be19b15069ccef0dcdd8071b4900448bf2ab374c002","24a8660ebdf54094d8e787486f19b2823f3bc4382f5ace764429a6b7e48025ea","fced9291b4339c4fe3a1abfe5878d210a500afa7e1fa4a3be8613a6791c02b8e","4f0494cf85322d540e9cb87295af1247377bcb65b09254900b7ca29f6f46508f","fced9291b4339c4fe3a1abfe5878d210a500afa7e1fa4a3be8613a6791c02b8e","9ce88cc6fd2e3d298b97592d431c301d994f9c4ed7a7886c225e167bce29c046","99744720b128c6ac678a1d6e0fad0e69f159c1606428e91e7d2b7695cc353a80","06a0a243811e9c4738a9d413597659ca8d07b00f640b74adc9cb351c179b3268")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring64 NOT NULL AND customstring64 IN ("fe8400a81be3de95807396ffa1539e6818c8c586bd8a17d833a573aa5d7b433b","46d7d74deaa27eaad25c97fa302d128a1c8d58058ce4cc95fd6055acbc9b959","a89b471528737b91046fc42527bf84008b067908ccc1bf4318135476c290de61","55ad68ee73fa288698cd3b885196d0d02cdfd417563d247f617bca288243bf44","15a3cd9fc6f3e89fc4901be19b15069ccef0dcdd8071b4900448bf2ab374c002","24a8660ebdf54094d8e787486f19b2823f3bc4382f5ace764429a6b7e48025ea","fced9291b4339c4fe3a1abfe5878d210a500afa7e1fa4a3be8613a6791c02b8e","4f0494cf85322d540e9cb87295af1247377bcb65b09254900b7ca29f6f46508f","fced9291b4339c4fe3a1abfe5878d210a500afa7e1fa4a3be8613a6791c02b8e","9ce88cc6fd2e3d298b97592d431c301d994f9c4ed7a7886c225e167bce29c046","99744720b128c6ac678a1d6e0fad0e69f159c1606428e91e7d2b7695cc353a80","06a0a243811e9c4738a9d413597659ca8d07b00f640b74adc9cb351c179b3268")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("fe8400a81be3de95807396ffa1539e6818c8c586bd8a17d833a573aa5d7b433b","46d7d74deaa27eaad25c97fa302d128a1c8d58058ce4cc95fd6055acbc9b959","a89b471528737b91046fc42527bf84008b067908ccc1bf4318135476c290de61","55ad68ee73fa288698cd3b885196d0d02cdfd417563d247f617bca288243bf44","15a3cd9fc6f3e89fc4901be19b15069ccef0dcdd8071b4900448bf2ab374c002","24a8660ebdf54094d8e787486f19b2823f3bc4382f5ace764429a6b7e48025ea","fced9291b4339c4fe3a1abfe5878d210a500afa7e1fa4a3be8613a6791c02b8e","4f0494cf85322d540e9cb87295af1247377bcb65b09254900b7ca29f6f46508f","fced9291b4339c4fe3a1abfe5878d210a500afa7e1fa4a3be8613a6791c02b8e","9ce88cc6fd2e3d298b97592d431c301d994f9c4ed7a7886c225e167bce29c046","99744720b128c6ac678a1d6e0fad0e69f159c1606428e91e7d2b7695cc353a80","06a0a243811e9c4738a9d413597659ca8d07b00f640b74adc9cb351c179b3268")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("fe8400a81be3de95807396ffa1539e6818c8c586bd8a17d833a573aa5d7b433b","46d7d74deaa27eaad25c97fa302d128a1c8d58058ce4cc95fd6055acbc9b959","a89b471528737b91046fc42527bf84008b067908ccc1bf4318135476c290de61","55ad68ee73fa288698cd3b885196d0d02cdfd417563d247f617bca288243bf44","15a3cd9fc6f3e89fc4901be19b15069ccef0dcdd8071b4900448bf2ab374c002","24a8660ebdf54094d8e787486f19b2823f3bc4382f5ace764429a6b7e48025ea","fced9291b4339c4fe3a1abfe5878d210a500afa7e1fa4a3be8613a6791c02b8e","4f0494cf85322d540e9cb87295af1247377bcb65b09254900b7ca29f6f46508f","fced9291b4339c4fe3a1abfe5878d210a500afa7e1fa4a3be8613a6791c02b8e","9ce88cc6fd2e3d298b97592d431c301d994f9c4ed7a7886c225e167bce29c046","99744720b128c6ac678a1d6e0fad0e69f159c1606428e91e7d2b7695cc353a80","06a0a243811e9c4738a9d413597659ca8d07b00f640b74adc9cb351c179b3268")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("fe8400a81be3de95807396ffa1539e6818c8c586bd8a17d833a573aa5d7b433b","46d7d74deaa27eaad25c97fa302d128a1c8d58058ce4cc95fd6055acbc9b959","a89b471528737b91046fc42527bf84008b067908ccc1bf4318135476c290de61","55ad68ee73fa288698cd3b885196d0d02cdfd417563d247f617bca288243bf44","15a3cd9fc6f3e89fc4901be19b15069ccef0dcdd8071b4900448bf2ab374c002","24a8660ebdf54094d8e787486f19b2823f3bc4382f5ace764429a6b7e48025ea","fced9291b4339c4fe3a1abfe5878d210a500afa7e1fa4a3be8613a6791c02b8e","4f0494cf85322d540e9cb87295af1247377bcb65b09254900b7ca29f6f46508f","fced9291b4339c4fe3a1abfe5878d210a500afa7e1fa4a3be8613a6791c02b8e","9ce88cc6fd2e3d298b97592d431c301d994f9c4ed7a7886c225e167bce29c046","99744720b128c6ac678a1d6e0fad0e69f159c1606428e91e7d2b7695cc353a80","06a0a243811e9c4738a9d413597659ca8d07b00f640b74adc9cb351c179b3268")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring64 NOT NULL AND customstring64 IN ("fe8400a81be3de95807396ffa1539e6818c8c586bd8a17d833a573aa5d7b433b","46d7d74deaa27eaad25c97fa302d128a1c8d58058ce4cc95fd6055acbc9b959","a89b471528737b91046fc42527bf84008b067908ccc1bf4318135476c290de61","55ad68ee73fa288698cd3b885196d0d02cdfd417563d247f617bca288243bf44","15a3cd9fc6f3e89fc4901be19b15069ccef0dcdd8071b4900448bf2ab374c002","24a8660ebdf54094d8e787486f19b2823f3bc4382f5ace764429a6b7e48025ea","fced9291b4339c4fe3a1abfe5878d210a500afa7e1fa4a3be8613a6791c02b8e","4f0494cf85322d540e9cb87295af1247377bcb65b09254900b7ca29f6f46508f","fced9291b4339c4fe3a1abfe5878d210a500afa7e1fa4a3be8613a6791c02b8e","9ce88cc6fd2e3d298b97592d431c301d994f9c4ed7a7886c225e167bce29c046","99744720b128c6ac678a1d6e0fad0e69f159c1606428e91e7d2b7695cc353a80","06a0a243811e9c4738a9d413597659ca8d07b00f640b74adc9cb351c179b3268")
index=activity AND rg_functionality="O365 General" AND filehash NOT NULL AND filehash IN ("fe8400a81be3de95807396ffa1539e6818c8c586bd8a17d833a573aa5d7b433b","46d7d74deaa27eaad25c97fa302d128a1c8d58058ce4cc95fd6055acbc9b959","a89b471528737b91046fc42527bf84008b067908ccc1bf4318135476c290de61","55ad68ee73fa288698cd3b885196d0d02cdfd417563d247f617bca288243bf44","15a3cd9fc6f3e89fc4901be19b15069ccef0dcdd8071b4900448bf2ab374c002","24a8660ebdf54094d8e787486f19b2823f3bc4382f5ace764429a6b7e48025ea","fced9291b4339c4fe3a1abfe5878d210a500afa7e1fa4a3be8613a6791c02b8e","4f0494cf85322d540e9cb87295af1247377bcb65b09254900b7ca29f6f46508f","fced9291b4339c4fe3a1abfe5878d210a500afa7e1fa4a3be8613a6791c02b8e","9ce88cc6fd2e3d298b97592d431c301d994f9c4ed7a7886c225e167bce29c046","99744720b128c6ac678a1d6e0fad0e69f159c1606428e91e7d2b7695cc353a80","06a0a243811e9c4738a9d413597659ca8d07b00f640b74adc9cb351c179b3268")
index=activity AND rg_functionality="O365 General" AND oldfilehash NOT NULL AND oldfilehash IN ("fe8400a81be3de95807396ffa1539e6818c8c586bd8a17d833a573aa5d7b433b","46d7d74deaa27eaad25c97fa302d128a1c8d58058ce4cc95fd6055acbc9b959","a89b471528737b91046fc42527bf84008b067908ccc1bf4318135476c290de61","55ad68ee73fa288698cd3b885196d0d02cdfd417563d247f617bca288243bf44","15a3cd9fc6f3e89fc4901be19b15069ccef0dcdd8071b4900448bf2ab374c002","24a8660ebdf54094d8e787486f19b2823f3bc4382f5ace764429a6b7e48025ea","fced9291b4339c4fe3a1abfe5878d210a500afa7e1fa4a3be8613a6791c02b8e","4f0494cf85322d540e9cb87295af1247377bcb65b09254900b7ca29f6f46508f","fced9291b4339c4fe3a1abfe5878d210a500afa7e1fa4a3be8613a6791c02b8e","9ce88cc6fd2e3d298b97592d431c301d994f9c4ed7a7886c225e167bce29c046","99744720b128c6ac678a1d6e0fad0e69f159c1606428e91e7d2b7695cc353a80","06a0a243811e9c4738a9d413597659ca8d07b00f640b74adc9cb351c179b3268")
index=activity AND rg_functionality="O365 General" AND customstring3 NOT NULL AND customstring3 IN ("fe8400a81be3de95807396ffa1539e6818c8c586bd8a17d833a573aa5d7b433b","46d7d74deaa27eaad25c97fa302d128a1c8d58058ce4cc95fd6055acbc9b959","a89b471528737b91046fc42527bf84008b067908ccc1bf4318135476c290de61","55ad68ee73fa288698cd3b885196d0d02cdfd417563d247f617bca288243bf44","15a3cd9fc6f3e89fc4901be19b15069ccef0dcdd8071b4900448bf2ab374c002","24a8660ebdf54094d8e787486f19b2823f3bc4382f5ace764429a6b7e48025ea","fced9291b4339c4fe3a1abfe5878d210a500afa7e1fa4a3be8613a6791c02b8e","4f0494cf85322d540e9cb87295af1247377bcb65b09254900b7ca29f6f46508f","fced9291b4339c4fe3a1abfe5878d210a500afa7e1fa4a3be8613a6791c02b8e","9ce88cc6fd2e3d298b97592d431c301d994f9c4ed7a7886c225e167bce29c046","99744720b128c6ac678a1d6e0fad0e69f159c1606428e91e7d2b7695cc353a80","06a0a243811e9c4738a9d413597659ca8d07b00f640b74adc9cb351c179b3268")
index=activity AND rg_functionality="O365 General" AND customstring64 NOT NULL AND customstring64 IN ("fe8400a81be3de95807396ffa1539e6818c8c586bd8a17d833a573aa5d7b433b","46d7d74deaa27eaad25c97fa302d128a1c8d58058ce4cc95fd6055acbc9b959","a89b471528737b91046fc42527bf84008b067908ccc1bf4318135476c290de61","55ad68ee73fa288698cd3b885196d0d02cdfd417563d247f617bca288243bf44","15a3cd9fc6f3e89fc4901be19b15069ccef0dcdd8071b4900448bf2ab374c002","24a8660ebdf54094d8e787486f19b2823f3bc4382f5ace764429a6b7e48025ea","fced9291b4339c4fe3a1abfe5878d210a500afa7e1fa4a3be8613a6791c02b8e","4f0494cf85322d540e9cb87295af1247377bcb65b09254900b7ca29f6f46508f","fced9291b4339c4fe3a1abfe5878d210a500afa7e1fa4a3be8613a6791c02b8e","9ce88cc6fd2e3d298b97592d431c301d994f9c4ed7a7886c225e167bce29c046","99744720b128c6ac678a1d6e0fad0e69f159c1606428e91e7d2b7695cc353a80","06a0a243811e9c4738a9d413597659ca8d07b00f640b74adc9cb351c179b3268")
