index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("340ddd9fd22f2abf0474b580a29129b09cc125fbd00a168eab899f6cdde351d7","79d7701146b24e023de7a34519bbfb635375d1db3711bdf58ab21440a42ca7c2","abba10d2808639724e8c6b3c22d565cb338dc17d680a4f1591d0408b9edf78d8","2c26bb95a938b6a5063bf4f95942440a0583d52bb129ea272584fc94906f5e86","d26171b8ecb3cf1b140d062c0274cc6ee125a318d74e2d5e19699213dca3ca9a","2797ce055d37f9ea23080498584979b31fbf1f178d989d00c50f0cbbc93c6cc9","32ead9cd1f4925c8f10b9c04d0aa8b874277495104d9b8adfe7bb42583e51218","f6e189a3074fc88dc5f1be8de7887e097fe2115867db56b3ecc68b3a278b4965","2f7cef4fdedf5393a5485ef4e3b718a56052184193b9833220b04930402dc96d","7472ac19dc16fc3bfd621cbb2a49e3641bd86325552d4eeb562e21d963f82bb3","1a449b92a96d37cd8210e25c17d495f9cf65387a3feb81b7b2c6a901e5ab7523")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("340ddd9fd22f2abf0474b580a29129b09cc125fbd00a168eab899f6cdde351d7","79d7701146b24e023de7a34519bbfb635375d1db3711bdf58ab21440a42ca7c2","abba10d2808639724e8c6b3c22d565cb338dc17d680a4f1591d0408b9edf78d8","2c26bb95a938b6a5063bf4f95942440a0583d52bb129ea272584fc94906f5e86","d26171b8ecb3cf1b140d062c0274cc6ee125a318d74e2d5e19699213dca3ca9a","2797ce055d37f9ea23080498584979b31fbf1f178d989d00c50f0cbbc93c6cc9","32ead9cd1f4925c8f10b9c04d0aa8b874277495104d9b8adfe7bb42583e51218","f6e189a3074fc88dc5f1be8de7887e097fe2115867db56b3ecc68b3a278b4965","2f7cef4fdedf5393a5485ef4e3b718a56052184193b9833220b04930402dc96d","7472ac19dc16fc3bfd621cbb2a49e3641bd86325552d4eeb562e21d963f82bb3","1a449b92a96d37cd8210e25c17d495f9cf65387a3feb81b7b2c6a901e5ab7523")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("340ddd9fd22f2abf0474b580a29129b09cc125fbd00a168eab899f6cdde351d7","79d7701146b24e023de7a34519bbfb635375d1db3711bdf58ab21440a42ca7c2","abba10d2808639724e8c6b3c22d565cb338dc17d680a4f1591d0408b9edf78d8","2c26bb95a938b6a5063bf4f95942440a0583d52bb129ea272584fc94906f5e86","d26171b8ecb3cf1b140d062c0274cc6ee125a318d74e2d5e19699213dca3ca9a","2797ce055d37f9ea23080498584979b31fbf1f178d989d00c50f0cbbc93c6cc9","32ead9cd1f4925c8f10b9c04d0aa8b874277495104d9b8adfe7bb42583e51218","f6e189a3074fc88dc5f1be8de7887e097fe2115867db56b3ecc68b3a278b4965","2f7cef4fdedf5393a5485ef4e3b718a56052184193b9833220b04930402dc96d","7472ac19dc16fc3bfd621cbb2a49e3641bd86325552d4eeb562e21d963f82bb3","1a449b92a96d37cd8210e25c17d495f9cf65387a3feb81b7b2c6a901e5ab7523")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring64 NOT NULL AND customstring64 IN ("340ddd9fd22f2abf0474b580a29129b09cc125fbd00a168eab899f6cdde351d7","79d7701146b24e023de7a34519bbfb635375d1db3711bdf58ab21440a42ca7c2","abba10d2808639724e8c6b3c22d565cb338dc17d680a4f1591d0408b9edf78d8","2c26bb95a938b6a5063bf4f95942440a0583d52bb129ea272584fc94906f5e86","d26171b8ecb3cf1b140d062c0274cc6ee125a318d74e2d5e19699213dca3ca9a","2797ce055d37f9ea23080498584979b31fbf1f178d989d00c50f0cbbc93c6cc9","32ead9cd1f4925c8f10b9c04d0aa8b874277495104d9b8adfe7bb42583e51218","f6e189a3074fc88dc5f1be8de7887e097fe2115867db56b3ecc68b3a278b4965","2f7cef4fdedf5393a5485ef4e3b718a56052184193b9833220b04930402dc96d","7472ac19dc16fc3bfd621cbb2a49e3641bd86325552d4eeb562e21d963f82bb3","1a449b92a96d37cd8210e25c17d495f9cf65387a3feb81b7b2c6a901e5ab7523")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("340ddd9fd22f2abf0474b580a29129b09cc125fbd00a168eab899f6cdde351d7","79d7701146b24e023de7a34519bbfb635375d1db3711bdf58ab21440a42ca7c2","abba10d2808639724e8c6b3c22d565cb338dc17d680a4f1591d0408b9edf78d8","2c26bb95a938b6a5063bf4f95942440a0583d52bb129ea272584fc94906f5e86","d26171b8ecb3cf1b140d062c0274cc6ee125a318d74e2d5e19699213dca3ca9a","2797ce055d37f9ea23080498584979b31fbf1f178d989d00c50f0cbbc93c6cc9","32ead9cd1f4925c8f10b9c04d0aa8b874277495104d9b8adfe7bb42583e51218","f6e189a3074fc88dc5f1be8de7887e097fe2115867db56b3ecc68b3a278b4965","2f7cef4fdedf5393a5485ef4e3b718a56052184193b9833220b04930402dc96d","7472ac19dc16fc3bfd621cbb2a49e3641bd86325552d4eeb562e21d963f82bb3","1a449b92a96d37cd8210e25c17d495f9cf65387a3feb81b7b2c6a901e5ab7523")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("340ddd9fd22f2abf0474b580a29129b09cc125fbd00a168eab899f6cdde351d7","79d7701146b24e023de7a34519bbfb635375d1db3711bdf58ab21440a42ca7c2","abba10d2808639724e8c6b3c22d565cb338dc17d680a4f1591d0408b9edf78d8","2c26bb95a938b6a5063bf4f95942440a0583d52bb129ea272584fc94906f5e86","d26171b8ecb3cf1b140d062c0274cc6ee125a318d74e2d5e19699213dca3ca9a","2797ce055d37f9ea23080498584979b31fbf1f178d989d00c50f0cbbc93c6cc9","32ead9cd1f4925c8f10b9c04d0aa8b874277495104d9b8adfe7bb42583e51218","f6e189a3074fc88dc5f1be8de7887e097fe2115867db56b3ecc68b3a278b4965","2f7cef4fdedf5393a5485ef4e3b718a56052184193b9833220b04930402dc96d","7472ac19dc16fc3bfd621cbb2a49e3641bd86325552d4eeb562e21d963f82bb3","1a449b92a96d37cd8210e25c17d495f9cf65387a3feb81b7b2c6a901e5ab7523")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("340ddd9fd22f2abf0474b580a29129b09cc125fbd00a168eab899f6cdde351d7","79d7701146b24e023de7a34519bbfb635375d1db3711bdf58ab21440a42ca7c2","abba10d2808639724e8c6b3c22d565cb338dc17d680a4f1591d0408b9edf78d8","2c26bb95a938b6a5063bf4f95942440a0583d52bb129ea272584fc94906f5e86","d26171b8ecb3cf1b140d062c0274cc6ee125a318d74e2d5e19699213dca3ca9a","2797ce055d37f9ea23080498584979b31fbf1f178d989d00c50f0cbbc93c6cc9","32ead9cd1f4925c8f10b9c04d0aa8b874277495104d9b8adfe7bb42583e51218","f6e189a3074fc88dc5f1be8de7887e097fe2115867db56b3ecc68b3a278b4965","2f7cef4fdedf5393a5485ef4e3b718a56052184193b9833220b04930402dc96d","7472ac19dc16fc3bfd621cbb2a49e3641bd86325552d4eeb562e21d963f82bb3","1a449b92a96d37cd8210e25c17d495f9cf65387a3feb81b7b2c6a901e5ab7523")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("340ddd9fd22f2abf0474b580a29129b09cc125fbd00a168eab899f6cdde351d7","79d7701146b24e023de7a34519bbfb635375d1db3711bdf58ab21440a42ca7c2","abba10d2808639724e8c6b3c22d565cb338dc17d680a4f1591d0408b9edf78d8","2c26bb95a938b6a5063bf4f95942440a0583d52bb129ea272584fc94906f5e86","d26171b8ecb3cf1b140d062c0274cc6ee125a318d74e2d5e19699213dca3ca9a","2797ce055d37f9ea23080498584979b31fbf1f178d989d00c50f0cbbc93c6cc9","32ead9cd1f4925c8f10b9c04d0aa8b874277495104d9b8adfe7bb42583e51218","f6e189a3074fc88dc5f1be8de7887e097fe2115867db56b3ecc68b3a278b4965","2f7cef4fdedf5393a5485ef4e3b718a56052184193b9833220b04930402dc96d","7472ac19dc16fc3bfd621cbb2a49e3641bd86325552d4eeb562e21d963f82bb3","1a449b92a96d37cd8210e25c17d495f9cf65387a3feb81b7b2c6a901e5ab7523")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("340ddd9fd22f2abf0474b580a29129b09cc125fbd00a168eab899f6cdde351d7","79d7701146b24e023de7a34519bbfb635375d1db3711bdf58ab21440a42ca7c2","abba10d2808639724e8c6b3c22d565cb338dc17d680a4f1591d0408b9edf78d8","2c26bb95a938b6a5063bf4f95942440a0583d52bb129ea272584fc94906f5e86","d26171b8ecb3cf1b140d062c0274cc6ee125a318d74e2d5e19699213dca3ca9a","2797ce055d37f9ea23080498584979b31fbf1f178d989d00c50f0cbbc93c6cc9","32ead9cd1f4925c8f10b9c04d0aa8b874277495104d9b8adfe7bb42583e51218","f6e189a3074fc88dc5f1be8de7887e097fe2115867db56b3ecc68b3a278b4965","2f7cef4fdedf5393a5485ef4e3b718a56052184193b9833220b04930402dc96d","7472ac19dc16fc3bfd621cbb2a49e3641bd86325552d4eeb562e21d963f82bb3","1a449b92a96d37cd8210e25c17d495f9cf65387a3feb81b7b2c6a901e5ab7523")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("340ddd9fd22f2abf0474b580a29129b09cc125fbd00a168eab899f6cdde351d7","79d7701146b24e023de7a34519bbfb635375d1db3711bdf58ab21440a42ca7c2","abba10d2808639724e8c6b3c22d565cb338dc17d680a4f1591d0408b9edf78d8","2c26bb95a938b6a5063bf4f95942440a0583d52bb129ea272584fc94906f5e86","d26171b8ecb3cf1b140d062c0274cc6ee125a318d74e2d5e19699213dca3ca9a","2797ce055d37f9ea23080498584979b31fbf1f178d989d00c50f0cbbc93c6cc9","32ead9cd1f4925c8f10b9c04d0aa8b874277495104d9b8adfe7bb42583e51218","f6e189a3074fc88dc5f1be8de7887e097fe2115867db56b3ecc68b3a278b4965","2f7cef4fdedf5393a5485ef4e3b718a56052184193b9833220b04930402dc96d","7472ac19dc16fc3bfd621cbb2a49e3641bd86325552d4eeb562e21d963f82bb3","1a449b92a96d37cd8210e25c17d495f9cf65387a3feb81b7b2c6a901e5ab7523")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("340ddd9fd22f2abf0474b580a29129b09cc125fbd00a168eab899f6cdde351d7","79d7701146b24e023de7a34519bbfb635375d1db3711bdf58ab21440a42ca7c2","abba10d2808639724e8c6b3c22d565cb338dc17d680a4f1591d0408b9edf78d8","2c26bb95a938b6a5063bf4f95942440a0583d52bb129ea272584fc94906f5e86","d26171b8ecb3cf1b140d062c0274cc6ee125a318d74e2d5e19699213dca3ca9a","2797ce055d37f9ea23080498584979b31fbf1f178d989d00c50f0cbbc93c6cc9","32ead9cd1f4925c8f10b9c04d0aa8b874277495104d9b8adfe7bb42583e51218","f6e189a3074fc88dc5f1be8de7887e097fe2115867db56b3ecc68b3a278b4965","2f7cef4fdedf5393a5485ef4e3b718a56052184193b9833220b04930402dc96d","7472ac19dc16fc3bfd621cbb2a49e3641bd86325552d4eeb562e21d963f82bb3","1a449b92a96d37cd8210e25c17d495f9cf65387a3feb81b7b2c6a901e5ab7523")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("340ddd9fd22f2abf0474b580a29129b09cc125fbd00a168eab899f6cdde351d7","79d7701146b24e023de7a34519bbfb635375d1db3711bdf58ab21440a42ca7c2","abba10d2808639724e8c6b3c22d565cb338dc17d680a4f1591d0408b9edf78d8","2c26bb95a938b6a5063bf4f95942440a0583d52bb129ea272584fc94906f5e86","d26171b8ecb3cf1b140d062c0274cc6ee125a318d74e2d5e19699213dca3ca9a","2797ce055d37f9ea23080498584979b31fbf1f178d989d00c50f0cbbc93c6cc9","32ead9cd1f4925c8f10b9c04d0aa8b874277495104d9b8adfe7bb42583e51218","f6e189a3074fc88dc5f1be8de7887e097fe2115867db56b3ecc68b3a278b4965","2f7cef4fdedf5393a5485ef4e3b718a56052184193b9833220b04930402dc96d","7472ac19dc16fc3bfd621cbb2a49e3641bd86325552d4eeb562e21d963f82bb3","1a449b92a96d37cd8210e25c17d495f9cf65387a3feb81b7b2c6a901e5ab7523")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("340ddd9fd22f2abf0474b580a29129b09cc125fbd00a168eab899f6cdde351d7","79d7701146b24e023de7a34519bbfb635375d1db3711bdf58ab21440a42ca7c2","abba10d2808639724e8c6b3c22d565cb338dc17d680a4f1591d0408b9edf78d8","2c26bb95a938b6a5063bf4f95942440a0583d52bb129ea272584fc94906f5e86","d26171b8ecb3cf1b140d062c0274cc6ee125a318d74e2d5e19699213dca3ca9a","2797ce055d37f9ea23080498584979b31fbf1f178d989d00c50f0cbbc93c6cc9","32ead9cd1f4925c8f10b9c04d0aa8b874277495104d9b8adfe7bb42583e51218","f6e189a3074fc88dc5f1be8de7887e097fe2115867db56b3ecc68b3a278b4965","2f7cef4fdedf5393a5485ef4e3b718a56052184193b9833220b04930402dc96d","7472ac19dc16fc3bfd621cbb2a49e3641bd86325552d4eeb562e21d963f82bb3","1a449b92a96d37cd8210e25c17d495f9cf65387a3feb81b7b2c6a901e5ab7523")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("340ddd9fd22f2abf0474b580a29129b09cc125fbd00a168eab899f6cdde351d7","79d7701146b24e023de7a34519bbfb635375d1db3711bdf58ab21440a42ca7c2","abba10d2808639724e8c6b3c22d565cb338dc17d680a4f1591d0408b9edf78d8","2c26bb95a938b6a5063bf4f95942440a0583d52bb129ea272584fc94906f5e86","d26171b8ecb3cf1b140d062c0274cc6ee125a318d74e2d5e19699213dca3ca9a","2797ce055d37f9ea23080498584979b31fbf1f178d989d00c50f0cbbc93c6cc9","32ead9cd1f4925c8f10b9c04d0aa8b874277495104d9b8adfe7bb42583e51218","f6e189a3074fc88dc5f1be8de7887e097fe2115867db56b3ecc68b3a278b4965","2f7cef4fdedf5393a5485ef4e3b718a56052184193b9833220b04930402dc96d","7472ac19dc16fc3bfd621cbb2a49e3641bd86325552d4eeb562e21d963f82bb3","1a449b92a96d37cd8210e25c17d495f9cf65387a3feb81b7b2c6a901e5ab7523")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("340ddd9fd22f2abf0474b580a29129b09cc125fbd00a168eab899f6cdde351d7","79d7701146b24e023de7a34519bbfb635375d1db3711bdf58ab21440a42ca7c2","abba10d2808639724e8c6b3c22d565cb338dc17d680a4f1591d0408b9edf78d8","2c26bb95a938b6a5063bf4f95942440a0583d52bb129ea272584fc94906f5e86","d26171b8ecb3cf1b140d062c0274cc6ee125a318d74e2d5e19699213dca3ca9a","2797ce055d37f9ea23080498584979b31fbf1f178d989d00c50f0cbbc93c6cc9","32ead9cd1f4925c8f10b9c04d0aa8b874277495104d9b8adfe7bb42583e51218","f6e189a3074fc88dc5f1be8de7887e097fe2115867db56b3ecc68b3a278b4965","2f7cef4fdedf5393a5485ef4e3b718a56052184193b9833220b04930402dc96d","7472ac19dc16fc3bfd621cbb2a49e3641bd86325552d4eeb562e21d963f82bb3","1a449b92a96d37cd8210e25c17d495f9cf65387a3feb81b7b2c6a901e5ab7523")
index=activity AND rg_functionality="Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("340ddd9fd22f2abf0474b580a29129b09cc125fbd00a168eab899f6cdde351d7","79d7701146b24e023de7a34519bbfb635375d1db3711bdf58ab21440a42ca7c2","abba10d2808639724e8c6b3c22d565cb338dc17d680a4f1591d0408b9edf78d8","2c26bb95a938b6a5063bf4f95942440a0583d52bb129ea272584fc94906f5e86","d26171b8ecb3cf1b140d062c0274cc6ee125a318d74e2d5e19699213dca3ca9a","2797ce055d37f9ea23080498584979b31fbf1f178d989d00c50f0cbbc93c6cc9","32ead9cd1f4925c8f10b9c04d0aa8b874277495104d9b8adfe7bb42583e51218","f6e189a3074fc88dc5f1be8de7887e097fe2115867db56b3ecc68b3a278b4965","2f7cef4fdedf5393a5485ef4e3b718a56052184193b9833220b04930402dc96d","7472ac19dc16fc3bfd621cbb2a49e3641bd86325552d4eeb562e21d963f82bb3","1a449b92a96d37cd8210e25c17d495f9cf65387a3feb81b7b2c6a901e5ab7523")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("340ddd9fd22f2abf0474b580a29129b09cc125fbd00a168eab899f6cdde351d7","79d7701146b24e023de7a34519bbfb635375d1db3711bdf58ab21440a42ca7c2","abba10d2808639724e8c6b3c22d565cb338dc17d680a4f1591d0408b9edf78d8","2c26bb95a938b6a5063bf4f95942440a0583d52bb129ea272584fc94906f5e86","d26171b8ecb3cf1b140d062c0274cc6ee125a318d74e2d5e19699213dca3ca9a","2797ce055d37f9ea23080498584979b31fbf1f178d989d00c50f0cbbc93c6cc9","32ead9cd1f4925c8f10b9c04d0aa8b874277495104d9b8adfe7bb42583e51218","f6e189a3074fc88dc5f1be8de7887e097fe2115867db56b3ecc68b3a278b4965","2f7cef4fdedf5393a5485ef4e3b718a56052184193b9833220b04930402dc96d","7472ac19dc16fc3bfd621cbb2a49e3641bd86325552d4eeb562e21d963f82bb3","1a449b92a96d37cd8210e25c17d495f9cf65387a3feb81b7b2c6a901e5ab7523")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("340ddd9fd22f2abf0474b580a29129b09cc125fbd00a168eab899f6cdde351d7","79d7701146b24e023de7a34519bbfb635375d1db3711bdf58ab21440a42ca7c2","abba10d2808639724e8c6b3c22d565cb338dc17d680a4f1591d0408b9edf78d8","2c26bb95a938b6a5063bf4f95942440a0583d52bb129ea272584fc94906f5e86","d26171b8ecb3cf1b140d062c0274cc6ee125a318d74e2d5e19699213dca3ca9a","2797ce055d37f9ea23080498584979b31fbf1f178d989d00c50f0cbbc93c6cc9","32ead9cd1f4925c8f10b9c04d0aa8b874277495104d9b8adfe7bb42583e51218","f6e189a3074fc88dc5f1be8de7887e097fe2115867db56b3ecc68b3a278b4965","2f7cef4fdedf5393a5485ef4e3b718a56052184193b9833220b04930402dc96d","7472ac19dc16fc3bfd621cbb2a49e3641bd86325552d4eeb562e21d963f82bb3","1a449b92a96d37cd8210e25c17d495f9cf65387a3feb81b7b2c6a901e5ab7523")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("340ddd9fd22f2abf0474b580a29129b09cc125fbd00a168eab899f6cdde351d7","79d7701146b24e023de7a34519bbfb635375d1db3711bdf58ab21440a42ca7c2","abba10d2808639724e8c6b3c22d565cb338dc17d680a4f1591d0408b9edf78d8","2c26bb95a938b6a5063bf4f95942440a0583d52bb129ea272584fc94906f5e86","d26171b8ecb3cf1b140d062c0274cc6ee125a318d74e2d5e19699213dca3ca9a","2797ce055d37f9ea23080498584979b31fbf1f178d989d00c50f0cbbc93c6cc9","32ead9cd1f4925c8f10b9c04d0aa8b874277495104d9b8adfe7bb42583e51218","f6e189a3074fc88dc5f1be8de7887e097fe2115867db56b3ecc68b3a278b4965","2f7cef4fdedf5393a5485ef4e3b718a56052184193b9833220b04930402dc96d","7472ac19dc16fc3bfd621cbb2a49e3641bd86325552d4eeb562e21d963f82bb3","1a449b92a96d37cd8210e25c17d495f9cf65387a3feb81b7b2c6a901e5ab7523")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("340ddd9fd22f2abf0474b580a29129b09cc125fbd00a168eab899f6cdde351d7","79d7701146b24e023de7a34519bbfb635375d1db3711bdf58ab21440a42ca7c2","abba10d2808639724e8c6b3c22d565cb338dc17d680a4f1591d0408b9edf78d8","2c26bb95a938b6a5063bf4f95942440a0583d52bb129ea272584fc94906f5e86","d26171b8ecb3cf1b140d062c0274cc6ee125a318d74e2d5e19699213dca3ca9a","2797ce055d37f9ea23080498584979b31fbf1f178d989d00c50f0cbbc93c6cc9","32ead9cd1f4925c8f10b9c04d0aa8b874277495104d9b8adfe7bb42583e51218","f6e189a3074fc88dc5f1be8de7887e097fe2115867db56b3ecc68b3a278b4965","2f7cef4fdedf5393a5485ef4e3b718a56052184193b9833220b04930402dc96d","7472ac19dc16fc3bfd621cbb2a49e3641bd86325552d4eeb562e21d963f82bb3","1a449b92a96d37cd8210e25c17d495f9cf65387a3feb81b7b2c6a901e5ab7523")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("340ddd9fd22f2abf0474b580a29129b09cc125fbd00a168eab899f6cdde351d7","79d7701146b24e023de7a34519bbfb635375d1db3711bdf58ab21440a42ca7c2","abba10d2808639724e8c6b3c22d565cb338dc17d680a4f1591d0408b9edf78d8","2c26bb95a938b6a5063bf4f95942440a0583d52bb129ea272584fc94906f5e86","d26171b8ecb3cf1b140d062c0274cc6ee125a318d74e2d5e19699213dca3ca9a","2797ce055d37f9ea23080498584979b31fbf1f178d989d00c50f0cbbc93c6cc9","32ead9cd1f4925c8f10b9c04d0aa8b874277495104d9b8adfe7bb42583e51218","f6e189a3074fc88dc5f1be8de7887e097fe2115867db56b3ecc68b3a278b4965","2f7cef4fdedf5393a5485ef4e3b718a56052184193b9833220b04930402dc96d","7472ac19dc16fc3bfd621cbb2a49e3641bd86325552d4eeb562e21d963f82bb3","1a449b92a96d37cd8210e25c17d495f9cf65387a3feb81b7b2c6a901e5ab7523")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("340ddd9fd22f2abf0474b580a29129b09cc125fbd00a168eab899f6cdde351d7","79d7701146b24e023de7a34519bbfb635375d1db3711bdf58ab21440a42ca7c2","abba10d2808639724e8c6b3c22d565cb338dc17d680a4f1591d0408b9edf78d8","2c26bb95a938b6a5063bf4f95942440a0583d52bb129ea272584fc94906f5e86","d26171b8ecb3cf1b140d062c0274cc6ee125a318d74e2d5e19699213dca3ca9a","2797ce055d37f9ea23080498584979b31fbf1f178d989d00c50f0cbbc93c6cc9","32ead9cd1f4925c8f10b9c04d0aa8b874277495104d9b8adfe7bb42583e51218","f6e189a3074fc88dc5f1be8de7887e097fe2115867db56b3ecc68b3a278b4965","2f7cef4fdedf5393a5485ef4e3b718a56052184193b9833220b04930402dc96d","7472ac19dc16fc3bfd621cbb2a49e3641bd86325552d4eeb562e21d963f82bb3","1a449b92a96d37cd8210e25c17d495f9cf65387a3feb81b7b2c6a901e5ab7523")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("340ddd9fd22f2abf0474b580a29129b09cc125fbd00a168eab899f6cdde351d7","79d7701146b24e023de7a34519bbfb635375d1db3711bdf58ab21440a42ca7c2","abba10d2808639724e8c6b3c22d565cb338dc17d680a4f1591d0408b9edf78d8","2c26bb95a938b6a5063bf4f95942440a0583d52bb129ea272584fc94906f5e86","d26171b8ecb3cf1b140d062c0274cc6ee125a318d74e2d5e19699213dca3ca9a","2797ce055d37f9ea23080498584979b31fbf1f178d989d00c50f0cbbc93c6cc9","32ead9cd1f4925c8f10b9c04d0aa8b874277495104d9b8adfe7bb42583e51218","f6e189a3074fc88dc5f1be8de7887e097fe2115867db56b3ecc68b3a278b4965","2f7cef4fdedf5393a5485ef4e3b718a56052184193b9833220b04930402dc96d","7472ac19dc16fc3bfd621cbb2a49e3641bd86325552d4eeb562e21d963f82bb3","1a449b92a96d37cd8210e25c17d495f9cf65387a3feb81b7b2c6a901e5ab7523")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring64 NOT NULL AND customstring64 IN ("340ddd9fd22f2abf0474b580a29129b09cc125fbd00a168eab899f6cdde351d7","79d7701146b24e023de7a34519bbfb635375d1db3711bdf58ab21440a42ca7c2","abba10d2808639724e8c6b3c22d565cb338dc17d680a4f1591d0408b9edf78d8","2c26bb95a938b6a5063bf4f95942440a0583d52bb129ea272584fc94906f5e86","d26171b8ecb3cf1b140d062c0274cc6ee125a318d74e2d5e19699213dca3ca9a","2797ce055d37f9ea23080498584979b31fbf1f178d989d00c50f0cbbc93c6cc9","32ead9cd1f4925c8f10b9c04d0aa8b874277495104d9b8adfe7bb42583e51218","f6e189a3074fc88dc5f1be8de7887e097fe2115867db56b3ecc68b3a278b4965","2f7cef4fdedf5393a5485ef4e3b718a56052184193b9833220b04930402dc96d","7472ac19dc16fc3bfd621cbb2a49e3641bd86325552d4eeb562e21d963f82bb3","1a449b92a96d37cd8210e25c17d495f9cf65387a3feb81b7b2c6a901e5ab7523")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("340ddd9fd22f2abf0474b580a29129b09cc125fbd00a168eab899f6cdde351d7","79d7701146b24e023de7a34519bbfb635375d1db3711bdf58ab21440a42ca7c2","abba10d2808639724e8c6b3c22d565cb338dc17d680a4f1591d0408b9edf78d8","2c26bb95a938b6a5063bf4f95942440a0583d52bb129ea272584fc94906f5e86","d26171b8ecb3cf1b140d062c0274cc6ee125a318d74e2d5e19699213dca3ca9a","2797ce055d37f9ea23080498584979b31fbf1f178d989d00c50f0cbbc93c6cc9","32ead9cd1f4925c8f10b9c04d0aa8b874277495104d9b8adfe7bb42583e51218","f6e189a3074fc88dc5f1be8de7887e097fe2115867db56b3ecc68b3a278b4965","2f7cef4fdedf5393a5485ef4e3b718a56052184193b9833220b04930402dc96d","7472ac19dc16fc3bfd621cbb2a49e3641bd86325552d4eeb562e21d963f82bb3","1a449b92a96d37cd8210e25c17d495f9cf65387a3feb81b7b2c6a901e5ab7523")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("340ddd9fd22f2abf0474b580a29129b09cc125fbd00a168eab899f6cdde351d7","79d7701146b24e023de7a34519bbfb635375d1db3711bdf58ab21440a42ca7c2","abba10d2808639724e8c6b3c22d565cb338dc17d680a4f1591d0408b9edf78d8","2c26bb95a938b6a5063bf4f95942440a0583d52bb129ea272584fc94906f5e86","d26171b8ecb3cf1b140d062c0274cc6ee125a318d74e2d5e19699213dca3ca9a","2797ce055d37f9ea23080498584979b31fbf1f178d989d00c50f0cbbc93c6cc9","32ead9cd1f4925c8f10b9c04d0aa8b874277495104d9b8adfe7bb42583e51218","f6e189a3074fc88dc5f1be8de7887e097fe2115867db56b3ecc68b3a278b4965","2f7cef4fdedf5393a5485ef4e3b718a56052184193b9833220b04930402dc96d","7472ac19dc16fc3bfd621cbb2a49e3641bd86325552d4eeb562e21d963f82bb3","1a449b92a96d37cd8210e25c17d495f9cf65387a3feb81b7b2c6a901e5ab7523")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("340ddd9fd22f2abf0474b580a29129b09cc125fbd00a168eab899f6cdde351d7","79d7701146b24e023de7a34519bbfb635375d1db3711bdf58ab21440a42ca7c2","abba10d2808639724e8c6b3c22d565cb338dc17d680a4f1591d0408b9edf78d8","2c26bb95a938b6a5063bf4f95942440a0583d52bb129ea272584fc94906f5e86","d26171b8ecb3cf1b140d062c0274cc6ee125a318d74e2d5e19699213dca3ca9a","2797ce055d37f9ea23080498584979b31fbf1f178d989d00c50f0cbbc93c6cc9","32ead9cd1f4925c8f10b9c04d0aa8b874277495104d9b8adfe7bb42583e51218","f6e189a3074fc88dc5f1be8de7887e097fe2115867db56b3ecc68b3a278b4965","2f7cef4fdedf5393a5485ef4e3b718a56052184193b9833220b04930402dc96d","7472ac19dc16fc3bfd621cbb2a49e3641bd86325552d4eeb562e21d963f82bb3","1a449b92a96d37cd8210e25c17d495f9cf65387a3feb81b7b2c6a901e5ab7523")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring64 NOT NULL AND customstring64 IN ("340ddd9fd22f2abf0474b580a29129b09cc125fbd00a168eab899f6cdde351d7","79d7701146b24e023de7a34519bbfb635375d1db3711bdf58ab21440a42ca7c2","abba10d2808639724e8c6b3c22d565cb338dc17d680a4f1591d0408b9edf78d8","2c26bb95a938b6a5063bf4f95942440a0583d52bb129ea272584fc94906f5e86","d26171b8ecb3cf1b140d062c0274cc6ee125a318d74e2d5e19699213dca3ca9a","2797ce055d37f9ea23080498584979b31fbf1f178d989d00c50f0cbbc93c6cc9","32ead9cd1f4925c8f10b9c04d0aa8b874277495104d9b8adfe7bb42583e51218","f6e189a3074fc88dc5f1be8de7887e097fe2115867db56b3ecc68b3a278b4965","2f7cef4fdedf5393a5485ef4e3b718a56052184193b9833220b04930402dc96d","7472ac19dc16fc3bfd621cbb2a49e3641bd86325552d4eeb562e21d963f82bb3","1a449b92a96d37cd8210e25c17d495f9cf65387a3feb81b7b2c6a901e5ab7523")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("340ddd9fd22f2abf0474b580a29129b09cc125fbd00a168eab899f6cdde351d7","79d7701146b24e023de7a34519bbfb635375d1db3711bdf58ab21440a42ca7c2","abba10d2808639724e8c6b3c22d565cb338dc17d680a4f1591d0408b9edf78d8","2c26bb95a938b6a5063bf4f95942440a0583d52bb129ea272584fc94906f5e86","d26171b8ecb3cf1b140d062c0274cc6ee125a318d74e2d5e19699213dca3ca9a","2797ce055d37f9ea23080498584979b31fbf1f178d989d00c50f0cbbc93c6cc9","32ead9cd1f4925c8f10b9c04d0aa8b874277495104d9b8adfe7bb42583e51218","f6e189a3074fc88dc5f1be8de7887e097fe2115867db56b3ecc68b3a278b4965","2f7cef4fdedf5393a5485ef4e3b718a56052184193b9833220b04930402dc96d","7472ac19dc16fc3bfd621cbb2a49e3641bd86325552d4eeb562e21d963f82bb3","1a449b92a96d37cd8210e25c17d495f9cf65387a3feb81b7b2c6a901e5ab7523")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("340ddd9fd22f2abf0474b580a29129b09cc125fbd00a168eab899f6cdde351d7","79d7701146b24e023de7a34519bbfb635375d1db3711bdf58ab21440a42ca7c2","abba10d2808639724e8c6b3c22d565cb338dc17d680a4f1591d0408b9edf78d8","2c26bb95a938b6a5063bf4f95942440a0583d52bb129ea272584fc94906f5e86","d26171b8ecb3cf1b140d062c0274cc6ee125a318d74e2d5e19699213dca3ca9a","2797ce055d37f9ea23080498584979b31fbf1f178d989d00c50f0cbbc93c6cc9","32ead9cd1f4925c8f10b9c04d0aa8b874277495104d9b8adfe7bb42583e51218","f6e189a3074fc88dc5f1be8de7887e097fe2115867db56b3ecc68b3a278b4965","2f7cef4fdedf5393a5485ef4e3b718a56052184193b9833220b04930402dc96d","7472ac19dc16fc3bfd621cbb2a49e3641bd86325552d4eeb562e21d963f82bb3","1a449b92a96d37cd8210e25c17d495f9cf65387a3feb81b7b2c6a901e5ab7523")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("340ddd9fd22f2abf0474b580a29129b09cc125fbd00a168eab899f6cdde351d7","79d7701146b24e023de7a34519bbfb635375d1db3711bdf58ab21440a42ca7c2","abba10d2808639724e8c6b3c22d565cb338dc17d680a4f1591d0408b9edf78d8","2c26bb95a938b6a5063bf4f95942440a0583d52bb129ea272584fc94906f5e86","d26171b8ecb3cf1b140d062c0274cc6ee125a318d74e2d5e19699213dca3ca9a","2797ce055d37f9ea23080498584979b31fbf1f178d989d00c50f0cbbc93c6cc9","32ead9cd1f4925c8f10b9c04d0aa8b874277495104d9b8adfe7bb42583e51218","f6e189a3074fc88dc5f1be8de7887e097fe2115867db56b3ecc68b3a278b4965","2f7cef4fdedf5393a5485ef4e3b718a56052184193b9833220b04930402dc96d","7472ac19dc16fc3bfd621cbb2a49e3641bd86325552d4eeb562e21d963f82bb3","1a449b92a96d37cd8210e25c17d495f9cf65387a3feb81b7b2c6a901e5ab7523")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring64 NOT NULL AND customstring64 IN ("340ddd9fd22f2abf0474b580a29129b09cc125fbd00a168eab899f6cdde351d7","79d7701146b24e023de7a34519bbfb635375d1db3711bdf58ab21440a42ca7c2","abba10d2808639724e8c6b3c22d565cb338dc17d680a4f1591d0408b9edf78d8","2c26bb95a938b6a5063bf4f95942440a0583d52bb129ea272584fc94906f5e86","d26171b8ecb3cf1b140d062c0274cc6ee125a318d74e2d5e19699213dca3ca9a","2797ce055d37f9ea23080498584979b31fbf1f178d989d00c50f0cbbc93c6cc9","32ead9cd1f4925c8f10b9c04d0aa8b874277495104d9b8adfe7bb42583e51218","f6e189a3074fc88dc5f1be8de7887e097fe2115867db56b3ecc68b3a278b4965","2f7cef4fdedf5393a5485ef4e3b718a56052184193b9833220b04930402dc96d","7472ac19dc16fc3bfd621cbb2a49e3641bd86325552d4eeb562e21d963f82bb3","1a449b92a96d37cd8210e25c17d495f9cf65387a3feb81b7b2c6a901e5ab7523")
index=activity AND rg_functionality="O365 General" AND filehash NOT NULL AND filehash IN ("340ddd9fd22f2abf0474b580a29129b09cc125fbd00a168eab899f6cdde351d7","79d7701146b24e023de7a34519bbfb635375d1db3711bdf58ab21440a42ca7c2","abba10d2808639724e8c6b3c22d565cb338dc17d680a4f1591d0408b9edf78d8","2c26bb95a938b6a5063bf4f95942440a0583d52bb129ea272584fc94906f5e86","d26171b8ecb3cf1b140d062c0274cc6ee125a318d74e2d5e19699213dca3ca9a","2797ce055d37f9ea23080498584979b31fbf1f178d989d00c50f0cbbc93c6cc9","32ead9cd1f4925c8f10b9c04d0aa8b874277495104d9b8adfe7bb42583e51218","f6e189a3074fc88dc5f1be8de7887e097fe2115867db56b3ecc68b3a278b4965","2f7cef4fdedf5393a5485ef4e3b718a56052184193b9833220b04930402dc96d","7472ac19dc16fc3bfd621cbb2a49e3641bd86325552d4eeb562e21d963f82bb3","1a449b92a96d37cd8210e25c17d495f9cf65387a3feb81b7b2c6a901e5ab7523")
index=activity AND rg_functionality="O365 General" AND oldfilehash NOT NULL AND oldfilehash IN ("340ddd9fd22f2abf0474b580a29129b09cc125fbd00a168eab899f6cdde351d7","79d7701146b24e023de7a34519bbfb635375d1db3711bdf58ab21440a42ca7c2","abba10d2808639724e8c6b3c22d565cb338dc17d680a4f1591d0408b9edf78d8","2c26bb95a938b6a5063bf4f95942440a0583d52bb129ea272584fc94906f5e86","d26171b8ecb3cf1b140d062c0274cc6ee125a318d74e2d5e19699213dca3ca9a","2797ce055d37f9ea23080498584979b31fbf1f178d989d00c50f0cbbc93c6cc9","32ead9cd1f4925c8f10b9c04d0aa8b874277495104d9b8adfe7bb42583e51218","f6e189a3074fc88dc5f1be8de7887e097fe2115867db56b3ecc68b3a278b4965","2f7cef4fdedf5393a5485ef4e3b718a56052184193b9833220b04930402dc96d","7472ac19dc16fc3bfd621cbb2a49e3641bd86325552d4eeb562e21d963f82bb3","1a449b92a96d37cd8210e25c17d495f9cf65387a3feb81b7b2c6a901e5ab7523")
index=activity AND rg_functionality="O365 General" AND customstring3 NOT NULL AND customstring3 IN ("340ddd9fd22f2abf0474b580a29129b09cc125fbd00a168eab899f6cdde351d7","79d7701146b24e023de7a34519bbfb635375d1db3711bdf58ab21440a42ca7c2","abba10d2808639724e8c6b3c22d565cb338dc17d680a4f1591d0408b9edf78d8","2c26bb95a938b6a5063bf4f95942440a0583d52bb129ea272584fc94906f5e86","d26171b8ecb3cf1b140d062c0274cc6ee125a318d74e2d5e19699213dca3ca9a","2797ce055d37f9ea23080498584979b31fbf1f178d989d00c50f0cbbc93c6cc9","32ead9cd1f4925c8f10b9c04d0aa8b874277495104d9b8adfe7bb42583e51218","f6e189a3074fc88dc5f1be8de7887e097fe2115867db56b3ecc68b3a278b4965","2f7cef4fdedf5393a5485ef4e3b718a56052184193b9833220b04930402dc96d","7472ac19dc16fc3bfd621cbb2a49e3641bd86325552d4eeb562e21d963f82bb3","1a449b92a96d37cd8210e25c17d495f9cf65387a3feb81b7b2c6a901e5ab7523")
index=activity AND rg_functionality="O365 General" AND customstring64 NOT NULL AND customstring64 IN ("340ddd9fd22f2abf0474b580a29129b09cc125fbd00a168eab899f6cdde351d7","79d7701146b24e023de7a34519bbfb635375d1db3711bdf58ab21440a42ca7c2","abba10d2808639724e8c6b3c22d565cb338dc17d680a4f1591d0408b9edf78d8","2c26bb95a938b6a5063bf4f95942440a0583d52bb129ea272584fc94906f5e86","d26171b8ecb3cf1b140d062c0274cc6ee125a318d74e2d5e19699213dca3ca9a","2797ce055d37f9ea23080498584979b31fbf1f178d989d00c50f0cbbc93c6cc9","32ead9cd1f4925c8f10b9c04d0aa8b874277495104d9b8adfe7bb42583e51218","f6e189a3074fc88dc5f1be8de7887e097fe2115867db56b3ecc68b3a278b4965","2f7cef4fdedf5393a5485ef4e3b718a56052184193b9833220b04930402dc96d","7472ac19dc16fc3bfd621cbb2a49e3641bd86325552d4eeb562e21d963f82bb3","1a449b92a96d37cd8210e25c17d495f9cf65387a3feb81b7b2c6a901e5ab7523")
