index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("b9129d83af902908fa7757e906ec0afe","666a4c569d435d0e6bf9fa4d337d1bf014952b42cc6d20e797db6c9df92dd724","0f0fadd0546734c5c82f3c33d8268046","cf59cd171270ec9bc2baf618838eb57802cc9d48f64205da308406811dd4da92","bdd8926f4be6576653ac96ee732d587a","efff4106cfd21a356b13a5a99c626a4f103f03b9491c0f1f5e135c1e3c84e76c","4b9aa7d571be1a6ec62931c4c6624328","88e5ca44189dabb4cec8a183f6268a42f3f92b2c6d7c722d7f55efd3dc5334c8","d521bf0f24c839e7ceb5db77de090fbc","55e2dbb906697dd1aff87ccf275efd06ee5e43bb21ea7865aef59513a858cf9f","4b9aa7d571be1a6ec62931c4c6624328","c3995f28476f7a775f4c1e8be47c64a300e0f16535dc5ed665ba796f05f19f73","48f8b7e0db439336549b93bda8633cd2","724351b5cc9ad496a6c9486b8ef34772f640590a90293f913f005e994717134b","fb99f5da9c0c46c27e17dc2dc1e162d7","2bfb82a43bb77127965a4011a87de845242b1fb98fd09085885be219e0499073","6ce2477efe7e853cea90764db5a64e6e","041c13a29d3bee8d2e4bd9d8bde8152b5ac8305c1efcc198244b224e33635282","7529f56dde7a8302947982c43080bfcc","b523cdd1669dbd7ab68b43fd20f30a790ec0351876a0610958b9405468753a10","8625c0cf0748d04d43db54884ee13672","213520170fc7113ac8f5e689f154f5c8074dd972584b56d820c19d84b7e5b477","7efb1bc15ee6e3043f8eaefcf3f10864","ac7e20d4ddccc5e249ff0c1a72e394f9c1667a896995cf55b97b4f9fbf5de2fd","4b9aa7d571be1a6ec62931c4c6624328","460f1a00002e1c713a7753293b4737e65d27d0b65667b109d66afca873c23894","d66776ee123ef2947bc3175653a68d05","ccfd6ef35c718e2484b3727035d162b667f4b56df43324782d106f50ed1e3bcc","847ec30a4ff2391f1eb7669c22940e51","735d59c0949e258501e177ec2dd5fbb60df9fa401ace08949b89077c6f0d41d0","ea47fd87c1b109d5fd529c213aea6b30","37a1ffaba2e3ea9a7b2aa272b0587826cc0b5909497d3744ec8c114b504d2544","3b61d82be05f18754238e26b835da103","b79629e820cdd36d0daed964a2c0338e125a1f90f08e226f52dc60070747c62e","e79da1e448c60e12d835b47735f9da03","a560931baa404189257ec9cbcc2b9449c579018218cc1d70c99b1d36dd292a0e")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("b9129d83af902908fa7757e906ec0afe","666a4c569d435d0e6bf9fa4d337d1bf014952b42cc6d20e797db6c9df92dd724","0f0fadd0546734c5c82f3c33d8268046","cf59cd171270ec9bc2baf618838eb57802cc9d48f64205da308406811dd4da92","bdd8926f4be6576653ac96ee732d587a","efff4106cfd21a356b13a5a99c626a4f103f03b9491c0f1f5e135c1e3c84e76c","4b9aa7d571be1a6ec62931c4c6624328","88e5ca44189dabb4cec8a183f6268a42f3f92b2c6d7c722d7f55efd3dc5334c8","d521bf0f24c839e7ceb5db77de090fbc","55e2dbb906697dd1aff87ccf275efd06ee5e43bb21ea7865aef59513a858cf9f","4b9aa7d571be1a6ec62931c4c6624328","c3995f28476f7a775f4c1e8be47c64a300e0f16535dc5ed665ba796f05f19f73","48f8b7e0db439336549b93bda8633cd2","724351b5cc9ad496a6c9486b8ef34772f640590a90293f913f005e994717134b","fb99f5da9c0c46c27e17dc2dc1e162d7","2bfb82a43bb77127965a4011a87de845242b1fb98fd09085885be219e0499073","6ce2477efe7e853cea90764db5a64e6e","041c13a29d3bee8d2e4bd9d8bde8152b5ac8305c1efcc198244b224e33635282","7529f56dde7a8302947982c43080bfcc","b523cdd1669dbd7ab68b43fd20f30a790ec0351876a0610958b9405468753a10","8625c0cf0748d04d43db54884ee13672","213520170fc7113ac8f5e689f154f5c8074dd972584b56d820c19d84b7e5b477","7efb1bc15ee6e3043f8eaefcf3f10864","ac7e20d4ddccc5e249ff0c1a72e394f9c1667a896995cf55b97b4f9fbf5de2fd","4b9aa7d571be1a6ec62931c4c6624328","460f1a00002e1c713a7753293b4737e65d27d0b65667b109d66afca873c23894","d66776ee123ef2947bc3175653a68d05","ccfd6ef35c718e2484b3727035d162b667f4b56df43324782d106f50ed1e3bcc","847ec30a4ff2391f1eb7669c22940e51","735d59c0949e258501e177ec2dd5fbb60df9fa401ace08949b89077c6f0d41d0","ea47fd87c1b109d5fd529c213aea6b30","37a1ffaba2e3ea9a7b2aa272b0587826cc0b5909497d3744ec8c114b504d2544","3b61d82be05f18754238e26b835da103","b79629e820cdd36d0daed964a2c0338e125a1f90f08e226f52dc60070747c62e","e79da1e448c60e12d835b47735f9da03","a560931baa404189257ec9cbcc2b9449c579018218cc1d70c99b1d36dd292a0e")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("b9129d83af902908fa7757e906ec0afe","666a4c569d435d0e6bf9fa4d337d1bf014952b42cc6d20e797db6c9df92dd724","0f0fadd0546734c5c82f3c33d8268046","cf59cd171270ec9bc2baf618838eb57802cc9d48f64205da308406811dd4da92","bdd8926f4be6576653ac96ee732d587a","efff4106cfd21a356b13a5a99c626a4f103f03b9491c0f1f5e135c1e3c84e76c","4b9aa7d571be1a6ec62931c4c6624328","88e5ca44189dabb4cec8a183f6268a42f3f92b2c6d7c722d7f55efd3dc5334c8","d521bf0f24c839e7ceb5db77de090fbc","55e2dbb906697dd1aff87ccf275efd06ee5e43bb21ea7865aef59513a858cf9f","4b9aa7d571be1a6ec62931c4c6624328","c3995f28476f7a775f4c1e8be47c64a300e0f16535dc5ed665ba796f05f19f73","48f8b7e0db439336549b93bda8633cd2","724351b5cc9ad496a6c9486b8ef34772f640590a90293f913f005e994717134b","fb99f5da9c0c46c27e17dc2dc1e162d7","2bfb82a43bb77127965a4011a87de845242b1fb98fd09085885be219e0499073","6ce2477efe7e853cea90764db5a64e6e","041c13a29d3bee8d2e4bd9d8bde8152b5ac8305c1efcc198244b224e33635282","7529f56dde7a8302947982c43080bfcc","b523cdd1669dbd7ab68b43fd20f30a790ec0351876a0610958b9405468753a10","8625c0cf0748d04d43db54884ee13672","213520170fc7113ac8f5e689f154f5c8074dd972584b56d820c19d84b7e5b477","7efb1bc15ee6e3043f8eaefcf3f10864","ac7e20d4ddccc5e249ff0c1a72e394f9c1667a896995cf55b97b4f9fbf5de2fd","4b9aa7d571be1a6ec62931c4c6624328","460f1a00002e1c713a7753293b4737e65d27d0b65667b109d66afca873c23894","d66776ee123ef2947bc3175653a68d05","ccfd6ef35c718e2484b3727035d162b667f4b56df43324782d106f50ed1e3bcc","847ec30a4ff2391f1eb7669c22940e51","735d59c0949e258501e177ec2dd5fbb60df9fa401ace08949b89077c6f0d41d0","ea47fd87c1b109d5fd529c213aea6b30","37a1ffaba2e3ea9a7b2aa272b0587826cc0b5909497d3744ec8c114b504d2544","3b61d82be05f18754238e26b835da103","b79629e820cdd36d0daed964a2c0338e125a1f90f08e226f52dc60070747c62e","e79da1e448c60e12d835b47735f9da03","a560931baa404189257ec9cbcc2b9449c579018218cc1d70c99b1d36dd292a0e")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring64 NOT NULL AND customstring64 IN ("b9129d83af902908fa7757e906ec0afe","666a4c569d435d0e6bf9fa4d337d1bf014952b42cc6d20e797db6c9df92dd724","0f0fadd0546734c5c82f3c33d8268046","cf59cd171270ec9bc2baf618838eb57802cc9d48f64205da308406811dd4da92","bdd8926f4be6576653ac96ee732d587a","efff4106cfd21a356b13a5a99c626a4f103f03b9491c0f1f5e135c1e3c84e76c","4b9aa7d571be1a6ec62931c4c6624328","88e5ca44189dabb4cec8a183f6268a42f3f92b2c6d7c722d7f55efd3dc5334c8","d521bf0f24c839e7ceb5db77de090fbc","55e2dbb906697dd1aff87ccf275efd06ee5e43bb21ea7865aef59513a858cf9f","4b9aa7d571be1a6ec62931c4c6624328","c3995f28476f7a775f4c1e8be47c64a300e0f16535dc5ed665ba796f05f19f73","48f8b7e0db439336549b93bda8633cd2","724351b5cc9ad496a6c9486b8ef34772f640590a90293f913f005e994717134b","fb99f5da9c0c46c27e17dc2dc1e162d7","2bfb82a43bb77127965a4011a87de845242b1fb98fd09085885be219e0499073","6ce2477efe7e853cea90764db5a64e6e","041c13a29d3bee8d2e4bd9d8bde8152b5ac8305c1efcc198244b224e33635282","7529f56dde7a8302947982c43080bfcc","b523cdd1669dbd7ab68b43fd20f30a790ec0351876a0610958b9405468753a10","8625c0cf0748d04d43db54884ee13672","213520170fc7113ac8f5e689f154f5c8074dd972584b56d820c19d84b7e5b477","7efb1bc15ee6e3043f8eaefcf3f10864","ac7e20d4ddccc5e249ff0c1a72e394f9c1667a896995cf55b97b4f9fbf5de2fd","4b9aa7d571be1a6ec62931c4c6624328","460f1a00002e1c713a7753293b4737e65d27d0b65667b109d66afca873c23894","d66776ee123ef2947bc3175653a68d05","ccfd6ef35c718e2484b3727035d162b667f4b56df43324782d106f50ed1e3bcc","847ec30a4ff2391f1eb7669c22940e51","735d59c0949e258501e177ec2dd5fbb60df9fa401ace08949b89077c6f0d41d0","ea47fd87c1b109d5fd529c213aea6b30","37a1ffaba2e3ea9a7b2aa272b0587826cc0b5909497d3744ec8c114b504d2544","3b61d82be05f18754238e26b835da103","b79629e820cdd36d0daed964a2c0338e125a1f90f08e226f52dc60070747c62e","e79da1e448c60e12d835b47735f9da03","a560931baa404189257ec9cbcc2b9449c579018218cc1d70c99b1d36dd292a0e")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("b9129d83af902908fa7757e906ec0afe","666a4c569d435d0e6bf9fa4d337d1bf014952b42cc6d20e797db6c9df92dd724","0f0fadd0546734c5c82f3c33d8268046","cf59cd171270ec9bc2baf618838eb57802cc9d48f64205da308406811dd4da92","bdd8926f4be6576653ac96ee732d587a","efff4106cfd21a356b13a5a99c626a4f103f03b9491c0f1f5e135c1e3c84e76c","4b9aa7d571be1a6ec62931c4c6624328","88e5ca44189dabb4cec8a183f6268a42f3f92b2c6d7c722d7f55efd3dc5334c8","d521bf0f24c839e7ceb5db77de090fbc","55e2dbb906697dd1aff87ccf275efd06ee5e43bb21ea7865aef59513a858cf9f","4b9aa7d571be1a6ec62931c4c6624328","c3995f28476f7a775f4c1e8be47c64a300e0f16535dc5ed665ba796f05f19f73","48f8b7e0db439336549b93bda8633cd2","724351b5cc9ad496a6c9486b8ef34772f640590a90293f913f005e994717134b","fb99f5da9c0c46c27e17dc2dc1e162d7","2bfb82a43bb77127965a4011a87de845242b1fb98fd09085885be219e0499073","6ce2477efe7e853cea90764db5a64e6e","041c13a29d3bee8d2e4bd9d8bde8152b5ac8305c1efcc198244b224e33635282","7529f56dde7a8302947982c43080bfcc","b523cdd1669dbd7ab68b43fd20f30a790ec0351876a0610958b9405468753a10","8625c0cf0748d04d43db54884ee13672","213520170fc7113ac8f5e689f154f5c8074dd972584b56d820c19d84b7e5b477","7efb1bc15ee6e3043f8eaefcf3f10864","ac7e20d4ddccc5e249ff0c1a72e394f9c1667a896995cf55b97b4f9fbf5de2fd","4b9aa7d571be1a6ec62931c4c6624328","460f1a00002e1c713a7753293b4737e65d27d0b65667b109d66afca873c23894","d66776ee123ef2947bc3175653a68d05","ccfd6ef35c718e2484b3727035d162b667f4b56df43324782d106f50ed1e3bcc","847ec30a4ff2391f1eb7669c22940e51","735d59c0949e258501e177ec2dd5fbb60df9fa401ace08949b89077c6f0d41d0","ea47fd87c1b109d5fd529c213aea6b30","37a1ffaba2e3ea9a7b2aa272b0587826cc0b5909497d3744ec8c114b504d2544","3b61d82be05f18754238e26b835da103","b79629e820cdd36d0daed964a2c0338e125a1f90f08e226f52dc60070747c62e","e79da1e448c60e12d835b47735f9da03","a560931baa404189257ec9cbcc2b9449c579018218cc1d70c99b1d36dd292a0e")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("b9129d83af902908fa7757e906ec0afe","666a4c569d435d0e6bf9fa4d337d1bf014952b42cc6d20e797db6c9df92dd724","0f0fadd0546734c5c82f3c33d8268046","cf59cd171270ec9bc2baf618838eb57802cc9d48f64205da308406811dd4da92","bdd8926f4be6576653ac96ee732d587a","efff4106cfd21a356b13a5a99c626a4f103f03b9491c0f1f5e135c1e3c84e76c","4b9aa7d571be1a6ec62931c4c6624328","88e5ca44189dabb4cec8a183f6268a42f3f92b2c6d7c722d7f55efd3dc5334c8","d521bf0f24c839e7ceb5db77de090fbc","55e2dbb906697dd1aff87ccf275efd06ee5e43bb21ea7865aef59513a858cf9f","4b9aa7d571be1a6ec62931c4c6624328","c3995f28476f7a775f4c1e8be47c64a300e0f16535dc5ed665ba796f05f19f73","48f8b7e0db439336549b93bda8633cd2","724351b5cc9ad496a6c9486b8ef34772f640590a90293f913f005e994717134b","fb99f5da9c0c46c27e17dc2dc1e162d7","2bfb82a43bb77127965a4011a87de845242b1fb98fd09085885be219e0499073","6ce2477efe7e853cea90764db5a64e6e","041c13a29d3bee8d2e4bd9d8bde8152b5ac8305c1efcc198244b224e33635282","7529f56dde7a8302947982c43080bfcc","b523cdd1669dbd7ab68b43fd20f30a790ec0351876a0610958b9405468753a10","8625c0cf0748d04d43db54884ee13672","213520170fc7113ac8f5e689f154f5c8074dd972584b56d820c19d84b7e5b477","7efb1bc15ee6e3043f8eaefcf3f10864","ac7e20d4ddccc5e249ff0c1a72e394f9c1667a896995cf55b97b4f9fbf5de2fd","4b9aa7d571be1a6ec62931c4c6624328","460f1a00002e1c713a7753293b4737e65d27d0b65667b109d66afca873c23894","d66776ee123ef2947bc3175653a68d05","ccfd6ef35c718e2484b3727035d162b667f4b56df43324782d106f50ed1e3bcc","847ec30a4ff2391f1eb7669c22940e51","735d59c0949e258501e177ec2dd5fbb60df9fa401ace08949b89077c6f0d41d0","ea47fd87c1b109d5fd529c213aea6b30","37a1ffaba2e3ea9a7b2aa272b0587826cc0b5909497d3744ec8c114b504d2544","3b61d82be05f18754238e26b835da103","b79629e820cdd36d0daed964a2c0338e125a1f90f08e226f52dc60070747c62e","e79da1e448c60e12d835b47735f9da03","a560931baa404189257ec9cbcc2b9449c579018218cc1d70c99b1d36dd292a0e")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("b9129d83af902908fa7757e906ec0afe","666a4c569d435d0e6bf9fa4d337d1bf014952b42cc6d20e797db6c9df92dd724","0f0fadd0546734c5c82f3c33d8268046","cf59cd171270ec9bc2baf618838eb57802cc9d48f64205da308406811dd4da92","bdd8926f4be6576653ac96ee732d587a","efff4106cfd21a356b13a5a99c626a4f103f03b9491c0f1f5e135c1e3c84e76c","4b9aa7d571be1a6ec62931c4c6624328","88e5ca44189dabb4cec8a183f6268a42f3f92b2c6d7c722d7f55efd3dc5334c8","d521bf0f24c839e7ceb5db77de090fbc","55e2dbb906697dd1aff87ccf275efd06ee5e43bb21ea7865aef59513a858cf9f","4b9aa7d571be1a6ec62931c4c6624328","c3995f28476f7a775f4c1e8be47c64a300e0f16535dc5ed665ba796f05f19f73","48f8b7e0db439336549b93bda8633cd2","724351b5cc9ad496a6c9486b8ef34772f640590a90293f913f005e994717134b","fb99f5da9c0c46c27e17dc2dc1e162d7","2bfb82a43bb77127965a4011a87de845242b1fb98fd09085885be219e0499073","6ce2477efe7e853cea90764db5a64e6e","041c13a29d3bee8d2e4bd9d8bde8152b5ac8305c1efcc198244b224e33635282","7529f56dde7a8302947982c43080bfcc","b523cdd1669dbd7ab68b43fd20f30a790ec0351876a0610958b9405468753a10","8625c0cf0748d04d43db54884ee13672","213520170fc7113ac8f5e689f154f5c8074dd972584b56d820c19d84b7e5b477","7efb1bc15ee6e3043f8eaefcf3f10864","ac7e20d4ddccc5e249ff0c1a72e394f9c1667a896995cf55b97b4f9fbf5de2fd","4b9aa7d571be1a6ec62931c4c6624328","460f1a00002e1c713a7753293b4737e65d27d0b65667b109d66afca873c23894","d66776ee123ef2947bc3175653a68d05","ccfd6ef35c718e2484b3727035d162b667f4b56df43324782d106f50ed1e3bcc","847ec30a4ff2391f1eb7669c22940e51","735d59c0949e258501e177ec2dd5fbb60df9fa401ace08949b89077c6f0d41d0","ea47fd87c1b109d5fd529c213aea6b30","37a1ffaba2e3ea9a7b2aa272b0587826cc0b5909497d3744ec8c114b504d2544","3b61d82be05f18754238e26b835da103","b79629e820cdd36d0daed964a2c0338e125a1f90f08e226f52dc60070747c62e","e79da1e448c60e12d835b47735f9da03","a560931baa404189257ec9cbcc2b9449c579018218cc1d70c99b1d36dd292a0e")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("b9129d83af902908fa7757e906ec0afe","666a4c569d435d0e6bf9fa4d337d1bf014952b42cc6d20e797db6c9df92dd724","0f0fadd0546734c5c82f3c33d8268046","cf59cd171270ec9bc2baf618838eb57802cc9d48f64205da308406811dd4da92","bdd8926f4be6576653ac96ee732d587a","efff4106cfd21a356b13a5a99c626a4f103f03b9491c0f1f5e135c1e3c84e76c","4b9aa7d571be1a6ec62931c4c6624328","88e5ca44189dabb4cec8a183f6268a42f3f92b2c6d7c722d7f55efd3dc5334c8","d521bf0f24c839e7ceb5db77de090fbc","55e2dbb906697dd1aff87ccf275efd06ee5e43bb21ea7865aef59513a858cf9f","4b9aa7d571be1a6ec62931c4c6624328","c3995f28476f7a775f4c1e8be47c64a300e0f16535dc5ed665ba796f05f19f73","48f8b7e0db439336549b93bda8633cd2","724351b5cc9ad496a6c9486b8ef34772f640590a90293f913f005e994717134b","fb99f5da9c0c46c27e17dc2dc1e162d7","2bfb82a43bb77127965a4011a87de845242b1fb98fd09085885be219e0499073","6ce2477efe7e853cea90764db5a64e6e","041c13a29d3bee8d2e4bd9d8bde8152b5ac8305c1efcc198244b224e33635282","7529f56dde7a8302947982c43080bfcc","b523cdd1669dbd7ab68b43fd20f30a790ec0351876a0610958b9405468753a10","8625c0cf0748d04d43db54884ee13672","213520170fc7113ac8f5e689f154f5c8074dd972584b56d820c19d84b7e5b477","7efb1bc15ee6e3043f8eaefcf3f10864","ac7e20d4ddccc5e249ff0c1a72e394f9c1667a896995cf55b97b4f9fbf5de2fd","4b9aa7d571be1a6ec62931c4c6624328","460f1a00002e1c713a7753293b4737e65d27d0b65667b109d66afca873c23894","d66776ee123ef2947bc3175653a68d05","ccfd6ef35c718e2484b3727035d162b667f4b56df43324782d106f50ed1e3bcc","847ec30a4ff2391f1eb7669c22940e51","735d59c0949e258501e177ec2dd5fbb60df9fa401ace08949b89077c6f0d41d0","ea47fd87c1b109d5fd529c213aea6b30","37a1ffaba2e3ea9a7b2aa272b0587826cc0b5909497d3744ec8c114b504d2544","3b61d82be05f18754238e26b835da103","b79629e820cdd36d0daed964a2c0338e125a1f90f08e226f52dc60070747c62e","e79da1e448c60e12d835b47735f9da03","a560931baa404189257ec9cbcc2b9449c579018218cc1d70c99b1d36dd292a0e")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("b9129d83af902908fa7757e906ec0afe","666a4c569d435d0e6bf9fa4d337d1bf014952b42cc6d20e797db6c9df92dd724","0f0fadd0546734c5c82f3c33d8268046","cf59cd171270ec9bc2baf618838eb57802cc9d48f64205da308406811dd4da92","bdd8926f4be6576653ac96ee732d587a","efff4106cfd21a356b13a5a99c626a4f103f03b9491c0f1f5e135c1e3c84e76c","4b9aa7d571be1a6ec62931c4c6624328","88e5ca44189dabb4cec8a183f6268a42f3f92b2c6d7c722d7f55efd3dc5334c8","d521bf0f24c839e7ceb5db77de090fbc","55e2dbb906697dd1aff87ccf275efd06ee5e43bb21ea7865aef59513a858cf9f","4b9aa7d571be1a6ec62931c4c6624328","c3995f28476f7a775f4c1e8be47c64a300e0f16535dc5ed665ba796f05f19f73","48f8b7e0db439336549b93bda8633cd2","724351b5cc9ad496a6c9486b8ef34772f640590a90293f913f005e994717134b","fb99f5da9c0c46c27e17dc2dc1e162d7","2bfb82a43bb77127965a4011a87de845242b1fb98fd09085885be219e0499073","6ce2477efe7e853cea90764db5a64e6e","041c13a29d3bee8d2e4bd9d8bde8152b5ac8305c1efcc198244b224e33635282","7529f56dde7a8302947982c43080bfcc","b523cdd1669dbd7ab68b43fd20f30a790ec0351876a0610958b9405468753a10","8625c0cf0748d04d43db54884ee13672","213520170fc7113ac8f5e689f154f5c8074dd972584b56d820c19d84b7e5b477","7efb1bc15ee6e3043f8eaefcf3f10864","ac7e20d4ddccc5e249ff0c1a72e394f9c1667a896995cf55b97b4f9fbf5de2fd","4b9aa7d571be1a6ec62931c4c6624328","460f1a00002e1c713a7753293b4737e65d27d0b65667b109d66afca873c23894","d66776ee123ef2947bc3175653a68d05","ccfd6ef35c718e2484b3727035d162b667f4b56df43324782d106f50ed1e3bcc","847ec30a4ff2391f1eb7669c22940e51","735d59c0949e258501e177ec2dd5fbb60df9fa401ace08949b89077c6f0d41d0","ea47fd87c1b109d5fd529c213aea6b30","37a1ffaba2e3ea9a7b2aa272b0587826cc0b5909497d3744ec8c114b504d2544","3b61d82be05f18754238e26b835da103","b79629e820cdd36d0daed964a2c0338e125a1f90f08e226f52dc60070747c62e","e79da1e448c60e12d835b47735f9da03","a560931baa404189257ec9cbcc2b9449c579018218cc1d70c99b1d36dd292a0e")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("b9129d83af902908fa7757e906ec0afe","666a4c569d435d0e6bf9fa4d337d1bf014952b42cc6d20e797db6c9df92dd724","0f0fadd0546734c5c82f3c33d8268046","cf59cd171270ec9bc2baf618838eb57802cc9d48f64205da308406811dd4da92","bdd8926f4be6576653ac96ee732d587a","efff4106cfd21a356b13a5a99c626a4f103f03b9491c0f1f5e135c1e3c84e76c","4b9aa7d571be1a6ec62931c4c6624328","88e5ca44189dabb4cec8a183f6268a42f3f92b2c6d7c722d7f55efd3dc5334c8","d521bf0f24c839e7ceb5db77de090fbc","55e2dbb906697dd1aff87ccf275efd06ee5e43bb21ea7865aef59513a858cf9f","4b9aa7d571be1a6ec62931c4c6624328","c3995f28476f7a775f4c1e8be47c64a300e0f16535dc5ed665ba796f05f19f73","48f8b7e0db439336549b93bda8633cd2","724351b5cc9ad496a6c9486b8ef34772f640590a90293f913f005e994717134b","fb99f5da9c0c46c27e17dc2dc1e162d7","2bfb82a43bb77127965a4011a87de845242b1fb98fd09085885be219e0499073","6ce2477efe7e853cea90764db5a64e6e","041c13a29d3bee8d2e4bd9d8bde8152b5ac8305c1efcc198244b224e33635282","7529f56dde7a8302947982c43080bfcc","b523cdd1669dbd7ab68b43fd20f30a790ec0351876a0610958b9405468753a10","8625c0cf0748d04d43db54884ee13672","213520170fc7113ac8f5e689f154f5c8074dd972584b56d820c19d84b7e5b477","7efb1bc15ee6e3043f8eaefcf3f10864","ac7e20d4ddccc5e249ff0c1a72e394f9c1667a896995cf55b97b4f9fbf5de2fd","4b9aa7d571be1a6ec62931c4c6624328","460f1a00002e1c713a7753293b4737e65d27d0b65667b109d66afca873c23894","d66776ee123ef2947bc3175653a68d05","ccfd6ef35c718e2484b3727035d162b667f4b56df43324782d106f50ed1e3bcc","847ec30a4ff2391f1eb7669c22940e51","735d59c0949e258501e177ec2dd5fbb60df9fa401ace08949b89077c6f0d41d0","ea47fd87c1b109d5fd529c213aea6b30","37a1ffaba2e3ea9a7b2aa272b0587826cc0b5909497d3744ec8c114b504d2544","3b61d82be05f18754238e26b835da103","b79629e820cdd36d0daed964a2c0338e125a1f90f08e226f52dc60070747c62e","e79da1e448c60e12d835b47735f9da03","a560931baa404189257ec9cbcc2b9449c579018218cc1d70c99b1d36dd292a0e")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("b9129d83af902908fa7757e906ec0afe","666a4c569d435d0e6bf9fa4d337d1bf014952b42cc6d20e797db6c9df92dd724","0f0fadd0546734c5c82f3c33d8268046","cf59cd171270ec9bc2baf618838eb57802cc9d48f64205da308406811dd4da92","bdd8926f4be6576653ac96ee732d587a","efff4106cfd21a356b13a5a99c626a4f103f03b9491c0f1f5e135c1e3c84e76c","4b9aa7d571be1a6ec62931c4c6624328","88e5ca44189dabb4cec8a183f6268a42f3f92b2c6d7c722d7f55efd3dc5334c8","d521bf0f24c839e7ceb5db77de090fbc","55e2dbb906697dd1aff87ccf275efd06ee5e43bb21ea7865aef59513a858cf9f","4b9aa7d571be1a6ec62931c4c6624328","c3995f28476f7a775f4c1e8be47c64a300e0f16535dc5ed665ba796f05f19f73","48f8b7e0db439336549b93bda8633cd2","724351b5cc9ad496a6c9486b8ef34772f640590a90293f913f005e994717134b","fb99f5da9c0c46c27e17dc2dc1e162d7","2bfb82a43bb77127965a4011a87de845242b1fb98fd09085885be219e0499073","6ce2477efe7e853cea90764db5a64e6e","041c13a29d3bee8d2e4bd9d8bde8152b5ac8305c1efcc198244b224e33635282","7529f56dde7a8302947982c43080bfcc","b523cdd1669dbd7ab68b43fd20f30a790ec0351876a0610958b9405468753a10","8625c0cf0748d04d43db54884ee13672","213520170fc7113ac8f5e689f154f5c8074dd972584b56d820c19d84b7e5b477","7efb1bc15ee6e3043f8eaefcf3f10864","ac7e20d4ddccc5e249ff0c1a72e394f9c1667a896995cf55b97b4f9fbf5de2fd","4b9aa7d571be1a6ec62931c4c6624328","460f1a00002e1c713a7753293b4737e65d27d0b65667b109d66afca873c23894","d66776ee123ef2947bc3175653a68d05","ccfd6ef35c718e2484b3727035d162b667f4b56df43324782d106f50ed1e3bcc","847ec30a4ff2391f1eb7669c22940e51","735d59c0949e258501e177ec2dd5fbb60df9fa401ace08949b89077c6f0d41d0","ea47fd87c1b109d5fd529c213aea6b30","37a1ffaba2e3ea9a7b2aa272b0587826cc0b5909497d3744ec8c114b504d2544","3b61d82be05f18754238e26b835da103","b79629e820cdd36d0daed964a2c0338e125a1f90f08e226f52dc60070747c62e","e79da1e448c60e12d835b47735f9da03","a560931baa404189257ec9cbcc2b9449c579018218cc1d70c99b1d36dd292a0e")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("b9129d83af902908fa7757e906ec0afe","666a4c569d435d0e6bf9fa4d337d1bf014952b42cc6d20e797db6c9df92dd724","0f0fadd0546734c5c82f3c33d8268046","cf59cd171270ec9bc2baf618838eb57802cc9d48f64205da308406811dd4da92","bdd8926f4be6576653ac96ee732d587a","efff4106cfd21a356b13a5a99c626a4f103f03b9491c0f1f5e135c1e3c84e76c","4b9aa7d571be1a6ec62931c4c6624328","88e5ca44189dabb4cec8a183f6268a42f3f92b2c6d7c722d7f55efd3dc5334c8","d521bf0f24c839e7ceb5db77de090fbc","55e2dbb906697dd1aff87ccf275efd06ee5e43bb21ea7865aef59513a858cf9f","4b9aa7d571be1a6ec62931c4c6624328","c3995f28476f7a775f4c1e8be47c64a300e0f16535dc5ed665ba796f05f19f73","48f8b7e0db439336549b93bda8633cd2","724351b5cc9ad496a6c9486b8ef34772f640590a90293f913f005e994717134b","fb99f5da9c0c46c27e17dc2dc1e162d7","2bfb82a43bb77127965a4011a87de845242b1fb98fd09085885be219e0499073","6ce2477efe7e853cea90764db5a64e6e","041c13a29d3bee8d2e4bd9d8bde8152b5ac8305c1efcc198244b224e33635282","7529f56dde7a8302947982c43080bfcc","b523cdd1669dbd7ab68b43fd20f30a790ec0351876a0610958b9405468753a10","8625c0cf0748d04d43db54884ee13672","213520170fc7113ac8f5e689f154f5c8074dd972584b56d820c19d84b7e5b477","7efb1bc15ee6e3043f8eaefcf3f10864","ac7e20d4ddccc5e249ff0c1a72e394f9c1667a896995cf55b97b4f9fbf5de2fd","4b9aa7d571be1a6ec62931c4c6624328","460f1a00002e1c713a7753293b4737e65d27d0b65667b109d66afca873c23894","d66776ee123ef2947bc3175653a68d05","ccfd6ef35c718e2484b3727035d162b667f4b56df43324782d106f50ed1e3bcc","847ec30a4ff2391f1eb7669c22940e51","735d59c0949e258501e177ec2dd5fbb60df9fa401ace08949b89077c6f0d41d0","ea47fd87c1b109d5fd529c213aea6b30","37a1ffaba2e3ea9a7b2aa272b0587826cc0b5909497d3744ec8c114b504d2544","3b61d82be05f18754238e26b835da103","b79629e820cdd36d0daed964a2c0338e125a1f90f08e226f52dc60070747c62e","e79da1e448c60e12d835b47735f9da03","a560931baa404189257ec9cbcc2b9449c579018218cc1d70c99b1d36dd292a0e")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("b9129d83af902908fa7757e906ec0afe","666a4c569d435d0e6bf9fa4d337d1bf014952b42cc6d20e797db6c9df92dd724","0f0fadd0546734c5c82f3c33d8268046","cf59cd171270ec9bc2baf618838eb57802cc9d48f64205da308406811dd4da92","bdd8926f4be6576653ac96ee732d587a","efff4106cfd21a356b13a5a99c626a4f103f03b9491c0f1f5e135c1e3c84e76c","4b9aa7d571be1a6ec62931c4c6624328","88e5ca44189dabb4cec8a183f6268a42f3f92b2c6d7c722d7f55efd3dc5334c8","d521bf0f24c839e7ceb5db77de090fbc","55e2dbb906697dd1aff87ccf275efd06ee5e43bb21ea7865aef59513a858cf9f","4b9aa7d571be1a6ec62931c4c6624328","c3995f28476f7a775f4c1e8be47c64a300e0f16535dc5ed665ba796f05f19f73","48f8b7e0db439336549b93bda8633cd2","724351b5cc9ad496a6c9486b8ef34772f640590a90293f913f005e994717134b","fb99f5da9c0c46c27e17dc2dc1e162d7","2bfb82a43bb77127965a4011a87de845242b1fb98fd09085885be219e0499073","6ce2477efe7e853cea90764db5a64e6e","041c13a29d3bee8d2e4bd9d8bde8152b5ac8305c1efcc198244b224e33635282","7529f56dde7a8302947982c43080bfcc","b523cdd1669dbd7ab68b43fd20f30a790ec0351876a0610958b9405468753a10","8625c0cf0748d04d43db54884ee13672","213520170fc7113ac8f5e689f154f5c8074dd972584b56d820c19d84b7e5b477","7efb1bc15ee6e3043f8eaefcf3f10864","ac7e20d4ddccc5e249ff0c1a72e394f9c1667a896995cf55b97b4f9fbf5de2fd","4b9aa7d571be1a6ec62931c4c6624328","460f1a00002e1c713a7753293b4737e65d27d0b65667b109d66afca873c23894","d66776ee123ef2947bc3175653a68d05","ccfd6ef35c718e2484b3727035d162b667f4b56df43324782d106f50ed1e3bcc","847ec30a4ff2391f1eb7669c22940e51","735d59c0949e258501e177ec2dd5fbb60df9fa401ace08949b89077c6f0d41d0","ea47fd87c1b109d5fd529c213aea6b30","37a1ffaba2e3ea9a7b2aa272b0587826cc0b5909497d3744ec8c114b504d2544","3b61d82be05f18754238e26b835da103","b79629e820cdd36d0daed964a2c0338e125a1f90f08e226f52dc60070747c62e","e79da1e448c60e12d835b47735f9da03","a560931baa404189257ec9cbcc2b9449c579018218cc1d70c99b1d36dd292a0e")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("b9129d83af902908fa7757e906ec0afe","666a4c569d435d0e6bf9fa4d337d1bf014952b42cc6d20e797db6c9df92dd724","0f0fadd0546734c5c82f3c33d8268046","cf59cd171270ec9bc2baf618838eb57802cc9d48f64205da308406811dd4da92","bdd8926f4be6576653ac96ee732d587a","efff4106cfd21a356b13a5a99c626a4f103f03b9491c0f1f5e135c1e3c84e76c","4b9aa7d571be1a6ec62931c4c6624328","88e5ca44189dabb4cec8a183f6268a42f3f92b2c6d7c722d7f55efd3dc5334c8","d521bf0f24c839e7ceb5db77de090fbc","55e2dbb906697dd1aff87ccf275efd06ee5e43bb21ea7865aef59513a858cf9f","4b9aa7d571be1a6ec62931c4c6624328","c3995f28476f7a775f4c1e8be47c64a300e0f16535dc5ed665ba796f05f19f73","48f8b7e0db439336549b93bda8633cd2","724351b5cc9ad496a6c9486b8ef34772f640590a90293f913f005e994717134b","fb99f5da9c0c46c27e17dc2dc1e162d7","2bfb82a43bb77127965a4011a87de845242b1fb98fd09085885be219e0499073","6ce2477efe7e853cea90764db5a64e6e","041c13a29d3bee8d2e4bd9d8bde8152b5ac8305c1efcc198244b224e33635282","7529f56dde7a8302947982c43080bfcc","b523cdd1669dbd7ab68b43fd20f30a790ec0351876a0610958b9405468753a10","8625c0cf0748d04d43db54884ee13672","213520170fc7113ac8f5e689f154f5c8074dd972584b56d820c19d84b7e5b477","7efb1bc15ee6e3043f8eaefcf3f10864","ac7e20d4ddccc5e249ff0c1a72e394f9c1667a896995cf55b97b4f9fbf5de2fd","4b9aa7d571be1a6ec62931c4c6624328","460f1a00002e1c713a7753293b4737e65d27d0b65667b109d66afca873c23894","d66776ee123ef2947bc3175653a68d05","ccfd6ef35c718e2484b3727035d162b667f4b56df43324782d106f50ed1e3bcc","847ec30a4ff2391f1eb7669c22940e51","735d59c0949e258501e177ec2dd5fbb60df9fa401ace08949b89077c6f0d41d0","ea47fd87c1b109d5fd529c213aea6b30","37a1ffaba2e3ea9a7b2aa272b0587826cc0b5909497d3744ec8c114b504d2544","3b61d82be05f18754238e26b835da103","b79629e820cdd36d0daed964a2c0338e125a1f90f08e226f52dc60070747c62e","e79da1e448c60e12d835b47735f9da03","a560931baa404189257ec9cbcc2b9449c579018218cc1d70c99b1d36dd292a0e")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("b9129d83af902908fa7757e906ec0afe","666a4c569d435d0e6bf9fa4d337d1bf014952b42cc6d20e797db6c9df92dd724","0f0fadd0546734c5c82f3c33d8268046","cf59cd171270ec9bc2baf618838eb57802cc9d48f64205da308406811dd4da92","bdd8926f4be6576653ac96ee732d587a","efff4106cfd21a356b13a5a99c626a4f103f03b9491c0f1f5e135c1e3c84e76c","4b9aa7d571be1a6ec62931c4c6624328","88e5ca44189dabb4cec8a183f6268a42f3f92b2c6d7c722d7f55efd3dc5334c8","d521bf0f24c839e7ceb5db77de090fbc","55e2dbb906697dd1aff87ccf275efd06ee5e43bb21ea7865aef59513a858cf9f","4b9aa7d571be1a6ec62931c4c6624328","c3995f28476f7a775f4c1e8be47c64a300e0f16535dc5ed665ba796f05f19f73","48f8b7e0db439336549b93bda8633cd2","724351b5cc9ad496a6c9486b8ef34772f640590a90293f913f005e994717134b","fb99f5da9c0c46c27e17dc2dc1e162d7","2bfb82a43bb77127965a4011a87de845242b1fb98fd09085885be219e0499073","6ce2477efe7e853cea90764db5a64e6e","041c13a29d3bee8d2e4bd9d8bde8152b5ac8305c1efcc198244b224e33635282","7529f56dde7a8302947982c43080bfcc","b523cdd1669dbd7ab68b43fd20f30a790ec0351876a0610958b9405468753a10","8625c0cf0748d04d43db54884ee13672","213520170fc7113ac8f5e689f154f5c8074dd972584b56d820c19d84b7e5b477","7efb1bc15ee6e3043f8eaefcf3f10864","ac7e20d4ddccc5e249ff0c1a72e394f9c1667a896995cf55b97b4f9fbf5de2fd","4b9aa7d571be1a6ec62931c4c6624328","460f1a00002e1c713a7753293b4737e65d27d0b65667b109d66afca873c23894","d66776ee123ef2947bc3175653a68d05","ccfd6ef35c718e2484b3727035d162b667f4b56df43324782d106f50ed1e3bcc","847ec30a4ff2391f1eb7669c22940e51","735d59c0949e258501e177ec2dd5fbb60df9fa401ace08949b89077c6f0d41d0","ea47fd87c1b109d5fd529c213aea6b30","37a1ffaba2e3ea9a7b2aa272b0587826cc0b5909497d3744ec8c114b504d2544","3b61d82be05f18754238e26b835da103","b79629e820cdd36d0daed964a2c0338e125a1f90f08e226f52dc60070747c62e","e79da1e448c60e12d835b47735f9da03","a560931baa404189257ec9cbcc2b9449c579018218cc1d70c99b1d36dd292a0e")
index=activity AND rg_functionality="Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("b9129d83af902908fa7757e906ec0afe","666a4c569d435d0e6bf9fa4d337d1bf014952b42cc6d20e797db6c9df92dd724","0f0fadd0546734c5c82f3c33d8268046","cf59cd171270ec9bc2baf618838eb57802cc9d48f64205da308406811dd4da92","bdd8926f4be6576653ac96ee732d587a","efff4106cfd21a356b13a5a99c626a4f103f03b9491c0f1f5e135c1e3c84e76c","4b9aa7d571be1a6ec62931c4c6624328","88e5ca44189dabb4cec8a183f6268a42f3f92b2c6d7c722d7f55efd3dc5334c8","d521bf0f24c839e7ceb5db77de090fbc","55e2dbb906697dd1aff87ccf275efd06ee5e43bb21ea7865aef59513a858cf9f","4b9aa7d571be1a6ec62931c4c6624328","c3995f28476f7a775f4c1e8be47c64a300e0f16535dc5ed665ba796f05f19f73","48f8b7e0db439336549b93bda8633cd2","724351b5cc9ad496a6c9486b8ef34772f640590a90293f913f005e994717134b","fb99f5da9c0c46c27e17dc2dc1e162d7","2bfb82a43bb77127965a4011a87de845242b1fb98fd09085885be219e0499073","6ce2477efe7e853cea90764db5a64e6e","041c13a29d3bee8d2e4bd9d8bde8152b5ac8305c1efcc198244b224e33635282","7529f56dde7a8302947982c43080bfcc","b523cdd1669dbd7ab68b43fd20f30a790ec0351876a0610958b9405468753a10","8625c0cf0748d04d43db54884ee13672","213520170fc7113ac8f5e689f154f5c8074dd972584b56d820c19d84b7e5b477","7efb1bc15ee6e3043f8eaefcf3f10864","ac7e20d4ddccc5e249ff0c1a72e394f9c1667a896995cf55b97b4f9fbf5de2fd","4b9aa7d571be1a6ec62931c4c6624328","460f1a00002e1c713a7753293b4737e65d27d0b65667b109d66afca873c23894","d66776ee123ef2947bc3175653a68d05","ccfd6ef35c718e2484b3727035d162b667f4b56df43324782d106f50ed1e3bcc","847ec30a4ff2391f1eb7669c22940e51","735d59c0949e258501e177ec2dd5fbb60df9fa401ace08949b89077c6f0d41d0","ea47fd87c1b109d5fd529c213aea6b30","37a1ffaba2e3ea9a7b2aa272b0587826cc0b5909497d3744ec8c114b504d2544","3b61d82be05f18754238e26b835da103","b79629e820cdd36d0daed964a2c0338e125a1f90f08e226f52dc60070747c62e","e79da1e448c60e12d835b47735f9da03","a560931baa404189257ec9cbcc2b9449c579018218cc1d70c99b1d36dd292a0e")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("b9129d83af902908fa7757e906ec0afe","666a4c569d435d0e6bf9fa4d337d1bf014952b42cc6d20e797db6c9df92dd724","0f0fadd0546734c5c82f3c33d8268046","cf59cd171270ec9bc2baf618838eb57802cc9d48f64205da308406811dd4da92","bdd8926f4be6576653ac96ee732d587a","efff4106cfd21a356b13a5a99c626a4f103f03b9491c0f1f5e135c1e3c84e76c","4b9aa7d571be1a6ec62931c4c6624328","88e5ca44189dabb4cec8a183f6268a42f3f92b2c6d7c722d7f55efd3dc5334c8","d521bf0f24c839e7ceb5db77de090fbc","55e2dbb906697dd1aff87ccf275efd06ee5e43bb21ea7865aef59513a858cf9f","4b9aa7d571be1a6ec62931c4c6624328","c3995f28476f7a775f4c1e8be47c64a300e0f16535dc5ed665ba796f05f19f73","48f8b7e0db439336549b93bda8633cd2","724351b5cc9ad496a6c9486b8ef34772f640590a90293f913f005e994717134b","fb99f5da9c0c46c27e17dc2dc1e162d7","2bfb82a43bb77127965a4011a87de845242b1fb98fd09085885be219e0499073","6ce2477efe7e853cea90764db5a64e6e","041c13a29d3bee8d2e4bd9d8bde8152b5ac8305c1efcc198244b224e33635282","7529f56dde7a8302947982c43080bfcc","b523cdd1669dbd7ab68b43fd20f30a790ec0351876a0610958b9405468753a10","8625c0cf0748d04d43db54884ee13672","213520170fc7113ac8f5e689f154f5c8074dd972584b56d820c19d84b7e5b477","7efb1bc15ee6e3043f8eaefcf3f10864","ac7e20d4ddccc5e249ff0c1a72e394f9c1667a896995cf55b97b4f9fbf5de2fd","4b9aa7d571be1a6ec62931c4c6624328","460f1a00002e1c713a7753293b4737e65d27d0b65667b109d66afca873c23894","d66776ee123ef2947bc3175653a68d05","ccfd6ef35c718e2484b3727035d162b667f4b56df43324782d106f50ed1e3bcc","847ec30a4ff2391f1eb7669c22940e51","735d59c0949e258501e177ec2dd5fbb60df9fa401ace08949b89077c6f0d41d0","ea47fd87c1b109d5fd529c213aea6b30","37a1ffaba2e3ea9a7b2aa272b0587826cc0b5909497d3744ec8c114b504d2544","3b61d82be05f18754238e26b835da103","b79629e820cdd36d0daed964a2c0338e125a1f90f08e226f52dc60070747c62e","e79da1e448c60e12d835b47735f9da03","a560931baa404189257ec9cbcc2b9449c579018218cc1d70c99b1d36dd292a0e")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("b9129d83af902908fa7757e906ec0afe","666a4c569d435d0e6bf9fa4d337d1bf014952b42cc6d20e797db6c9df92dd724","0f0fadd0546734c5c82f3c33d8268046","cf59cd171270ec9bc2baf618838eb57802cc9d48f64205da308406811dd4da92","bdd8926f4be6576653ac96ee732d587a","efff4106cfd21a356b13a5a99c626a4f103f03b9491c0f1f5e135c1e3c84e76c","4b9aa7d571be1a6ec62931c4c6624328","88e5ca44189dabb4cec8a183f6268a42f3f92b2c6d7c722d7f55efd3dc5334c8","d521bf0f24c839e7ceb5db77de090fbc","55e2dbb906697dd1aff87ccf275efd06ee5e43bb21ea7865aef59513a858cf9f","4b9aa7d571be1a6ec62931c4c6624328","c3995f28476f7a775f4c1e8be47c64a300e0f16535dc5ed665ba796f05f19f73","48f8b7e0db439336549b93bda8633cd2","724351b5cc9ad496a6c9486b8ef34772f640590a90293f913f005e994717134b","fb99f5da9c0c46c27e17dc2dc1e162d7","2bfb82a43bb77127965a4011a87de845242b1fb98fd09085885be219e0499073","6ce2477efe7e853cea90764db5a64e6e","041c13a29d3bee8d2e4bd9d8bde8152b5ac8305c1efcc198244b224e33635282","7529f56dde7a8302947982c43080bfcc","b523cdd1669dbd7ab68b43fd20f30a790ec0351876a0610958b9405468753a10","8625c0cf0748d04d43db54884ee13672","213520170fc7113ac8f5e689f154f5c8074dd972584b56d820c19d84b7e5b477","7efb1bc15ee6e3043f8eaefcf3f10864","ac7e20d4ddccc5e249ff0c1a72e394f9c1667a896995cf55b97b4f9fbf5de2fd","4b9aa7d571be1a6ec62931c4c6624328","460f1a00002e1c713a7753293b4737e65d27d0b65667b109d66afca873c23894","d66776ee123ef2947bc3175653a68d05","ccfd6ef35c718e2484b3727035d162b667f4b56df43324782d106f50ed1e3bcc","847ec30a4ff2391f1eb7669c22940e51","735d59c0949e258501e177ec2dd5fbb60df9fa401ace08949b89077c6f0d41d0","ea47fd87c1b109d5fd529c213aea6b30","37a1ffaba2e3ea9a7b2aa272b0587826cc0b5909497d3744ec8c114b504d2544","3b61d82be05f18754238e26b835da103","b79629e820cdd36d0daed964a2c0338e125a1f90f08e226f52dc60070747c62e","e79da1e448c60e12d835b47735f9da03","a560931baa404189257ec9cbcc2b9449c579018218cc1d70c99b1d36dd292a0e")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("b9129d83af902908fa7757e906ec0afe","666a4c569d435d0e6bf9fa4d337d1bf014952b42cc6d20e797db6c9df92dd724","0f0fadd0546734c5c82f3c33d8268046","cf59cd171270ec9bc2baf618838eb57802cc9d48f64205da308406811dd4da92","bdd8926f4be6576653ac96ee732d587a","efff4106cfd21a356b13a5a99c626a4f103f03b9491c0f1f5e135c1e3c84e76c","4b9aa7d571be1a6ec62931c4c6624328","88e5ca44189dabb4cec8a183f6268a42f3f92b2c6d7c722d7f55efd3dc5334c8","d521bf0f24c839e7ceb5db77de090fbc","55e2dbb906697dd1aff87ccf275efd06ee5e43bb21ea7865aef59513a858cf9f","4b9aa7d571be1a6ec62931c4c6624328","c3995f28476f7a775f4c1e8be47c64a300e0f16535dc5ed665ba796f05f19f73","48f8b7e0db439336549b93bda8633cd2","724351b5cc9ad496a6c9486b8ef34772f640590a90293f913f005e994717134b","fb99f5da9c0c46c27e17dc2dc1e162d7","2bfb82a43bb77127965a4011a87de845242b1fb98fd09085885be219e0499073","6ce2477efe7e853cea90764db5a64e6e","041c13a29d3bee8d2e4bd9d8bde8152b5ac8305c1efcc198244b224e33635282","7529f56dde7a8302947982c43080bfcc","b523cdd1669dbd7ab68b43fd20f30a790ec0351876a0610958b9405468753a10","8625c0cf0748d04d43db54884ee13672","213520170fc7113ac8f5e689f154f5c8074dd972584b56d820c19d84b7e5b477","7efb1bc15ee6e3043f8eaefcf3f10864","ac7e20d4ddccc5e249ff0c1a72e394f9c1667a896995cf55b97b4f9fbf5de2fd","4b9aa7d571be1a6ec62931c4c6624328","460f1a00002e1c713a7753293b4737e65d27d0b65667b109d66afca873c23894","d66776ee123ef2947bc3175653a68d05","ccfd6ef35c718e2484b3727035d162b667f4b56df43324782d106f50ed1e3bcc","847ec30a4ff2391f1eb7669c22940e51","735d59c0949e258501e177ec2dd5fbb60df9fa401ace08949b89077c6f0d41d0","ea47fd87c1b109d5fd529c213aea6b30","37a1ffaba2e3ea9a7b2aa272b0587826cc0b5909497d3744ec8c114b504d2544","3b61d82be05f18754238e26b835da103","b79629e820cdd36d0daed964a2c0338e125a1f90f08e226f52dc60070747c62e","e79da1e448c60e12d835b47735f9da03","a560931baa404189257ec9cbcc2b9449c579018218cc1d70c99b1d36dd292a0e")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("b9129d83af902908fa7757e906ec0afe","666a4c569d435d0e6bf9fa4d337d1bf014952b42cc6d20e797db6c9df92dd724","0f0fadd0546734c5c82f3c33d8268046","cf59cd171270ec9bc2baf618838eb57802cc9d48f64205da308406811dd4da92","bdd8926f4be6576653ac96ee732d587a","efff4106cfd21a356b13a5a99c626a4f103f03b9491c0f1f5e135c1e3c84e76c","4b9aa7d571be1a6ec62931c4c6624328","88e5ca44189dabb4cec8a183f6268a42f3f92b2c6d7c722d7f55efd3dc5334c8","d521bf0f24c839e7ceb5db77de090fbc","55e2dbb906697dd1aff87ccf275efd06ee5e43bb21ea7865aef59513a858cf9f","4b9aa7d571be1a6ec62931c4c6624328","c3995f28476f7a775f4c1e8be47c64a300e0f16535dc5ed665ba796f05f19f73","48f8b7e0db439336549b93bda8633cd2","724351b5cc9ad496a6c9486b8ef34772f640590a90293f913f005e994717134b","fb99f5da9c0c46c27e17dc2dc1e162d7","2bfb82a43bb77127965a4011a87de845242b1fb98fd09085885be219e0499073","6ce2477efe7e853cea90764db5a64e6e","041c13a29d3bee8d2e4bd9d8bde8152b5ac8305c1efcc198244b224e33635282","7529f56dde7a8302947982c43080bfcc","b523cdd1669dbd7ab68b43fd20f30a790ec0351876a0610958b9405468753a10","8625c0cf0748d04d43db54884ee13672","213520170fc7113ac8f5e689f154f5c8074dd972584b56d820c19d84b7e5b477","7efb1bc15ee6e3043f8eaefcf3f10864","ac7e20d4ddccc5e249ff0c1a72e394f9c1667a896995cf55b97b4f9fbf5de2fd","4b9aa7d571be1a6ec62931c4c6624328","460f1a00002e1c713a7753293b4737e65d27d0b65667b109d66afca873c23894","d66776ee123ef2947bc3175653a68d05","ccfd6ef35c718e2484b3727035d162b667f4b56df43324782d106f50ed1e3bcc","847ec30a4ff2391f1eb7669c22940e51","735d59c0949e258501e177ec2dd5fbb60df9fa401ace08949b89077c6f0d41d0","ea47fd87c1b109d5fd529c213aea6b30","37a1ffaba2e3ea9a7b2aa272b0587826cc0b5909497d3744ec8c114b504d2544","3b61d82be05f18754238e26b835da103","b79629e820cdd36d0daed964a2c0338e125a1f90f08e226f52dc60070747c62e","e79da1e448c60e12d835b47735f9da03","a560931baa404189257ec9cbcc2b9449c579018218cc1d70c99b1d36dd292a0e")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("b9129d83af902908fa7757e906ec0afe","666a4c569d435d0e6bf9fa4d337d1bf014952b42cc6d20e797db6c9df92dd724","0f0fadd0546734c5c82f3c33d8268046","cf59cd171270ec9bc2baf618838eb57802cc9d48f64205da308406811dd4da92","bdd8926f4be6576653ac96ee732d587a","efff4106cfd21a356b13a5a99c626a4f103f03b9491c0f1f5e135c1e3c84e76c","4b9aa7d571be1a6ec62931c4c6624328","88e5ca44189dabb4cec8a183f6268a42f3f92b2c6d7c722d7f55efd3dc5334c8","d521bf0f24c839e7ceb5db77de090fbc","55e2dbb906697dd1aff87ccf275efd06ee5e43bb21ea7865aef59513a858cf9f","4b9aa7d571be1a6ec62931c4c6624328","c3995f28476f7a775f4c1e8be47c64a300e0f16535dc5ed665ba796f05f19f73","48f8b7e0db439336549b93bda8633cd2","724351b5cc9ad496a6c9486b8ef34772f640590a90293f913f005e994717134b","fb99f5da9c0c46c27e17dc2dc1e162d7","2bfb82a43bb77127965a4011a87de845242b1fb98fd09085885be219e0499073","6ce2477efe7e853cea90764db5a64e6e","041c13a29d3bee8d2e4bd9d8bde8152b5ac8305c1efcc198244b224e33635282","7529f56dde7a8302947982c43080bfcc","b523cdd1669dbd7ab68b43fd20f30a790ec0351876a0610958b9405468753a10","8625c0cf0748d04d43db54884ee13672","213520170fc7113ac8f5e689f154f5c8074dd972584b56d820c19d84b7e5b477","7efb1bc15ee6e3043f8eaefcf3f10864","ac7e20d4ddccc5e249ff0c1a72e394f9c1667a896995cf55b97b4f9fbf5de2fd","4b9aa7d571be1a6ec62931c4c6624328","460f1a00002e1c713a7753293b4737e65d27d0b65667b109d66afca873c23894","d66776ee123ef2947bc3175653a68d05","ccfd6ef35c718e2484b3727035d162b667f4b56df43324782d106f50ed1e3bcc","847ec30a4ff2391f1eb7669c22940e51","735d59c0949e258501e177ec2dd5fbb60df9fa401ace08949b89077c6f0d41d0","ea47fd87c1b109d5fd529c213aea6b30","37a1ffaba2e3ea9a7b2aa272b0587826cc0b5909497d3744ec8c114b504d2544","3b61d82be05f18754238e26b835da103","b79629e820cdd36d0daed964a2c0338e125a1f90f08e226f52dc60070747c62e","e79da1e448c60e12d835b47735f9da03","a560931baa404189257ec9cbcc2b9449c579018218cc1d70c99b1d36dd292a0e")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("b9129d83af902908fa7757e906ec0afe","666a4c569d435d0e6bf9fa4d337d1bf014952b42cc6d20e797db6c9df92dd724","0f0fadd0546734c5c82f3c33d8268046","cf59cd171270ec9bc2baf618838eb57802cc9d48f64205da308406811dd4da92","bdd8926f4be6576653ac96ee732d587a","efff4106cfd21a356b13a5a99c626a4f103f03b9491c0f1f5e135c1e3c84e76c","4b9aa7d571be1a6ec62931c4c6624328","88e5ca44189dabb4cec8a183f6268a42f3f92b2c6d7c722d7f55efd3dc5334c8","d521bf0f24c839e7ceb5db77de090fbc","55e2dbb906697dd1aff87ccf275efd06ee5e43bb21ea7865aef59513a858cf9f","4b9aa7d571be1a6ec62931c4c6624328","c3995f28476f7a775f4c1e8be47c64a300e0f16535dc5ed665ba796f05f19f73","48f8b7e0db439336549b93bda8633cd2","724351b5cc9ad496a6c9486b8ef34772f640590a90293f913f005e994717134b","fb99f5da9c0c46c27e17dc2dc1e162d7","2bfb82a43bb77127965a4011a87de845242b1fb98fd09085885be219e0499073","6ce2477efe7e853cea90764db5a64e6e","041c13a29d3bee8d2e4bd9d8bde8152b5ac8305c1efcc198244b224e33635282","7529f56dde7a8302947982c43080bfcc","b523cdd1669dbd7ab68b43fd20f30a790ec0351876a0610958b9405468753a10","8625c0cf0748d04d43db54884ee13672","213520170fc7113ac8f5e689f154f5c8074dd972584b56d820c19d84b7e5b477","7efb1bc15ee6e3043f8eaefcf3f10864","ac7e20d4ddccc5e249ff0c1a72e394f9c1667a896995cf55b97b4f9fbf5de2fd","4b9aa7d571be1a6ec62931c4c6624328","460f1a00002e1c713a7753293b4737e65d27d0b65667b109d66afca873c23894","d66776ee123ef2947bc3175653a68d05","ccfd6ef35c718e2484b3727035d162b667f4b56df43324782d106f50ed1e3bcc","847ec30a4ff2391f1eb7669c22940e51","735d59c0949e258501e177ec2dd5fbb60df9fa401ace08949b89077c6f0d41d0","ea47fd87c1b109d5fd529c213aea6b30","37a1ffaba2e3ea9a7b2aa272b0587826cc0b5909497d3744ec8c114b504d2544","3b61d82be05f18754238e26b835da103","b79629e820cdd36d0daed964a2c0338e125a1f90f08e226f52dc60070747c62e","e79da1e448c60e12d835b47735f9da03","a560931baa404189257ec9cbcc2b9449c579018218cc1d70c99b1d36dd292a0e")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("b9129d83af902908fa7757e906ec0afe","666a4c569d435d0e6bf9fa4d337d1bf014952b42cc6d20e797db6c9df92dd724","0f0fadd0546734c5c82f3c33d8268046","cf59cd171270ec9bc2baf618838eb57802cc9d48f64205da308406811dd4da92","bdd8926f4be6576653ac96ee732d587a","efff4106cfd21a356b13a5a99c626a4f103f03b9491c0f1f5e135c1e3c84e76c","4b9aa7d571be1a6ec62931c4c6624328","88e5ca44189dabb4cec8a183f6268a42f3f92b2c6d7c722d7f55efd3dc5334c8","d521bf0f24c839e7ceb5db77de090fbc","55e2dbb906697dd1aff87ccf275efd06ee5e43bb21ea7865aef59513a858cf9f","4b9aa7d571be1a6ec62931c4c6624328","c3995f28476f7a775f4c1e8be47c64a300e0f16535dc5ed665ba796f05f19f73","48f8b7e0db439336549b93bda8633cd2","724351b5cc9ad496a6c9486b8ef34772f640590a90293f913f005e994717134b","fb99f5da9c0c46c27e17dc2dc1e162d7","2bfb82a43bb77127965a4011a87de845242b1fb98fd09085885be219e0499073","6ce2477efe7e853cea90764db5a64e6e","041c13a29d3bee8d2e4bd9d8bde8152b5ac8305c1efcc198244b224e33635282","7529f56dde7a8302947982c43080bfcc","b523cdd1669dbd7ab68b43fd20f30a790ec0351876a0610958b9405468753a10","8625c0cf0748d04d43db54884ee13672","213520170fc7113ac8f5e689f154f5c8074dd972584b56d820c19d84b7e5b477","7efb1bc15ee6e3043f8eaefcf3f10864","ac7e20d4ddccc5e249ff0c1a72e394f9c1667a896995cf55b97b4f9fbf5de2fd","4b9aa7d571be1a6ec62931c4c6624328","460f1a00002e1c713a7753293b4737e65d27d0b65667b109d66afca873c23894","d66776ee123ef2947bc3175653a68d05","ccfd6ef35c718e2484b3727035d162b667f4b56df43324782d106f50ed1e3bcc","847ec30a4ff2391f1eb7669c22940e51","735d59c0949e258501e177ec2dd5fbb60df9fa401ace08949b89077c6f0d41d0","ea47fd87c1b109d5fd529c213aea6b30","37a1ffaba2e3ea9a7b2aa272b0587826cc0b5909497d3744ec8c114b504d2544","3b61d82be05f18754238e26b835da103","b79629e820cdd36d0daed964a2c0338e125a1f90f08e226f52dc60070747c62e","e79da1e448c60e12d835b47735f9da03","a560931baa404189257ec9cbcc2b9449c579018218cc1d70c99b1d36dd292a0e")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring64 NOT NULL AND customstring64 IN ("b9129d83af902908fa7757e906ec0afe","666a4c569d435d0e6bf9fa4d337d1bf014952b42cc6d20e797db6c9df92dd724","0f0fadd0546734c5c82f3c33d8268046","cf59cd171270ec9bc2baf618838eb57802cc9d48f64205da308406811dd4da92","bdd8926f4be6576653ac96ee732d587a","efff4106cfd21a356b13a5a99c626a4f103f03b9491c0f1f5e135c1e3c84e76c","4b9aa7d571be1a6ec62931c4c6624328","88e5ca44189dabb4cec8a183f6268a42f3f92b2c6d7c722d7f55efd3dc5334c8","d521bf0f24c839e7ceb5db77de090fbc","55e2dbb906697dd1aff87ccf275efd06ee5e43bb21ea7865aef59513a858cf9f","4b9aa7d571be1a6ec62931c4c6624328","c3995f28476f7a775f4c1e8be47c64a300e0f16535dc5ed665ba796f05f19f73","48f8b7e0db439336549b93bda8633cd2","724351b5cc9ad496a6c9486b8ef34772f640590a90293f913f005e994717134b","fb99f5da9c0c46c27e17dc2dc1e162d7","2bfb82a43bb77127965a4011a87de845242b1fb98fd09085885be219e0499073","6ce2477efe7e853cea90764db5a64e6e","041c13a29d3bee8d2e4bd9d8bde8152b5ac8305c1efcc198244b224e33635282","7529f56dde7a8302947982c43080bfcc","b523cdd1669dbd7ab68b43fd20f30a790ec0351876a0610958b9405468753a10","8625c0cf0748d04d43db54884ee13672","213520170fc7113ac8f5e689f154f5c8074dd972584b56d820c19d84b7e5b477","7efb1bc15ee6e3043f8eaefcf3f10864","ac7e20d4ddccc5e249ff0c1a72e394f9c1667a896995cf55b97b4f9fbf5de2fd","4b9aa7d571be1a6ec62931c4c6624328","460f1a00002e1c713a7753293b4737e65d27d0b65667b109d66afca873c23894","d66776ee123ef2947bc3175653a68d05","ccfd6ef35c718e2484b3727035d162b667f4b56df43324782d106f50ed1e3bcc","847ec30a4ff2391f1eb7669c22940e51","735d59c0949e258501e177ec2dd5fbb60df9fa401ace08949b89077c6f0d41d0","ea47fd87c1b109d5fd529c213aea6b30","37a1ffaba2e3ea9a7b2aa272b0587826cc0b5909497d3744ec8c114b504d2544","3b61d82be05f18754238e26b835da103","b79629e820cdd36d0daed964a2c0338e125a1f90f08e226f52dc60070747c62e","e79da1e448c60e12d835b47735f9da03","a560931baa404189257ec9cbcc2b9449c579018218cc1d70c99b1d36dd292a0e")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("b9129d83af902908fa7757e906ec0afe","666a4c569d435d0e6bf9fa4d337d1bf014952b42cc6d20e797db6c9df92dd724","0f0fadd0546734c5c82f3c33d8268046","cf59cd171270ec9bc2baf618838eb57802cc9d48f64205da308406811dd4da92","bdd8926f4be6576653ac96ee732d587a","efff4106cfd21a356b13a5a99c626a4f103f03b9491c0f1f5e135c1e3c84e76c","4b9aa7d571be1a6ec62931c4c6624328","88e5ca44189dabb4cec8a183f6268a42f3f92b2c6d7c722d7f55efd3dc5334c8","d521bf0f24c839e7ceb5db77de090fbc","55e2dbb906697dd1aff87ccf275efd06ee5e43bb21ea7865aef59513a858cf9f","4b9aa7d571be1a6ec62931c4c6624328","c3995f28476f7a775f4c1e8be47c64a300e0f16535dc5ed665ba796f05f19f73","48f8b7e0db439336549b93bda8633cd2","724351b5cc9ad496a6c9486b8ef34772f640590a90293f913f005e994717134b","fb99f5da9c0c46c27e17dc2dc1e162d7","2bfb82a43bb77127965a4011a87de845242b1fb98fd09085885be219e0499073","6ce2477efe7e853cea90764db5a64e6e","041c13a29d3bee8d2e4bd9d8bde8152b5ac8305c1efcc198244b224e33635282","7529f56dde7a8302947982c43080bfcc","b523cdd1669dbd7ab68b43fd20f30a790ec0351876a0610958b9405468753a10","8625c0cf0748d04d43db54884ee13672","213520170fc7113ac8f5e689f154f5c8074dd972584b56d820c19d84b7e5b477","7efb1bc15ee6e3043f8eaefcf3f10864","ac7e20d4ddccc5e249ff0c1a72e394f9c1667a896995cf55b97b4f9fbf5de2fd","4b9aa7d571be1a6ec62931c4c6624328","460f1a00002e1c713a7753293b4737e65d27d0b65667b109d66afca873c23894","d66776ee123ef2947bc3175653a68d05","ccfd6ef35c718e2484b3727035d162b667f4b56df43324782d106f50ed1e3bcc","847ec30a4ff2391f1eb7669c22940e51","735d59c0949e258501e177ec2dd5fbb60df9fa401ace08949b89077c6f0d41d0","ea47fd87c1b109d5fd529c213aea6b30","37a1ffaba2e3ea9a7b2aa272b0587826cc0b5909497d3744ec8c114b504d2544","3b61d82be05f18754238e26b835da103","b79629e820cdd36d0daed964a2c0338e125a1f90f08e226f52dc60070747c62e","e79da1e448c60e12d835b47735f9da03","a560931baa404189257ec9cbcc2b9449c579018218cc1d70c99b1d36dd292a0e")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("b9129d83af902908fa7757e906ec0afe","666a4c569d435d0e6bf9fa4d337d1bf014952b42cc6d20e797db6c9df92dd724","0f0fadd0546734c5c82f3c33d8268046","cf59cd171270ec9bc2baf618838eb57802cc9d48f64205da308406811dd4da92","bdd8926f4be6576653ac96ee732d587a","efff4106cfd21a356b13a5a99c626a4f103f03b9491c0f1f5e135c1e3c84e76c","4b9aa7d571be1a6ec62931c4c6624328","88e5ca44189dabb4cec8a183f6268a42f3f92b2c6d7c722d7f55efd3dc5334c8","d521bf0f24c839e7ceb5db77de090fbc","55e2dbb906697dd1aff87ccf275efd06ee5e43bb21ea7865aef59513a858cf9f","4b9aa7d571be1a6ec62931c4c6624328","c3995f28476f7a775f4c1e8be47c64a300e0f16535dc5ed665ba796f05f19f73","48f8b7e0db439336549b93bda8633cd2","724351b5cc9ad496a6c9486b8ef34772f640590a90293f913f005e994717134b","fb99f5da9c0c46c27e17dc2dc1e162d7","2bfb82a43bb77127965a4011a87de845242b1fb98fd09085885be219e0499073","6ce2477efe7e853cea90764db5a64e6e","041c13a29d3bee8d2e4bd9d8bde8152b5ac8305c1efcc198244b224e33635282","7529f56dde7a8302947982c43080bfcc","b523cdd1669dbd7ab68b43fd20f30a790ec0351876a0610958b9405468753a10","8625c0cf0748d04d43db54884ee13672","213520170fc7113ac8f5e689f154f5c8074dd972584b56d820c19d84b7e5b477","7efb1bc15ee6e3043f8eaefcf3f10864","ac7e20d4ddccc5e249ff0c1a72e394f9c1667a896995cf55b97b4f9fbf5de2fd","4b9aa7d571be1a6ec62931c4c6624328","460f1a00002e1c713a7753293b4737e65d27d0b65667b109d66afca873c23894","d66776ee123ef2947bc3175653a68d05","ccfd6ef35c718e2484b3727035d162b667f4b56df43324782d106f50ed1e3bcc","847ec30a4ff2391f1eb7669c22940e51","735d59c0949e258501e177ec2dd5fbb60df9fa401ace08949b89077c6f0d41d0","ea47fd87c1b109d5fd529c213aea6b30","37a1ffaba2e3ea9a7b2aa272b0587826cc0b5909497d3744ec8c114b504d2544","3b61d82be05f18754238e26b835da103","b79629e820cdd36d0daed964a2c0338e125a1f90f08e226f52dc60070747c62e","e79da1e448c60e12d835b47735f9da03","a560931baa404189257ec9cbcc2b9449c579018218cc1d70c99b1d36dd292a0e")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("b9129d83af902908fa7757e906ec0afe","666a4c569d435d0e6bf9fa4d337d1bf014952b42cc6d20e797db6c9df92dd724","0f0fadd0546734c5c82f3c33d8268046","cf59cd171270ec9bc2baf618838eb57802cc9d48f64205da308406811dd4da92","bdd8926f4be6576653ac96ee732d587a","efff4106cfd21a356b13a5a99c626a4f103f03b9491c0f1f5e135c1e3c84e76c","4b9aa7d571be1a6ec62931c4c6624328","88e5ca44189dabb4cec8a183f6268a42f3f92b2c6d7c722d7f55efd3dc5334c8","d521bf0f24c839e7ceb5db77de090fbc","55e2dbb906697dd1aff87ccf275efd06ee5e43bb21ea7865aef59513a858cf9f","4b9aa7d571be1a6ec62931c4c6624328","c3995f28476f7a775f4c1e8be47c64a300e0f16535dc5ed665ba796f05f19f73","48f8b7e0db439336549b93bda8633cd2","724351b5cc9ad496a6c9486b8ef34772f640590a90293f913f005e994717134b","fb99f5da9c0c46c27e17dc2dc1e162d7","2bfb82a43bb77127965a4011a87de845242b1fb98fd09085885be219e0499073","6ce2477efe7e853cea90764db5a64e6e","041c13a29d3bee8d2e4bd9d8bde8152b5ac8305c1efcc198244b224e33635282","7529f56dde7a8302947982c43080bfcc","b523cdd1669dbd7ab68b43fd20f30a790ec0351876a0610958b9405468753a10","8625c0cf0748d04d43db54884ee13672","213520170fc7113ac8f5e689f154f5c8074dd972584b56d820c19d84b7e5b477","7efb1bc15ee6e3043f8eaefcf3f10864","ac7e20d4ddccc5e249ff0c1a72e394f9c1667a896995cf55b97b4f9fbf5de2fd","4b9aa7d571be1a6ec62931c4c6624328","460f1a00002e1c713a7753293b4737e65d27d0b65667b109d66afca873c23894","d66776ee123ef2947bc3175653a68d05","ccfd6ef35c718e2484b3727035d162b667f4b56df43324782d106f50ed1e3bcc","847ec30a4ff2391f1eb7669c22940e51","735d59c0949e258501e177ec2dd5fbb60df9fa401ace08949b89077c6f0d41d0","ea47fd87c1b109d5fd529c213aea6b30","37a1ffaba2e3ea9a7b2aa272b0587826cc0b5909497d3744ec8c114b504d2544","3b61d82be05f18754238e26b835da103","b79629e820cdd36d0daed964a2c0338e125a1f90f08e226f52dc60070747c62e","e79da1e448c60e12d835b47735f9da03","a560931baa404189257ec9cbcc2b9449c579018218cc1d70c99b1d36dd292a0e")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring64 NOT NULL AND customstring64 IN ("b9129d83af902908fa7757e906ec0afe","666a4c569d435d0e6bf9fa4d337d1bf014952b42cc6d20e797db6c9df92dd724","0f0fadd0546734c5c82f3c33d8268046","cf59cd171270ec9bc2baf618838eb57802cc9d48f64205da308406811dd4da92","bdd8926f4be6576653ac96ee732d587a","efff4106cfd21a356b13a5a99c626a4f103f03b9491c0f1f5e135c1e3c84e76c","4b9aa7d571be1a6ec62931c4c6624328","88e5ca44189dabb4cec8a183f6268a42f3f92b2c6d7c722d7f55efd3dc5334c8","d521bf0f24c839e7ceb5db77de090fbc","55e2dbb906697dd1aff87ccf275efd06ee5e43bb21ea7865aef59513a858cf9f","4b9aa7d571be1a6ec62931c4c6624328","c3995f28476f7a775f4c1e8be47c64a300e0f16535dc5ed665ba796f05f19f73","48f8b7e0db439336549b93bda8633cd2","724351b5cc9ad496a6c9486b8ef34772f640590a90293f913f005e994717134b","fb99f5da9c0c46c27e17dc2dc1e162d7","2bfb82a43bb77127965a4011a87de845242b1fb98fd09085885be219e0499073","6ce2477efe7e853cea90764db5a64e6e","041c13a29d3bee8d2e4bd9d8bde8152b5ac8305c1efcc198244b224e33635282","7529f56dde7a8302947982c43080bfcc","b523cdd1669dbd7ab68b43fd20f30a790ec0351876a0610958b9405468753a10","8625c0cf0748d04d43db54884ee13672","213520170fc7113ac8f5e689f154f5c8074dd972584b56d820c19d84b7e5b477","7efb1bc15ee6e3043f8eaefcf3f10864","ac7e20d4ddccc5e249ff0c1a72e394f9c1667a896995cf55b97b4f9fbf5de2fd","4b9aa7d571be1a6ec62931c4c6624328","460f1a00002e1c713a7753293b4737e65d27d0b65667b109d66afca873c23894","d66776ee123ef2947bc3175653a68d05","ccfd6ef35c718e2484b3727035d162b667f4b56df43324782d106f50ed1e3bcc","847ec30a4ff2391f1eb7669c22940e51","735d59c0949e258501e177ec2dd5fbb60df9fa401ace08949b89077c6f0d41d0","ea47fd87c1b109d5fd529c213aea6b30","37a1ffaba2e3ea9a7b2aa272b0587826cc0b5909497d3744ec8c114b504d2544","3b61d82be05f18754238e26b835da103","b79629e820cdd36d0daed964a2c0338e125a1f90f08e226f52dc60070747c62e","e79da1e448c60e12d835b47735f9da03","a560931baa404189257ec9cbcc2b9449c579018218cc1d70c99b1d36dd292a0e")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("b9129d83af902908fa7757e906ec0afe","666a4c569d435d0e6bf9fa4d337d1bf014952b42cc6d20e797db6c9df92dd724","0f0fadd0546734c5c82f3c33d8268046","cf59cd171270ec9bc2baf618838eb57802cc9d48f64205da308406811dd4da92","bdd8926f4be6576653ac96ee732d587a","efff4106cfd21a356b13a5a99c626a4f103f03b9491c0f1f5e135c1e3c84e76c","4b9aa7d571be1a6ec62931c4c6624328","88e5ca44189dabb4cec8a183f6268a42f3f92b2c6d7c722d7f55efd3dc5334c8","d521bf0f24c839e7ceb5db77de090fbc","55e2dbb906697dd1aff87ccf275efd06ee5e43bb21ea7865aef59513a858cf9f","4b9aa7d571be1a6ec62931c4c6624328","c3995f28476f7a775f4c1e8be47c64a300e0f16535dc5ed665ba796f05f19f73","48f8b7e0db439336549b93bda8633cd2","724351b5cc9ad496a6c9486b8ef34772f640590a90293f913f005e994717134b","fb99f5da9c0c46c27e17dc2dc1e162d7","2bfb82a43bb77127965a4011a87de845242b1fb98fd09085885be219e0499073","6ce2477efe7e853cea90764db5a64e6e","041c13a29d3bee8d2e4bd9d8bde8152b5ac8305c1efcc198244b224e33635282","7529f56dde7a8302947982c43080bfcc","b523cdd1669dbd7ab68b43fd20f30a790ec0351876a0610958b9405468753a10","8625c0cf0748d04d43db54884ee13672","213520170fc7113ac8f5e689f154f5c8074dd972584b56d820c19d84b7e5b477","7efb1bc15ee6e3043f8eaefcf3f10864","ac7e20d4ddccc5e249ff0c1a72e394f9c1667a896995cf55b97b4f9fbf5de2fd","4b9aa7d571be1a6ec62931c4c6624328","460f1a00002e1c713a7753293b4737e65d27d0b65667b109d66afca873c23894","d66776ee123ef2947bc3175653a68d05","ccfd6ef35c718e2484b3727035d162b667f4b56df43324782d106f50ed1e3bcc","847ec30a4ff2391f1eb7669c22940e51","735d59c0949e258501e177ec2dd5fbb60df9fa401ace08949b89077c6f0d41d0","ea47fd87c1b109d5fd529c213aea6b30","37a1ffaba2e3ea9a7b2aa272b0587826cc0b5909497d3744ec8c114b504d2544","3b61d82be05f18754238e26b835da103","b79629e820cdd36d0daed964a2c0338e125a1f90f08e226f52dc60070747c62e","e79da1e448c60e12d835b47735f9da03","a560931baa404189257ec9cbcc2b9449c579018218cc1d70c99b1d36dd292a0e")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("b9129d83af902908fa7757e906ec0afe","666a4c569d435d0e6bf9fa4d337d1bf014952b42cc6d20e797db6c9df92dd724","0f0fadd0546734c5c82f3c33d8268046","cf59cd171270ec9bc2baf618838eb57802cc9d48f64205da308406811dd4da92","bdd8926f4be6576653ac96ee732d587a","efff4106cfd21a356b13a5a99c626a4f103f03b9491c0f1f5e135c1e3c84e76c","4b9aa7d571be1a6ec62931c4c6624328","88e5ca44189dabb4cec8a183f6268a42f3f92b2c6d7c722d7f55efd3dc5334c8","d521bf0f24c839e7ceb5db77de090fbc","55e2dbb906697dd1aff87ccf275efd06ee5e43bb21ea7865aef59513a858cf9f","4b9aa7d571be1a6ec62931c4c6624328","c3995f28476f7a775f4c1e8be47c64a300e0f16535dc5ed665ba796f05f19f73","48f8b7e0db439336549b93bda8633cd2","724351b5cc9ad496a6c9486b8ef34772f640590a90293f913f005e994717134b","fb99f5da9c0c46c27e17dc2dc1e162d7","2bfb82a43bb77127965a4011a87de845242b1fb98fd09085885be219e0499073","6ce2477efe7e853cea90764db5a64e6e","041c13a29d3bee8d2e4bd9d8bde8152b5ac8305c1efcc198244b224e33635282","7529f56dde7a8302947982c43080bfcc","b523cdd1669dbd7ab68b43fd20f30a790ec0351876a0610958b9405468753a10","8625c0cf0748d04d43db54884ee13672","213520170fc7113ac8f5e689f154f5c8074dd972584b56d820c19d84b7e5b477","7efb1bc15ee6e3043f8eaefcf3f10864","ac7e20d4ddccc5e249ff0c1a72e394f9c1667a896995cf55b97b4f9fbf5de2fd","4b9aa7d571be1a6ec62931c4c6624328","460f1a00002e1c713a7753293b4737e65d27d0b65667b109d66afca873c23894","d66776ee123ef2947bc3175653a68d05","ccfd6ef35c718e2484b3727035d162b667f4b56df43324782d106f50ed1e3bcc","847ec30a4ff2391f1eb7669c22940e51","735d59c0949e258501e177ec2dd5fbb60df9fa401ace08949b89077c6f0d41d0","ea47fd87c1b109d5fd529c213aea6b30","37a1ffaba2e3ea9a7b2aa272b0587826cc0b5909497d3744ec8c114b504d2544","3b61d82be05f18754238e26b835da103","b79629e820cdd36d0daed964a2c0338e125a1f90f08e226f52dc60070747c62e","e79da1e448c60e12d835b47735f9da03","a560931baa404189257ec9cbcc2b9449c579018218cc1d70c99b1d36dd292a0e")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("b9129d83af902908fa7757e906ec0afe","666a4c569d435d0e6bf9fa4d337d1bf014952b42cc6d20e797db6c9df92dd724","0f0fadd0546734c5c82f3c33d8268046","cf59cd171270ec9bc2baf618838eb57802cc9d48f64205da308406811dd4da92","bdd8926f4be6576653ac96ee732d587a","efff4106cfd21a356b13a5a99c626a4f103f03b9491c0f1f5e135c1e3c84e76c","4b9aa7d571be1a6ec62931c4c6624328","88e5ca44189dabb4cec8a183f6268a42f3f92b2c6d7c722d7f55efd3dc5334c8","d521bf0f24c839e7ceb5db77de090fbc","55e2dbb906697dd1aff87ccf275efd06ee5e43bb21ea7865aef59513a858cf9f","4b9aa7d571be1a6ec62931c4c6624328","c3995f28476f7a775f4c1e8be47c64a300e0f16535dc5ed665ba796f05f19f73","48f8b7e0db439336549b93bda8633cd2","724351b5cc9ad496a6c9486b8ef34772f640590a90293f913f005e994717134b","fb99f5da9c0c46c27e17dc2dc1e162d7","2bfb82a43bb77127965a4011a87de845242b1fb98fd09085885be219e0499073","6ce2477efe7e853cea90764db5a64e6e","041c13a29d3bee8d2e4bd9d8bde8152b5ac8305c1efcc198244b224e33635282","7529f56dde7a8302947982c43080bfcc","b523cdd1669dbd7ab68b43fd20f30a790ec0351876a0610958b9405468753a10","8625c0cf0748d04d43db54884ee13672","213520170fc7113ac8f5e689f154f5c8074dd972584b56d820c19d84b7e5b477","7efb1bc15ee6e3043f8eaefcf3f10864","ac7e20d4ddccc5e249ff0c1a72e394f9c1667a896995cf55b97b4f9fbf5de2fd","4b9aa7d571be1a6ec62931c4c6624328","460f1a00002e1c713a7753293b4737e65d27d0b65667b109d66afca873c23894","d66776ee123ef2947bc3175653a68d05","ccfd6ef35c718e2484b3727035d162b667f4b56df43324782d106f50ed1e3bcc","847ec30a4ff2391f1eb7669c22940e51","735d59c0949e258501e177ec2dd5fbb60df9fa401ace08949b89077c6f0d41d0","ea47fd87c1b109d5fd529c213aea6b30","37a1ffaba2e3ea9a7b2aa272b0587826cc0b5909497d3744ec8c114b504d2544","3b61d82be05f18754238e26b835da103","b79629e820cdd36d0daed964a2c0338e125a1f90f08e226f52dc60070747c62e","e79da1e448c60e12d835b47735f9da03","a560931baa404189257ec9cbcc2b9449c579018218cc1d70c99b1d36dd292a0e")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring64 NOT NULL AND customstring64 IN ("b9129d83af902908fa7757e906ec0afe","666a4c569d435d0e6bf9fa4d337d1bf014952b42cc6d20e797db6c9df92dd724","0f0fadd0546734c5c82f3c33d8268046","cf59cd171270ec9bc2baf618838eb57802cc9d48f64205da308406811dd4da92","bdd8926f4be6576653ac96ee732d587a","efff4106cfd21a356b13a5a99c626a4f103f03b9491c0f1f5e135c1e3c84e76c","4b9aa7d571be1a6ec62931c4c6624328","88e5ca44189dabb4cec8a183f6268a42f3f92b2c6d7c722d7f55efd3dc5334c8","d521bf0f24c839e7ceb5db77de090fbc","55e2dbb906697dd1aff87ccf275efd06ee5e43bb21ea7865aef59513a858cf9f","4b9aa7d571be1a6ec62931c4c6624328","c3995f28476f7a775f4c1e8be47c64a300e0f16535dc5ed665ba796f05f19f73","48f8b7e0db439336549b93bda8633cd2","724351b5cc9ad496a6c9486b8ef34772f640590a90293f913f005e994717134b","fb99f5da9c0c46c27e17dc2dc1e162d7","2bfb82a43bb77127965a4011a87de845242b1fb98fd09085885be219e0499073","6ce2477efe7e853cea90764db5a64e6e","041c13a29d3bee8d2e4bd9d8bde8152b5ac8305c1efcc198244b224e33635282","7529f56dde7a8302947982c43080bfcc","b523cdd1669dbd7ab68b43fd20f30a790ec0351876a0610958b9405468753a10","8625c0cf0748d04d43db54884ee13672","213520170fc7113ac8f5e689f154f5c8074dd972584b56d820c19d84b7e5b477","7efb1bc15ee6e3043f8eaefcf3f10864","ac7e20d4ddccc5e249ff0c1a72e394f9c1667a896995cf55b97b4f9fbf5de2fd","4b9aa7d571be1a6ec62931c4c6624328","460f1a00002e1c713a7753293b4737e65d27d0b65667b109d66afca873c23894","d66776ee123ef2947bc3175653a68d05","ccfd6ef35c718e2484b3727035d162b667f4b56df43324782d106f50ed1e3bcc","847ec30a4ff2391f1eb7669c22940e51","735d59c0949e258501e177ec2dd5fbb60df9fa401ace08949b89077c6f0d41d0","ea47fd87c1b109d5fd529c213aea6b30","37a1ffaba2e3ea9a7b2aa272b0587826cc0b5909497d3744ec8c114b504d2544","3b61d82be05f18754238e26b835da103","b79629e820cdd36d0daed964a2c0338e125a1f90f08e226f52dc60070747c62e","e79da1e448c60e12d835b47735f9da03","a560931baa404189257ec9cbcc2b9449c579018218cc1d70c99b1d36dd292a0e")
index=activity AND rg_functionality="Endpoint Management Systems" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="119.147.213.48" AND destinationport=28992 OR destinationaddress="202.43.239.13" AND destinationport=28992 OR destinationaddress="103.255.176.176" AND destinationport=28992)
index=activity AND rg_functionality="Endpoint Management Systems" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="119.147.213.48" AND sourceport=28992 OR sourceaddress="202.43.239.13" AND sourceport=28992 OR sourceaddress="103.255.176.176" AND sourceport=28992)
index=activity AND rg_functionality="Endpoint Management Systems" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="119.147.213.48" AND sourceport=28992 OR translatedipaddress="202.43.239.13" AND sourceport=28992 OR translatedipaddress="103.255.176.176" AND sourceport=28992)
index=activity AND rg_functionality="Endpoint Management Systems" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="119.147.213.48" AND destinationport=28992 OR destinationtranslatedaddress="202.43.239.13" AND destinationport=28992 OR destinationtranslatedaddress="103.255.176.176" AND destinationport=28992)
index=activity AND rg_functionality="Endpoint Management Systems" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="119.147.213.48" AND destinationtranslatedport=28992 OR destinationtranslatedaddress="202.43.239.13" AND destinationtranslatedport=28992 OR destinationtranslatedaddress="103.255.176.176" AND destinationtranslatedport=28992)
index=activity AND rg_functionality="Endpoint Management Systems" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="119.147.213.48" AND translatedport=28992 OR destinationtranslatedaddress="202.43.239.13" AND translatedport=28992 OR destinationtranslatedaddress="103.255.176.176" AND translatedport=28992)
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="119.147.213.48" AND destinationport=28992 OR destinationaddress="202.43.239.13" AND destinationport=28992 OR destinationaddress="103.255.176.176" AND destinationport=28992)
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="119.147.213.48" AND sourceport=28992 OR sourceaddress="202.43.239.13" AND sourceport=28992 OR sourceaddress="103.255.176.176" AND sourceport=28992)
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="119.147.213.48" AND sourceport=28992 OR translatedipaddress="202.43.239.13" AND sourceport=28992 OR translatedipaddress="103.255.176.176" AND sourceport=28992)
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="119.147.213.48" AND destinationport=28992 OR destinationtranslatedaddress="202.43.239.13" AND destinationport=28992 OR destinationtranslatedaddress="103.255.176.176" AND destinationport=28992)
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="119.147.213.48" AND destinationtranslatedport=28992 OR destinationtranslatedaddress="202.43.239.13" AND destinationtranslatedport=28992 OR destinationtranslatedaddress="103.255.176.176" AND destinationtranslatedport=28992)
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="119.147.213.48" AND translatedport=28992 OR destinationtranslatedaddress="202.43.239.13" AND translatedport=28992 OR destinationtranslatedaddress="103.255.176.176" AND translatedport=28992)
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="119.147.213.48" AND destinationport=28992 OR destinationaddress="202.43.239.13" AND destinationport=28992 OR destinationaddress="103.255.176.176" AND destinationport=28992)
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="119.147.213.48" AND sourceport=28992 OR sourceaddress="202.43.239.13" AND sourceport=28992 OR sourceaddress="103.255.176.176" AND sourceport=28992)
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="119.147.213.48" AND sourceport=28992 OR translatedipaddress="202.43.239.13" AND sourceport=28992 OR translatedipaddress="103.255.176.176" AND sourceport=28992)
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="119.147.213.48" AND destinationport=28992 OR destinationtranslatedaddress="202.43.239.13" AND destinationport=28992 OR destinationtranslatedaddress="103.255.176.176" AND destinationport=28992)
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="119.147.213.48" AND destinationtranslatedport=28992 OR destinationtranslatedaddress="202.43.239.13" AND destinationtranslatedport=28992 OR destinationtranslatedaddress="103.255.176.176" AND destinationtranslatedport=28992)
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="119.147.213.48" AND translatedport=28992 OR destinationtranslatedaddress="202.43.239.13" AND translatedport=28992 OR destinationtranslatedaddress="103.255.176.176" AND translatedport=28992)
index=activity AND rg_functionality="Email / Email Security" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="119.147.213.48" AND destinationport=28992 OR destinationaddress="202.43.239.13" AND destinationport=28992 OR destinationaddress="103.255.176.176" AND destinationport=28992)
index=activity AND rg_functionality="Email / Email Security" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="119.147.213.48" AND sourceport=28992 OR sourceaddress="202.43.239.13" AND sourceport=28992 OR sourceaddress="103.255.176.176" AND sourceport=28992)
index=activity AND rg_functionality="Email / Email Security" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="119.147.213.48" AND sourceport=28992 OR translatedipaddress="202.43.239.13" AND sourceport=28992 OR translatedipaddress="103.255.176.176" AND sourceport=28992)
index=activity AND rg_functionality="Email / Email Security" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="119.147.213.48" AND destinationport=28992 OR destinationtranslatedaddress="202.43.239.13" AND destinationport=28992 OR destinationtranslatedaddress="103.255.176.176" AND destinationport=28992)
index=activity AND rg_functionality="Email / Email Security" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="119.147.213.48" AND destinationtranslatedport=28992 OR destinationtranslatedaddress="202.43.239.13" AND destinationtranslatedport=28992 OR destinationtranslatedaddress="103.255.176.176" AND destinationtranslatedport=28992)
index=activity AND rg_functionality="Email / Email Security" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="119.147.213.48" AND translatedport=28992 OR destinationtranslatedaddress="202.43.239.13" AND translatedport=28992 OR destinationtranslatedaddress="103.255.176.176" AND translatedport=28992)
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="119.147.213.48" AND destinationport=28992 OR destinationaddress="202.43.239.13" AND destinationport=28992 OR destinationaddress="103.255.176.176" AND destinationport=28992)
index=activity AND rg_functionality="Cloud Email / Email Security" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="119.147.213.48" AND sourceport=28992 OR sourceaddress="202.43.239.13" AND sourceport=28992 OR sourceaddress="103.255.176.176" AND sourceport=28992)
index=activity AND rg_functionality="Cloud Email / Email Security" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="119.147.213.48" AND sourceport=28992 OR translatedipaddress="202.43.239.13" AND sourceport=28992 OR translatedipaddress="103.255.176.176" AND sourceport=28992)
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="119.147.213.48" AND destinationport=28992 OR destinationtranslatedaddress="202.43.239.13" AND destinationport=28992 OR destinationtranslatedaddress="103.255.176.176" AND destinationport=28992)
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="119.147.213.48" AND destinationtranslatedport=28992 OR destinationtranslatedaddress="202.43.239.13" AND destinationtranslatedport=28992 OR destinationtranslatedaddress="103.255.176.176" AND destinationtranslatedport=28992)
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="119.147.213.48" AND translatedport=28992 OR destinationtranslatedaddress="202.43.239.13" AND translatedport=28992 OR destinationtranslatedaddress="103.255.176.176" AND translatedport=28992)
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="119.147.213.48" AND destinationport=28992 OR destinationaddress="202.43.239.13" AND destinationport=28992 OR destinationaddress="103.255.176.176" AND destinationport=28992)
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="119.147.213.48" AND sourceport=28992 OR sourceaddress="202.43.239.13" AND sourceport=28992 OR sourceaddress="103.255.176.176" AND sourceport=28992)
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="119.147.213.48" AND sourceport=28992 OR translatedipaddress="202.43.239.13" AND sourceport=28992 OR translatedipaddress="103.255.176.176" AND sourceport=28992)
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="119.147.213.48" AND destinationport=28992 OR destinationtranslatedaddress="202.43.239.13" AND destinationport=28992 OR destinationtranslatedaddress="103.255.176.176" AND destinationport=28992)
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="119.147.213.48" AND destinationtranslatedport=28992 OR destinationtranslatedaddress="202.43.239.13" AND destinationtranslatedport=28992 OR destinationtranslatedaddress="103.255.176.176" AND destinationtranslatedport=28992)
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="119.147.213.48" AND translatedport=28992 OR destinationtranslatedaddress="202.43.239.13" AND translatedport=28992 OR destinationtranslatedaddress="103.255.176.176" AND translatedport=28992)
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="119.147.213.48" AND destinationport=28992 OR destinationaddress="202.43.239.13" AND destinationport=28992 OR destinationaddress="103.255.176.176" AND destinationport=28992)
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="119.147.213.48" AND sourceport=28992 OR sourceaddress="202.43.239.13" AND sourceport=28992 OR sourceaddress="103.255.176.176" AND sourceport=28992)
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="119.147.213.48" AND sourceport=28992 OR translatedipaddress="202.43.239.13" AND sourceport=28992 OR translatedipaddress="103.255.176.176" AND sourceport=28992)
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="119.147.213.48" AND destinationport=28992 OR destinationtranslatedaddress="202.43.239.13" AND destinationport=28992 OR destinationtranslatedaddress="103.255.176.176" AND destinationport=28992)
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="119.147.213.48" AND destinationtranslatedport=28992 OR destinationtranslatedaddress="202.43.239.13" AND destinationtranslatedport=28992 OR destinationtranslatedaddress="103.255.176.176" AND destinationtranslatedport=28992)
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="119.147.213.48" AND translatedport=28992 OR destinationtranslatedaddress="202.43.239.13" AND translatedport=28992 OR destinationtranslatedaddress="103.255.176.176" AND translatedport=28992)
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="119.147.213.48" AND destinationport=28992 OR destinationaddress="202.43.239.13" AND destinationport=28992 OR destinationaddress="103.255.176.176" AND destinationport=28992)
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="119.147.213.48" AND sourceport=28992 OR sourceaddress="202.43.239.13" AND sourceport=28992 OR sourceaddress="103.255.176.176" AND sourceport=28992)
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="119.147.213.48" AND sourceport=28992 OR translatedipaddress="202.43.239.13" AND sourceport=28992 OR translatedipaddress="103.255.176.176" AND sourceport=28992)
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="119.147.213.48" AND destinationport=28992 OR destinationtranslatedaddress="202.43.239.13" AND destinationport=28992 OR destinationtranslatedaddress="103.255.176.176" AND destinationport=28992)
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="119.147.213.48" AND destinationtranslatedport=28992 OR destinationtranslatedaddress="202.43.239.13" AND destinationtranslatedport=28992 OR destinationtranslatedaddress="103.255.176.176" AND destinationtranslatedport=28992)
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="119.147.213.48" AND translatedport=28992 OR destinationtranslatedaddress="202.43.239.13" AND translatedport=28992 OR destinationtranslatedaddress="103.255.176.176" AND translatedport=28992)
index=activity AND rg_functionality="Next Generation Firewall" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="119.147.213.48" AND destinationport=28992 OR destinationaddress="202.43.239.13" AND destinationport=28992 OR destinationaddress="103.255.176.176" AND destinationport=28992)
index=activity AND rg_functionality="Next Generation Firewall" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="119.147.213.48" AND sourceport=28992 OR sourceaddress="202.43.239.13" AND sourceport=28992 OR sourceaddress="103.255.176.176" AND sourceport=28992)
index=activity AND rg_functionality="Next Generation Firewall" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="119.147.213.48" AND sourceport=28992 OR translatedipaddress="202.43.239.13" AND sourceport=28992 OR translatedipaddress="103.255.176.176" AND sourceport=28992)
index=activity AND rg_functionality="Next Generation Firewall" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="119.147.213.48" AND destinationport=28992 OR destinationtranslatedaddress="202.43.239.13" AND destinationport=28992 OR destinationtranslatedaddress="103.255.176.176" AND destinationport=28992)
index=activity AND rg_functionality="Next Generation Firewall" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="119.147.213.48" AND destinationtranslatedport=28992 OR destinationtranslatedaddress="202.43.239.13" AND destinationtranslatedport=28992 OR destinationtranslatedaddress="103.255.176.176" AND destinationtranslatedport=28992)
index=activity AND rg_functionality="Next Generation Firewall" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="119.147.213.48" AND translatedport=28992 OR destinationtranslatedaddress="202.43.239.13" AND translatedport=28992 OR destinationtranslatedaddress="103.255.176.176" AND translatedport=28992)
index=activity AND rg_functionality="Firewall" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="119.147.213.48" AND destinationport=28992 OR destinationaddress="202.43.239.13" AND destinationport=28992 OR destinationaddress="103.255.176.176" AND destinationport=28992)
index=activity AND rg_functionality="Firewall" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="119.147.213.48" AND sourceport=28992 OR sourceaddress="202.43.239.13" AND sourceport=28992 OR sourceaddress="103.255.176.176" AND sourceport=28992)
index=activity AND rg_functionality="Firewall" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="119.147.213.48" AND sourceport=28992 OR translatedipaddress="202.43.239.13" AND sourceport=28992 OR translatedipaddress="103.255.176.176" AND sourceport=28992)
index=activity AND rg_functionality="Firewall" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="119.147.213.48" AND destinationport=28992 OR destinationtranslatedaddress="202.43.239.13" AND destinationport=28992 OR destinationtranslatedaddress="103.255.176.176" AND destinationport=28992)
index=activity AND rg_functionality="Firewall" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="119.147.213.48" AND destinationtranslatedport=28992 OR destinationtranslatedaddress="202.43.239.13" AND destinationtranslatedport=28992 OR destinationtranslatedaddress="103.255.176.176" AND destinationtranslatedport=28992)
index=activity AND rg_functionality="Firewall" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="119.147.213.48" AND translatedport=28992 OR destinationtranslatedaddress="202.43.239.13" AND translatedport=28992 OR destinationtranslatedaddress="103.255.176.176" AND translatedport=28992)
index=activity AND rg_functionality="Web Proxy" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="119.147.213.48" AND destinationport=28992 OR destinationaddress="202.43.239.13" AND destinationport=28992 OR destinationaddress="103.255.176.176" AND destinationport=28992)
index=activity AND rg_functionality="Web Proxy" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="119.147.213.48" AND sourceport=28992 OR sourceaddress="202.43.239.13" AND sourceport=28992 OR sourceaddress="103.255.176.176" AND sourceport=28992)
index=activity AND rg_functionality="Web Proxy" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="119.147.213.48" AND sourceport=28992 OR translatedipaddress="202.43.239.13" AND sourceport=28992 OR translatedipaddress="103.255.176.176" AND sourceport=28992)
index=activity AND rg_functionality="Web Proxy" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="119.147.213.48" AND destinationport=28992 OR destinationtranslatedaddress="202.43.239.13" AND destinationport=28992 OR destinationtranslatedaddress="103.255.176.176" AND destinationport=28992)
index=activity AND rg_functionality="Web Proxy" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="119.147.213.48" AND destinationtranslatedport=28992 OR destinationtranslatedaddress="202.43.239.13" AND destinationtranslatedport=28992 OR destinationtranslatedaddress="103.255.176.176" AND destinationtranslatedport=28992)
index=activity AND rg_functionality="Web Proxy" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="119.147.213.48" AND translatedport=28992 OR destinationtranslatedaddress="202.43.239.13" AND translatedport=28992 OR destinationtranslatedaddress="103.255.176.176" AND translatedport=28992)
index=activity AND rg_functionality="Flow" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="119.147.213.48" AND destinationport=28992 OR destinationaddress="202.43.239.13" AND destinationport=28992 OR destinationaddress="103.255.176.176" AND destinationport=28992)
index=activity AND rg_functionality="Flow" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="119.147.213.48" AND sourceport=28992 OR sourceaddress="202.43.239.13" AND sourceport=28992 OR sourceaddress="103.255.176.176" AND sourceport=28992)
index=activity AND rg_functionality="Flow" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="119.147.213.48" AND sourceport=28992 OR translatedipaddress="202.43.239.13" AND sourceport=28992 OR translatedipaddress="103.255.176.176" AND sourceport=28992)
index=activity AND rg_functionality="Flow" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="119.147.213.48" AND destinationport=28992 OR destinationtranslatedaddress="202.43.239.13" AND destinationport=28992 OR destinationtranslatedaddress="103.255.176.176" AND destinationport=28992)
index=activity AND rg_functionality="Flow" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="119.147.213.48" AND destinationtranslatedport=28992 OR destinationtranslatedaddress="202.43.239.13" AND destinationtranslatedport=28992 OR destinationtranslatedaddress="103.255.176.176" AND destinationtranslatedport=28992)
index=activity AND rg_functionality="Flow" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="119.147.213.48" AND translatedport=28992 OR destinationtranslatedaddress="202.43.239.13" AND translatedport=28992 OR destinationtranslatedaddress="103.255.176.176" AND translatedport=28992)
index=activity AND rg_functionality="Web Server" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="119.147.213.48" AND destinationport=28992 OR destinationaddress="202.43.239.13" AND destinationport=28992 OR destinationaddress="103.255.176.176" AND destinationport=28992)
index=activity AND rg_functionality="Web Server" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="119.147.213.48" AND sourceport=28992 OR sourceaddress="202.43.239.13" AND sourceport=28992 OR sourceaddress="103.255.176.176" AND sourceport=28992)
index=activity AND rg_functionality="Web Server" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="119.147.213.48" AND sourceport=28992 OR translatedipaddress="202.43.239.13" AND sourceport=28992 OR translatedipaddress="103.255.176.176" AND sourceport=28992)
index=activity AND rg_functionality="Web Server" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="119.147.213.48" AND destinationport=28992 OR destinationtranslatedaddress="202.43.239.13" AND destinationport=28992 OR destinationtranslatedaddress="103.255.176.176" AND destinationport=28992)
index=activity AND rg_functionality="Web Server" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="119.147.213.48" AND destinationtranslatedport=28992 OR destinationtranslatedaddress="202.43.239.13" AND destinationtranslatedport=28992 OR destinationtranslatedaddress="103.255.176.176" AND destinationtranslatedport=28992)
index=activity AND rg_functionality="Web Server" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="119.147.213.48" AND translatedport=28992 OR destinationtranslatedaddress="202.43.239.13" AND translatedport=28992 OR destinationtranslatedaddress="103.255.176.176" AND translatedport=28992)
index=activity AND rg_functionality="Web Application Firewall" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="119.147.213.48" AND destinationport=28992 OR destinationaddress="202.43.239.13" AND destinationport=28992 OR destinationaddress="103.255.176.176" AND destinationport=28992)
index=activity AND rg_functionality="Web Application Firewall" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="119.147.213.48" AND sourceport=28992 OR sourceaddress="202.43.239.13" AND sourceport=28992 OR sourceaddress="103.255.176.176" AND sourceport=28992)
index=activity AND rg_functionality="Web Application Firewall" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="119.147.213.48" AND sourceport=28992 OR translatedipaddress="202.43.239.13" AND sourceport=28992 OR translatedipaddress="103.255.176.176" AND sourceport=28992)
index=activity AND rg_functionality="Web Application Firewall" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="119.147.213.48" AND destinationport=28992 OR destinationtranslatedaddress="202.43.239.13" AND destinationport=28992 OR destinationtranslatedaddress="103.255.176.176" AND destinationport=28992)
index=activity AND rg_functionality="Web Application Firewall" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="119.147.213.48" AND destinationtranslatedport=28992 OR destinationtranslatedaddress="202.43.239.13" AND destinationtranslatedport=28992 OR destinationtranslatedaddress="103.255.176.176" AND destinationtranslatedport=28992)
index=activity AND rg_functionality="Web Application Firewall" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="119.147.213.48" AND translatedport=28992 OR destinationtranslatedaddress="202.43.239.13" AND translatedport=28992 OR destinationtranslatedaddress="103.255.176.176" AND translatedport=28992)
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="119.147.213.48" AND destinationport=28992 OR destinationaddress="202.43.239.13" AND destinationport=28992 OR destinationaddress="103.255.176.176" AND destinationport=28992)
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="119.147.213.48" AND sourceport=28992 OR sourceaddress="202.43.239.13" AND sourceport=28992 OR sourceaddress="103.255.176.176" AND sourceport=28992)
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="119.147.213.48" AND sourceport=28992 OR translatedipaddress="202.43.239.13" AND sourceport=28992 OR translatedipaddress="103.255.176.176" AND sourceport=28992)
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="119.147.213.48" AND destinationport=28992 OR destinationtranslatedaddress="202.43.239.13" AND destinationport=28992 OR destinationtranslatedaddress="103.255.176.176" AND destinationport=28992)
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="119.147.213.48" AND destinationtranslatedport=28992 OR destinationtranslatedaddress="202.43.239.13" AND destinationtranslatedport=28992 OR destinationtranslatedaddress="103.255.176.176" AND destinationtranslatedport=28992)
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="119.147.213.48" AND translatedport=28992 OR destinationtranslatedaddress="202.43.239.13" AND translatedport=28992 OR destinationtranslatedaddress="103.255.176.176" AND translatedport=28992)
index=activity AND rg_functionality="Cloud Services / Applications" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="119.147.213.48" AND destinationport=28992 OR destinationaddress="202.43.239.13" AND destinationport=28992 OR destinationaddress="103.255.176.176" AND destinationport=28992)
index=activity AND rg_functionality="Cloud Services / Applications" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="119.147.213.48" AND sourceport=28992 OR sourceaddress="202.43.239.13" AND sourceport=28992 OR sourceaddress="103.255.176.176" AND sourceport=28992)
index=activity AND rg_functionality="Cloud Services / Applications" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="119.147.213.48" AND sourceport=28992 OR translatedipaddress="202.43.239.13" AND sourceport=28992 OR translatedipaddress="103.255.176.176" AND sourceport=28992)
index=activity AND rg_functionality="Cloud Services / Applications" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="119.147.213.48" AND destinationport=28992 OR destinationtranslatedaddress="202.43.239.13" AND destinationport=28992 OR destinationtranslatedaddress="103.255.176.176" AND destinationport=28992)
index=activity AND rg_functionality="Cloud Services / Applications" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="119.147.213.48" AND destinationtranslatedport=28992 OR destinationtranslatedaddress="202.43.239.13" AND destinationtranslatedport=28992 OR destinationtranslatedaddress="103.255.176.176" AND destinationtranslatedport=28992)
index=activity AND rg_functionality="Cloud Services / Applications" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="119.147.213.48" AND translatedport=28992 OR destinationtranslatedaddress="202.43.239.13" AND translatedport=28992 OR destinationtranslatedaddress="103.255.176.176" AND translatedport=28992)
index=activity AND rg_functionality="Cloud Application Audit" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="119.147.213.48" AND destinationport=28992 OR destinationaddress="202.43.239.13" AND destinationport=28992 OR destinationaddress="103.255.176.176" AND destinationport=28992)
index=activity AND rg_functionality="Cloud Application Audit" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="119.147.213.48" AND sourceport=28992 OR sourceaddress="202.43.239.13" AND sourceport=28992 OR sourceaddress="103.255.176.176" AND sourceport=28992)
index=activity AND rg_functionality="Cloud Application Audit" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="119.147.213.48" AND sourceport=28992 OR translatedipaddress="202.43.239.13" AND sourceport=28992 OR translatedipaddress="103.255.176.176" AND sourceport=28992)
index=activity AND rg_functionality="Cloud Application Audit" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="119.147.213.48" AND destinationport=28992 OR destinationtranslatedaddress="202.43.239.13" AND destinationport=28992 OR destinationtranslatedaddress="103.255.176.176" AND destinationport=28992)
index=activity AND rg_functionality="Cloud Application Audit" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="119.147.213.48" AND destinationtranslatedport=28992 OR destinationtranslatedaddress="202.43.239.13" AND destinationtranslatedport=28992 OR destinationtranslatedaddress="103.255.176.176" AND destinationtranslatedport=28992)
index=activity AND rg_functionality="Cloud Application Audit" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="119.147.213.48" AND translatedport=28992 OR destinationtranslatedaddress="202.43.239.13" AND translatedport=28992 OR destinationtranslatedaddress="103.255.176.176" AND translatedport=28992)
index=activity AND rg_functionality="Authentication / VPN" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="119.147.213.48" AND destinationport=28992 OR destinationaddress="202.43.239.13" AND destinationport=28992 OR destinationaddress="103.255.176.176" AND destinationport=28992)
index=activity AND rg_functionality="Authentication / VPN" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="119.147.213.48" AND sourceport=28992 OR sourceaddress="202.43.239.13" AND sourceport=28992 OR sourceaddress="103.255.176.176" AND sourceport=28992)
index=activity AND rg_functionality="Authentication / VPN" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="119.147.213.48" AND sourceport=28992 OR translatedipaddress="202.43.239.13" AND sourceport=28992 OR translatedipaddress="103.255.176.176" AND sourceport=28992)
index=activity AND rg_functionality="Authentication / VPN" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="119.147.213.48" AND destinationport=28992 OR destinationtranslatedaddress="202.43.239.13" AND destinationport=28992 OR destinationtranslatedaddress="103.255.176.176" AND destinationport=28992)
index=activity AND rg_functionality="Authentication / VPN" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="119.147.213.48" AND destinationtranslatedport=28992 OR destinationtranslatedaddress="202.43.239.13" AND destinationtranslatedport=28992 OR destinationtranslatedaddress="103.255.176.176" AND destinationtranslatedport=28992)
index=activity AND rg_functionality="Authentication / VPN" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="119.147.213.48" AND translatedport=28992 OR destinationtranslatedaddress="202.43.239.13" AND translatedport=28992 OR destinationtranslatedaddress="103.255.176.176" AND translatedport=28992)
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="119.147.213.48" AND destinationport=28992 OR destinationaddress="202.43.239.13" AND destinationport=28992 OR destinationaddress="103.255.176.176" AND destinationport=28992)
index=activity AND rg_functionality="Unix / Linux / AIX" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="119.147.213.48" AND sourceport=28992 OR sourceaddress="202.43.239.13" AND sourceport=28992 OR sourceaddress="103.255.176.176" AND sourceport=28992)
index=activity AND rg_functionality="Unix / Linux / AIX" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="119.147.213.48" AND sourceport=28992 OR translatedipaddress="202.43.239.13" AND sourceport=28992 OR translatedipaddress="103.255.176.176" AND sourceport=28992)
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="119.147.213.48" AND destinationport=28992 OR destinationtranslatedaddress="202.43.239.13" AND destinationport=28992 OR destinationtranslatedaddress="103.255.176.176" AND destinationport=28992)
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="119.147.213.48" AND destinationtranslatedport=28992 OR destinationtranslatedaddress="202.43.239.13" AND destinationtranslatedport=28992 OR destinationtranslatedaddress="103.255.176.176" AND destinationtranslatedport=28992)
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="119.147.213.48" AND translatedport=28992 OR destinationtranslatedaddress="202.43.239.13" AND translatedport=28992 OR destinationtranslatedaddress="103.255.176.176" AND translatedport=28992)
index=activity AND rg_functionality="Authentication / WiFi" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="119.147.213.48" AND destinationport=28992 OR destinationaddress="202.43.239.13" AND destinationport=28992 OR destinationaddress="103.255.176.176" AND destinationport=28992)
index=activity AND rg_functionality="Authentication / WiFi" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="119.147.213.48" AND sourceport=28992 OR sourceaddress="202.43.239.13" AND sourceport=28992 OR sourceaddress="103.255.176.176" AND sourceport=28992)
index=activity AND rg_functionality="Authentication / WiFi" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="119.147.213.48" AND sourceport=28992 OR translatedipaddress="202.43.239.13" AND sourceport=28992 OR translatedipaddress="103.255.176.176" AND sourceport=28992)
index=activity AND rg_functionality="Authentication / WiFi" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="119.147.213.48" AND destinationport=28992 OR destinationtranslatedaddress="202.43.239.13" AND destinationport=28992 OR destinationtranslatedaddress="103.255.176.176" AND destinationport=28992)
index=activity AND rg_functionality="Authentication / WiFi" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="119.147.213.48" AND destinationtranslatedport=28992 OR destinationtranslatedaddress="202.43.239.13" AND destinationtranslatedport=28992 OR destinationtranslatedaddress="103.255.176.176" AND destinationtranslatedport=28992)
index=activity AND rg_functionality="Authentication / WiFi" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="119.147.213.48" AND translatedport=28992 OR destinationtranslatedaddress="202.43.239.13" AND translatedport=28992 OR destinationtranslatedaddress="103.255.176.176" AND translatedport=28992)
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="119.147.213.48" AND destinationport=28992 OR destinationaddress="202.43.239.13" AND destinationport=28992 OR destinationaddress="103.255.176.176" AND destinationport=28992)
index=activity AND rg_functionality="Cloud Application Security Broker" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="119.147.213.48" AND sourceport=28992 OR sourceaddress="202.43.239.13" AND sourceport=28992 OR sourceaddress="103.255.176.176" AND sourceport=28992)
index=activity AND rg_functionality="Cloud Application Security Broker" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="119.147.213.48" AND sourceport=28992 OR translatedipaddress="202.43.239.13" AND sourceport=28992 OR translatedipaddress="103.255.176.176" AND sourceport=28992)
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="119.147.213.48" AND destinationport=28992 OR destinationtranslatedaddress="202.43.239.13" AND destinationport=28992 OR destinationtranslatedaddress="103.255.176.176" AND destinationport=28992)
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="119.147.213.48" AND destinationtranslatedport=28992 OR destinationtranslatedaddress="202.43.239.13" AND destinationtranslatedport=28992 OR destinationtranslatedaddress="103.255.176.176" AND destinationtranslatedport=28992)
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="119.147.213.48" AND translatedport=28992 OR destinationtranslatedaddress="202.43.239.13" AND translatedport=28992 OR destinationtranslatedaddress="103.255.176.176" AND translatedport=28992)
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="119.147.213.48" AND destinationport=28992 OR destinationaddress="202.43.239.13" AND destinationport=28992 OR destinationaddress="103.255.176.176" AND destinationport=28992)
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="119.147.213.48" AND sourceport=28992 OR sourceaddress="202.43.239.13" AND sourceport=28992 OR sourceaddress="103.255.176.176" AND sourceport=28992)
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="119.147.213.48" AND sourceport=28992 OR translatedipaddress="202.43.239.13" AND sourceport=28992 OR translatedipaddress="103.255.176.176" AND sourceport=28992)
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="119.147.213.48" AND destinationport=28992 OR destinationtranslatedaddress="202.43.239.13" AND destinationport=28992 OR destinationtranslatedaddress="103.255.176.176" AND destinationport=28992)
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="119.147.213.48" AND destinationtranslatedport=28992 OR destinationtranslatedaddress="202.43.239.13" AND destinationtranslatedport=28992 OR destinationtranslatedaddress="103.255.176.176" AND destinationtranslatedport=28992)
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="119.147.213.48" AND translatedport=28992 OR destinationtranslatedaddress="202.43.239.13" AND translatedport=28992 OR destinationtranslatedaddress="103.255.176.176" AND translatedport=28992)
