index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("2fec3ab587e6b5533b4c6b3c11dd357a","d8ccaef116cada9c558f9e912d5cf7ef2978082611e677f6f55ca233f47a2f68","cc1732ce2d2cd79dc85893fdc3b7d143","6652b46987350e831678d7a33a70bce94c8c9cca137f0bb0efbbd0c07279cbb6","ba1859659089253621e5a65181ea94cd","8f8abfa6717ad2043a295d16b5aeeac3e7084b7994f6eec8351e18a9a3c59997","1e857958a3c7f909ee1370c66d71adfd","56b569912a6e1c4c08e5612c0ef5ddf9f238b1d708621b89963b47b31e45cde1")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("2fec3ab587e6b5533b4c6b3c11dd357a","d8ccaef116cada9c558f9e912d5cf7ef2978082611e677f6f55ca233f47a2f68","cc1732ce2d2cd79dc85893fdc3b7d143","6652b46987350e831678d7a33a70bce94c8c9cca137f0bb0efbbd0c07279cbb6","ba1859659089253621e5a65181ea94cd","8f8abfa6717ad2043a295d16b5aeeac3e7084b7994f6eec8351e18a9a3c59997","1e857958a3c7f909ee1370c66d71adfd","56b569912a6e1c4c08e5612c0ef5ddf9f238b1d708621b89963b47b31e45cde1")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("2fec3ab587e6b5533b4c6b3c11dd357a","d8ccaef116cada9c558f9e912d5cf7ef2978082611e677f6f55ca233f47a2f68","cc1732ce2d2cd79dc85893fdc3b7d143","6652b46987350e831678d7a33a70bce94c8c9cca137f0bb0efbbd0c07279cbb6","ba1859659089253621e5a65181ea94cd","8f8abfa6717ad2043a295d16b5aeeac3e7084b7994f6eec8351e18a9a3c59997","1e857958a3c7f909ee1370c66d71adfd","56b569912a6e1c4c08e5612c0ef5ddf9f238b1d708621b89963b47b31e45cde1")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring64 NOT NULL AND customstring64 IN ("2fec3ab587e6b5533b4c6b3c11dd357a","d8ccaef116cada9c558f9e912d5cf7ef2978082611e677f6f55ca233f47a2f68","cc1732ce2d2cd79dc85893fdc3b7d143","6652b46987350e831678d7a33a70bce94c8c9cca137f0bb0efbbd0c07279cbb6","ba1859659089253621e5a65181ea94cd","8f8abfa6717ad2043a295d16b5aeeac3e7084b7994f6eec8351e18a9a3c59997","1e857958a3c7f909ee1370c66d71adfd","56b569912a6e1c4c08e5612c0ef5ddf9f238b1d708621b89963b47b31e45cde1")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("2fec3ab587e6b5533b4c6b3c11dd357a","d8ccaef116cada9c558f9e912d5cf7ef2978082611e677f6f55ca233f47a2f68","cc1732ce2d2cd79dc85893fdc3b7d143","6652b46987350e831678d7a33a70bce94c8c9cca137f0bb0efbbd0c07279cbb6","ba1859659089253621e5a65181ea94cd","8f8abfa6717ad2043a295d16b5aeeac3e7084b7994f6eec8351e18a9a3c59997","1e857958a3c7f909ee1370c66d71adfd","56b569912a6e1c4c08e5612c0ef5ddf9f238b1d708621b89963b47b31e45cde1")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("2fec3ab587e6b5533b4c6b3c11dd357a","d8ccaef116cada9c558f9e912d5cf7ef2978082611e677f6f55ca233f47a2f68","cc1732ce2d2cd79dc85893fdc3b7d143","6652b46987350e831678d7a33a70bce94c8c9cca137f0bb0efbbd0c07279cbb6","ba1859659089253621e5a65181ea94cd","8f8abfa6717ad2043a295d16b5aeeac3e7084b7994f6eec8351e18a9a3c59997","1e857958a3c7f909ee1370c66d71adfd","56b569912a6e1c4c08e5612c0ef5ddf9f238b1d708621b89963b47b31e45cde1")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("2fec3ab587e6b5533b4c6b3c11dd357a","d8ccaef116cada9c558f9e912d5cf7ef2978082611e677f6f55ca233f47a2f68","cc1732ce2d2cd79dc85893fdc3b7d143","6652b46987350e831678d7a33a70bce94c8c9cca137f0bb0efbbd0c07279cbb6","ba1859659089253621e5a65181ea94cd","8f8abfa6717ad2043a295d16b5aeeac3e7084b7994f6eec8351e18a9a3c59997","1e857958a3c7f909ee1370c66d71adfd","56b569912a6e1c4c08e5612c0ef5ddf9f238b1d708621b89963b47b31e45cde1")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("2fec3ab587e6b5533b4c6b3c11dd357a","d8ccaef116cada9c558f9e912d5cf7ef2978082611e677f6f55ca233f47a2f68","cc1732ce2d2cd79dc85893fdc3b7d143","6652b46987350e831678d7a33a70bce94c8c9cca137f0bb0efbbd0c07279cbb6","ba1859659089253621e5a65181ea94cd","8f8abfa6717ad2043a295d16b5aeeac3e7084b7994f6eec8351e18a9a3c59997","1e857958a3c7f909ee1370c66d71adfd","56b569912a6e1c4c08e5612c0ef5ddf9f238b1d708621b89963b47b31e45cde1")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("2fec3ab587e6b5533b4c6b3c11dd357a","d8ccaef116cada9c558f9e912d5cf7ef2978082611e677f6f55ca233f47a2f68","cc1732ce2d2cd79dc85893fdc3b7d143","6652b46987350e831678d7a33a70bce94c8c9cca137f0bb0efbbd0c07279cbb6","ba1859659089253621e5a65181ea94cd","8f8abfa6717ad2043a295d16b5aeeac3e7084b7994f6eec8351e18a9a3c59997","1e857958a3c7f909ee1370c66d71adfd","56b569912a6e1c4c08e5612c0ef5ddf9f238b1d708621b89963b47b31e45cde1")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("2fec3ab587e6b5533b4c6b3c11dd357a","d8ccaef116cada9c558f9e912d5cf7ef2978082611e677f6f55ca233f47a2f68","cc1732ce2d2cd79dc85893fdc3b7d143","6652b46987350e831678d7a33a70bce94c8c9cca137f0bb0efbbd0c07279cbb6","ba1859659089253621e5a65181ea94cd","8f8abfa6717ad2043a295d16b5aeeac3e7084b7994f6eec8351e18a9a3c59997","1e857958a3c7f909ee1370c66d71adfd","56b569912a6e1c4c08e5612c0ef5ddf9f238b1d708621b89963b47b31e45cde1")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("2fec3ab587e6b5533b4c6b3c11dd357a","d8ccaef116cada9c558f9e912d5cf7ef2978082611e677f6f55ca233f47a2f68","cc1732ce2d2cd79dc85893fdc3b7d143","6652b46987350e831678d7a33a70bce94c8c9cca137f0bb0efbbd0c07279cbb6","ba1859659089253621e5a65181ea94cd","8f8abfa6717ad2043a295d16b5aeeac3e7084b7994f6eec8351e18a9a3c59997","1e857958a3c7f909ee1370c66d71adfd","56b569912a6e1c4c08e5612c0ef5ddf9f238b1d708621b89963b47b31e45cde1")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("2fec3ab587e6b5533b4c6b3c11dd357a","d8ccaef116cada9c558f9e912d5cf7ef2978082611e677f6f55ca233f47a2f68","cc1732ce2d2cd79dc85893fdc3b7d143","6652b46987350e831678d7a33a70bce94c8c9cca137f0bb0efbbd0c07279cbb6","ba1859659089253621e5a65181ea94cd","8f8abfa6717ad2043a295d16b5aeeac3e7084b7994f6eec8351e18a9a3c59997","1e857958a3c7f909ee1370c66d71adfd","56b569912a6e1c4c08e5612c0ef5ddf9f238b1d708621b89963b47b31e45cde1")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("2fec3ab587e6b5533b4c6b3c11dd357a","d8ccaef116cada9c558f9e912d5cf7ef2978082611e677f6f55ca233f47a2f68","cc1732ce2d2cd79dc85893fdc3b7d143","6652b46987350e831678d7a33a70bce94c8c9cca137f0bb0efbbd0c07279cbb6","ba1859659089253621e5a65181ea94cd","8f8abfa6717ad2043a295d16b5aeeac3e7084b7994f6eec8351e18a9a3c59997","1e857958a3c7f909ee1370c66d71adfd","56b569912a6e1c4c08e5612c0ef5ddf9f238b1d708621b89963b47b31e45cde1")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("2fec3ab587e6b5533b4c6b3c11dd357a","d8ccaef116cada9c558f9e912d5cf7ef2978082611e677f6f55ca233f47a2f68","cc1732ce2d2cd79dc85893fdc3b7d143","6652b46987350e831678d7a33a70bce94c8c9cca137f0bb0efbbd0c07279cbb6","ba1859659089253621e5a65181ea94cd","8f8abfa6717ad2043a295d16b5aeeac3e7084b7994f6eec8351e18a9a3c59997","1e857958a3c7f909ee1370c66d71adfd","56b569912a6e1c4c08e5612c0ef5ddf9f238b1d708621b89963b47b31e45cde1")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("2fec3ab587e6b5533b4c6b3c11dd357a","d8ccaef116cada9c558f9e912d5cf7ef2978082611e677f6f55ca233f47a2f68","cc1732ce2d2cd79dc85893fdc3b7d143","6652b46987350e831678d7a33a70bce94c8c9cca137f0bb0efbbd0c07279cbb6","ba1859659089253621e5a65181ea94cd","8f8abfa6717ad2043a295d16b5aeeac3e7084b7994f6eec8351e18a9a3c59997","1e857958a3c7f909ee1370c66d71adfd","56b569912a6e1c4c08e5612c0ef5ddf9f238b1d708621b89963b47b31e45cde1")
index=activity AND rg_functionality="Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("2fec3ab587e6b5533b4c6b3c11dd357a","d8ccaef116cada9c558f9e912d5cf7ef2978082611e677f6f55ca233f47a2f68","cc1732ce2d2cd79dc85893fdc3b7d143","6652b46987350e831678d7a33a70bce94c8c9cca137f0bb0efbbd0c07279cbb6","ba1859659089253621e5a65181ea94cd","8f8abfa6717ad2043a295d16b5aeeac3e7084b7994f6eec8351e18a9a3c59997","1e857958a3c7f909ee1370c66d71adfd","56b569912a6e1c4c08e5612c0ef5ddf9f238b1d708621b89963b47b31e45cde1")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("2fec3ab587e6b5533b4c6b3c11dd357a","d8ccaef116cada9c558f9e912d5cf7ef2978082611e677f6f55ca233f47a2f68","cc1732ce2d2cd79dc85893fdc3b7d143","6652b46987350e831678d7a33a70bce94c8c9cca137f0bb0efbbd0c07279cbb6","ba1859659089253621e5a65181ea94cd","8f8abfa6717ad2043a295d16b5aeeac3e7084b7994f6eec8351e18a9a3c59997","1e857958a3c7f909ee1370c66d71adfd","56b569912a6e1c4c08e5612c0ef5ddf9f238b1d708621b89963b47b31e45cde1")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("2fec3ab587e6b5533b4c6b3c11dd357a","d8ccaef116cada9c558f9e912d5cf7ef2978082611e677f6f55ca233f47a2f68","cc1732ce2d2cd79dc85893fdc3b7d143","6652b46987350e831678d7a33a70bce94c8c9cca137f0bb0efbbd0c07279cbb6","ba1859659089253621e5a65181ea94cd","8f8abfa6717ad2043a295d16b5aeeac3e7084b7994f6eec8351e18a9a3c59997","1e857958a3c7f909ee1370c66d71adfd","56b569912a6e1c4c08e5612c0ef5ddf9f238b1d708621b89963b47b31e45cde1")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("2fec3ab587e6b5533b4c6b3c11dd357a","d8ccaef116cada9c558f9e912d5cf7ef2978082611e677f6f55ca233f47a2f68","cc1732ce2d2cd79dc85893fdc3b7d143","6652b46987350e831678d7a33a70bce94c8c9cca137f0bb0efbbd0c07279cbb6","ba1859659089253621e5a65181ea94cd","8f8abfa6717ad2043a295d16b5aeeac3e7084b7994f6eec8351e18a9a3c59997","1e857958a3c7f909ee1370c66d71adfd","56b569912a6e1c4c08e5612c0ef5ddf9f238b1d708621b89963b47b31e45cde1")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("2fec3ab587e6b5533b4c6b3c11dd357a","d8ccaef116cada9c558f9e912d5cf7ef2978082611e677f6f55ca233f47a2f68","cc1732ce2d2cd79dc85893fdc3b7d143","6652b46987350e831678d7a33a70bce94c8c9cca137f0bb0efbbd0c07279cbb6","ba1859659089253621e5a65181ea94cd","8f8abfa6717ad2043a295d16b5aeeac3e7084b7994f6eec8351e18a9a3c59997","1e857958a3c7f909ee1370c66d71adfd","56b569912a6e1c4c08e5612c0ef5ddf9f238b1d708621b89963b47b31e45cde1")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("2fec3ab587e6b5533b4c6b3c11dd357a","d8ccaef116cada9c558f9e912d5cf7ef2978082611e677f6f55ca233f47a2f68","cc1732ce2d2cd79dc85893fdc3b7d143","6652b46987350e831678d7a33a70bce94c8c9cca137f0bb0efbbd0c07279cbb6","ba1859659089253621e5a65181ea94cd","8f8abfa6717ad2043a295d16b5aeeac3e7084b7994f6eec8351e18a9a3c59997","1e857958a3c7f909ee1370c66d71adfd","56b569912a6e1c4c08e5612c0ef5ddf9f238b1d708621b89963b47b31e45cde1")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("2fec3ab587e6b5533b4c6b3c11dd357a","d8ccaef116cada9c558f9e912d5cf7ef2978082611e677f6f55ca233f47a2f68","cc1732ce2d2cd79dc85893fdc3b7d143","6652b46987350e831678d7a33a70bce94c8c9cca137f0bb0efbbd0c07279cbb6","ba1859659089253621e5a65181ea94cd","8f8abfa6717ad2043a295d16b5aeeac3e7084b7994f6eec8351e18a9a3c59997","1e857958a3c7f909ee1370c66d71adfd","56b569912a6e1c4c08e5612c0ef5ddf9f238b1d708621b89963b47b31e45cde1")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("2fec3ab587e6b5533b4c6b3c11dd357a","d8ccaef116cada9c558f9e912d5cf7ef2978082611e677f6f55ca233f47a2f68","cc1732ce2d2cd79dc85893fdc3b7d143","6652b46987350e831678d7a33a70bce94c8c9cca137f0bb0efbbd0c07279cbb6","ba1859659089253621e5a65181ea94cd","8f8abfa6717ad2043a295d16b5aeeac3e7084b7994f6eec8351e18a9a3c59997","1e857958a3c7f909ee1370c66d71adfd","56b569912a6e1c4c08e5612c0ef5ddf9f238b1d708621b89963b47b31e45cde1")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring64 NOT NULL AND customstring64 IN ("2fec3ab587e6b5533b4c6b3c11dd357a","d8ccaef116cada9c558f9e912d5cf7ef2978082611e677f6f55ca233f47a2f68","cc1732ce2d2cd79dc85893fdc3b7d143","6652b46987350e831678d7a33a70bce94c8c9cca137f0bb0efbbd0c07279cbb6","ba1859659089253621e5a65181ea94cd","8f8abfa6717ad2043a295d16b5aeeac3e7084b7994f6eec8351e18a9a3c59997","1e857958a3c7f909ee1370c66d71adfd","56b569912a6e1c4c08e5612c0ef5ddf9f238b1d708621b89963b47b31e45cde1")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("2fec3ab587e6b5533b4c6b3c11dd357a","d8ccaef116cada9c558f9e912d5cf7ef2978082611e677f6f55ca233f47a2f68","cc1732ce2d2cd79dc85893fdc3b7d143","6652b46987350e831678d7a33a70bce94c8c9cca137f0bb0efbbd0c07279cbb6","ba1859659089253621e5a65181ea94cd","8f8abfa6717ad2043a295d16b5aeeac3e7084b7994f6eec8351e18a9a3c59997","1e857958a3c7f909ee1370c66d71adfd","56b569912a6e1c4c08e5612c0ef5ddf9f238b1d708621b89963b47b31e45cde1")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("2fec3ab587e6b5533b4c6b3c11dd357a","d8ccaef116cada9c558f9e912d5cf7ef2978082611e677f6f55ca233f47a2f68","cc1732ce2d2cd79dc85893fdc3b7d143","6652b46987350e831678d7a33a70bce94c8c9cca137f0bb0efbbd0c07279cbb6","ba1859659089253621e5a65181ea94cd","8f8abfa6717ad2043a295d16b5aeeac3e7084b7994f6eec8351e18a9a3c59997","1e857958a3c7f909ee1370c66d71adfd","56b569912a6e1c4c08e5612c0ef5ddf9f238b1d708621b89963b47b31e45cde1")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("2fec3ab587e6b5533b4c6b3c11dd357a","d8ccaef116cada9c558f9e912d5cf7ef2978082611e677f6f55ca233f47a2f68","cc1732ce2d2cd79dc85893fdc3b7d143","6652b46987350e831678d7a33a70bce94c8c9cca137f0bb0efbbd0c07279cbb6","ba1859659089253621e5a65181ea94cd","8f8abfa6717ad2043a295d16b5aeeac3e7084b7994f6eec8351e18a9a3c59997","1e857958a3c7f909ee1370c66d71adfd","56b569912a6e1c4c08e5612c0ef5ddf9f238b1d708621b89963b47b31e45cde1")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring64 NOT NULL AND customstring64 IN ("2fec3ab587e6b5533b4c6b3c11dd357a","d8ccaef116cada9c558f9e912d5cf7ef2978082611e677f6f55ca233f47a2f68","cc1732ce2d2cd79dc85893fdc3b7d143","6652b46987350e831678d7a33a70bce94c8c9cca137f0bb0efbbd0c07279cbb6","ba1859659089253621e5a65181ea94cd","8f8abfa6717ad2043a295d16b5aeeac3e7084b7994f6eec8351e18a9a3c59997","1e857958a3c7f909ee1370c66d71adfd","56b569912a6e1c4c08e5612c0ef5ddf9f238b1d708621b89963b47b31e45cde1")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("2fec3ab587e6b5533b4c6b3c11dd357a","d8ccaef116cada9c558f9e912d5cf7ef2978082611e677f6f55ca233f47a2f68","cc1732ce2d2cd79dc85893fdc3b7d143","6652b46987350e831678d7a33a70bce94c8c9cca137f0bb0efbbd0c07279cbb6","ba1859659089253621e5a65181ea94cd","8f8abfa6717ad2043a295d16b5aeeac3e7084b7994f6eec8351e18a9a3c59997","1e857958a3c7f909ee1370c66d71adfd","56b569912a6e1c4c08e5612c0ef5ddf9f238b1d708621b89963b47b31e45cde1")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("2fec3ab587e6b5533b4c6b3c11dd357a","d8ccaef116cada9c558f9e912d5cf7ef2978082611e677f6f55ca233f47a2f68","cc1732ce2d2cd79dc85893fdc3b7d143","6652b46987350e831678d7a33a70bce94c8c9cca137f0bb0efbbd0c07279cbb6","ba1859659089253621e5a65181ea94cd","8f8abfa6717ad2043a295d16b5aeeac3e7084b7994f6eec8351e18a9a3c59997","1e857958a3c7f909ee1370c66d71adfd","56b569912a6e1c4c08e5612c0ef5ddf9f238b1d708621b89963b47b31e45cde1")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("2fec3ab587e6b5533b4c6b3c11dd357a","d8ccaef116cada9c558f9e912d5cf7ef2978082611e677f6f55ca233f47a2f68","cc1732ce2d2cd79dc85893fdc3b7d143","6652b46987350e831678d7a33a70bce94c8c9cca137f0bb0efbbd0c07279cbb6","ba1859659089253621e5a65181ea94cd","8f8abfa6717ad2043a295d16b5aeeac3e7084b7994f6eec8351e18a9a3c59997","1e857958a3c7f909ee1370c66d71adfd","56b569912a6e1c4c08e5612c0ef5ddf9f238b1d708621b89963b47b31e45cde1")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring64 NOT NULL AND customstring64 IN ("2fec3ab587e6b5533b4c6b3c11dd357a","d8ccaef116cada9c558f9e912d5cf7ef2978082611e677f6f55ca233f47a2f68","cc1732ce2d2cd79dc85893fdc3b7d143","6652b46987350e831678d7a33a70bce94c8c9cca137f0bb0efbbd0c07279cbb6","ba1859659089253621e5a65181ea94cd","8f8abfa6717ad2043a295d16b5aeeac3e7084b7994f6eec8351e18a9a3c59997","1e857958a3c7f909ee1370c66d71adfd","56b569912a6e1c4c08e5612c0ef5ddf9f238b1d708621b89963b47b31e45cde1")
