index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("796deae716a6d66b49a99d00e541056babe34fd2fcbcea0380491de4b792afba","18e45358462363996688ceabfc098e17f855d73842f460b34c683e58c728149f","88bd580aa51129e4e5fa69e148131874c862015e7c51d59497e11f22db2d72c6","23664decf3c2f28a3f552dc98d90017926617969713ccccdc9f5fd3178d76dbf","ba63fbf6f7bab000bc1b1bf92319415328cea238872450adbaac6a6069132779","f359b687fb9e1a4c27fdf5174380abc9877f940ef6a6fd4d38e9ef40bb778107","815ebfc4fb5bddf1f9ca1b12ae2a1b0e37736a93ea9babe858747096ad9ce671","d21ae84e104a305b5aebee8e6fbb4837976ef26935dac90372637f913ef58154","0c006540abcb768cad80a1a8ced926fa58f10cf9eb0be16c4185850df83bff82","847e684a228292dc905205d7353ed9458e10129105fe3b387c4e9374d6afd783","ed6a350c4b1baa6f098293c328d0a62d35aafb4ab62b93e6f3a611f06be9aa29","123480357ab54d2c2067640105b5683445777ae1d20fd52551a5df9327692103","3710742057e470e8882a84412721ed19652e3f13977af21a937bad27d75b6f96","dd1a177126d48072381db98af74c964100c8ef2e43286f3a31114461251a164c","0d8c5bb69c567e3949cc6e087610d79c886d9140d0eda88cc92d3ec63fb7a3b9","b6bc001bc9b4171a27fb2a485cb3e3d8f23bc1ee6b4a03bbcfbba63b7d208477","2c7bf841a659fa1d8105d26f6664ebc3a78b99e0c071eb7f529503346c40f778","cbbe1d5a7d4a721c61b9c3b8b6a8e5d65508f02c70e708698d8165d92e154383","25034c2542757ac93cb6008479a5bfc594f9e92f66249f6fb862447a18847ba7","148d3552db2acf469c84e26889336f06167c6cf455248e08d703282bc0556fb8","7186674c208242b8e6fdf7b0f4e7539218590618fee517aa264e8446247d3440","7a48db17a02e94c97a329cc1a578777d8b4fb74221bdb22202369d6590917fd0","7a48db17a02e94c97a329cc1a578777d8b4fb74221bdb22202369d6590917fd0","ca7dc2b0856f89e71ce9da6f179b34c8879456b5dffda0b5bd3f0fd73bab1c50")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("796deae716a6d66b49a99d00e541056babe34fd2fcbcea0380491de4b792afba","18e45358462363996688ceabfc098e17f855d73842f460b34c683e58c728149f","88bd580aa51129e4e5fa69e148131874c862015e7c51d59497e11f22db2d72c6","23664decf3c2f28a3f552dc98d90017926617969713ccccdc9f5fd3178d76dbf","ba63fbf6f7bab000bc1b1bf92319415328cea238872450adbaac6a6069132779","f359b687fb9e1a4c27fdf5174380abc9877f940ef6a6fd4d38e9ef40bb778107","815ebfc4fb5bddf1f9ca1b12ae2a1b0e37736a93ea9babe858747096ad9ce671","d21ae84e104a305b5aebee8e6fbb4837976ef26935dac90372637f913ef58154","0c006540abcb768cad80a1a8ced926fa58f10cf9eb0be16c4185850df83bff82","847e684a228292dc905205d7353ed9458e10129105fe3b387c4e9374d6afd783","ed6a350c4b1baa6f098293c328d0a62d35aafb4ab62b93e6f3a611f06be9aa29","123480357ab54d2c2067640105b5683445777ae1d20fd52551a5df9327692103","3710742057e470e8882a84412721ed19652e3f13977af21a937bad27d75b6f96","dd1a177126d48072381db98af74c964100c8ef2e43286f3a31114461251a164c","0d8c5bb69c567e3949cc6e087610d79c886d9140d0eda88cc92d3ec63fb7a3b9","b6bc001bc9b4171a27fb2a485cb3e3d8f23bc1ee6b4a03bbcfbba63b7d208477","2c7bf841a659fa1d8105d26f6664ebc3a78b99e0c071eb7f529503346c40f778","cbbe1d5a7d4a721c61b9c3b8b6a8e5d65508f02c70e708698d8165d92e154383","25034c2542757ac93cb6008479a5bfc594f9e92f66249f6fb862447a18847ba7","148d3552db2acf469c84e26889336f06167c6cf455248e08d703282bc0556fb8","7186674c208242b8e6fdf7b0f4e7539218590618fee517aa264e8446247d3440","7a48db17a02e94c97a329cc1a578777d8b4fb74221bdb22202369d6590917fd0","7a48db17a02e94c97a329cc1a578777d8b4fb74221bdb22202369d6590917fd0","ca7dc2b0856f89e71ce9da6f179b34c8879456b5dffda0b5bd3f0fd73bab1c50")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("796deae716a6d66b49a99d00e541056babe34fd2fcbcea0380491de4b792afba","18e45358462363996688ceabfc098e17f855d73842f460b34c683e58c728149f","88bd580aa51129e4e5fa69e148131874c862015e7c51d59497e11f22db2d72c6","23664decf3c2f28a3f552dc98d90017926617969713ccccdc9f5fd3178d76dbf","ba63fbf6f7bab000bc1b1bf92319415328cea238872450adbaac6a6069132779","f359b687fb9e1a4c27fdf5174380abc9877f940ef6a6fd4d38e9ef40bb778107","815ebfc4fb5bddf1f9ca1b12ae2a1b0e37736a93ea9babe858747096ad9ce671","d21ae84e104a305b5aebee8e6fbb4837976ef26935dac90372637f913ef58154","0c006540abcb768cad80a1a8ced926fa58f10cf9eb0be16c4185850df83bff82","847e684a228292dc905205d7353ed9458e10129105fe3b387c4e9374d6afd783","ed6a350c4b1baa6f098293c328d0a62d35aafb4ab62b93e6f3a611f06be9aa29","123480357ab54d2c2067640105b5683445777ae1d20fd52551a5df9327692103","3710742057e470e8882a84412721ed19652e3f13977af21a937bad27d75b6f96","dd1a177126d48072381db98af74c964100c8ef2e43286f3a31114461251a164c","0d8c5bb69c567e3949cc6e087610d79c886d9140d0eda88cc92d3ec63fb7a3b9","b6bc001bc9b4171a27fb2a485cb3e3d8f23bc1ee6b4a03bbcfbba63b7d208477","2c7bf841a659fa1d8105d26f6664ebc3a78b99e0c071eb7f529503346c40f778","cbbe1d5a7d4a721c61b9c3b8b6a8e5d65508f02c70e708698d8165d92e154383","25034c2542757ac93cb6008479a5bfc594f9e92f66249f6fb862447a18847ba7","148d3552db2acf469c84e26889336f06167c6cf455248e08d703282bc0556fb8","7186674c208242b8e6fdf7b0f4e7539218590618fee517aa264e8446247d3440","7a48db17a02e94c97a329cc1a578777d8b4fb74221bdb22202369d6590917fd0","7a48db17a02e94c97a329cc1a578777d8b4fb74221bdb22202369d6590917fd0","ca7dc2b0856f89e71ce9da6f179b34c8879456b5dffda0b5bd3f0fd73bab1c50")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring64 NOT NULL AND customstring64 IN ("796deae716a6d66b49a99d00e541056babe34fd2fcbcea0380491de4b792afba","18e45358462363996688ceabfc098e17f855d73842f460b34c683e58c728149f","88bd580aa51129e4e5fa69e148131874c862015e7c51d59497e11f22db2d72c6","23664decf3c2f28a3f552dc98d90017926617969713ccccdc9f5fd3178d76dbf","ba63fbf6f7bab000bc1b1bf92319415328cea238872450adbaac6a6069132779","f359b687fb9e1a4c27fdf5174380abc9877f940ef6a6fd4d38e9ef40bb778107","815ebfc4fb5bddf1f9ca1b12ae2a1b0e37736a93ea9babe858747096ad9ce671","d21ae84e104a305b5aebee8e6fbb4837976ef26935dac90372637f913ef58154","0c006540abcb768cad80a1a8ced926fa58f10cf9eb0be16c4185850df83bff82","847e684a228292dc905205d7353ed9458e10129105fe3b387c4e9374d6afd783","ed6a350c4b1baa6f098293c328d0a62d35aafb4ab62b93e6f3a611f06be9aa29","123480357ab54d2c2067640105b5683445777ae1d20fd52551a5df9327692103","3710742057e470e8882a84412721ed19652e3f13977af21a937bad27d75b6f96","dd1a177126d48072381db98af74c964100c8ef2e43286f3a31114461251a164c","0d8c5bb69c567e3949cc6e087610d79c886d9140d0eda88cc92d3ec63fb7a3b9","b6bc001bc9b4171a27fb2a485cb3e3d8f23bc1ee6b4a03bbcfbba63b7d208477","2c7bf841a659fa1d8105d26f6664ebc3a78b99e0c071eb7f529503346c40f778","cbbe1d5a7d4a721c61b9c3b8b6a8e5d65508f02c70e708698d8165d92e154383","25034c2542757ac93cb6008479a5bfc594f9e92f66249f6fb862447a18847ba7","148d3552db2acf469c84e26889336f06167c6cf455248e08d703282bc0556fb8","7186674c208242b8e6fdf7b0f4e7539218590618fee517aa264e8446247d3440","7a48db17a02e94c97a329cc1a578777d8b4fb74221bdb22202369d6590917fd0","7a48db17a02e94c97a329cc1a578777d8b4fb74221bdb22202369d6590917fd0","ca7dc2b0856f89e71ce9da6f179b34c8879456b5dffda0b5bd3f0fd73bab1c50")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("796deae716a6d66b49a99d00e541056babe34fd2fcbcea0380491de4b792afba","18e45358462363996688ceabfc098e17f855d73842f460b34c683e58c728149f","88bd580aa51129e4e5fa69e148131874c862015e7c51d59497e11f22db2d72c6","23664decf3c2f28a3f552dc98d90017926617969713ccccdc9f5fd3178d76dbf","ba63fbf6f7bab000bc1b1bf92319415328cea238872450adbaac6a6069132779","f359b687fb9e1a4c27fdf5174380abc9877f940ef6a6fd4d38e9ef40bb778107","815ebfc4fb5bddf1f9ca1b12ae2a1b0e37736a93ea9babe858747096ad9ce671","d21ae84e104a305b5aebee8e6fbb4837976ef26935dac90372637f913ef58154","0c006540abcb768cad80a1a8ced926fa58f10cf9eb0be16c4185850df83bff82","847e684a228292dc905205d7353ed9458e10129105fe3b387c4e9374d6afd783","ed6a350c4b1baa6f098293c328d0a62d35aafb4ab62b93e6f3a611f06be9aa29","123480357ab54d2c2067640105b5683445777ae1d20fd52551a5df9327692103","3710742057e470e8882a84412721ed19652e3f13977af21a937bad27d75b6f96","dd1a177126d48072381db98af74c964100c8ef2e43286f3a31114461251a164c","0d8c5bb69c567e3949cc6e087610d79c886d9140d0eda88cc92d3ec63fb7a3b9","b6bc001bc9b4171a27fb2a485cb3e3d8f23bc1ee6b4a03bbcfbba63b7d208477","2c7bf841a659fa1d8105d26f6664ebc3a78b99e0c071eb7f529503346c40f778","cbbe1d5a7d4a721c61b9c3b8b6a8e5d65508f02c70e708698d8165d92e154383","25034c2542757ac93cb6008479a5bfc594f9e92f66249f6fb862447a18847ba7","148d3552db2acf469c84e26889336f06167c6cf455248e08d703282bc0556fb8","7186674c208242b8e6fdf7b0f4e7539218590618fee517aa264e8446247d3440","7a48db17a02e94c97a329cc1a578777d8b4fb74221bdb22202369d6590917fd0","7a48db17a02e94c97a329cc1a578777d8b4fb74221bdb22202369d6590917fd0","ca7dc2b0856f89e71ce9da6f179b34c8879456b5dffda0b5bd3f0fd73bab1c50")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("796deae716a6d66b49a99d00e541056babe34fd2fcbcea0380491de4b792afba","18e45358462363996688ceabfc098e17f855d73842f460b34c683e58c728149f","88bd580aa51129e4e5fa69e148131874c862015e7c51d59497e11f22db2d72c6","23664decf3c2f28a3f552dc98d90017926617969713ccccdc9f5fd3178d76dbf","ba63fbf6f7bab000bc1b1bf92319415328cea238872450adbaac6a6069132779","f359b687fb9e1a4c27fdf5174380abc9877f940ef6a6fd4d38e9ef40bb778107","815ebfc4fb5bddf1f9ca1b12ae2a1b0e37736a93ea9babe858747096ad9ce671","d21ae84e104a305b5aebee8e6fbb4837976ef26935dac90372637f913ef58154","0c006540abcb768cad80a1a8ced926fa58f10cf9eb0be16c4185850df83bff82","847e684a228292dc905205d7353ed9458e10129105fe3b387c4e9374d6afd783","ed6a350c4b1baa6f098293c328d0a62d35aafb4ab62b93e6f3a611f06be9aa29","123480357ab54d2c2067640105b5683445777ae1d20fd52551a5df9327692103","3710742057e470e8882a84412721ed19652e3f13977af21a937bad27d75b6f96","dd1a177126d48072381db98af74c964100c8ef2e43286f3a31114461251a164c","0d8c5bb69c567e3949cc6e087610d79c886d9140d0eda88cc92d3ec63fb7a3b9","b6bc001bc9b4171a27fb2a485cb3e3d8f23bc1ee6b4a03bbcfbba63b7d208477","2c7bf841a659fa1d8105d26f6664ebc3a78b99e0c071eb7f529503346c40f778","cbbe1d5a7d4a721c61b9c3b8b6a8e5d65508f02c70e708698d8165d92e154383","25034c2542757ac93cb6008479a5bfc594f9e92f66249f6fb862447a18847ba7","148d3552db2acf469c84e26889336f06167c6cf455248e08d703282bc0556fb8","7186674c208242b8e6fdf7b0f4e7539218590618fee517aa264e8446247d3440","7a48db17a02e94c97a329cc1a578777d8b4fb74221bdb22202369d6590917fd0","7a48db17a02e94c97a329cc1a578777d8b4fb74221bdb22202369d6590917fd0","ca7dc2b0856f89e71ce9da6f179b34c8879456b5dffda0b5bd3f0fd73bab1c50")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("796deae716a6d66b49a99d00e541056babe34fd2fcbcea0380491de4b792afba","18e45358462363996688ceabfc098e17f855d73842f460b34c683e58c728149f","88bd580aa51129e4e5fa69e148131874c862015e7c51d59497e11f22db2d72c6","23664decf3c2f28a3f552dc98d90017926617969713ccccdc9f5fd3178d76dbf","ba63fbf6f7bab000bc1b1bf92319415328cea238872450adbaac6a6069132779","f359b687fb9e1a4c27fdf5174380abc9877f940ef6a6fd4d38e9ef40bb778107","815ebfc4fb5bddf1f9ca1b12ae2a1b0e37736a93ea9babe858747096ad9ce671","d21ae84e104a305b5aebee8e6fbb4837976ef26935dac90372637f913ef58154","0c006540abcb768cad80a1a8ced926fa58f10cf9eb0be16c4185850df83bff82","847e684a228292dc905205d7353ed9458e10129105fe3b387c4e9374d6afd783","ed6a350c4b1baa6f098293c328d0a62d35aafb4ab62b93e6f3a611f06be9aa29","123480357ab54d2c2067640105b5683445777ae1d20fd52551a5df9327692103","3710742057e470e8882a84412721ed19652e3f13977af21a937bad27d75b6f96","dd1a177126d48072381db98af74c964100c8ef2e43286f3a31114461251a164c","0d8c5bb69c567e3949cc6e087610d79c886d9140d0eda88cc92d3ec63fb7a3b9","b6bc001bc9b4171a27fb2a485cb3e3d8f23bc1ee6b4a03bbcfbba63b7d208477","2c7bf841a659fa1d8105d26f6664ebc3a78b99e0c071eb7f529503346c40f778","cbbe1d5a7d4a721c61b9c3b8b6a8e5d65508f02c70e708698d8165d92e154383","25034c2542757ac93cb6008479a5bfc594f9e92f66249f6fb862447a18847ba7","148d3552db2acf469c84e26889336f06167c6cf455248e08d703282bc0556fb8","7186674c208242b8e6fdf7b0f4e7539218590618fee517aa264e8446247d3440","7a48db17a02e94c97a329cc1a578777d8b4fb74221bdb22202369d6590917fd0","7a48db17a02e94c97a329cc1a578777d8b4fb74221bdb22202369d6590917fd0","ca7dc2b0856f89e71ce9da6f179b34c8879456b5dffda0b5bd3f0fd73bab1c50")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("796deae716a6d66b49a99d00e541056babe34fd2fcbcea0380491de4b792afba","18e45358462363996688ceabfc098e17f855d73842f460b34c683e58c728149f","88bd580aa51129e4e5fa69e148131874c862015e7c51d59497e11f22db2d72c6","23664decf3c2f28a3f552dc98d90017926617969713ccccdc9f5fd3178d76dbf","ba63fbf6f7bab000bc1b1bf92319415328cea238872450adbaac6a6069132779","f359b687fb9e1a4c27fdf5174380abc9877f940ef6a6fd4d38e9ef40bb778107","815ebfc4fb5bddf1f9ca1b12ae2a1b0e37736a93ea9babe858747096ad9ce671","d21ae84e104a305b5aebee8e6fbb4837976ef26935dac90372637f913ef58154","0c006540abcb768cad80a1a8ced926fa58f10cf9eb0be16c4185850df83bff82","847e684a228292dc905205d7353ed9458e10129105fe3b387c4e9374d6afd783","ed6a350c4b1baa6f098293c328d0a62d35aafb4ab62b93e6f3a611f06be9aa29","123480357ab54d2c2067640105b5683445777ae1d20fd52551a5df9327692103","3710742057e470e8882a84412721ed19652e3f13977af21a937bad27d75b6f96","dd1a177126d48072381db98af74c964100c8ef2e43286f3a31114461251a164c","0d8c5bb69c567e3949cc6e087610d79c886d9140d0eda88cc92d3ec63fb7a3b9","b6bc001bc9b4171a27fb2a485cb3e3d8f23bc1ee6b4a03bbcfbba63b7d208477","2c7bf841a659fa1d8105d26f6664ebc3a78b99e0c071eb7f529503346c40f778","cbbe1d5a7d4a721c61b9c3b8b6a8e5d65508f02c70e708698d8165d92e154383","25034c2542757ac93cb6008479a5bfc594f9e92f66249f6fb862447a18847ba7","148d3552db2acf469c84e26889336f06167c6cf455248e08d703282bc0556fb8","7186674c208242b8e6fdf7b0f4e7539218590618fee517aa264e8446247d3440","7a48db17a02e94c97a329cc1a578777d8b4fb74221bdb22202369d6590917fd0","7a48db17a02e94c97a329cc1a578777d8b4fb74221bdb22202369d6590917fd0","ca7dc2b0856f89e71ce9da6f179b34c8879456b5dffda0b5bd3f0fd73bab1c50")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("796deae716a6d66b49a99d00e541056babe34fd2fcbcea0380491de4b792afba","18e45358462363996688ceabfc098e17f855d73842f460b34c683e58c728149f","88bd580aa51129e4e5fa69e148131874c862015e7c51d59497e11f22db2d72c6","23664decf3c2f28a3f552dc98d90017926617969713ccccdc9f5fd3178d76dbf","ba63fbf6f7bab000bc1b1bf92319415328cea238872450adbaac6a6069132779","f359b687fb9e1a4c27fdf5174380abc9877f940ef6a6fd4d38e9ef40bb778107","815ebfc4fb5bddf1f9ca1b12ae2a1b0e37736a93ea9babe858747096ad9ce671","d21ae84e104a305b5aebee8e6fbb4837976ef26935dac90372637f913ef58154","0c006540abcb768cad80a1a8ced926fa58f10cf9eb0be16c4185850df83bff82","847e684a228292dc905205d7353ed9458e10129105fe3b387c4e9374d6afd783","ed6a350c4b1baa6f098293c328d0a62d35aafb4ab62b93e6f3a611f06be9aa29","123480357ab54d2c2067640105b5683445777ae1d20fd52551a5df9327692103","3710742057e470e8882a84412721ed19652e3f13977af21a937bad27d75b6f96","dd1a177126d48072381db98af74c964100c8ef2e43286f3a31114461251a164c","0d8c5bb69c567e3949cc6e087610d79c886d9140d0eda88cc92d3ec63fb7a3b9","b6bc001bc9b4171a27fb2a485cb3e3d8f23bc1ee6b4a03bbcfbba63b7d208477","2c7bf841a659fa1d8105d26f6664ebc3a78b99e0c071eb7f529503346c40f778","cbbe1d5a7d4a721c61b9c3b8b6a8e5d65508f02c70e708698d8165d92e154383","25034c2542757ac93cb6008479a5bfc594f9e92f66249f6fb862447a18847ba7","148d3552db2acf469c84e26889336f06167c6cf455248e08d703282bc0556fb8","7186674c208242b8e6fdf7b0f4e7539218590618fee517aa264e8446247d3440","7a48db17a02e94c97a329cc1a578777d8b4fb74221bdb22202369d6590917fd0","7a48db17a02e94c97a329cc1a578777d8b4fb74221bdb22202369d6590917fd0","ca7dc2b0856f89e71ce9da6f179b34c8879456b5dffda0b5bd3f0fd73bab1c50")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("796deae716a6d66b49a99d00e541056babe34fd2fcbcea0380491de4b792afba","18e45358462363996688ceabfc098e17f855d73842f460b34c683e58c728149f","88bd580aa51129e4e5fa69e148131874c862015e7c51d59497e11f22db2d72c6","23664decf3c2f28a3f552dc98d90017926617969713ccccdc9f5fd3178d76dbf","ba63fbf6f7bab000bc1b1bf92319415328cea238872450adbaac6a6069132779","f359b687fb9e1a4c27fdf5174380abc9877f940ef6a6fd4d38e9ef40bb778107","815ebfc4fb5bddf1f9ca1b12ae2a1b0e37736a93ea9babe858747096ad9ce671","d21ae84e104a305b5aebee8e6fbb4837976ef26935dac90372637f913ef58154","0c006540abcb768cad80a1a8ced926fa58f10cf9eb0be16c4185850df83bff82","847e684a228292dc905205d7353ed9458e10129105fe3b387c4e9374d6afd783","ed6a350c4b1baa6f098293c328d0a62d35aafb4ab62b93e6f3a611f06be9aa29","123480357ab54d2c2067640105b5683445777ae1d20fd52551a5df9327692103","3710742057e470e8882a84412721ed19652e3f13977af21a937bad27d75b6f96","dd1a177126d48072381db98af74c964100c8ef2e43286f3a31114461251a164c","0d8c5bb69c567e3949cc6e087610d79c886d9140d0eda88cc92d3ec63fb7a3b9","b6bc001bc9b4171a27fb2a485cb3e3d8f23bc1ee6b4a03bbcfbba63b7d208477","2c7bf841a659fa1d8105d26f6664ebc3a78b99e0c071eb7f529503346c40f778","cbbe1d5a7d4a721c61b9c3b8b6a8e5d65508f02c70e708698d8165d92e154383","25034c2542757ac93cb6008479a5bfc594f9e92f66249f6fb862447a18847ba7","148d3552db2acf469c84e26889336f06167c6cf455248e08d703282bc0556fb8","7186674c208242b8e6fdf7b0f4e7539218590618fee517aa264e8446247d3440","7a48db17a02e94c97a329cc1a578777d8b4fb74221bdb22202369d6590917fd0","7a48db17a02e94c97a329cc1a578777d8b4fb74221bdb22202369d6590917fd0","ca7dc2b0856f89e71ce9da6f179b34c8879456b5dffda0b5bd3f0fd73bab1c50")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("796deae716a6d66b49a99d00e541056babe34fd2fcbcea0380491de4b792afba","18e45358462363996688ceabfc098e17f855d73842f460b34c683e58c728149f","88bd580aa51129e4e5fa69e148131874c862015e7c51d59497e11f22db2d72c6","23664decf3c2f28a3f552dc98d90017926617969713ccccdc9f5fd3178d76dbf","ba63fbf6f7bab000bc1b1bf92319415328cea238872450adbaac6a6069132779","f359b687fb9e1a4c27fdf5174380abc9877f940ef6a6fd4d38e9ef40bb778107","815ebfc4fb5bddf1f9ca1b12ae2a1b0e37736a93ea9babe858747096ad9ce671","d21ae84e104a305b5aebee8e6fbb4837976ef26935dac90372637f913ef58154","0c006540abcb768cad80a1a8ced926fa58f10cf9eb0be16c4185850df83bff82","847e684a228292dc905205d7353ed9458e10129105fe3b387c4e9374d6afd783","ed6a350c4b1baa6f098293c328d0a62d35aafb4ab62b93e6f3a611f06be9aa29","123480357ab54d2c2067640105b5683445777ae1d20fd52551a5df9327692103","3710742057e470e8882a84412721ed19652e3f13977af21a937bad27d75b6f96","dd1a177126d48072381db98af74c964100c8ef2e43286f3a31114461251a164c","0d8c5bb69c567e3949cc6e087610d79c886d9140d0eda88cc92d3ec63fb7a3b9","b6bc001bc9b4171a27fb2a485cb3e3d8f23bc1ee6b4a03bbcfbba63b7d208477","2c7bf841a659fa1d8105d26f6664ebc3a78b99e0c071eb7f529503346c40f778","cbbe1d5a7d4a721c61b9c3b8b6a8e5d65508f02c70e708698d8165d92e154383","25034c2542757ac93cb6008479a5bfc594f9e92f66249f6fb862447a18847ba7","148d3552db2acf469c84e26889336f06167c6cf455248e08d703282bc0556fb8","7186674c208242b8e6fdf7b0f4e7539218590618fee517aa264e8446247d3440","7a48db17a02e94c97a329cc1a578777d8b4fb74221bdb22202369d6590917fd0","7a48db17a02e94c97a329cc1a578777d8b4fb74221bdb22202369d6590917fd0","ca7dc2b0856f89e71ce9da6f179b34c8879456b5dffda0b5bd3f0fd73bab1c50")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("796deae716a6d66b49a99d00e541056babe34fd2fcbcea0380491de4b792afba","18e45358462363996688ceabfc098e17f855d73842f460b34c683e58c728149f","88bd580aa51129e4e5fa69e148131874c862015e7c51d59497e11f22db2d72c6","23664decf3c2f28a3f552dc98d90017926617969713ccccdc9f5fd3178d76dbf","ba63fbf6f7bab000bc1b1bf92319415328cea238872450adbaac6a6069132779","f359b687fb9e1a4c27fdf5174380abc9877f940ef6a6fd4d38e9ef40bb778107","815ebfc4fb5bddf1f9ca1b12ae2a1b0e37736a93ea9babe858747096ad9ce671","d21ae84e104a305b5aebee8e6fbb4837976ef26935dac90372637f913ef58154","0c006540abcb768cad80a1a8ced926fa58f10cf9eb0be16c4185850df83bff82","847e684a228292dc905205d7353ed9458e10129105fe3b387c4e9374d6afd783","ed6a350c4b1baa6f098293c328d0a62d35aafb4ab62b93e6f3a611f06be9aa29","123480357ab54d2c2067640105b5683445777ae1d20fd52551a5df9327692103","3710742057e470e8882a84412721ed19652e3f13977af21a937bad27d75b6f96","dd1a177126d48072381db98af74c964100c8ef2e43286f3a31114461251a164c","0d8c5bb69c567e3949cc6e087610d79c886d9140d0eda88cc92d3ec63fb7a3b9","b6bc001bc9b4171a27fb2a485cb3e3d8f23bc1ee6b4a03bbcfbba63b7d208477","2c7bf841a659fa1d8105d26f6664ebc3a78b99e0c071eb7f529503346c40f778","cbbe1d5a7d4a721c61b9c3b8b6a8e5d65508f02c70e708698d8165d92e154383","25034c2542757ac93cb6008479a5bfc594f9e92f66249f6fb862447a18847ba7","148d3552db2acf469c84e26889336f06167c6cf455248e08d703282bc0556fb8","7186674c208242b8e6fdf7b0f4e7539218590618fee517aa264e8446247d3440","7a48db17a02e94c97a329cc1a578777d8b4fb74221bdb22202369d6590917fd0","7a48db17a02e94c97a329cc1a578777d8b4fb74221bdb22202369d6590917fd0","ca7dc2b0856f89e71ce9da6f179b34c8879456b5dffda0b5bd3f0fd73bab1c50")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("796deae716a6d66b49a99d00e541056babe34fd2fcbcea0380491de4b792afba","18e45358462363996688ceabfc098e17f855d73842f460b34c683e58c728149f","88bd580aa51129e4e5fa69e148131874c862015e7c51d59497e11f22db2d72c6","23664decf3c2f28a3f552dc98d90017926617969713ccccdc9f5fd3178d76dbf","ba63fbf6f7bab000bc1b1bf92319415328cea238872450adbaac6a6069132779","f359b687fb9e1a4c27fdf5174380abc9877f940ef6a6fd4d38e9ef40bb778107","815ebfc4fb5bddf1f9ca1b12ae2a1b0e37736a93ea9babe858747096ad9ce671","d21ae84e104a305b5aebee8e6fbb4837976ef26935dac90372637f913ef58154","0c006540abcb768cad80a1a8ced926fa58f10cf9eb0be16c4185850df83bff82","847e684a228292dc905205d7353ed9458e10129105fe3b387c4e9374d6afd783","ed6a350c4b1baa6f098293c328d0a62d35aafb4ab62b93e6f3a611f06be9aa29","123480357ab54d2c2067640105b5683445777ae1d20fd52551a5df9327692103","3710742057e470e8882a84412721ed19652e3f13977af21a937bad27d75b6f96","dd1a177126d48072381db98af74c964100c8ef2e43286f3a31114461251a164c","0d8c5bb69c567e3949cc6e087610d79c886d9140d0eda88cc92d3ec63fb7a3b9","b6bc001bc9b4171a27fb2a485cb3e3d8f23bc1ee6b4a03bbcfbba63b7d208477","2c7bf841a659fa1d8105d26f6664ebc3a78b99e0c071eb7f529503346c40f778","cbbe1d5a7d4a721c61b9c3b8b6a8e5d65508f02c70e708698d8165d92e154383","25034c2542757ac93cb6008479a5bfc594f9e92f66249f6fb862447a18847ba7","148d3552db2acf469c84e26889336f06167c6cf455248e08d703282bc0556fb8","7186674c208242b8e6fdf7b0f4e7539218590618fee517aa264e8446247d3440","7a48db17a02e94c97a329cc1a578777d8b4fb74221bdb22202369d6590917fd0","7a48db17a02e94c97a329cc1a578777d8b4fb74221bdb22202369d6590917fd0","ca7dc2b0856f89e71ce9da6f179b34c8879456b5dffda0b5bd3f0fd73bab1c50")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("796deae716a6d66b49a99d00e541056babe34fd2fcbcea0380491de4b792afba","18e45358462363996688ceabfc098e17f855d73842f460b34c683e58c728149f","88bd580aa51129e4e5fa69e148131874c862015e7c51d59497e11f22db2d72c6","23664decf3c2f28a3f552dc98d90017926617969713ccccdc9f5fd3178d76dbf","ba63fbf6f7bab000bc1b1bf92319415328cea238872450adbaac6a6069132779","f359b687fb9e1a4c27fdf5174380abc9877f940ef6a6fd4d38e9ef40bb778107","815ebfc4fb5bddf1f9ca1b12ae2a1b0e37736a93ea9babe858747096ad9ce671","d21ae84e104a305b5aebee8e6fbb4837976ef26935dac90372637f913ef58154","0c006540abcb768cad80a1a8ced926fa58f10cf9eb0be16c4185850df83bff82","847e684a228292dc905205d7353ed9458e10129105fe3b387c4e9374d6afd783","ed6a350c4b1baa6f098293c328d0a62d35aafb4ab62b93e6f3a611f06be9aa29","123480357ab54d2c2067640105b5683445777ae1d20fd52551a5df9327692103","3710742057e470e8882a84412721ed19652e3f13977af21a937bad27d75b6f96","dd1a177126d48072381db98af74c964100c8ef2e43286f3a31114461251a164c","0d8c5bb69c567e3949cc6e087610d79c886d9140d0eda88cc92d3ec63fb7a3b9","b6bc001bc9b4171a27fb2a485cb3e3d8f23bc1ee6b4a03bbcfbba63b7d208477","2c7bf841a659fa1d8105d26f6664ebc3a78b99e0c071eb7f529503346c40f778","cbbe1d5a7d4a721c61b9c3b8b6a8e5d65508f02c70e708698d8165d92e154383","25034c2542757ac93cb6008479a5bfc594f9e92f66249f6fb862447a18847ba7","148d3552db2acf469c84e26889336f06167c6cf455248e08d703282bc0556fb8","7186674c208242b8e6fdf7b0f4e7539218590618fee517aa264e8446247d3440","7a48db17a02e94c97a329cc1a578777d8b4fb74221bdb22202369d6590917fd0","7a48db17a02e94c97a329cc1a578777d8b4fb74221bdb22202369d6590917fd0","ca7dc2b0856f89e71ce9da6f179b34c8879456b5dffda0b5bd3f0fd73bab1c50")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("796deae716a6d66b49a99d00e541056babe34fd2fcbcea0380491de4b792afba","18e45358462363996688ceabfc098e17f855d73842f460b34c683e58c728149f","88bd580aa51129e4e5fa69e148131874c862015e7c51d59497e11f22db2d72c6","23664decf3c2f28a3f552dc98d90017926617969713ccccdc9f5fd3178d76dbf","ba63fbf6f7bab000bc1b1bf92319415328cea238872450adbaac6a6069132779","f359b687fb9e1a4c27fdf5174380abc9877f940ef6a6fd4d38e9ef40bb778107","815ebfc4fb5bddf1f9ca1b12ae2a1b0e37736a93ea9babe858747096ad9ce671","d21ae84e104a305b5aebee8e6fbb4837976ef26935dac90372637f913ef58154","0c006540abcb768cad80a1a8ced926fa58f10cf9eb0be16c4185850df83bff82","847e684a228292dc905205d7353ed9458e10129105fe3b387c4e9374d6afd783","ed6a350c4b1baa6f098293c328d0a62d35aafb4ab62b93e6f3a611f06be9aa29","123480357ab54d2c2067640105b5683445777ae1d20fd52551a5df9327692103","3710742057e470e8882a84412721ed19652e3f13977af21a937bad27d75b6f96","dd1a177126d48072381db98af74c964100c8ef2e43286f3a31114461251a164c","0d8c5bb69c567e3949cc6e087610d79c886d9140d0eda88cc92d3ec63fb7a3b9","b6bc001bc9b4171a27fb2a485cb3e3d8f23bc1ee6b4a03bbcfbba63b7d208477","2c7bf841a659fa1d8105d26f6664ebc3a78b99e0c071eb7f529503346c40f778","cbbe1d5a7d4a721c61b9c3b8b6a8e5d65508f02c70e708698d8165d92e154383","25034c2542757ac93cb6008479a5bfc594f9e92f66249f6fb862447a18847ba7","148d3552db2acf469c84e26889336f06167c6cf455248e08d703282bc0556fb8","7186674c208242b8e6fdf7b0f4e7539218590618fee517aa264e8446247d3440","7a48db17a02e94c97a329cc1a578777d8b4fb74221bdb22202369d6590917fd0","7a48db17a02e94c97a329cc1a578777d8b4fb74221bdb22202369d6590917fd0","ca7dc2b0856f89e71ce9da6f179b34c8879456b5dffda0b5bd3f0fd73bab1c50")
index=activity AND rg_functionality="Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("796deae716a6d66b49a99d00e541056babe34fd2fcbcea0380491de4b792afba","18e45358462363996688ceabfc098e17f855d73842f460b34c683e58c728149f","88bd580aa51129e4e5fa69e148131874c862015e7c51d59497e11f22db2d72c6","23664decf3c2f28a3f552dc98d90017926617969713ccccdc9f5fd3178d76dbf","ba63fbf6f7bab000bc1b1bf92319415328cea238872450adbaac6a6069132779","f359b687fb9e1a4c27fdf5174380abc9877f940ef6a6fd4d38e9ef40bb778107","815ebfc4fb5bddf1f9ca1b12ae2a1b0e37736a93ea9babe858747096ad9ce671","d21ae84e104a305b5aebee8e6fbb4837976ef26935dac90372637f913ef58154","0c006540abcb768cad80a1a8ced926fa58f10cf9eb0be16c4185850df83bff82","847e684a228292dc905205d7353ed9458e10129105fe3b387c4e9374d6afd783","ed6a350c4b1baa6f098293c328d0a62d35aafb4ab62b93e6f3a611f06be9aa29","123480357ab54d2c2067640105b5683445777ae1d20fd52551a5df9327692103","3710742057e470e8882a84412721ed19652e3f13977af21a937bad27d75b6f96","dd1a177126d48072381db98af74c964100c8ef2e43286f3a31114461251a164c","0d8c5bb69c567e3949cc6e087610d79c886d9140d0eda88cc92d3ec63fb7a3b9","b6bc001bc9b4171a27fb2a485cb3e3d8f23bc1ee6b4a03bbcfbba63b7d208477","2c7bf841a659fa1d8105d26f6664ebc3a78b99e0c071eb7f529503346c40f778","cbbe1d5a7d4a721c61b9c3b8b6a8e5d65508f02c70e708698d8165d92e154383","25034c2542757ac93cb6008479a5bfc594f9e92f66249f6fb862447a18847ba7","148d3552db2acf469c84e26889336f06167c6cf455248e08d703282bc0556fb8","7186674c208242b8e6fdf7b0f4e7539218590618fee517aa264e8446247d3440","7a48db17a02e94c97a329cc1a578777d8b4fb74221bdb22202369d6590917fd0","7a48db17a02e94c97a329cc1a578777d8b4fb74221bdb22202369d6590917fd0","ca7dc2b0856f89e71ce9da6f179b34c8879456b5dffda0b5bd3f0fd73bab1c50")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("796deae716a6d66b49a99d00e541056babe34fd2fcbcea0380491de4b792afba","18e45358462363996688ceabfc098e17f855d73842f460b34c683e58c728149f","88bd580aa51129e4e5fa69e148131874c862015e7c51d59497e11f22db2d72c6","23664decf3c2f28a3f552dc98d90017926617969713ccccdc9f5fd3178d76dbf","ba63fbf6f7bab000bc1b1bf92319415328cea238872450adbaac6a6069132779","f359b687fb9e1a4c27fdf5174380abc9877f940ef6a6fd4d38e9ef40bb778107","815ebfc4fb5bddf1f9ca1b12ae2a1b0e37736a93ea9babe858747096ad9ce671","d21ae84e104a305b5aebee8e6fbb4837976ef26935dac90372637f913ef58154","0c006540abcb768cad80a1a8ced926fa58f10cf9eb0be16c4185850df83bff82","847e684a228292dc905205d7353ed9458e10129105fe3b387c4e9374d6afd783","ed6a350c4b1baa6f098293c328d0a62d35aafb4ab62b93e6f3a611f06be9aa29","123480357ab54d2c2067640105b5683445777ae1d20fd52551a5df9327692103","3710742057e470e8882a84412721ed19652e3f13977af21a937bad27d75b6f96","dd1a177126d48072381db98af74c964100c8ef2e43286f3a31114461251a164c","0d8c5bb69c567e3949cc6e087610d79c886d9140d0eda88cc92d3ec63fb7a3b9","b6bc001bc9b4171a27fb2a485cb3e3d8f23bc1ee6b4a03bbcfbba63b7d208477","2c7bf841a659fa1d8105d26f6664ebc3a78b99e0c071eb7f529503346c40f778","cbbe1d5a7d4a721c61b9c3b8b6a8e5d65508f02c70e708698d8165d92e154383","25034c2542757ac93cb6008479a5bfc594f9e92f66249f6fb862447a18847ba7","148d3552db2acf469c84e26889336f06167c6cf455248e08d703282bc0556fb8","7186674c208242b8e6fdf7b0f4e7539218590618fee517aa264e8446247d3440","7a48db17a02e94c97a329cc1a578777d8b4fb74221bdb22202369d6590917fd0","7a48db17a02e94c97a329cc1a578777d8b4fb74221bdb22202369d6590917fd0","ca7dc2b0856f89e71ce9da6f179b34c8879456b5dffda0b5bd3f0fd73bab1c50")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("796deae716a6d66b49a99d00e541056babe34fd2fcbcea0380491de4b792afba","18e45358462363996688ceabfc098e17f855d73842f460b34c683e58c728149f","88bd580aa51129e4e5fa69e148131874c862015e7c51d59497e11f22db2d72c6","23664decf3c2f28a3f552dc98d90017926617969713ccccdc9f5fd3178d76dbf","ba63fbf6f7bab000bc1b1bf92319415328cea238872450adbaac6a6069132779","f359b687fb9e1a4c27fdf5174380abc9877f940ef6a6fd4d38e9ef40bb778107","815ebfc4fb5bddf1f9ca1b12ae2a1b0e37736a93ea9babe858747096ad9ce671","d21ae84e104a305b5aebee8e6fbb4837976ef26935dac90372637f913ef58154","0c006540abcb768cad80a1a8ced926fa58f10cf9eb0be16c4185850df83bff82","847e684a228292dc905205d7353ed9458e10129105fe3b387c4e9374d6afd783","ed6a350c4b1baa6f098293c328d0a62d35aafb4ab62b93e6f3a611f06be9aa29","123480357ab54d2c2067640105b5683445777ae1d20fd52551a5df9327692103","3710742057e470e8882a84412721ed19652e3f13977af21a937bad27d75b6f96","dd1a177126d48072381db98af74c964100c8ef2e43286f3a31114461251a164c","0d8c5bb69c567e3949cc6e087610d79c886d9140d0eda88cc92d3ec63fb7a3b9","b6bc001bc9b4171a27fb2a485cb3e3d8f23bc1ee6b4a03bbcfbba63b7d208477","2c7bf841a659fa1d8105d26f6664ebc3a78b99e0c071eb7f529503346c40f778","cbbe1d5a7d4a721c61b9c3b8b6a8e5d65508f02c70e708698d8165d92e154383","25034c2542757ac93cb6008479a5bfc594f9e92f66249f6fb862447a18847ba7","148d3552db2acf469c84e26889336f06167c6cf455248e08d703282bc0556fb8","7186674c208242b8e6fdf7b0f4e7539218590618fee517aa264e8446247d3440","7a48db17a02e94c97a329cc1a578777d8b4fb74221bdb22202369d6590917fd0","7a48db17a02e94c97a329cc1a578777d8b4fb74221bdb22202369d6590917fd0","ca7dc2b0856f89e71ce9da6f179b34c8879456b5dffda0b5bd3f0fd73bab1c50")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("796deae716a6d66b49a99d00e541056babe34fd2fcbcea0380491de4b792afba","18e45358462363996688ceabfc098e17f855d73842f460b34c683e58c728149f","88bd580aa51129e4e5fa69e148131874c862015e7c51d59497e11f22db2d72c6","23664decf3c2f28a3f552dc98d90017926617969713ccccdc9f5fd3178d76dbf","ba63fbf6f7bab000bc1b1bf92319415328cea238872450adbaac6a6069132779","f359b687fb9e1a4c27fdf5174380abc9877f940ef6a6fd4d38e9ef40bb778107","815ebfc4fb5bddf1f9ca1b12ae2a1b0e37736a93ea9babe858747096ad9ce671","d21ae84e104a305b5aebee8e6fbb4837976ef26935dac90372637f913ef58154","0c006540abcb768cad80a1a8ced926fa58f10cf9eb0be16c4185850df83bff82","847e684a228292dc905205d7353ed9458e10129105fe3b387c4e9374d6afd783","ed6a350c4b1baa6f098293c328d0a62d35aafb4ab62b93e6f3a611f06be9aa29","123480357ab54d2c2067640105b5683445777ae1d20fd52551a5df9327692103","3710742057e470e8882a84412721ed19652e3f13977af21a937bad27d75b6f96","dd1a177126d48072381db98af74c964100c8ef2e43286f3a31114461251a164c","0d8c5bb69c567e3949cc6e087610d79c886d9140d0eda88cc92d3ec63fb7a3b9","b6bc001bc9b4171a27fb2a485cb3e3d8f23bc1ee6b4a03bbcfbba63b7d208477","2c7bf841a659fa1d8105d26f6664ebc3a78b99e0c071eb7f529503346c40f778","cbbe1d5a7d4a721c61b9c3b8b6a8e5d65508f02c70e708698d8165d92e154383","25034c2542757ac93cb6008479a5bfc594f9e92f66249f6fb862447a18847ba7","148d3552db2acf469c84e26889336f06167c6cf455248e08d703282bc0556fb8","7186674c208242b8e6fdf7b0f4e7539218590618fee517aa264e8446247d3440","7a48db17a02e94c97a329cc1a578777d8b4fb74221bdb22202369d6590917fd0","7a48db17a02e94c97a329cc1a578777d8b4fb74221bdb22202369d6590917fd0","ca7dc2b0856f89e71ce9da6f179b34c8879456b5dffda0b5bd3f0fd73bab1c50")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("796deae716a6d66b49a99d00e541056babe34fd2fcbcea0380491de4b792afba","18e45358462363996688ceabfc098e17f855d73842f460b34c683e58c728149f","88bd580aa51129e4e5fa69e148131874c862015e7c51d59497e11f22db2d72c6","23664decf3c2f28a3f552dc98d90017926617969713ccccdc9f5fd3178d76dbf","ba63fbf6f7bab000bc1b1bf92319415328cea238872450adbaac6a6069132779","f359b687fb9e1a4c27fdf5174380abc9877f940ef6a6fd4d38e9ef40bb778107","815ebfc4fb5bddf1f9ca1b12ae2a1b0e37736a93ea9babe858747096ad9ce671","d21ae84e104a305b5aebee8e6fbb4837976ef26935dac90372637f913ef58154","0c006540abcb768cad80a1a8ced926fa58f10cf9eb0be16c4185850df83bff82","847e684a228292dc905205d7353ed9458e10129105fe3b387c4e9374d6afd783","ed6a350c4b1baa6f098293c328d0a62d35aafb4ab62b93e6f3a611f06be9aa29","123480357ab54d2c2067640105b5683445777ae1d20fd52551a5df9327692103","3710742057e470e8882a84412721ed19652e3f13977af21a937bad27d75b6f96","dd1a177126d48072381db98af74c964100c8ef2e43286f3a31114461251a164c","0d8c5bb69c567e3949cc6e087610d79c886d9140d0eda88cc92d3ec63fb7a3b9","b6bc001bc9b4171a27fb2a485cb3e3d8f23bc1ee6b4a03bbcfbba63b7d208477","2c7bf841a659fa1d8105d26f6664ebc3a78b99e0c071eb7f529503346c40f778","cbbe1d5a7d4a721c61b9c3b8b6a8e5d65508f02c70e708698d8165d92e154383","25034c2542757ac93cb6008479a5bfc594f9e92f66249f6fb862447a18847ba7","148d3552db2acf469c84e26889336f06167c6cf455248e08d703282bc0556fb8","7186674c208242b8e6fdf7b0f4e7539218590618fee517aa264e8446247d3440","7a48db17a02e94c97a329cc1a578777d8b4fb74221bdb22202369d6590917fd0","7a48db17a02e94c97a329cc1a578777d8b4fb74221bdb22202369d6590917fd0","ca7dc2b0856f89e71ce9da6f179b34c8879456b5dffda0b5bd3f0fd73bab1c50")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("796deae716a6d66b49a99d00e541056babe34fd2fcbcea0380491de4b792afba","18e45358462363996688ceabfc098e17f855d73842f460b34c683e58c728149f","88bd580aa51129e4e5fa69e148131874c862015e7c51d59497e11f22db2d72c6","23664decf3c2f28a3f552dc98d90017926617969713ccccdc9f5fd3178d76dbf","ba63fbf6f7bab000bc1b1bf92319415328cea238872450adbaac6a6069132779","f359b687fb9e1a4c27fdf5174380abc9877f940ef6a6fd4d38e9ef40bb778107","815ebfc4fb5bddf1f9ca1b12ae2a1b0e37736a93ea9babe858747096ad9ce671","d21ae84e104a305b5aebee8e6fbb4837976ef26935dac90372637f913ef58154","0c006540abcb768cad80a1a8ced926fa58f10cf9eb0be16c4185850df83bff82","847e684a228292dc905205d7353ed9458e10129105fe3b387c4e9374d6afd783","ed6a350c4b1baa6f098293c328d0a62d35aafb4ab62b93e6f3a611f06be9aa29","123480357ab54d2c2067640105b5683445777ae1d20fd52551a5df9327692103","3710742057e470e8882a84412721ed19652e3f13977af21a937bad27d75b6f96","dd1a177126d48072381db98af74c964100c8ef2e43286f3a31114461251a164c","0d8c5bb69c567e3949cc6e087610d79c886d9140d0eda88cc92d3ec63fb7a3b9","b6bc001bc9b4171a27fb2a485cb3e3d8f23bc1ee6b4a03bbcfbba63b7d208477","2c7bf841a659fa1d8105d26f6664ebc3a78b99e0c071eb7f529503346c40f778","cbbe1d5a7d4a721c61b9c3b8b6a8e5d65508f02c70e708698d8165d92e154383","25034c2542757ac93cb6008479a5bfc594f9e92f66249f6fb862447a18847ba7","148d3552db2acf469c84e26889336f06167c6cf455248e08d703282bc0556fb8","7186674c208242b8e6fdf7b0f4e7539218590618fee517aa264e8446247d3440","7a48db17a02e94c97a329cc1a578777d8b4fb74221bdb22202369d6590917fd0","7a48db17a02e94c97a329cc1a578777d8b4fb74221bdb22202369d6590917fd0","ca7dc2b0856f89e71ce9da6f179b34c8879456b5dffda0b5bd3f0fd73bab1c50")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("796deae716a6d66b49a99d00e541056babe34fd2fcbcea0380491de4b792afba","18e45358462363996688ceabfc098e17f855d73842f460b34c683e58c728149f","88bd580aa51129e4e5fa69e148131874c862015e7c51d59497e11f22db2d72c6","23664decf3c2f28a3f552dc98d90017926617969713ccccdc9f5fd3178d76dbf","ba63fbf6f7bab000bc1b1bf92319415328cea238872450adbaac6a6069132779","f359b687fb9e1a4c27fdf5174380abc9877f940ef6a6fd4d38e9ef40bb778107","815ebfc4fb5bddf1f9ca1b12ae2a1b0e37736a93ea9babe858747096ad9ce671","d21ae84e104a305b5aebee8e6fbb4837976ef26935dac90372637f913ef58154","0c006540abcb768cad80a1a8ced926fa58f10cf9eb0be16c4185850df83bff82","847e684a228292dc905205d7353ed9458e10129105fe3b387c4e9374d6afd783","ed6a350c4b1baa6f098293c328d0a62d35aafb4ab62b93e6f3a611f06be9aa29","123480357ab54d2c2067640105b5683445777ae1d20fd52551a5df9327692103","3710742057e470e8882a84412721ed19652e3f13977af21a937bad27d75b6f96","dd1a177126d48072381db98af74c964100c8ef2e43286f3a31114461251a164c","0d8c5bb69c567e3949cc6e087610d79c886d9140d0eda88cc92d3ec63fb7a3b9","b6bc001bc9b4171a27fb2a485cb3e3d8f23bc1ee6b4a03bbcfbba63b7d208477","2c7bf841a659fa1d8105d26f6664ebc3a78b99e0c071eb7f529503346c40f778","cbbe1d5a7d4a721c61b9c3b8b6a8e5d65508f02c70e708698d8165d92e154383","25034c2542757ac93cb6008479a5bfc594f9e92f66249f6fb862447a18847ba7","148d3552db2acf469c84e26889336f06167c6cf455248e08d703282bc0556fb8","7186674c208242b8e6fdf7b0f4e7539218590618fee517aa264e8446247d3440","7a48db17a02e94c97a329cc1a578777d8b4fb74221bdb22202369d6590917fd0","7a48db17a02e94c97a329cc1a578777d8b4fb74221bdb22202369d6590917fd0","ca7dc2b0856f89e71ce9da6f179b34c8879456b5dffda0b5bd3f0fd73bab1c50")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("796deae716a6d66b49a99d00e541056babe34fd2fcbcea0380491de4b792afba","18e45358462363996688ceabfc098e17f855d73842f460b34c683e58c728149f","88bd580aa51129e4e5fa69e148131874c862015e7c51d59497e11f22db2d72c6","23664decf3c2f28a3f552dc98d90017926617969713ccccdc9f5fd3178d76dbf","ba63fbf6f7bab000bc1b1bf92319415328cea238872450adbaac6a6069132779","f359b687fb9e1a4c27fdf5174380abc9877f940ef6a6fd4d38e9ef40bb778107","815ebfc4fb5bddf1f9ca1b12ae2a1b0e37736a93ea9babe858747096ad9ce671","d21ae84e104a305b5aebee8e6fbb4837976ef26935dac90372637f913ef58154","0c006540abcb768cad80a1a8ced926fa58f10cf9eb0be16c4185850df83bff82","847e684a228292dc905205d7353ed9458e10129105fe3b387c4e9374d6afd783","ed6a350c4b1baa6f098293c328d0a62d35aafb4ab62b93e6f3a611f06be9aa29","123480357ab54d2c2067640105b5683445777ae1d20fd52551a5df9327692103","3710742057e470e8882a84412721ed19652e3f13977af21a937bad27d75b6f96","dd1a177126d48072381db98af74c964100c8ef2e43286f3a31114461251a164c","0d8c5bb69c567e3949cc6e087610d79c886d9140d0eda88cc92d3ec63fb7a3b9","b6bc001bc9b4171a27fb2a485cb3e3d8f23bc1ee6b4a03bbcfbba63b7d208477","2c7bf841a659fa1d8105d26f6664ebc3a78b99e0c071eb7f529503346c40f778","cbbe1d5a7d4a721c61b9c3b8b6a8e5d65508f02c70e708698d8165d92e154383","25034c2542757ac93cb6008479a5bfc594f9e92f66249f6fb862447a18847ba7","148d3552db2acf469c84e26889336f06167c6cf455248e08d703282bc0556fb8","7186674c208242b8e6fdf7b0f4e7539218590618fee517aa264e8446247d3440","7a48db17a02e94c97a329cc1a578777d8b4fb74221bdb22202369d6590917fd0","7a48db17a02e94c97a329cc1a578777d8b4fb74221bdb22202369d6590917fd0","ca7dc2b0856f89e71ce9da6f179b34c8879456b5dffda0b5bd3f0fd73bab1c50")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring64 NOT NULL AND customstring64 IN ("796deae716a6d66b49a99d00e541056babe34fd2fcbcea0380491de4b792afba","18e45358462363996688ceabfc098e17f855d73842f460b34c683e58c728149f","88bd580aa51129e4e5fa69e148131874c862015e7c51d59497e11f22db2d72c6","23664decf3c2f28a3f552dc98d90017926617969713ccccdc9f5fd3178d76dbf","ba63fbf6f7bab000bc1b1bf92319415328cea238872450adbaac6a6069132779","f359b687fb9e1a4c27fdf5174380abc9877f940ef6a6fd4d38e9ef40bb778107","815ebfc4fb5bddf1f9ca1b12ae2a1b0e37736a93ea9babe858747096ad9ce671","d21ae84e104a305b5aebee8e6fbb4837976ef26935dac90372637f913ef58154","0c006540abcb768cad80a1a8ced926fa58f10cf9eb0be16c4185850df83bff82","847e684a228292dc905205d7353ed9458e10129105fe3b387c4e9374d6afd783","ed6a350c4b1baa6f098293c328d0a62d35aafb4ab62b93e6f3a611f06be9aa29","123480357ab54d2c2067640105b5683445777ae1d20fd52551a5df9327692103","3710742057e470e8882a84412721ed19652e3f13977af21a937bad27d75b6f96","dd1a177126d48072381db98af74c964100c8ef2e43286f3a31114461251a164c","0d8c5bb69c567e3949cc6e087610d79c886d9140d0eda88cc92d3ec63fb7a3b9","b6bc001bc9b4171a27fb2a485cb3e3d8f23bc1ee6b4a03bbcfbba63b7d208477","2c7bf841a659fa1d8105d26f6664ebc3a78b99e0c071eb7f529503346c40f778","cbbe1d5a7d4a721c61b9c3b8b6a8e5d65508f02c70e708698d8165d92e154383","25034c2542757ac93cb6008479a5bfc594f9e92f66249f6fb862447a18847ba7","148d3552db2acf469c84e26889336f06167c6cf455248e08d703282bc0556fb8","7186674c208242b8e6fdf7b0f4e7539218590618fee517aa264e8446247d3440","7a48db17a02e94c97a329cc1a578777d8b4fb74221bdb22202369d6590917fd0","7a48db17a02e94c97a329cc1a578777d8b4fb74221bdb22202369d6590917fd0","ca7dc2b0856f89e71ce9da6f179b34c8879456b5dffda0b5bd3f0fd73bab1c50")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("796deae716a6d66b49a99d00e541056babe34fd2fcbcea0380491de4b792afba","18e45358462363996688ceabfc098e17f855d73842f460b34c683e58c728149f","88bd580aa51129e4e5fa69e148131874c862015e7c51d59497e11f22db2d72c6","23664decf3c2f28a3f552dc98d90017926617969713ccccdc9f5fd3178d76dbf","ba63fbf6f7bab000bc1b1bf92319415328cea238872450adbaac6a6069132779","f359b687fb9e1a4c27fdf5174380abc9877f940ef6a6fd4d38e9ef40bb778107","815ebfc4fb5bddf1f9ca1b12ae2a1b0e37736a93ea9babe858747096ad9ce671","d21ae84e104a305b5aebee8e6fbb4837976ef26935dac90372637f913ef58154","0c006540abcb768cad80a1a8ced926fa58f10cf9eb0be16c4185850df83bff82","847e684a228292dc905205d7353ed9458e10129105fe3b387c4e9374d6afd783","ed6a350c4b1baa6f098293c328d0a62d35aafb4ab62b93e6f3a611f06be9aa29","123480357ab54d2c2067640105b5683445777ae1d20fd52551a5df9327692103","3710742057e470e8882a84412721ed19652e3f13977af21a937bad27d75b6f96","dd1a177126d48072381db98af74c964100c8ef2e43286f3a31114461251a164c","0d8c5bb69c567e3949cc6e087610d79c886d9140d0eda88cc92d3ec63fb7a3b9","b6bc001bc9b4171a27fb2a485cb3e3d8f23bc1ee6b4a03bbcfbba63b7d208477","2c7bf841a659fa1d8105d26f6664ebc3a78b99e0c071eb7f529503346c40f778","cbbe1d5a7d4a721c61b9c3b8b6a8e5d65508f02c70e708698d8165d92e154383","25034c2542757ac93cb6008479a5bfc594f9e92f66249f6fb862447a18847ba7","148d3552db2acf469c84e26889336f06167c6cf455248e08d703282bc0556fb8","7186674c208242b8e6fdf7b0f4e7539218590618fee517aa264e8446247d3440","7a48db17a02e94c97a329cc1a578777d8b4fb74221bdb22202369d6590917fd0","7a48db17a02e94c97a329cc1a578777d8b4fb74221bdb22202369d6590917fd0","ca7dc2b0856f89e71ce9da6f179b34c8879456b5dffda0b5bd3f0fd73bab1c50")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("796deae716a6d66b49a99d00e541056babe34fd2fcbcea0380491de4b792afba","18e45358462363996688ceabfc098e17f855d73842f460b34c683e58c728149f","88bd580aa51129e4e5fa69e148131874c862015e7c51d59497e11f22db2d72c6","23664decf3c2f28a3f552dc98d90017926617969713ccccdc9f5fd3178d76dbf","ba63fbf6f7bab000bc1b1bf92319415328cea238872450adbaac6a6069132779","f359b687fb9e1a4c27fdf5174380abc9877f940ef6a6fd4d38e9ef40bb778107","815ebfc4fb5bddf1f9ca1b12ae2a1b0e37736a93ea9babe858747096ad9ce671","d21ae84e104a305b5aebee8e6fbb4837976ef26935dac90372637f913ef58154","0c006540abcb768cad80a1a8ced926fa58f10cf9eb0be16c4185850df83bff82","847e684a228292dc905205d7353ed9458e10129105fe3b387c4e9374d6afd783","ed6a350c4b1baa6f098293c328d0a62d35aafb4ab62b93e6f3a611f06be9aa29","123480357ab54d2c2067640105b5683445777ae1d20fd52551a5df9327692103","3710742057e470e8882a84412721ed19652e3f13977af21a937bad27d75b6f96","dd1a177126d48072381db98af74c964100c8ef2e43286f3a31114461251a164c","0d8c5bb69c567e3949cc6e087610d79c886d9140d0eda88cc92d3ec63fb7a3b9","b6bc001bc9b4171a27fb2a485cb3e3d8f23bc1ee6b4a03bbcfbba63b7d208477","2c7bf841a659fa1d8105d26f6664ebc3a78b99e0c071eb7f529503346c40f778","cbbe1d5a7d4a721c61b9c3b8b6a8e5d65508f02c70e708698d8165d92e154383","25034c2542757ac93cb6008479a5bfc594f9e92f66249f6fb862447a18847ba7","148d3552db2acf469c84e26889336f06167c6cf455248e08d703282bc0556fb8","7186674c208242b8e6fdf7b0f4e7539218590618fee517aa264e8446247d3440","7a48db17a02e94c97a329cc1a578777d8b4fb74221bdb22202369d6590917fd0","7a48db17a02e94c97a329cc1a578777d8b4fb74221bdb22202369d6590917fd0","ca7dc2b0856f89e71ce9da6f179b34c8879456b5dffda0b5bd3f0fd73bab1c50")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("796deae716a6d66b49a99d00e541056babe34fd2fcbcea0380491de4b792afba","18e45358462363996688ceabfc098e17f855d73842f460b34c683e58c728149f","88bd580aa51129e4e5fa69e148131874c862015e7c51d59497e11f22db2d72c6","23664decf3c2f28a3f552dc98d90017926617969713ccccdc9f5fd3178d76dbf","ba63fbf6f7bab000bc1b1bf92319415328cea238872450adbaac6a6069132779","f359b687fb9e1a4c27fdf5174380abc9877f940ef6a6fd4d38e9ef40bb778107","815ebfc4fb5bddf1f9ca1b12ae2a1b0e37736a93ea9babe858747096ad9ce671","d21ae84e104a305b5aebee8e6fbb4837976ef26935dac90372637f913ef58154","0c006540abcb768cad80a1a8ced926fa58f10cf9eb0be16c4185850df83bff82","847e684a228292dc905205d7353ed9458e10129105fe3b387c4e9374d6afd783","ed6a350c4b1baa6f098293c328d0a62d35aafb4ab62b93e6f3a611f06be9aa29","123480357ab54d2c2067640105b5683445777ae1d20fd52551a5df9327692103","3710742057e470e8882a84412721ed19652e3f13977af21a937bad27d75b6f96","dd1a177126d48072381db98af74c964100c8ef2e43286f3a31114461251a164c","0d8c5bb69c567e3949cc6e087610d79c886d9140d0eda88cc92d3ec63fb7a3b9","b6bc001bc9b4171a27fb2a485cb3e3d8f23bc1ee6b4a03bbcfbba63b7d208477","2c7bf841a659fa1d8105d26f6664ebc3a78b99e0c071eb7f529503346c40f778","cbbe1d5a7d4a721c61b9c3b8b6a8e5d65508f02c70e708698d8165d92e154383","25034c2542757ac93cb6008479a5bfc594f9e92f66249f6fb862447a18847ba7","148d3552db2acf469c84e26889336f06167c6cf455248e08d703282bc0556fb8","7186674c208242b8e6fdf7b0f4e7539218590618fee517aa264e8446247d3440","7a48db17a02e94c97a329cc1a578777d8b4fb74221bdb22202369d6590917fd0","7a48db17a02e94c97a329cc1a578777d8b4fb74221bdb22202369d6590917fd0","ca7dc2b0856f89e71ce9da6f179b34c8879456b5dffda0b5bd3f0fd73bab1c50")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring64 NOT NULL AND customstring64 IN ("796deae716a6d66b49a99d00e541056babe34fd2fcbcea0380491de4b792afba","18e45358462363996688ceabfc098e17f855d73842f460b34c683e58c728149f","88bd580aa51129e4e5fa69e148131874c862015e7c51d59497e11f22db2d72c6","23664decf3c2f28a3f552dc98d90017926617969713ccccdc9f5fd3178d76dbf","ba63fbf6f7bab000bc1b1bf92319415328cea238872450adbaac6a6069132779","f359b687fb9e1a4c27fdf5174380abc9877f940ef6a6fd4d38e9ef40bb778107","815ebfc4fb5bddf1f9ca1b12ae2a1b0e37736a93ea9babe858747096ad9ce671","d21ae84e104a305b5aebee8e6fbb4837976ef26935dac90372637f913ef58154","0c006540abcb768cad80a1a8ced926fa58f10cf9eb0be16c4185850df83bff82","847e684a228292dc905205d7353ed9458e10129105fe3b387c4e9374d6afd783","ed6a350c4b1baa6f098293c328d0a62d35aafb4ab62b93e6f3a611f06be9aa29","123480357ab54d2c2067640105b5683445777ae1d20fd52551a5df9327692103","3710742057e470e8882a84412721ed19652e3f13977af21a937bad27d75b6f96","dd1a177126d48072381db98af74c964100c8ef2e43286f3a31114461251a164c","0d8c5bb69c567e3949cc6e087610d79c886d9140d0eda88cc92d3ec63fb7a3b9","b6bc001bc9b4171a27fb2a485cb3e3d8f23bc1ee6b4a03bbcfbba63b7d208477","2c7bf841a659fa1d8105d26f6664ebc3a78b99e0c071eb7f529503346c40f778","cbbe1d5a7d4a721c61b9c3b8b6a8e5d65508f02c70e708698d8165d92e154383","25034c2542757ac93cb6008479a5bfc594f9e92f66249f6fb862447a18847ba7","148d3552db2acf469c84e26889336f06167c6cf455248e08d703282bc0556fb8","7186674c208242b8e6fdf7b0f4e7539218590618fee517aa264e8446247d3440","7a48db17a02e94c97a329cc1a578777d8b4fb74221bdb22202369d6590917fd0","7a48db17a02e94c97a329cc1a578777d8b4fb74221bdb22202369d6590917fd0","ca7dc2b0856f89e71ce9da6f179b34c8879456b5dffda0b5bd3f0fd73bab1c50")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("796deae716a6d66b49a99d00e541056babe34fd2fcbcea0380491de4b792afba","18e45358462363996688ceabfc098e17f855d73842f460b34c683e58c728149f","88bd580aa51129e4e5fa69e148131874c862015e7c51d59497e11f22db2d72c6","23664decf3c2f28a3f552dc98d90017926617969713ccccdc9f5fd3178d76dbf","ba63fbf6f7bab000bc1b1bf92319415328cea238872450adbaac6a6069132779","f359b687fb9e1a4c27fdf5174380abc9877f940ef6a6fd4d38e9ef40bb778107","815ebfc4fb5bddf1f9ca1b12ae2a1b0e37736a93ea9babe858747096ad9ce671","d21ae84e104a305b5aebee8e6fbb4837976ef26935dac90372637f913ef58154","0c006540abcb768cad80a1a8ced926fa58f10cf9eb0be16c4185850df83bff82","847e684a228292dc905205d7353ed9458e10129105fe3b387c4e9374d6afd783","ed6a350c4b1baa6f098293c328d0a62d35aafb4ab62b93e6f3a611f06be9aa29","123480357ab54d2c2067640105b5683445777ae1d20fd52551a5df9327692103","3710742057e470e8882a84412721ed19652e3f13977af21a937bad27d75b6f96","dd1a177126d48072381db98af74c964100c8ef2e43286f3a31114461251a164c","0d8c5bb69c567e3949cc6e087610d79c886d9140d0eda88cc92d3ec63fb7a3b9","b6bc001bc9b4171a27fb2a485cb3e3d8f23bc1ee6b4a03bbcfbba63b7d208477","2c7bf841a659fa1d8105d26f6664ebc3a78b99e0c071eb7f529503346c40f778","cbbe1d5a7d4a721c61b9c3b8b6a8e5d65508f02c70e708698d8165d92e154383","25034c2542757ac93cb6008479a5bfc594f9e92f66249f6fb862447a18847ba7","148d3552db2acf469c84e26889336f06167c6cf455248e08d703282bc0556fb8","7186674c208242b8e6fdf7b0f4e7539218590618fee517aa264e8446247d3440","7a48db17a02e94c97a329cc1a578777d8b4fb74221bdb22202369d6590917fd0","7a48db17a02e94c97a329cc1a578777d8b4fb74221bdb22202369d6590917fd0","ca7dc2b0856f89e71ce9da6f179b34c8879456b5dffda0b5bd3f0fd73bab1c50")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("796deae716a6d66b49a99d00e541056babe34fd2fcbcea0380491de4b792afba","18e45358462363996688ceabfc098e17f855d73842f460b34c683e58c728149f","88bd580aa51129e4e5fa69e148131874c862015e7c51d59497e11f22db2d72c6","23664decf3c2f28a3f552dc98d90017926617969713ccccdc9f5fd3178d76dbf","ba63fbf6f7bab000bc1b1bf92319415328cea238872450adbaac6a6069132779","f359b687fb9e1a4c27fdf5174380abc9877f940ef6a6fd4d38e9ef40bb778107","815ebfc4fb5bddf1f9ca1b12ae2a1b0e37736a93ea9babe858747096ad9ce671","d21ae84e104a305b5aebee8e6fbb4837976ef26935dac90372637f913ef58154","0c006540abcb768cad80a1a8ced926fa58f10cf9eb0be16c4185850df83bff82","847e684a228292dc905205d7353ed9458e10129105fe3b387c4e9374d6afd783","ed6a350c4b1baa6f098293c328d0a62d35aafb4ab62b93e6f3a611f06be9aa29","123480357ab54d2c2067640105b5683445777ae1d20fd52551a5df9327692103","3710742057e470e8882a84412721ed19652e3f13977af21a937bad27d75b6f96","dd1a177126d48072381db98af74c964100c8ef2e43286f3a31114461251a164c","0d8c5bb69c567e3949cc6e087610d79c886d9140d0eda88cc92d3ec63fb7a3b9","b6bc001bc9b4171a27fb2a485cb3e3d8f23bc1ee6b4a03bbcfbba63b7d208477","2c7bf841a659fa1d8105d26f6664ebc3a78b99e0c071eb7f529503346c40f778","cbbe1d5a7d4a721c61b9c3b8b6a8e5d65508f02c70e708698d8165d92e154383","25034c2542757ac93cb6008479a5bfc594f9e92f66249f6fb862447a18847ba7","148d3552db2acf469c84e26889336f06167c6cf455248e08d703282bc0556fb8","7186674c208242b8e6fdf7b0f4e7539218590618fee517aa264e8446247d3440","7a48db17a02e94c97a329cc1a578777d8b4fb74221bdb22202369d6590917fd0","7a48db17a02e94c97a329cc1a578777d8b4fb74221bdb22202369d6590917fd0","ca7dc2b0856f89e71ce9da6f179b34c8879456b5dffda0b5bd3f0fd73bab1c50")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("796deae716a6d66b49a99d00e541056babe34fd2fcbcea0380491de4b792afba","18e45358462363996688ceabfc098e17f855d73842f460b34c683e58c728149f","88bd580aa51129e4e5fa69e148131874c862015e7c51d59497e11f22db2d72c6","23664decf3c2f28a3f552dc98d90017926617969713ccccdc9f5fd3178d76dbf","ba63fbf6f7bab000bc1b1bf92319415328cea238872450adbaac6a6069132779","f359b687fb9e1a4c27fdf5174380abc9877f940ef6a6fd4d38e9ef40bb778107","815ebfc4fb5bddf1f9ca1b12ae2a1b0e37736a93ea9babe858747096ad9ce671","d21ae84e104a305b5aebee8e6fbb4837976ef26935dac90372637f913ef58154","0c006540abcb768cad80a1a8ced926fa58f10cf9eb0be16c4185850df83bff82","847e684a228292dc905205d7353ed9458e10129105fe3b387c4e9374d6afd783","ed6a350c4b1baa6f098293c328d0a62d35aafb4ab62b93e6f3a611f06be9aa29","123480357ab54d2c2067640105b5683445777ae1d20fd52551a5df9327692103","3710742057e470e8882a84412721ed19652e3f13977af21a937bad27d75b6f96","dd1a177126d48072381db98af74c964100c8ef2e43286f3a31114461251a164c","0d8c5bb69c567e3949cc6e087610d79c886d9140d0eda88cc92d3ec63fb7a3b9","b6bc001bc9b4171a27fb2a485cb3e3d8f23bc1ee6b4a03bbcfbba63b7d208477","2c7bf841a659fa1d8105d26f6664ebc3a78b99e0c071eb7f529503346c40f778","cbbe1d5a7d4a721c61b9c3b8b6a8e5d65508f02c70e708698d8165d92e154383","25034c2542757ac93cb6008479a5bfc594f9e92f66249f6fb862447a18847ba7","148d3552db2acf469c84e26889336f06167c6cf455248e08d703282bc0556fb8","7186674c208242b8e6fdf7b0f4e7539218590618fee517aa264e8446247d3440","7a48db17a02e94c97a329cc1a578777d8b4fb74221bdb22202369d6590917fd0","7a48db17a02e94c97a329cc1a578777d8b4fb74221bdb22202369d6590917fd0","ca7dc2b0856f89e71ce9da6f179b34c8879456b5dffda0b5bd3f0fd73bab1c50")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring64 NOT NULL AND customstring64 IN ("796deae716a6d66b49a99d00e541056babe34fd2fcbcea0380491de4b792afba","18e45358462363996688ceabfc098e17f855d73842f460b34c683e58c728149f","88bd580aa51129e4e5fa69e148131874c862015e7c51d59497e11f22db2d72c6","23664decf3c2f28a3f552dc98d90017926617969713ccccdc9f5fd3178d76dbf","ba63fbf6f7bab000bc1b1bf92319415328cea238872450adbaac6a6069132779","f359b687fb9e1a4c27fdf5174380abc9877f940ef6a6fd4d38e9ef40bb778107","815ebfc4fb5bddf1f9ca1b12ae2a1b0e37736a93ea9babe858747096ad9ce671","d21ae84e104a305b5aebee8e6fbb4837976ef26935dac90372637f913ef58154","0c006540abcb768cad80a1a8ced926fa58f10cf9eb0be16c4185850df83bff82","847e684a228292dc905205d7353ed9458e10129105fe3b387c4e9374d6afd783","ed6a350c4b1baa6f098293c328d0a62d35aafb4ab62b93e6f3a611f06be9aa29","123480357ab54d2c2067640105b5683445777ae1d20fd52551a5df9327692103","3710742057e470e8882a84412721ed19652e3f13977af21a937bad27d75b6f96","dd1a177126d48072381db98af74c964100c8ef2e43286f3a31114461251a164c","0d8c5bb69c567e3949cc6e087610d79c886d9140d0eda88cc92d3ec63fb7a3b9","b6bc001bc9b4171a27fb2a485cb3e3d8f23bc1ee6b4a03bbcfbba63b7d208477","2c7bf841a659fa1d8105d26f6664ebc3a78b99e0c071eb7f529503346c40f778","cbbe1d5a7d4a721c61b9c3b8b6a8e5d65508f02c70e708698d8165d92e154383","25034c2542757ac93cb6008479a5bfc594f9e92f66249f6fb862447a18847ba7","148d3552db2acf469c84e26889336f06167c6cf455248e08d703282bc0556fb8","7186674c208242b8e6fdf7b0f4e7539218590618fee517aa264e8446247d3440","7a48db17a02e94c97a329cc1a578777d8b4fb74221bdb22202369d6590917fd0","7a48db17a02e94c97a329cc1a578777d8b4fb74221bdb22202369d6590917fd0","ca7dc2b0856f89e71ce9da6f179b34c8879456b5dffda0b5bd3f0fd73bab1c50")
index=activity AND rg_functionality="O365 General" AND filehash NOT NULL AND filehash IN ("796deae716a6d66b49a99d00e541056babe34fd2fcbcea0380491de4b792afba","18e45358462363996688ceabfc098e17f855d73842f460b34c683e58c728149f","88bd580aa51129e4e5fa69e148131874c862015e7c51d59497e11f22db2d72c6","23664decf3c2f28a3f552dc98d90017926617969713ccccdc9f5fd3178d76dbf","ba63fbf6f7bab000bc1b1bf92319415328cea238872450adbaac6a6069132779","f359b687fb9e1a4c27fdf5174380abc9877f940ef6a6fd4d38e9ef40bb778107","815ebfc4fb5bddf1f9ca1b12ae2a1b0e37736a93ea9babe858747096ad9ce671","d21ae84e104a305b5aebee8e6fbb4837976ef26935dac90372637f913ef58154","0c006540abcb768cad80a1a8ced926fa58f10cf9eb0be16c4185850df83bff82","847e684a228292dc905205d7353ed9458e10129105fe3b387c4e9374d6afd783","ed6a350c4b1baa6f098293c328d0a62d35aafb4ab62b93e6f3a611f06be9aa29","123480357ab54d2c2067640105b5683445777ae1d20fd52551a5df9327692103","3710742057e470e8882a84412721ed19652e3f13977af21a937bad27d75b6f96","dd1a177126d48072381db98af74c964100c8ef2e43286f3a31114461251a164c","0d8c5bb69c567e3949cc6e087610d79c886d9140d0eda88cc92d3ec63fb7a3b9","b6bc001bc9b4171a27fb2a485cb3e3d8f23bc1ee6b4a03bbcfbba63b7d208477","2c7bf841a659fa1d8105d26f6664ebc3a78b99e0c071eb7f529503346c40f778","cbbe1d5a7d4a721c61b9c3b8b6a8e5d65508f02c70e708698d8165d92e154383","25034c2542757ac93cb6008479a5bfc594f9e92f66249f6fb862447a18847ba7","148d3552db2acf469c84e26889336f06167c6cf455248e08d703282bc0556fb8","7186674c208242b8e6fdf7b0f4e7539218590618fee517aa264e8446247d3440","7a48db17a02e94c97a329cc1a578777d8b4fb74221bdb22202369d6590917fd0","7a48db17a02e94c97a329cc1a578777d8b4fb74221bdb22202369d6590917fd0","ca7dc2b0856f89e71ce9da6f179b34c8879456b5dffda0b5bd3f0fd73bab1c50")
index=activity AND rg_functionality="O365 General" AND oldfilehash NOT NULL AND oldfilehash IN ("796deae716a6d66b49a99d00e541056babe34fd2fcbcea0380491de4b792afba","18e45358462363996688ceabfc098e17f855d73842f460b34c683e58c728149f","88bd580aa51129e4e5fa69e148131874c862015e7c51d59497e11f22db2d72c6","23664decf3c2f28a3f552dc98d90017926617969713ccccdc9f5fd3178d76dbf","ba63fbf6f7bab000bc1b1bf92319415328cea238872450adbaac6a6069132779","f359b687fb9e1a4c27fdf5174380abc9877f940ef6a6fd4d38e9ef40bb778107","815ebfc4fb5bddf1f9ca1b12ae2a1b0e37736a93ea9babe858747096ad9ce671","d21ae84e104a305b5aebee8e6fbb4837976ef26935dac90372637f913ef58154","0c006540abcb768cad80a1a8ced926fa58f10cf9eb0be16c4185850df83bff82","847e684a228292dc905205d7353ed9458e10129105fe3b387c4e9374d6afd783","ed6a350c4b1baa6f098293c328d0a62d35aafb4ab62b93e6f3a611f06be9aa29","123480357ab54d2c2067640105b5683445777ae1d20fd52551a5df9327692103","3710742057e470e8882a84412721ed19652e3f13977af21a937bad27d75b6f96","dd1a177126d48072381db98af74c964100c8ef2e43286f3a31114461251a164c","0d8c5bb69c567e3949cc6e087610d79c886d9140d0eda88cc92d3ec63fb7a3b9","b6bc001bc9b4171a27fb2a485cb3e3d8f23bc1ee6b4a03bbcfbba63b7d208477","2c7bf841a659fa1d8105d26f6664ebc3a78b99e0c071eb7f529503346c40f778","cbbe1d5a7d4a721c61b9c3b8b6a8e5d65508f02c70e708698d8165d92e154383","25034c2542757ac93cb6008479a5bfc594f9e92f66249f6fb862447a18847ba7","148d3552db2acf469c84e26889336f06167c6cf455248e08d703282bc0556fb8","7186674c208242b8e6fdf7b0f4e7539218590618fee517aa264e8446247d3440","7a48db17a02e94c97a329cc1a578777d8b4fb74221bdb22202369d6590917fd0","7a48db17a02e94c97a329cc1a578777d8b4fb74221bdb22202369d6590917fd0","ca7dc2b0856f89e71ce9da6f179b34c8879456b5dffda0b5bd3f0fd73bab1c50")
index=activity AND rg_functionality="O365 General" AND customstring3 NOT NULL AND customstring3 IN ("796deae716a6d66b49a99d00e541056babe34fd2fcbcea0380491de4b792afba","18e45358462363996688ceabfc098e17f855d73842f460b34c683e58c728149f","88bd580aa51129e4e5fa69e148131874c862015e7c51d59497e11f22db2d72c6","23664decf3c2f28a3f552dc98d90017926617969713ccccdc9f5fd3178d76dbf","ba63fbf6f7bab000bc1b1bf92319415328cea238872450adbaac6a6069132779","f359b687fb9e1a4c27fdf5174380abc9877f940ef6a6fd4d38e9ef40bb778107","815ebfc4fb5bddf1f9ca1b12ae2a1b0e37736a93ea9babe858747096ad9ce671","d21ae84e104a305b5aebee8e6fbb4837976ef26935dac90372637f913ef58154","0c006540abcb768cad80a1a8ced926fa58f10cf9eb0be16c4185850df83bff82","847e684a228292dc905205d7353ed9458e10129105fe3b387c4e9374d6afd783","ed6a350c4b1baa6f098293c328d0a62d35aafb4ab62b93e6f3a611f06be9aa29","123480357ab54d2c2067640105b5683445777ae1d20fd52551a5df9327692103","3710742057e470e8882a84412721ed19652e3f13977af21a937bad27d75b6f96","dd1a177126d48072381db98af74c964100c8ef2e43286f3a31114461251a164c","0d8c5bb69c567e3949cc6e087610d79c886d9140d0eda88cc92d3ec63fb7a3b9","b6bc001bc9b4171a27fb2a485cb3e3d8f23bc1ee6b4a03bbcfbba63b7d208477","2c7bf841a659fa1d8105d26f6664ebc3a78b99e0c071eb7f529503346c40f778","cbbe1d5a7d4a721c61b9c3b8b6a8e5d65508f02c70e708698d8165d92e154383","25034c2542757ac93cb6008479a5bfc594f9e92f66249f6fb862447a18847ba7","148d3552db2acf469c84e26889336f06167c6cf455248e08d703282bc0556fb8","7186674c208242b8e6fdf7b0f4e7539218590618fee517aa264e8446247d3440","7a48db17a02e94c97a329cc1a578777d8b4fb74221bdb22202369d6590917fd0","7a48db17a02e94c97a329cc1a578777d8b4fb74221bdb22202369d6590917fd0","ca7dc2b0856f89e71ce9da6f179b34c8879456b5dffda0b5bd3f0fd73bab1c50")
index=activity AND rg_functionality="O365 General" AND customstring64 NOT NULL AND customstring64 IN ("796deae716a6d66b49a99d00e541056babe34fd2fcbcea0380491de4b792afba","18e45358462363996688ceabfc098e17f855d73842f460b34c683e58c728149f","88bd580aa51129e4e5fa69e148131874c862015e7c51d59497e11f22db2d72c6","23664decf3c2f28a3f552dc98d90017926617969713ccccdc9f5fd3178d76dbf","ba63fbf6f7bab000bc1b1bf92319415328cea238872450adbaac6a6069132779","f359b687fb9e1a4c27fdf5174380abc9877f940ef6a6fd4d38e9ef40bb778107","815ebfc4fb5bddf1f9ca1b12ae2a1b0e37736a93ea9babe858747096ad9ce671","d21ae84e104a305b5aebee8e6fbb4837976ef26935dac90372637f913ef58154","0c006540abcb768cad80a1a8ced926fa58f10cf9eb0be16c4185850df83bff82","847e684a228292dc905205d7353ed9458e10129105fe3b387c4e9374d6afd783","ed6a350c4b1baa6f098293c328d0a62d35aafb4ab62b93e6f3a611f06be9aa29","123480357ab54d2c2067640105b5683445777ae1d20fd52551a5df9327692103","3710742057e470e8882a84412721ed19652e3f13977af21a937bad27d75b6f96","dd1a177126d48072381db98af74c964100c8ef2e43286f3a31114461251a164c","0d8c5bb69c567e3949cc6e087610d79c886d9140d0eda88cc92d3ec63fb7a3b9","b6bc001bc9b4171a27fb2a485cb3e3d8f23bc1ee6b4a03bbcfbba63b7d208477","2c7bf841a659fa1d8105d26f6664ebc3a78b99e0c071eb7f529503346c40f778","cbbe1d5a7d4a721c61b9c3b8b6a8e5d65508f02c70e708698d8165d92e154383","25034c2542757ac93cb6008479a5bfc594f9e92f66249f6fb862447a18847ba7","148d3552db2acf469c84e26889336f06167c6cf455248e08d703282bc0556fb8","7186674c208242b8e6fdf7b0f4e7539218590618fee517aa264e8446247d3440","7a48db17a02e94c97a329cc1a578777d8b4fb74221bdb22202369d6590917fd0","7a48db17a02e94c97a329cc1a578777d8b4fb74221bdb22202369d6590917fd0","ca7dc2b0856f89e71ce9da6f179b34c8879456b5dffda0b5bd3f0fd73bab1c50")
