index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("ddc607bb993b94c543c63808bebf682a","862adb87b0b894d450f8914a353e3e9c","a1ae8b0d794af648908e0345204ea192","9d0364e1f625edb286b0d5541bb15357","eee70de3ac0dc902b99ed33408e646c9","64011a7871abb873c822b8b99082e8ab","b012cb8cfee0062632817d12d43f98b4")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("ddc607bb993b94c543c63808bebf682a","862adb87b0b894d450f8914a353e3e9c","a1ae8b0d794af648908e0345204ea192","9d0364e1f625edb286b0d5541bb15357","eee70de3ac0dc902b99ed33408e646c9","64011a7871abb873c822b8b99082e8ab","b012cb8cfee0062632817d12d43f98b4")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("ddc607bb993b94c543c63808bebf682a","862adb87b0b894d450f8914a353e3e9c","a1ae8b0d794af648908e0345204ea192","9d0364e1f625edb286b0d5541bb15357","eee70de3ac0dc902b99ed33408e646c9","64011a7871abb873c822b8b99082e8ab","b012cb8cfee0062632817d12d43f98b4")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring64 NOT NULL AND customstring64 IN ("ddc607bb993b94c543c63808bebf682a","862adb87b0b894d450f8914a353e3e9c","a1ae8b0d794af648908e0345204ea192","9d0364e1f625edb286b0d5541bb15357","eee70de3ac0dc902b99ed33408e646c9","64011a7871abb873c822b8b99082e8ab","b012cb8cfee0062632817d12d43f98b4")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("ddc607bb993b94c543c63808bebf682a","862adb87b0b894d450f8914a353e3e9c","a1ae8b0d794af648908e0345204ea192","9d0364e1f625edb286b0d5541bb15357","eee70de3ac0dc902b99ed33408e646c9","64011a7871abb873c822b8b99082e8ab","b012cb8cfee0062632817d12d43f98b4")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("ddc607bb993b94c543c63808bebf682a","862adb87b0b894d450f8914a353e3e9c","a1ae8b0d794af648908e0345204ea192","9d0364e1f625edb286b0d5541bb15357","eee70de3ac0dc902b99ed33408e646c9","64011a7871abb873c822b8b99082e8ab","b012cb8cfee0062632817d12d43f98b4")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("ddc607bb993b94c543c63808bebf682a","862adb87b0b894d450f8914a353e3e9c","a1ae8b0d794af648908e0345204ea192","9d0364e1f625edb286b0d5541bb15357","eee70de3ac0dc902b99ed33408e646c9","64011a7871abb873c822b8b99082e8ab","b012cb8cfee0062632817d12d43f98b4")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("ddc607bb993b94c543c63808bebf682a","862adb87b0b894d450f8914a353e3e9c","a1ae8b0d794af648908e0345204ea192","9d0364e1f625edb286b0d5541bb15357","eee70de3ac0dc902b99ed33408e646c9","64011a7871abb873c822b8b99082e8ab","b012cb8cfee0062632817d12d43f98b4")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("ddc607bb993b94c543c63808bebf682a","862adb87b0b894d450f8914a353e3e9c","a1ae8b0d794af648908e0345204ea192","9d0364e1f625edb286b0d5541bb15357","eee70de3ac0dc902b99ed33408e646c9","64011a7871abb873c822b8b99082e8ab","b012cb8cfee0062632817d12d43f98b4")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("ddc607bb993b94c543c63808bebf682a","862adb87b0b894d450f8914a353e3e9c","a1ae8b0d794af648908e0345204ea192","9d0364e1f625edb286b0d5541bb15357","eee70de3ac0dc902b99ed33408e646c9","64011a7871abb873c822b8b99082e8ab","b012cb8cfee0062632817d12d43f98b4")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("ddc607bb993b94c543c63808bebf682a","862adb87b0b894d450f8914a353e3e9c","a1ae8b0d794af648908e0345204ea192","9d0364e1f625edb286b0d5541bb15357","eee70de3ac0dc902b99ed33408e646c9","64011a7871abb873c822b8b99082e8ab","b012cb8cfee0062632817d12d43f98b4")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("ddc607bb993b94c543c63808bebf682a","862adb87b0b894d450f8914a353e3e9c","a1ae8b0d794af648908e0345204ea192","9d0364e1f625edb286b0d5541bb15357","eee70de3ac0dc902b99ed33408e646c9","64011a7871abb873c822b8b99082e8ab","b012cb8cfee0062632817d12d43f98b4")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("ddc607bb993b94c543c63808bebf682a","862adb87b0b894d450f8914a353e3e9c","a1ae8b0d794af648908e0345204ea192","9d0364e1f625edb286b0d5541bb15357","eee70de3ac0dc902b99ed33408e646c9","64011a7871abb873c822b8b99082e8ab","b012cb8cfee0062632817d12d43f98b4")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("ddc607bb993b94c543c63808bebf682a","862adb87b0b894d450f8914a353e3e9c","a1ae8b0d794af648908e0345204ea192","9d0364e1f625edb286b0d5541bb15357","eee70de3ac0dc902b99ed33408e646c9","64011a7871abb873c822b8b99082e8ab","b012cb8cfee0062632817d12d43f98b4")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("ddc607bb993b94c543c63808bebf682a","862adb87b0b894d450f8914a353e3e9c","a1ae8b0d794af648908e0345204ea192","9d0364e1f625edb286b0d5541bb15357","eee70de3ac0dc902b99ed33408e646c9","64011a7871abb873c822b8b99082e8ab","b012cb8cfee0062632817d12d43f98b4")
index=activity AND rg_functionality="Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("ddc607bb993b94c543c63808bebf682a","862adb87b0b894d450f8914a353e3e9c","a1ae8b0d794af648908e0345204ea192","9d0364e1f625edb286b0d5541bb15357","eee70de3ac0dc902b99ed33408e646c9","64011a7871abb873c822b8b99082e8ab","b012cb8cfee0062632817d12d43f98b4")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("ddc607bb993b94c543c63808bebf682a","862adb87b0b894d450f8914a353e3e9c","a1ae8b0d794af648908e0345204ea192","9d0364e1f625edb286b0d5541bb15357","eee70de3ac0dc902b99ed33408e646c9","64011a7871abb873c822b8b99082e8ab","b012cb8cfee0062632817d12d43f98b4")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("ddc607bb993b94c543c63808bebf682a","862adb87b0b894d450f8914a353e3e9c","a1ae8b0d794af648908e0345204ea192","9d0364e1f625edb286b0d5541bb15357","eee70de3ac0dc902b99ed33408e646c9","64011a7871abb873c822b8b99082e8ab","b012cb8cfee0062632817d12d43f98b4")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("ddc607bb993b94c543c63808bebf682a","862adb87b0b894d450f8914a353e3e9c","a1ae8b0d794af648908e0345204ea192","9d0364e1f625edb286b0d5541bb15357","eee70de3ac0dc902b99ed33408e646c9","64011a7871abb873c822b8b99082e8ab","b012cb8cfee0062632817d12d43f98b4")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("ddc607bb993b94c543c63808bebf682a","862adb87b0b894d450f8914a353e3e9c","a1ae8b0d794af648908e0345204ea192","9d0364e1f625edb286b0d5541bb15357","eee70de3ac0dc902b99ed33408e646c9","64011a7871abb873c822b8b99082e8ab","b012cb8cfee0062632817d12d43f98b4")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("ddc607bb993b94c543c63808bebf682a","862adb87b0b894d450f8914a353e3e9c","a1ae8b0d794af648908e0345204ea192","9d0364e1f625edb286b0d5541bb15357","eee70de3ac0dc902b99ed33408e646c9","64011a7871abb873c822b8b99082e8ab","b012cb8cfee0062632817d12d43f98b4")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("ddc607bb993b94c543c63808bebf682a","862adb87b0b894d450f8914a353e3e9c","a1ae8b0d794af648908e0345204ea192","9d0364e1f625edb286b0d5541bb15357","eee70de3ac0dc902b99ed33408e646c9","64011a7871abb873c822b8b99082e8ab","b012cb8cfee0062632817d12d43f98b4")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("ddc607bb993b94c543c63808bebf682a","862adb87b0b894d450f8914a353e3e9c","a1ae8b0d794af648908e0345204ea192","9d0364e1f625edb286b0d5541bb15357","eee70de3ac0dc902b99ed33408e646c9","64011a7871abb873c822b8b99082e8ab","b012cb8cfee0062632817d12d43f98b4")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring64 NOT NULL AND customstring64 IN ("ddc607bb993b94c543c63808bebf682a","862adb87b0b894d450f8914a353e3e9c","a1ae8b0d794af648908e0345204ea192","9d0364e1f625edb286b0d5541bb15357","eee70de3ac0dc902b99ed33408e646c9","64011a7871abb873c822b8b99082e8ab","b012cb8cfee0062632817d12d43f98b4")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("ddc607bb993b94c543c63808bebf682a","862adb87b0b894d450f8914a353e3e9c","a1ae8b0d794af648908e0345204ea192","9d0364e1f625edb286b0d5541bb15357","eee70de3ac0dc902b99ed33408e646c9","64011a7871abb873c822b8b99082e8ab","b012cb8cfee0062632817d12d43f98b4")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("ddc607bb993b94c543c63808bebf682a","862adb87b0b894d450f8914a353e3e9c","a1ae8b0d794af648908e0345204ea192","9d0364e1f625edb286b0d5541bb15357","eee70de3ac0dc902b99ed33408e646c9","64011a7871abb873c822b8b99082e8ab","b012cb8cfee0062632817d12d43f98b4")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("ddc607bb993b94c543c63808bebf682a","862adb87b0b894d450f8914a353e3e9c","a1ae8b0d794af648908e0345204ea192","9d0364e1f625edb286b0d5541bb15357","eee70de3ac0dc902b99ed33408e646c9","64011a7871abb873c822b8b99082e8ab","b012cb8cfee0062632817d12d43f98b4")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring64 NOT NULL AND customstring64 IN ("ddc607bb993b94c543c63808bebf682a","862adb87b0b894d450f8914a353e3e9c","a1ae8b0d794af648908e0345204ea192","9d0364e1f625edb286b0d5541bb15357","eee70de3ac0dc902b99ed33408e646c9","64011a7871abb873c822b8b99082e8ab","b012cb8cfee0062632817d12d43f98b4")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("ddc607bb993b94c543c63808bebf682a","862adb87b0b894d450f8914a353e3e9c","a1ae8b0d794af648908e0345204ea192","9d0364e1f625edb286b0d5541bb15357","eee70de3ac0dc902b99ed33408e646c9","64011a7871abb873c822b8b99082e8ab","b012cb8cfee0062632817d12d43f98b4")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("ddc607bb993b94c543c63808bebf682a","862adb87b0b894d450f8914a353e3e9c","a1ae8b0d794af648908e0345204ea192","9d0364e1f625edb286b0d5541bb15357","eee70de3ac0dc902b99ed33408e646c9","64011a7871abb873c822b8b99082e8ab","b012cb8cfee0062632817d12d43f98b4")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("ddc607bb993b94c543c63808bebf682a","862adb87b0b894d450f8914a353e3e9c","a1ae8b0d794af648908e0345204ea192","9d0364e1f625edb286b0d5541bb15357","eee70de3ac0dc902b99ed33408e646c9","64011a7871abb873c822b8b99082e8ab","b012cb8cfee0062632817d12d43f98b4")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring64 NOT NULL AND customstring64 IN ("ddc607bb993b94c543c63808bebf682a","862adb87b0b894d450f8914a353e3e9c","a1ae8b0d794af648908e0345204ea192","9d0364e1f625edb286b0d5541bb15357","eee70de3ac0dc902b99ed33408e646c9","64011a7871abb873c822b8b99082e8ab","b012cb8cfee0062632817d12d43f98b4")
