index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("ee2c8909089f53aafc421d9853c01856b0a9015eba12aa0382e98417d28aef3f","8c4926dd32204b6a666b274a78ccfb16fe84bbd7d6bc218a5310970c4c5d9450","723d804cfc334cad788f86c39c7fb58b42f452a72191f7f39400cf05d980b4f3","2c0273394cda1b07680913edd70d3438a098bb4468f16eebf2f50d060cdf4e96","26c855264896db95ed46e502f2d318e5f2ad25b59bdc47bd7ffe92646102ae0d")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("ee2c8909089f53aafc421d9853c01856b0a9015eba12aa0382e98417d28aef3f","8c4926dd32204b6a666b274a78ccfb16fe84bbd7d6bc218a5310970c4c5d9450","723d804cfc334cad788f86c39c7fb58b42f452a72191f7f39400cf05d980b4f3","2c0273394cda1b07680913edd70d3438a098bb4468f16eebf2f50d060cdf4e96","26c855264896db95ed46e502f2d318e5f2ad25b59bdc47bd7ffe92646102ae0d")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("ee2c8909089f53aafc421d9853c01856b0a9015eba12aa0382e98417d28aef3f","8c4926dd32204b6a666b274a78ccfb16fe84bbd7d6bc218a5310970c4c5d9450","723d804cfc334cad788f86c39c7fb58b42f452a72191f7f39400cf05d980b4f3","2c0273394cda1b07680913edd70d3438a098bb4468f16eebf2f50d060cdf4e96","26c855264896db95ed46e502f2d318e5f2ad25b59bdc47bd7ffe92646102ae0d")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring64 NOT NULL AND customstring64 IN ("ee2c8909089f53aafc421d9853c01856b0a9015eba12aa0382e98417d28aef3f","8c4926dd32204b6a666b274a78ccfb16fe84bbd7d6bc218a5310970c4c5d9450","723d804cfc334cad788f86c39c7fb58b42f452a72191f7f39400cf05d980b4f3","2c0273394cda1b07680913edd70d3438a098bb4468f16eebf2f50d060cdf4e96","26c855264896db95ed46e502f2d318e5f2ad25b59bdc47bd7ffe92646102ae0d")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("ee2c8909089f53aafc421d9853c01856b0a9015eba12aa0382e98417d28aef3f","8c4926dd32204b6a666b274a78ccfb16fe84bbd7d6bc218a5310970c4c5d9450","723d804cfc334cad788f86c39c7fb58b42f452a72191f7f39400cf05d980b4f3","2c0273394cda1b07680913edd70d3438a098bb4468f16eebf2f50d060cdf4e96","26c855264896db95ed46e502f2d318e5f2ad25b59bdc47bd7ffe92646102ae0d")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("ee2c8909089f53aafc421d9853c01856b0a9015eba12aa0382e98417d28aef3f","8c4926dd32204b6a666b274a78ccfb16fe84bbd7d6bc218a5310970c4c5d9450","723d804cfc334cad788f86c39c7fb58b42f452a72191f7f39400cf05d980b4f3","2c0273394cda1b07680913edd70d3438a098bb4468f16eebf2f50d060cdf4e96","26c855264896db95ed46e502f2d318e5f2ad25b59bdc47bd7ffe92646102ae0d")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("ee2c8909089f53aafc421d9853c01856b0a9015eba12aa0382e98417d28aef3f","8c4926dd32204b6a666b274a78ccfb16fe84bbd7d6bc218a5310970c4c5d9450","723d804cfc334cad788f86c39c7fb58b42f452a72191f7f39400cf05d980b4f3","2c0273394cda1b07680913edd70d3438a098bb4468f16eebf2f50d060cdf4e96","26c855264896db95ed46e502f2d318e5f2ad25b59bdc47bd7ffe92646102ae0d")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("ee2c8909089f53aafc421d9853c01856b0a9015eba12aa0382e98417d28aef3f","8c4926dd32204b6a666b274a78ccfb16fe84bbd7d6bc218a5310970c4c5d9450","723d804cfc334cad788f86c39c7fb58b42f452a72191f7f39400cf05d980b4f3","2c0273394cda1b07680913edd70d3438a098bb4468f16eebf2f50d060cdf4e96","26c855264896db95ed46e502f2d318e5f2ad25b59bdc47bd7ffe92646102ae0d")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("ee2c8909089f53aafc421d9853c01856b0a9015eba12aa0382e98417d28aef3f","8c4926dd32204b6a666b274a78ccfb16fe84bbd7d6bc218a5310970c4c5d9450","723d804cfc334cad788f86c39c7fb58b42f452a72191f7f39400cf05d980b4f3","2c0273394cda1b07680913edd70d3438a098bb4468f16eebf2f50d060cdf4e96","26c855264896db95ed46e502f2d318e5f2ad25b59bdc47bd7ffe92646102ae0d")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("ee2c8909089f53aafc421d9853c01856b0a9015eba12aa0382e98417d28aef3f","8c4926dd32204b6a666b274a78ccfb16fe84bbd7d6bc218a5310970c4c5d9450","723d804cfc334cad788f86c39c7fb58b42f452a72191f7f39400cf05d980b4f3","2c0273394cda1b07680913edd70d3438a098bb4468f16eebf2f50d060cdf4e96","26c855264896db95ed46e502f2d318e5f2ad25b59bdc47bd7ffe92646102ae0d")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("ee2c8909089f53aafc421d9853c01856b0a9015eba12aa0382e98417d28aef3f","8c4926dd32204b6a666b274a78ccfb16fe84bbd7d6bc218a5310970c4c5d9450","723d804cfc334cad788f86c39c7fb58b42f452a72191f7f39400cf05d980b4f3","2c0273394cda1b07680913edd70d3438a098bb4468f16eebf2f50d060cdf4e96","26c855264896db95ed46e502f2d318e5f2ad25b59bdc47bd7ffe92646102ae0d")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("ee2c8909089f53aafc421d9853c01856b0a9015eba12aa0382e98417d28aef3f","8c4926dd32204b6a666b274a78ccfb16fe84bbd7d6bc218a5310970c4c5d9450","723d804cfc334cad788f86c39c7fb58b42f452a72191f7f39400cf05d980b4f3","2c0273394cda1b07680913edd70d3438a098bb4468f16eebf2f50d060cdf4e96","26c855264896db95ed46e502f2d318e5f2ad25b59bdc47bd7ffe92646102ae0d")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("ee2c8909089f53aafc421d9853c01856b0a9015eba12aa0382e98417d28aef3f","8c4926dd32204b6a666b274a78ccfb16fe84bbd7d6bc218a5310970c4c5d9450","723d804cfc334cad788f86c39c7fb58b42f452a72191f7f39400cf05d980b4f3","2c0273394cda1b07680913edd70d3438a098bb4468f16eebf2f50d060cdf4e96","26c855264896db95ed46e502f2d318e5f2ad25b59bdc47bd7ffe92646102ae0d")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("ee2c8909089f53aafc421d9853c01856b0a9015eba12aa0382e98417d28aef3f","8c4926dd32204b6a666b274a78ccfb16fe84bbd7d6bc218a5310970c4c5d9450","723d804cfc334cad788f86c39c7fb58b42f452a72191f7f39400cf05d980b4f3","2c0273394cda1b07680913edd70d3438a098bb4468f16eebf2f50d060cdf4e96","26c855264896db95ed46e502f2d318e5f2ad25b59bdc47bd7ffe92646102ae0d")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("ee2c8909089f53aafc421d9853c01856b0a9015eba12aa0382e98417d28aef3f","8c4926dd32204b6a666b274a78ccfb16fe84bbd7d6bc218a5310970c4c5d9450","723d804cfc334cad788f86c39c7fb58b42f452a72191f7f39400cf05d980b4f3","2c0273394cda1b07680913edd70d3438a098bb4468f16eebf2f50d060cdf4e96","26c855264896db95ed46e502f2d318e5f2ad25b59bdc47bd7ffe92646102ae0d")
index=activity AND rg_functionality="Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("ee2c8909089f53aafc421d9853c01856b0a9015eba12aa0382e98417d28aef3f","8c4926dd32204b6a666b274a78ccfb16fe84bbd7d6bc218a5310970c4c5d9450","723d804cfc334cad788f86c39c7fb58b42f452a72191f7f39400cf05d980b4f3","2c0273394cda1b07680913edd70d3438a098bb4468f16eebf2f50d060cdf4e96","26c855264896db95ed46e502f2d318e5f2ad25b59bdc47bd7ffe92646102ae0d")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("ee2c8909089f53aafc421d9853c01856b0a9015eba12aa0382e98417d28aef3f","8c4926dd32204b6a666b274a78ccfb16fe84bbd7d6bc218a5310970c4c5d9450","723d804cfc334cad788f86c39c7fb58b42f452a72191f7f39400cf05d980b4f3","2c0273394cda1b07680913edd70d3438a098bb4468f16eebf2f50d060cdf4e96","26c855264896db95ed46e502f2d318e5f2ad25b59bdc47bd7ffe92646102ae0d")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("ee2c8909089f53aafc421d9853c01856b0a9015eba12aa0382e98417d28aef3f","8c4926dd32204b6a666b274a78ccfb16fe84bbd7d6bc218a5310970c4c5d9450","723d804cfc334cad788f86c39c7fb58b42f452a72191f7f39400cf05d980b4f3","2c0273394cda1b07680913edd70d3438a098bb4468f16eebf2f50d060cdf4e96","26c855264896db95ed46e502f2d318e5f2ad25b59bdc47bd7ffe92646102ae0d")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("ee2c8909089f53aafc421d9853c01856b0a9015eba12aa0382e98417d28aef3f","8c4926dd32204b6a666b274a78ccfb16fe84bbd7d6bc218a5310970c4c5d9450","723d804cfc334cad788f86c39c7fb58b42f452a72191f7f39400cf05d980b4f3","2c0273394cda1b07680913edd70d3438a098bb4468f16eebf2f50d060cdf4e96","26c855264896db95ed46e502f2d318e5f2ad25b59bdc47bd7ffe92646102ae0d")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("ee2c8909089f53aafc421d9853c01856b0a9015eba12aa0382e98417d28aef3f","8c4926dd32204b6a666b274a78ccfb16fe84bbd7d6bc218a5310970c4c5d9450","723d804cfc334cad788f86c39c7fb58b42f452a72191f7f39400cf05d980b4f3","2c0273394cda1b07680913edd70d3438a098bb4468f16eebf2f50d060cdf4e96","26c855264896db95ed46e502f2d318e5f2ad25b59bdc47bd7ffe92646102ae0d")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("ee2c8909089f53aafc421d9853c01856b0a9015eba12aa0382e98417d28aef3f","8c4926dd32204b6a666b274a78ccfb16fe84bbd7d6bc218a5310970c4c5d9450","723d804cfc334cad788f86c39c7fb58b42f452a72191f7f39400cf05d980b4f3","2c0273394cda1b07680913edd70d3438a098bb4468f16eebf2f50d060cdf4e96","26c855264896db95ed46e502f2d318e5f2ad25b59bdc47bd7ffe92646102ae0d")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("ee2c8909089f53aafc421d9853c01856b0a9015eba12aa0382e98417d28aef3f","8c4926dd32204b6a666b274a78ccfb16fe84bbd7d6bc218a5310970c4c5d9450","723d804cfc334cad788f86c39c7fb58b42f452a72191f7f39400cf05d980b4f3","2c0273394cda1b07680913edd70d3438a098bb4468f16eebf2f50d060cdf4e96","26c855264896db95ed46e502f2d318e5f2ad25b59bdc47bd7ffe92646102ae0d")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("ee2c8909089f53aafc421d9853c01856b0a9015eba12aa0382e98417d28aef3f","8c4926dd32204b6a666b274a78ccfb16fe84bbd7d6bc218a5310970c4c5d9450","723d804cfc334cad788f86c39c7fb58b42f452a72191f7f39400cf05d980b4f3","2c0273394cda1b07680913edd70d3438a098bb4468f16eebf2f50d060cdf4e96","26c855264896db95ed46e502f2d318e5f2ad25b59bdc47bd7ffe92646102ae0d")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring64 NOT NULL AND customstring64 IN ("ee2c8909089f53aafc421d9853c01856b0a9015eba12aa0382e98417d28aef3f","8c4926dd32204b6a666b274a78ccfb16fe84bbd7d6bc218a5310970c4c5d9450","723d804cfc334cad788f86c39c7fb58b42f452a72191f7f39400cf05d980b4f3","2c0273394cda1b07680913edd70d3438a098bb4468f16eebf2f50d060cdf4e96","26c855264896db95ed46e502f2d318e5f2ad25b59bdc47bd7ffe92646102ae0d")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("ee2c8909089f53aafc421d9853c01856b0a9015eba12aa0382e98417d28aef3f","8c4926dd32204b6a666b274a78ccfb16fe84bbd7d6bc218a5310970c4c5d9450","723d804cfc334cad788f86c39c7fb58b42f452a72191f7f39400cf05d980b4f3","2c0273394cda1b07680913edd70d3438a098bb4468f16eebf2f50d060cdf4e96","26c855264896db95ed46e502f2d318e5f2ad25b59bdc47bd7ffe92646102ae0d")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("ee2c8909089f53aafc421d9853c01856b0a9015eba12aa0382e98417d28aef3f","8c4926dd32204b6a666b274a78ccfb16fe84bbd7d6bc218a5310970c4c5d9450","723d804cfc334cad788f86c39c7fb58b42f452a72191f7f39400cf05d980b4f3","2c0273394cda1b07680913edd70d3438a098bb4468f16eebf2f50d060cdf4e96","26c855264896db95ed46e502f2d318e5f2ad25b59bdc47bd7ffe92646102ae0d")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("ee2c8909089f53aafc421d9853c01856b0a9015eba12aa0382e98417d28aef3f","8c4926dd32204b6a666b274a78ccfb16fe84bbd7d6bc218a5310970c4c5d9450","723d804cfc334cad788f86c39c7fb58b42f452a72191f7f39400cf05d980b4f3","2c0273394cda1b07680913edd70d3438a098bb4468f16eebf2f50d060cdf4e96","26c855264896db95ed46e502f2d318e5f2ad25b59bdc47bd7ffe92646102ae0d")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring64 NOT NULL AND customstring64 IN ("ee2c8909089f53aafc421d9853c01856b0a9015eba12aa0382e98417d28aef3f","8c4926dd32204b6a666b274a78ccfb16fe84bbd7d6bc218a5310970c4c5d9450","723d804cfc334cad788f86c39c7fb58b42f452a72191f7f39400cf05d980b4f3","2c0273394cda1b07680913edd70d3438a098bb4468f16eebf2f50d060cdf4e96","26c855264896db95ed46e502f2d318e5f2ad25b59bdc47bd7ffe92646102ae0d")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("ee2c8909089f53aafc421d9853c01856b0a9015eba12aa0382e98417d28aef3f","8c4926dd32204b6a666b274a78ccfb16fe84bbd7d6bc218a5310970c4c5d9450","723d804cfc334cad788f86c39c7fb58b42f452a72191f7f39400cf05d980b4f3","2c0273394cda1b07680913edd70d3438a098bb4468f16eebf2f50d060cdf4e96","26c855264896db95ed46e502f2d318e5f2ad25b59bdc47bd7ffe92646102ae0d")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("ee2c8909089f53aafc421d9853c01856b0a9015eba12aa0382e98417d28aef3f","8c4926dd32204b6a666b274a78ccfb16fe84bbd7d6bc218a5310970c4c5d9450","723d804cfc334cad788f86c39c7fb58b42f452a72191f7f39400cf05d980b4f3","2c0273394cda1b07680913edd70d3438a098bb4468f16eebf2f50d060cdf4e96","26c855264896db95ed46e502f2d318e5f2ad25b59bdc47bd7ffe92646102ae0d")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("ee2c8909089f53aafc421d9853c01856b0a9015eba12aa0382e98417d28aef3f","8c4926dd32204b6a666b274a78ccfb16fe84bbd7d6bc218a5310970c4c5d9450","723d804cfc334cad788f86c39c7fb58b42f452a72191f7f39400cf05d980b4f3","2c0273394cda1b07680913edd70d3438a098bb4468f16eebf2f50d060cdf4e96","26c855264896db95ed46e502f2d318e5f2ad25b59bdc47bd7ffe92646102ae0d")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring64 NOT NULL AND customstring64 IN ("ee2c8909089f53aafc421d9853c01856b0a9015eba12aa0382e98417d28aef3f","8c4926dd32204b6a666b274a78ccfb16fe84bbd7d6bc218a5310970c4c5d9450","723d804cfc334cad788f86c39c7fb58b42f452a72191f7f39400cf05d980b4f3","2c0273394cda1b07680913edd70d3438a098bb4468f16eebf2f50d060cdf4e96","26c855264896db95ed46e502f2d318e5f2ad25b59bdc47bd7ffe92646102ae0d")
