index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("1248c4b352b9b1325ef97435bd38b2f02d21e2c6d494a2218ee363d9874b7607","46f3029fcc7e2a12253c0cc65e5c58b5f1296df1e364878b178027ab26562d68","60133376a7c8e051da787187761e596ce9b3d0cfcea21ed8f434992aa7cb8605")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("1248c4b352b9b1325ef97435bd38b2f02d21e2c6d494a2218ee363d9874b7607","46f3029fcc7e2a12253c0cc65e5c58b5f1296df1e364878b178027ab26562d68","60133376a7c8e051da787187761e596ce9b3d0cfcea21ed8f434992aa7cb8605")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("1248c4b352b9b1325ef97435bd38b2f02d21e2c6d494a2218ee363d9874b7607","46f3029fcc7e2a12253c0cc65e5c58b5f1296df1e364878b178027ab26562d68","60133376a7c8e051da787187761e596ce9b3d0cfcea21ed8f434992aa7cb8605")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring64 NOT NULL AND customstring64 IN ("1248c4b352b9b1325ef97435bd38b2f02d21e2c6d494a2218ee363d9874b7607","46f3029fcc7e2a12253c0cc65e5c58b5f1296df1e364878b178027ab26562d68","60133376a7c8e051da787187761e596ce9b3d0cfcea21ed8f434992aa7cb8605")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("1248c4b352b9b1325ef97435bd38b2f02d21e2c6d494a2218ee363d9874b7607","46f3029fcc7e2a12253c0cc65e5c58b5f1296df1e364878b178027ab26562d68","60133376a7c8e051da787187761e596ce9b3d0cfcea21ed8f434992aa7cb8605")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("1248c4b352b9b1325ef97435bd38b2f02d21e2c6d494a2218ee363d9874b7607","46f3029fcc7e2a12253c0cc65e5c58b5f1296df1e364878b178027ab26562d68","60133376a7c8e051da787187761e596ce9b3d0cfcea21ed8f434992aa7cb8605")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("1248c4b352b9b1325ef97435bd38b2f02d21e2c6d494a2218ee363d9874b7607","46f3029fcc7e2a12253c0cc65e5c58b5f1296df1e364878b178027ab26562d68","60133376a7c8e051da787187761e596ce9b3d0cfcea21ed8f434992aa7cb8605")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("1248c4b352b9b1325ef97435bd38b2f02d21e2c6d494a2218ee363d9874b7607","46f3029fcc7e2a12253c0cc65e5c58b5f1296df1e364878b178027ab26562d68","60133376a7c8e051da787187761e596ce9b3d0cfcea21ed8f434992aa7cb8605")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("1248c4b352b9b1325ef97435bd38b2f02d21e2c6d494a2218ee363d9874b7607","46f3029fcc7e2a12253c0cc65e5c58b5f1296df1e364878b178027ab26562d68","60133376a7c8e051da787187761e596ce9b3d0cfcea21ed8f434992aa7cb8605")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("1248c4b352b9b1325ef97435bd38b2f02d21e2c6d494a2218ee363d9874b7607","46f3029fcc7e2a12253c0cc65e5c58b5f1296df1e364878b178027ab26562d68","60133376a7c8e051da787187761e596ce9b3d0cfcea21ed8f434992aa7cb8605")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("1248c4b352b9b1325ef97435bd38b2f02d21e2c6d494a2218ee363d9874b7607","46f3029fcc7e2a12253c0cc65e5c58b5f1296df1e364878b178027ab26562d68","60133376a7c8e051da787187761e596ce9b3d0cfcea21ed8f434992aa7cb8605")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("1248c4b352b9b1325ef97435bd38b2f02d21e2c6d494a2218ee363d9874b7607","46f3029fcc7e2a12253c0cc65e5c58b5f1296df1e364878b178027ab26562d68","60133376a7c8e051da787187761e596ce9b3d0cfcea21ed8f434992aa7cb8605")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("1248c4b352b9b1325ef97435bd38b2f02d21e2c6d494a2218ee363d9874b7607","46f3029fcc7e2a12253c0cc65e5c58b5f1296df1e364878b178027ab26562d68","60133376a7c8e051da787187761e596ce9b3d0cfcea21ed8f434992aa7cb8605")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("1248c4b352b9b1325ef97435bd38b2f02d21e2c6d494a2218ee363d9874b7607","46f3029fcc7e2a12253c0cc65e5c58b5f1296df1e364878b178027ab26562d68","60133376a7c8e051da787187761e596ce9b3d0cfcea21ed8f434992aa7cb8605")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("1248c4b352b9b1325ef97435bd38b2f02d21e2c6d494a2218ee363d9874b7607","46f3029fcc7e2a12253c0cc65e5c58b5f1296df1e364878b178027ab26562d68","60133376a7c8e051da787187761e596ce9b3d0cfcea21ed8f434992aa7cb8605")
index=activity AND rg_functionality="Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("1248c4b352b9b1325ef97435bd38b2f02d21e2c6d494a2218ee363d9874b7607","46f3029fcc7e2a12253c0cc65e5c58b5f1296df1e364878b178027ab26562d68","60133376a7c8e051da787187761e596ce9b3d0cfcea21ed8f434992aa7cb8605")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("1248c4b352b9b1325ef97435bd38b2f02d21e2c6d494a2218ee363d9874b7607","46f3029fcc7e2a12253c0cc65e5c58b5f1296df1e364878b178027ab26562d68","60133376a7c8e051da787187761e596ce9b3d0cfcea21ed8f434992aa7cb8605")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("1248c4b352b9b1325ef97435bd38b2f02d21e2c6d494a2218ee363d9874b7607","46f3029fcc7e2a12253c0cc65e5c58b5f1296df1e364878b178027ab26562d68","60133376a7c8e051da787187761e596ce9b3d0cfcea21ed8f434992aa7cb8605")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("1248c4b352b9b1325ef97435bd38b2f02d21e2c6d494a2218ee363d9874b7607","46f3029fcc7e2a12253c0cc65e5c58b5f1296df1e364878b178027ab26562d68","60133376a7c8e051da787187761e596ce9b3d0cfcea21ed8f434992aa7cb8605")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("1248c4b352b9b1325ef97435bd38b2f02d21e2c6d494a2218ee363d9874b7607","46f3029fcc7e2a12253c0cc65e5c58b5f1296df1e364878b178027ab26562d68","60133376a7c8e051da787187761e596ce9b3d0cfcea21ed8f434992aa7cb8605")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("1248c4b352b9b1325ef97435bd38b2f02d21e2c6d494a2218ee363d9874b7607","46f3029fcc7e2a12253c0cc65e5c58b5f1296df1e364878b178027ab26562d68","60133376a7c8e051da787187761e596ce9b3d0cfcea21ed8f434992aa7cb8605")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("1248c4b352b9b1325ef97435bd38b2f02d21e2c6d494a2218ee363d9874b7607","46f3029fcc7e2a12253c0cc65e5c58b5f1296df1e364878b178027ab26562d68","60133376a7c8e051da787187761e596ce9b3d0cfcea21ed8f434992aa7cb8605")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("1248c4b352b9b1325ef97435bd38b2f02d21e2c6d494a2218ee363d9874b7607","46f3029fcc7e2a12253c0cc65e5c58b5f1296df1e364878b178027ab26562d68","60133376a7c8e051da787187761e596ce9b3d0cfcea21ed8f434992aa7cb8605")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring64 NOT NULL AND customstring64 IN ("1248c4b352b9b1325ef97435bd38b2f02d21e2c6d494a2218ee363d9874b7607","46f3029fcc7e2a12253c0cc65e5c58b5f1296df1e364878b178027ab26562d68","60133376a7c8e051da787187761e596ce9b3d0cfcea21ed8f434992aa7cb8605")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("1248c4b352b9b1325ef97435bd38b2f02d21e2c6d494a2218ee363d9874b7607","46f3029fcc7e2a12253c0cc65e5c58b5f1296df1e364878b178027ab26562d68","60133376a7c8e051da787187761e596ce9b3d0cfcea21ed8f434992aa7cb8605")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("1248c4b352b9b1325ef97435bd38b2f02d21e2c6d494a2218ee363d9874b7607","46f3029fcc7e2a12253c0cc65e5c58b5f1296df1e364878b178027ab26562d68","60133376a7c8e051da787187761e596ce9b3d0cfcea21ed8f434992aa7cb8605")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("1248c4b352b9b1325ef97435bd38b2f02d21e2c6d494a2218ee363d9874b7607","46f3029fcc7e2a12253c0cc65e5c58b5f1296df1e364878b178027ab26562d68","60133376a7c8e051da787187761e596ce9b3d0cfcea21ed8f434992aa7cb8605")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring64 NOT NULL AND customstring64 IN ("1248c4b352b9b1325ef97435bd38b2f02d21e2c6d494a2218ee363d9874b7607","46f3029fcc7e2a12253c0cc65e5c58b5f1296df1e364878b178027ab26562d68","60133376a7c8e051da787187761e596ce9b3d0cfcea21ed8f434992aa7cb8605")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("1248c4b352b9b1325ef97435bd38b2f02d21e2c6d494a2218ee363d9874b7607","46f3029fcc7e2a12253c0cc65e5c58b5f1296df1e364878b178027ab26562d68","60133376a7c8e051da787187761e596ce9b3d0cfcea21ed8f434992aa7cb8605")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("1248c4b352b9b1325ef97435bd38b2f02d21e2c6d494a2218ee363d9874b7607","46f3029fcc7e2a12253c0cc65e5c58b5f1296df1e364878b178027ab26562d68","60133376a7c8e051da787187761e596ce9b3d0cfcea21ed8f434992aa7cb8605")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("1248c4b352b9b1325ef97435bd38b2f02d21e2c6d494a2218ee363d9874b7607","46f3029fcc7e2a12253c0cc65e5c58b5f1296df1e364878b178027ab26562d68","60133376a7c8e051da787187761e596ce9b3d0cfcea21ed8f434992aa7cb8605")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring64 NOT NULL AND customstring64 IN ("1248c4b352b9b1325ef97435bd38b2f02d21e2c6d494a2218ee363d9874b7607","46f3029fcc7e2a12253c0cc65e5c58b5f1296df1e364878b178027ab26562d68","60133376a7c8e051da787187761e596ce9b3d0cfcea21ed8f434992aa7cb8605")
index=activity AND rg_functionality="O365 General" AND filehash NOT NULL AND filehash IN ("1248c4b352b9b1325ef97435bd38b2f02d21e2c6d494a2218ee363d9874b7607","46f3029fcc7e2a12253c0cc65e5c58b5f1296df1e364878b178027ab26562d68","60133376a7c8e051da787187761e596ce9b3d0cfcea21ed8f434992aa7cb8605")
index=activity AND rg_functionality="O365 General" AND oldfilehash NOT NULL AND oldfilehash IN ("1248c4b352b9b1325ef97435bd38b2f02d21e2c6d494a2218ee363d9874b7607","46f3029fcc7e2a12253c0cc65e5c58b5f1296df1e364878b178027ab26562d68","60133376a7c8e051da787187761e596ce9b3d0cfcea21ed8f434992aa7cb8605")
index=activity AND rg_functionality="O365 General" AND customstring3 NOT NULL AND customstring3 IN ("1248c4b352b9b1325ef97435bd38b2f02d21e2c6d494a2218ee363d9874b7607","46f3029fcc7e2a12253c0cc65e5c58b5f1296df1e364878b178027ab26562d68","60133376a7c8e051da787187761e596ce9b3d0cfcea21ed8f434992aa7cb8605")
index=activity AND rg_functionality="O365 General" AND customstring64 NOT NULL AND customstring64 IN ("1248c4b352b9b1325ef97435bd38b2f02d21e2c6d494a2218ee363d9874b7607","46f3029fcc7e2a12253c0cc65e5c58b5f1296df1e364878b178027ab26562d68","60133376a7c8e051da787187761e596ce9b3d0cfcea21ed8f434992aa7cb8605")
