index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("3a285221a2ee58369c4d39d2ee508b3d","d04754ca5c9853d4f5688ddafd76b125306dd01b","ad79376aa24df8dab799d4fb4c5d0c913fda03bfea65cbd80923a5919bb1e9b9","9f36aa7edd5e1f19b541f209386bc7ea","ed51900e5b6bb58c116236aff1ed3dec4440702b","1349f1ac1da22cb2f2251a7e26dbc1e8716504c76d623d800e96295b8cdd00eb")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("3a285221a2ee58369c4d39d2ee508b3d","d04754ca5c9853d4f5688ddafd76b125306dd01b","ad79376aa24df8dab799d4fb4c5d0c913fda03bfea65cbd80923a5919bb1e9b9","9f36aa7edd5e1f19b541f209386bc7ea","ed51900e5b6bb58c116236aff1ed3dec4440702b","1349f1ac1da22cb2f2251a7e26dbc1e8716504c76d623d800e96295b8cdd00eb")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("3a285221a2ee58369c4d39d2ee508b3d","d04754ca5c9853d4f5688ddafd76b125306dd01b","ad79376aa24df8dab799d4fb4c5d0c913fda03bfea65cbd80923a5919bb1e9b9","9f36aa7edd5e1f19b541f209386bc7ea","ed51900e5b6bb58c116236aff1ed3dec4440702b","1349f1ac1da22cb2f2251a7e26dbc1e8716504c76d623d800e96295b8cdd00eb")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring64 NOT NULL AND customstring64 IN ("3a285221a2ee58369c4d39d2ee508b3d","d04754ca5c9853d4f5688ddafd76b125306dd01b","ad79376aa24df8dab799d4fb4c5d0c913fda03bfea65cbd80923a5919bb1e9b9","9f36aa7edd5e1f19b541f209386bc7ea","ed51900e5b6bb58c116236aff1ed3dec4440702b","1349f1ac1da22cb2f2251a7e26dbc1e8716504c76d623d800e96295b8cdd00eb")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("3a285221a2ee58369c4d39d2ee508b3d","d04754ca5c9853d4f5688ddafd76b125306dd01b","ad79376aa24df8dab799d4fb4c5d0c913fda03bfea65cbd80923a5919bb1e9b9","9f36aa7edd5e1f19b541f209386bc7ea","ed51900e5b6bb58c116236aff1ed3dec4440702b","1349f1ac1da22cb2f2251a7e26dbc1e8716504c76d623d800e96295b8cdd00eb")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("3a285221a2ee58369c4d39d2ee508b3d","d04754ca5c9853d4f5688ddafd76b125306dd01b","ad79376aa24df8dab799d4fb4c5d0c913fda03bfea65cbd80923a5919bb1e9b9","9f36aa7edd5e1f19b541f209386bc7ea","ed51900e5b6bb58c116236aff1ed3dec4440702b","1349f1ac1da22cb2f2251a7e26dbc1e8716504c76d623d800e96295b8cdd00eb")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("3a285221a2ee58369c4d39d2ee508b3d","d04754ca5c9853d4f5688ddafd76b125306dd01b","ad79376aa24df8dab799d4fb4c5d0c913fda03bfea65cbd80923a5919bb1e9b9","9f36aa7edd5e1f19b541f209386bc7ea","ed51900e5b6bb58c116236aff1ed3dec4440702b","1349f1ac1da22cb2f2251a7e26dbc1e8716504c76d623d800e96295b8cdd00eb")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("3a285221a2ee58369c4d39d2ee508b3d","d04754ca5c9853d4f5688ddafd76b125306dd01b","ad79376aa24df8dab799d4fb4c5d0c913fda03bfea65cbd80923a5919bb1e9b9","9f36aa7edd5e1f19b541f209386bc7ea","ed51900e5b6bb58c116236aff1ed3dec4440702b","1349f1ac1da22cb2f2251a7e26dbc1e8716504c76d623d800e96295b8cdd00eb")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("3a285221a2ee58369c4d39d2ee508b3d","d04754ca5c9853d4f5688ddafd76b125306dd01b","ad79376aa24df8dab799d4fb4c5d0c913fda03bfea65cbd80923a5919bb1e9b9","9f36aa7edd5e1f19b541f209386bc7ea","ed51900e5b6bb58c116236aff1ed3dec4440702b","1349f1ac1da22cb2f2251a7e26dbc1e8716504c76d623d800e96295b8cdd00eb")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("3a285221a2ee58369c4d39d2ee508b3d","d04754ca5c9853d4f5688ddafd76b125306dd01b","ad79376aa24df8dab799d4fb4c5d0c913fda03bfea65cbd80923a5919bb1e9b9","9f36aa7edd5e1f19b541f209386bc7ea","ed51900e5b6bb58c116236aff1ed3dec4440702b","1349f1ac1da22cb2f2251a7e26dbc1e8716504c76d623d800e96295b8cdd00eb")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("3a285221a2ee58369c4d39d2ee508b3d","d04754ca5c9853d4f5688ddafd76b125306dd01b","ad79376aa24df8dab799d4fb4c5d0c913fda03bfea65cbd80923a5919bb1e9b9","9f36aa7edd5e1f19b541f209386bc7ea","ed51900e5b6bb58c116236aff1ed3dec4440702b","1349f1ac1da22cb2f2251a7e26dbc1e8716504c76d623d800e96295b8cdd00eb")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("3a285221a2ee58369c4d39d2ee508b3d","d04754ca5c9853d4f5688ddafd76b125306dd01b","ad79376aa24df8dab799d4fb4c5d0c913fda03bfea65cbd80923a5919bb1e9b9","9f36aa7edd5e1f19b541f209386bc7ea","ed51900e5b6bb58c116236aff1ed3dec4440702b","1349f1ac1da22cb2f2251a7e26dbc1e8716504c76d623d800e96295b8cdd00eb")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("3a285221a2ee58369c4d39d2ee508b3d","d04754ca5c9853d4f5688ddafd76b125306dd01b","ad79376aa24df8dab799d4fb4c5d0c913fda03bfea65cbd80923a5919bb1e9b9","9f36aa7edd5e1f19b541f209386bc7ea","ed51900e5b6bb58c116236aff1ed3dec4440702b","1349f1ac1da22cb2f2251a7e26dbc1e8716504c76d623d800e96295b8cdd00eb")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("3a285221a2ee58369c4d39d2ee508b3d","d04754ca5c9853d4f5688ddafd76b125306dd01b","ad79376aa24df8dab799d4fb4c5d0c913fda03bfea65cbd80923a5919bb1e9b9","9f36aa7edd5e1f19b541f209386bc7ea","ed51900e5b6bb58c116236aff1ed3dec4440702b","1349f1ac1da22cb2f2251a7e26dbc1e8716504c76d623d800e96295b8cdd00eb")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("3a285221a2ee58369c4d39d2ee508b3d","d04754ca5c9853d4f5688ddafd76b125306dd01b","ad79376aa24df8dab799d4fb4c5d0c913fda03bfea65cbd80923a5919bb1e9b9","9f36aa7edd5e1f19b541f209386bc7ea","ed51900e5b6bb58c116236aff1ed3dec4440702b","1349f1ac1da22cb2f2251a7e26dbc1e8716504c76d623d800e96295b8cdd00eb")
index=activity AND rg_functionality="Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("3a285221a2ee58369c4d39d2ee508b3d","d04754ca5c9853d4f5688ddafd76b125306dd01b","ad79376aa24df8dab799d4fb4c5d0c913fda03bfea65cbd80923a5919bb1e9b9","9f36aa7edd5e1f19b541f209386bc7ea","ed51900e5b6bb58c116236aff1ed3dec4440702b","1349f1ac1da22cb2f2251a7e26dbc1e8716504c76d623d800e96295b8cdd00eb")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("3a285221a2ee58369c4d39d2ee508b3d","d04754ca5c9853d4f5688ddafd76b125306dd01b","ad79376aa24df8dab799d4fb4c5d0c913fda03bfea65cbd80923a5919bb1e9b9","9f36aa7edd5e1f19b541f209386bc7ea","ed51900e5b6bb58c116236aff1ed3dec4440702b","1349f1ac1da22cb2f2251a7e26dbc1e8716504c76d623d800e96295b8cdd00eb")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("3a285221a2ee58369c4d39d2ee508b3d","d04754ca5c9853d4f5688ddafd76b125306dd01b","ad79376aa24df8dab799d4fb4c5d0c913fda03bfea65cbd80923a5919bb1e9b9","9f36aa7edd5e1f19b541f209386bc7ea","ed51900e5b6bb58c116236aff1ed3dec4440702b","1349f1ac1da22cb2f2251a7e26dbc1e8716504c76d623d800e96295b8cdd00eb")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("3a285221a2ee58369c4d39d2ee508b3d","d04754ca5c9853d4f5688ddafd76b125306dd01b","ad79376aa24df8dab799d4fb4c5d0c913fda03bfea65cbd80923a5919bb1e9b9","9f36aa7edd5e1f19b541f209386bc7ea","ed51900e5b6bb58c116236aff1ed3dec4440702b","1349f1ac1da22cb2f2251a7e26dbc1e8716504c76d623d800e96295b8cdd00eb")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("3a285221a2ee58369c4d39d2ee508b3d","d04754ca5c9853d4f5688ddafd76b125306dd01b","ad79376aa24df8dab799d4fb4c5d0c913fda03bfea65cbd80923a5919bb1e9b9","9f36aa7edd5e1f19b541f209386bc7ea","ed51900e5b6bb58c116236aff1ed3dec4440702b","1349f1ac1da22cb2f2251a7e26dbc1e8716504c76d623d800e96295b8cdd00eb")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("3a285221a2ee58369c4d39d2ee508b3d","d04754ca5c9853d4f5688ddafd76b125306dd01b","ad79376aa24df8dab799d4fb4c5d0c913fda03bfea65cbd80923a5919bb1e9b9","9f36aa7edd5e1f19b541f209386bc7ea","ed51900e5b6bb58c116236aff1ed3dec4440702b","1349f1ac1da22cb2f2251a7e26dbc1e8716504c76d623d800e96295b8cdd00eb")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("3a285221a2ee58369c4d39d2ee508b3d","d04754ca5c9853d4f5688ddafd76b125306dd01b","ad79376aa24df8dab799d4fb4c5d0c913fda03bfea65cbd80923a5919bb1e9b9","9f36aa7edd5e1f19b541f209386bc7ea","ed51900e5b6bb58c116236aff1ed3dec4440702b","1349f1ac1da22cb2f2251a7e26dbc1e8716504c76d623d800e96295b8cdd00eb")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("3a285221a2ee58369c4d39d2ee508b3d","d04754ca5c9853d4f5688ddafd76b125306dd01b","ad79376aa24df8dab799d4fb4c5d0c913fda03bfea65cbd80923a5919bb1e9b9","9f36aa7edd5e1f19b541f209386bc7ea","ed51900e5b6bb58c116236aff1ed3dec4440702b","1349f1ac1da22cb2f2251a7e26dbc1e8716504c76d623d800e96295b8cdd00eb")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring64 NOT NULL AND customstring64 IN ("3a285221a2ee58369c4d39d2ee508b3d","d04754ca5c9853d4f5688ddafd76b125306dd01b","ad79376aa24df8dab799d4fb4c5d0c913fda03bfea65cbd80923a5919bb1e9b9","9f36aa7edd5e1f19b541f209386bc7ea","ed51900e5b6bb58c116236aff1ed3dec4440702b","1349f1ac1da22cb2f2251a7e26dbc1e8716504c76d623d800e96295b8cdd00eb")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("3a285221a2ee58369c4d39d2ee508b3d","d04754ca5c9853d4f5688ddafd76b125306dd01b","ad79376aa24df8dab799d4fb4c5d0c913fda03bfea65cbd80923a5919bb1e9b9","9f36aa7edd5e1f19b541f209386bc7ea","ed51900e5b6bb58c116236aff1ed3dec4440702b","1349f1ac1da22cb2f2251a7e26dbc1e8716504c76d623d800e96295b8cdd00eb")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("3a285221a2ee58369c4d39d2ee508b3d","d04754ca5c9853d4f5688ddafd76b125306dd01b","ad79376aa24df8dab799d4fb4c5d0c913fda03bfea65cbd80923a5919bb1e9b9","9f36aa7edd5e1f19b541f209386bc7ea","ed51900e5b6bb58c116236aff1ed3dec4440702b","1349f1ac1da22cb2f2251a7e26dbc1e8716504c76d623d800e96295b8cdd00eb")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("3a285221a2ee58369c4d39d2ee508b3d","d04754ca5c9853d4f5688ddafd76b125306dd01b","ad79376aa24df8dab799d4fb4c5d0c913fda03bfea65cbd80923a5919bb1e9b9","9f36aa7edd5e1f19b541f209386bc7ea","ed51900e5b6bb58c116236aff1ed3dec4440702b","1349f1ac1da22cb2f2251a7e26dbc1e8716504c76d623d800e96295b8cdd00eb")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring64 NOT NULL AND customstring64 IN ("3a285221a2ee58369c4d39d2ee508b3d","d04754ca5c9853d4f5688ddafd76b125306dd01b","ad79376aa24df8dab799d4fb4c5d0c913fda03bfea65cbd80923a5919bb1e9b9","9f36aa7edd5e1f19b541f209386bc7ea","ed51900e5b6bb58c116236aff1ed3dec4440702b","1349f1ac1da22cb2f2251a7e26dbc1e8716504c76d623d800e96295b8cdd00eb")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("3a285221a2ee58369c4d39d2ee508b3d","d04754ca5c9853d4f5688ddafd76b125306dd01b","ad79376aa24df8dab799d4fb4c5d0c913fda03bfea65cbd80923a5919bb1e9b9","9f36aa7edd5e1f19b541f209386bc7ea","ed51900e5b6bb58c116236aff1ed3dec4440702b","1349f1ac1da22cb2f2251a7e26dbc1e8716504c76d623d800e96295b8cdd00eb")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("3a285221a2ee58369c4d39d2ee508b3d","d04754ca5c9853d4f5688ddafd76b125306dd01b","ad79376aa24df8dab799d4fb4c5d0c913fda03bfea65cbd80923a5919bb1e9b9","9f36aa7edd5e1f19b541f209386bc7ea","ed51900e5b6bb58c116236aff1ed3dec4440702b","1349f1ac1da22cb2f2251a7e26dbc1e8716504c76d623d800e96295b8cdd00eb")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("3a285221a2ee58369c4d39d2ee508b3d","d04754ca5c9853d4f5688ddafd76b125306dd01b","ad79376aa24df8dab799d4fb4c5d0c913fda03bfea65cbd80923a5919bb1e9b9","9f36aa7edd5e1f19b541f209386bc7ea","ed51900e5b6bb58c116236aff1ed3dec4440702b","1349f1ac1da22cb2f2251a7e26dbc1e8716504c76d623d800e96295b8cdd00eb")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring64 NOT NULL AND customstring64 IN ("3a285221a2ee58369c4d39d2ee508b3d","d04754ca5c9853d4f5688ddafd76b125306dd01b","ad79376aa24df8dab799d4fb4c5d0c913fda03bfea65cbd80923a5919bb1e9b9","9f36aa7edd5e1f19b541f209386bc7ea","ed51900e5b6bb58c116236aff1ed3dec4440702b","1349f1ac1da22cb2f2251a7e26dbc1e8716504c76d623d800e96295b8cdd00eb")
