index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("6ba5d9ea8ad6b924a68a6d3a4e0ce358","526ca9259b0dfc7fe135e1f8fbd5b5c2bf52a57c","73742d6e77fc30cb4ab9869b8b48b055801f25fe749fa237a73e530f6fa40a09")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("6ba5d9ea8ad6b924a68a6d3a4e0ce358","526ca9259b0dfc7fe135e1f8fbd5b5c2bf52a57c","73742d6e77fc30cb4ab9869b8b48b055801f25fe749fa237a73e530f6fa40a09")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("6ba5d9ea8ad6b924a68a6d3a4e0ce358","526ca9259b0dfc7fe135e1f8fbd5b5c2bf52a57c","73742d6e77fc30cb4ab9869b8b48b055801f25fe749fa237a73e530f6fa40a09")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring64 NOT NULL AND customstring64 IN ("6ba5d9ea8ad6b924a68a6d3a4e0ce358","526ca9259b0dfc7fe135e1f8fbd5b5c2bf52a57c","73742d6e77fc30cb4ab9869b8b48b055801f25fe749fa237a73e530f6fa40a09")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("6ba5d9ea8ad6b924a68a6d3a4e0ce358","526ca9259b0dfc7fe135e1f8fbd5b5c2bf52a57c","73742d6e77fc30cb4ab9869b8b48b055801f25fe749fa237a73e530f6fa40a09")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("6ba5d9ea8ad6b924a68a6d3a4e0ce358","526ca9259b0dfc7fe135e1f8fbd5b5c2bf52a57c","73742d6e77fc30cb4ab9869b8b48b055801f25fe749fa237a73e530f6fa40a09")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("6ba5d9ea8ad6b924a68a6d3a4e0ce358","526ca9259b0dfc7fe135e1f8fbd5b5c2bf52a57c","73742d6e77fc30cb4ab9869b8b48b055801f25fe749fa237a73e530f6fa40a09")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("6ba5d9ea8ad6b924a68a6d3a4e0ce358","526ca9259b0dfc7fe135e1f8fbd5b5c2bf52a57c","73742d6e77fc30cb4ab9869b8b48b055801f25fe749fa237a73e530f6fa40a09")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("6ba5d9ea8ad6b924a68a6d3a4e0ce358","526ca9259b0dfc7fe135e1f8fbd5b5c2bf52a57c","73742d6e77fc30cb4ab9869b8b48b055801f25fe749fa237a73e530f6fa40a09")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("6ba5d9ea8ad6b924a68a6d3a4e0ce358","526ca9259b0dfc7fe135e1f8fbd5b5c2bf52a57c","73742d6e77fc30cb4ab9869b8b48b055801f25fe749fa237a73e530f6fa40a09")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("6ba5d9ea8ad6b924a68a6d3a4e0ce358","526ca9259b0dfc7fe135e1f8fbd5b5c2bf52a57c","73742d6e77fc30cb4ab9869b8b48b055801f25fe749fa237a73e530f6fa40a09")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("6ba5d9ea8ad6b924a68a6d3a4e0ce358","526ca9259b0dfc7fe135e1f8fbd5b5c2bf52a57c","73742d6e77fc30cb4ab9869b8b48b055801f25fe749fa237a73e530f6fa40a09")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("6ba5d9ea8ad6b924a68a6d3a4e0ce358","526ca9259b0dfc7fe135e1f8fbd5b5c2bf52a57c","73742d6e77fc30cb4ab9869b8b48b055801f25fe749fa237a73e530f6fa40a09")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("6ba5d9ea8ad6b924a68a6d3a4e0ce358","526ca9259b0dfc7fe135e1f8fbd5b5c2bf52a57c","73742d6e77fc30cb4ab9869b8b48b055801f25fe749fa237a73e530f6fa40a09")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("6ba5d9ea8ad6b924a68a6d3a4e0ce358","526ca9259b0dfc7fe135e1f8fbd5b5c2bf52a57c","73742d6e77fc30cb4ab9869b8b48b055801f25fe749fa237a73e530f6fa40a09")
index=activity AND rg_functionality="Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("6ba5d9ea8ad6b924a68a6d3a4e0ce358","526ca9259b0dfc7fe135e1f8fbd5b5c2bf52a57c","73742d6e77fc30cb4ab9869b8b48b055801f25fe749fa237a73e530f6fa40a09")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("6ba5d9ea8ad6b924a68a6d3a4e0ce358","526ca9259b0dfc7fe135e1f8fbd5b5c2bf52a57c","73742d6e77fc30cb4ab9869b8b48b055801f25fe749fa237a73e530f6fa40a09")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("6ba5d9ea8ad6b924a68a6d3a4e0ce358","526ca9259b0dfc7fe135e1f8fbd5b5c2bf52a57c","73742d6e77fc30cb4ab9869b8b48b055801f25fe749fa237a73e530f6fa40a09")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("6ba5d9ea8ad6b924a68a6d3a4e0ce358","526ca9259b0dfc7fe135e1f8fbd5b5c2bf52a57c","73742d6e77fc30cb4ab9869b8b48b055801f25fe749fa237a73e530f6fa40a09")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("6ba5d9ea8ad6b924a68a6d3a4e0ce358","526ca9259b0dfc7fe135e1f8fbd5b5c2bf52a57c","73742d6e77fc30cb4ab9869b8b48b055801f25fe749fa237a73e530f6fa40a09")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("6ba5d9ea8ad6b924a68a6d3a4e0ce358","526ca9259b0dfc7fe135e1f8fbd5b5c2bf52a57c","73742d6e77fc30cb4ab9869b8b48b055801f25fe749fa237a73e530f6fa40a09")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("6ba5d9ea8ad6b924a68a6d3a4e0ce358","526ca9259b0dfc7fe135e1f8fbd5b5c2bf52a57c","73742d6e77fc30cb4ab9869b8b48b055801f25fe749fa237a73e530f6fa40a09")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("6ba5d9ea8ad6b924a68a6d3a4e0ce358","526ca9259b0dfc7fe135e1f8fbd5b5c2bf52a57c","73742d6e77fc30cb4ab9869b8b48b055801f25fe749fa237a73e530f6fa40a09")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring64 NOT NULL AND customstring64 IN ("6ba5d9ea8ad6b924a68a6d3a4e0ce358","526ca9259b0dfc7fe135e1f8fbd5b5c2bf52a57c","73742d6e77fc30cb4ab9869b8b48b055801f25fe749fa237a73e530f6fa40a09")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("6ba5d9ea8ad6b924a68a6d3a4e0ce358","526ca9259b0dfc7fe135e1f8fbd5b5c2bf52a57c","73742d6e77fc30cb4ab9869b8b48b055801f25fe749fa237a73e530f6fa40a09")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("6ba5d9ea8ad6b924a68a6d3a4e0ce358","526ca9259b0dfc7fe135e1f8fbd5b5c2bf52a57c","73742d6e77fc30cb4ab9869b8b48b055801f25fe749fa237a73e530f6fa40a09")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("6ba5d9ea8ad6b924a68a6d3a4e0ce358","526ca9259b0dfc7fe135e1f8fbd5b5c2bf52a57c","73742d6e77fc30cb4ab9869b8b48b055801f25fe749fa237a73e530f6fa40a09")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring64 NOT NULL AND customstring64 IN ("6ba5d9ea8ad6b924a68a6d3a4e0ce358","526ca9259b0dfc7fe135e1f8fbd5b5c2bf52a57c","73742d6e77fc30cb4ab9869b8b48b055801f25fe749fa237a73e530f6fa40a09")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("6ba5d9ea8ad6b924a68a6d3a4e0ce358","526ca9259b0dfc7fe135e1f8fbd5b5c2bf52a57c","73742d6e77fc30cb4ab9869b8b48b055801f25fe749fa237a73e530f6fa40a09")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("6ba5d9ea8ad6b924a68a6d3a4e0ce358","526ca9259b0dfc7fe135e1f8fbd5b5c2bf52a57c","73742d6e77fc30cb4ab9869b8b48b055801f25fe749fa237a73e530f6fa40a09")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("6ba5d9ea8ad6b924a68a6d3a4e0ce358","526ca9259b0dfc7fe135e1f8fbd5b5c2bf52a57c","73742d6e77fc30cb4ab9869b8b48b055801f25fe749fa237a73e530f6fa40a09")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring64 NOT NULL AND customstring64 IN ("6ba5d9ea8ad6b924a68a6d3a4e0ce358","526ca9259b0dfc7fe135e1f8fbd5b5c2bf52a57c","73742d6e77fc30cb4ab9869b8b48b055801f25fe749fa237a73e530f6fa40a09")
