index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("9fe22114dea040c36539ccb2e7c584ab","7f6c4cf9e4094d84bf4b7d90e028c29c","3cbafd64e2ef11fb58ccda3161c53d7733acabf5","9b9ed71f851ba0006816a8ccdfbdf0736f3f9ea0","56856e1e275cebcd477e3a2995cd76398cfbb6c210181a14939c6307a82e6763","342b7b89082431c1ba088315c5ee81e89a94e36663f2ab8cfc27e17f7853ca2b","60b477dab8494d3a049cf3b17118a4124b68f9f7d3dcc3c92026ac86b00aae1e")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("9fe22114dea040c36539ccb2e7c584ab","7f6c4cf9e4094d84bf4b7d90e028c29c","3cbafd64e2ef11fb58ccda3161c53d7733acabf5","9b9ed71f851ba0006816a8ccdfbdf0736f3f9ea0","56856e1e275cebcd477e3a2995cd76398cfbb6c210181a14939c6307a82e6763","342b7b89082431c1ba088315c5ee81e89a94e36663f2ab8cfc27e17f7853ca2b","60b477dab8494d3a049cf3b17118a4124b68f9f7d3dcc3c92026ac86b00aae1e")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("9fe22114dea040c36539ccb2e7c584ab","7f6c4cf9e4094d84bf4b7d90e028c29c","3cbafd64e2ef11fb58ccda3161c53d7733acabf5","9b9ed71f851ba0006816a8ccdfbdf0736f3f9ea0","56856e1e275cebcd477e3a2995cd76398cfbb6c210181a14939c6307a82e6763","342b7b89082431c1ba088315c5ee81e89a94e36663f2ab8cfc27e17f7853ca2b","60b477dab8494d3a049cf3b17118a4124b68f9f7d3dcc3c92026ac86b00aae1e")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring64 NOT NULL AND customstring64 IN ("9fe22114dea040c36539ccb2e7c584ab","7f6c4cf9e4094d84bf4b7d90e028c29c","3cbafd64e2ef11fb58ccda3161c53d7733acabf5","9b9ed71f851ba0006816a8ccdfbdf0736f3f9ea0","56856e1e275cebcd477e3a2995cd76398cfbb6c210181a14939c6307a82e6763","342b7b89082431c1ba088315c5ee81e89a94e36663f2ab8cfc27e17f7853ca2b","60b477dab8494d3a049cf3b17118a4124b68f9f7d3dcc3c92026ac86b00aae1e")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("9fe22114dea040c36539ccb2e7c584ab","7f6c4cf9e4094d84bf4b7d90e028c29c","3cbafd64e2ef11fb58ccda3161c53d7733acabf5","9b9ed71f851ba0006816a8ccdfbdf0736f3f9ea0","56856e1e275cebcd477e3a2995cd76398cfbb6c210181a14939c6307a82e6763","342b7b89082431c1ba088315c5ee81e89a94e36663f2ab8cfc27e17f7853ca2b","60b477dab8494d3a049cf3b17118a4124b68f9f7d3dcc3c92026ac86b00aae1e")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("9fe22114dea040c36539ccb2e7c584ab","7f6c4cf9e4094d84bf4b7d90e028c29c","3cbafd64e2ef11fb58ccda3161c53d7733acabf5","9b9ed71f851ba0006816a8ccdfbdf0736f3f9ea0","56856e1e275cebcd477e3a2995cd76398cfbb6c210181a14939c6307a82e6763","342b7b89082431c1ba088315c5ee81e89a94e36663f2ab8cfc27e17f7853ca2b","60b477dab8494d3a049cf3b17118a4124b68f9f7d3dcc3c92026ac86b00aae1e")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("9fe22114dea040c36539ccb2e7c584ab","7f6c4cf9e4094d84bf4b7d90e028c29c","3cbafd64e2ef11fb58ccda3161c53d7733acabf5","9b9ed71f851ba0006816a8ccdfbdf0736f3f9ea0","56856e1e275cebcd477e3a2995cd76398cfbb6c210181a14939c6307a82e6763","342b7b89082431c1ba088315c5ee81e89a94e36663f2ab8cfc27e17f7853ca2b","60b477dab8494d3a049cf3b17118a4124b68f9f7d3dcc3c92026ac86b00aae1e")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("9fe22114dea040c36539ccb2e7c584ab","7f6c4cf9e4094d84bf4b7d90e028c29c","3cbafd64e2ef11fb58ccda3161c53d7733acabf5","9b9ed71f851ba0006816a8ccdfbdf0736f3f9ea0","56856e1e275cebcd477e3a2995cd76398cfbb6c210181a14939c6307a82e6763","342b7b89082431c1ba088315c5ee81e89a94e36663f2ab8cfc27e17f7853ca2b","60b477dab8494d3a049cf3b17118a4124b68f9f7d3dcc3c92026ac86b00aae1e")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("9fe22114dea040c36539ccb2e7c584ab","7f6c4cf9e4094d84bf4b7d90e028c29c","3cbafd64e2ef11fb58ccda3161c53d7733acabf5","9b9ed71f851ba0006816a8ccdfbdf0736f3f9ea0","56856e1e275cebcd477e3a2995cd76398cfbb6c210181a14939c6307a82e6763","342b7b89082431c1ba088315c5ee81e89a94e36663f2ab8cfc27e17f7853ca2b","60b477dab8494d3a049cf3b17118a4124b68f9f7d3dcc3c92026ac86b00aae1e")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("9fe22114dea040c36539ccb2e7c584ab","7f6c4cf9e4094d84bf4b7d90e028c29c","3cbafd64e2ef11fb58ccda3161c53d7733acabf5","9b9ed71f851ba0006816a8ccdfbdf0736f3f9ea0","56856e1e275cebcd477e3a2995cd76398cfbb6c210181a14939c6307a82e6763","342b7b89082431c1ba088315c5ee81e89a94e36663f2ab8cfc27e17f7853ca2b","60b477dab8494d3a049cf3b17118a4124b68f9f7d3dcc3c92026ac86b00aae1e")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("9fe22114dea040c36539ccb2e7c584ab","7f6c4cf9e4094d84bf4b7d90e028c29c","3cbafd64e2ef11fb58ccda3161c53d7733acabf5","9b9ed71f851ba0006816a8ccdfbdf0736f3f9ea0","56856e1e275cebcd477e3a2995cd76398cfbb6c210181a14939c6307a82e6763","342b7b89082431c1ba088315c5ee81e89a94e36663f2ab8cfc27e17f7853ca2b","60b477dab8494d3a049cf3b17118a4124b68f9f7d3dcc3c92026ac86b00aae1e")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("9fe22114dea040c36539ccb2e7c584ab","7f6c4cf9e4094d84bf4b7d90e028c29c","3cbafd64e2ef11fb58ccda3161c53d7733acabf5","9b9ed71f851ba0006816a8ccdfbdf0736f3f9ea0","56856e1e275cebcd477e3a2995cd76398cfbb6c210181a14939c6307a82e6763","342b7b89082431c1ba088315c5ee81e89a94e36663f2ab8cfc27e17f7853ca2b","60b477dab8494d3a049cf3b17118a4124b68f9f7d3dcc3c92026ac86b00aae1e")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("9fe22114dea040c36539ccb2e7c584ab","7f6c4cf9e4094d84bf4b7d90e028c29c","3cbafd64e2ef11fb58ccda3161c53d7733acabf5","9b9ed71f851ba0006816a8ccdfbdf0736f3f9ea0","56856e1e275cebcd477e3a2995cd76398cfbb6c210181a14939c6307a82e6763","342b7b89082431c1ba088315c5ee81e89a94e36663f2ab8cfc27e17f7853ca2b","60b477dab8494d3a049cf3b17118a4124b68f9f7d3dcc3c92026ac86b00aae1e")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("9fe22114dea040c36539ccb2e7c584ab","7f6c4cf9e4094d84bf4b7d90e028c29c","3cbafd64e2ef11fb58ccda3161c53d7733acabf5","9b9ed71f851ba0006816a8ccdfbdf0736f3f9ea0","56856e1e275cebcd477e3a2995cd76398cfbb6c210181a14939c6307a82e6763","342b7b89082431c1ba088315c5ee81e89a94e36663f2ab8cfc27e17f7853ca2b","60b477dab8494d3a049cf3b17118a4124b68f9f7d3dcc3c92026ac86b00aae1e")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("9fe22114dea040c36539ccb2e7c584ab","7f6c4cf9e4094d84bf4b7d90e028c29c","3cbafd64e2ef11fb58ccda3161c53d7733acabf5","9b9ed71f851ba0006816a8ccdfbdf0736f3f9ea0","56856e1e275cebcd477e3a2995cd76398cfbb6c210181a14939c6307a82e6763","342b7b89082431c1ba088315c5ee81e89a94e36663f2ab8cfc27e17f7853ca2b","60b477dab8494d3a049cf3b17118a4124b68f9f7d3dcc3c92026ac86b00aae1e")
index=activity AND rg_functionality="Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("9fe22114dea040c36539ccb2e7c584ab","7f6c4cf9e4094d84bf4b7d90e028c29c","3cbafd64e2ef11fb58ccda3161c53d7733acabf5","9b9ed71f851ba0006816a8ccdfbdf0736f3f9ea0","56856e1e275cebcd477e3a2995cd76398cfbb6c210181a14939c6307a82e6763","342b7b89082431c1ba088315c5ee81e89a94e36663f2ab8cfc27e17f7853ca2b","60b477dab8494d3a049cf3b17118a4124b68f9f7d3dcc3c92026ac86b00aae1e")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("9fe22114dea040c36539ccb2e7c584ab","7f6c4cf9e4094d84bf4b7d90e028c29c","3cbafd64e2ef11fb58ccda3161c53d7733acabf5","9b9ed71f851ba0006816a8ccdfbdf0736f3f9ea0","56856e1e275cebcd477e3a2995cd76398cfbb6c210181a14939c6307a82e6763","342b7b89082431c1ba088315c5ee81e89a94e36663f2ab8cfc27e17f7853ca2b","60b477dab8494d3a049cf3b17118a4124b68f9f7d3dcc3c92026ac86b00aae1e")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("9fe22114dea040c36539ccb2e7c584ab","7f6c4cf9e4094d84bf4b7d90e028c29c","3cbafd64e2ef11fb58ccda3161c53d7733acabf5","9b9ed71f851ba0006816a8ccdfbdf0736f3f9ea0","56856e1e275cebcd477e3a2995cd76398cfbb6c210181a14939c6307a82e6763","342b7b89082431c1ba088315c5ee81e89a94e36663f2ab8cfc27e17f7853ca2b","60b477dab8494d3a049cf3b17118a4124b68f9f7d3dcc3c92026ac86b00aae1e")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("9fe22114dea040c36539ccb2e7c584ab","7f6c4cf9e4094d84bf4b7d90e028c29c","3cbafd64e2ef11fb58ccda3161c53d7733acabf5","9b9ed71f851ba0006816a8ccdfbdf0736f3f9ea0","56856e1e275cebcd477e3a2995cd76398cfbb6c210181a14939c6307a82e6763","342b7b89082431c1ba088315c5ee81e89a94e36663f2ab8cfc27e17f7853ca2b","60b477dab8494d3a049cf3b17118a4124b68f9f7d3dcc3c92026ac86b00aae1e")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("9fe22114dea040c36539ccb2e7c584ab","7f6c4cf9e4094d84bf4b7d90e028c29c","3cbafd64e2ef11fb58ccda3161c53d7733acabf5","9b9ed71f851ba0006816a8ccdfbdf0736f3f9ea0","56856e1e275cebcd477e3a2995cd76398cfbb6c210181a14939c6307a82e6763","342b7b89082431c1ba088315c5ee81e89a94e36663f2ab8cfc27e17f7853ca2b","60b477dab8494d3a049cf3b17118a4124b68f9f7d3dcc3c92026ac86b00aae1e")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("9fe22114dea040c36539ccb2e7c584ab","7f6c4cf9e4094d84bf4b7d90e028c29c","3cbafd64e2ef11fb58ccda3161c53d7733acabf5","9b9ed71f851ba0006816a8ccdfbdf0736f3f9ea0","56856e1e275cebcd477e3a2995cd76398cfbb6c210181a14939c6307a82e6763","342b7b89082431c1ba088315c5ee81e89a94e36663f2ab8cfc27e17f7853ca2b","60b477dab8494d3a049cf3b17118a4124b68f9f7d3dcc3c92026ac86b00aae1e")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("9fe22114dea040c36539ccb2e7c584ab","7f6c4cf9e4094d84bf4b7d90e028c29c","3cbafd64e2ef11fb58ccda3161c53d7733acabf5","9b9ed71f851ba0006816a8ccdfbdf0736f3f9ea0","56856e1e275cebcd477e3a2995cd76398cfbb6c210181a14939c6307a82e6763","342b7b89082431c1ba088315c5ee81e89a94e36663f2ab8cfc27e17f7853ca2b","60b477dab8494d3a049cf3b17118a4124b68f9f7d3dcc3c92026ac86b00aae1e")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("9fe22114dea040c36539ccb2e7c584ab","7f6c4cf9e4094d84bf4b7d90e028c29c","3cbafd64e2ef11fb58ccda3161c53d7733acabf5","9b9ed71f851ba0006816a8ccdfbdf0736f3f9ea0","56856e1e275cebcd477e3a2995cd76398cfbb6c210181a14939c6307a82e6763","342b7b89082431c1ba088315c5ee81e89a94e36663f2ab8cfc27e17f7853ca2b","60b477dab8494d3a049cf3b17118a4124b68f9f7d3dcc3c92026ac86b00aae1e")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring64 NOT NULL AND customstring64 IN ("9fe22114dea040c36539ccb2e7c584ab","7f6c4cf9e4094d84bf4b7d90e028c29c","3cbafd64e2ef11fb58ccda3161c53d7733acabf5","9b9ed71f851ba0006816a8ccdfbdf0736f3f9ea0","56856e1e275cebcd477e3a2995cd76398cfbb6c210181a14939c6307a82e6763","342b7b89082431c1ba088315c5ee81e89a94e36663f2ab8cfc27e17f7853ca2b","60b477dab8494d3a049cf3b17118a4124b68f9f7d3dcc3c92026ac86b00aae1e")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("9fe22114dea040c36539ccb2e7c584ab","7f6c4cf9e4094d84bf4b7d90e028c29c","3cbafd64e2ef11fb58ccda3161c53d7733acabf5","9b9ed71f851ba0006816a8ccdfbdf0736f3f9ea0","56856e1e275cebcd477e3a2995cd76398cfbb6c210181a14939c6307a82e6763","342b7b89082431c1ba088315c5ee81e89a94e36663f2ab8cfc27e17f7853ca2b","60b477dab8494d3a049cf3b17118a4124b68f9f7d3dcc3c92026ac86b00aae1e")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("9fe22114dea040c36539ccb2e7c584ab","7f6c4cf9e4094d84bf4b7d90e028c29c","3cbafd64e2ef11fb58ccda3161c53d7733acabf5","9b9ed71f851ba0006816a8ccdfbdf0736f3f9ea0","56856e1e275cebcd477e3a2995cd76398cfbb6c210181a14939c6307a82e6763","342b7b89082431c1ba088315c5ee81e89a94e36663f2ab8cfc27e17f7853ca2b","60b477dab8494d3a049cf3b17118a4124b68f9f7d3dcc3c92026ac86b00aae1e")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("9fe22114dea040c36539ccb2e7c584ab","7f6c4cf9e4094d84bf4b7d90e028c29c","3cbafd64e2ef11fb58ccda3161c53d7733acabf5","9b9ed71f851ba0006816a8ccdfbdf0736f3f9ea0","56856e1e275cebcd477e3a2995cd76398cfbb6c210181a14939c6307a82e6763","342b7b89082431c1ba088315c5ee81e89a94e36663f2ab8cfc27e17f7853ca2b","60b477dab8494d3a049cf3b17118a4124b68f9f7d3dcc3c92026ac86b00aae1e")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring64 NOT NULL AND customstring64 IN ("9fe22114dea040c36539ccb2e7c584ab","7f6c4cf9e4094d84bf4b7d90e028c29c","3cbafd64e2ef11fb58ccda3161c53d7733acabf5","9b9ed71f851ba0006816a8ccdfbdf0736f3f9ea0","56856e1e275cebcd477e3a2995cd76398cfbb6c210181a14939c6307a82e6763","342b7b89082431c1ba088315c5ee81e89a94e36663f2ab8cfc27e17f7853ca2b","60b477dab8494d3a049cf3b17118a4124b68f9f7d3dcc3c92026ac86b00aae1e")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("9fe22114dea040c36539ccb2e7c584ab","7f6c4cf9e4094d84bf4b7d90e028c29c","3cbafd64e2ef11fb58ccda3161c53d7733acabf5","9b9ed71f851ba0006816a8ccdfbdf0736f3f9ea0","56856e1e275cebcd477e3a2995cd76398cfbb6c210181a14939c6307a82e6763","342b7b89082431c1ba088315c5ee81e89a94e36663f2ab8cfc27e17f7853ca2b","60b477dab8494d3a049cf3b17118a4124b68f9f7d3dcc3c92026ac86b00aae1e")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("9fe22114dea040c36539ccb2e7c584ab","7f6c4cf9e4094d84bf4b7d90e028c29c","3cbafd64e2ef11fb58ccda3161c53d7733acabf5","9b9ed71f851ba0006816a8ccdfbdf0736f3f9ea0","56856e1e275cebcd477e3a2995cd76398cfbb6c210181a14939c6307a82e6763","342b7b89082431c1ba088315c5ee81e89a94e36663f2ab8cfc27e17f7853ca2b","60b477dab8494d3a049cf3b17118a4124b68f9f7d3dcc3c92026ac86b00aae1e")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("9fe22114dea040c36539ccb2e7c584ab","7f6c4cf9e4094d84bf4b7d90e028c29c","3cbafd64e2ef11fb58ccda3161c53d7733acabf5","9b9ed71f851ba0006816a8ccdfbdf0736f3f9ea0","56856e1e275cebcd477e3a2995cd76398cfbb6c210181a14939c6307a82e6763","342b7b89082431c1ba088315c5ee81e89a94e36663f2ab8cfc27e17f7853ca2b","60b477dab8494d3a049cf3b17118a4124b68f9f7d3dcc3c92026ac86b00aae1e")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring64 NOT NULL AND customstring64 IN ("9fe22114dea040c36539ccb2e7c584ab","7f6c4cf9e4094d84bf4b7d90e028c29c","3cbafd64e2ef11fb58ccda3161c53d7733acabf5","9b9ed71f851ba0006816a8ccdfbdf0736f3f9ea0","56856e1e275cebcd477e3a2995cd76398cfbb6c210181a14939c6307a82e6763","342b7b89082431c1ba088315c5ee81e89a94e36663f2ab8cfc27e17f7853ca2b","60b477dab8494d3a049cf3b17118a4124b68f9f7d3dcc3c92026ac86b00aae1e")
