index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("912342F1C840A42F6B74132F8A7C4FFE7D40FB77","61B25D11392172E587D8DA3045812A66C3385451","3C54C9A49A8DDCA02189FE15FEA52FE24F41A86F","F32D791EC9E6385A91B45942C230F52AFF1626DF","AD602039C6F0237D4A997D5640E92CE5E2B3BBA3","736A4CFAD1ED83A6A0B75B0474D5E01A3A36F950","E9B96E9B86FAD28D950CA428879168E0894D854F","23873BF2670CF64C2440058130548D4E4DA412DD")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("912342F1C840A42F6B74132F8A7C4FFE7D40FB77","61B25D11392172E587D8DA3045812A66C3385451","3C54C9A49A8DDCA02189FE15FEA52FE24F41A86F","F32D791EC9E6385A91B45942C230F52AFF1626DF","AD602039C6F0237D4A997D5640E92CE5E2B3BBA3","736A4CFAD1ED83A6A0B75B0474D5E01A3A36F950","E9B96E9B86FAD28D950CA428879168E0894D854F","23873BF2670CF64C2440058130548D4E4DA412DD")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("912342F1C840A42F6B74132F8A7C4FFE7D40FB77","61B25D11392172E587D8DA3045812A66C3385451","3C54C9A49A8DDCA02189FE15FEA52FE24F41A86F","F32D791EC9E6385A91B45942C230F52AFF1626DF","AD602039C6F0237D4A997D5640E92CE5E2B3BBA3","736A4CFAD1ED83A6A0B75B0474D5E01A3A36F950","E9B96E9B86FAD28D950CA428879168E0894D854F","23873BF2670CF64C2440058130548D4E4DA412DD")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("912342F1C840A42F6B74132F8A7C4FFE7D40FB77","61B25D11392172E587D8DA3045812A66C3385451","3C54C9A49A8DDCA02189FE15FEA52FE24F41A86F","F32D791EC9E6385A91B45942C230F52AFF1626DF","AD602039C6F0237D4A997D5640E92CE5E2B3BBA3","736A4CFAD1ED83A6A0B75B0474D5E01A3A36F950","E9B96E9B86FAD28D950CA428879168E0894D854F","23873BF2670CF64C2440058130548D4E4DA412DD")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("912342F1C840A42F6B74132F8A7C4FFE7D40FB77","61B25D11392172E587D8DA3045812A66C3385451","3C54C9A49A8DDCA02189FE15FEA52FE24F41A86F","F32D791EC9E6385A91B45942C230F52AFF1626DF","AD602039C6F0237D4A997D5640E92CE5E2B3BBA3","736A4CFAD1ED83A6A0B75B0474D5E01A3A36F950","E9B96E9B86FAD28D950CA428879168E0894D854F","23873BF2670CF64C2440058130548D4E4DA412DD")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("912342F1C840A42F6B74132F8A7C4FFE7D40FB77","61B25D11392172E587D8DA3045812A66C3385451","3C54C9A49A8DDCA02189FE15FEA52FE24F41A86F","F32D791EC9E6385A91B45942C230F52AFF1626DF","AD602039C6F0237D4A997D5640E92CE5E2B3BBA3","736A4CFAD1ED83A6A0B75B0474D5E01A3A36F950","E9B96E9B86FAD28D950CA428879168E0894D854F","23873BF2670CF64C2440058130548D4E4DA412DD")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("912342F1C840A42F6B74132F8A7C4FFE7D40FB77","61B25D11392172E587D8DA3045812A66C3385451","3C54C9A49A8DDCA02189FE15FEA52FE24F41A86F","F32D791EC9E6385A91B45942C230F52AFF1626DF","AD602039C6F0237D4A997D5640E92CE5E2B3BBA3","736A4CFAD1ED83A6A0B75B0474D5E01A3A36F950","E9B96E9B86FAD28D950CA428879168E0894D854F","23873BF2670CF64C2440058130548D4E4DA412DD")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("912342F1C840A42F6B74132F8A7C4FFE7D40FB77","61B25D11392172E587D8DA3045812A66C3385451","3C54C9A49A8DDCA02189FE15FEA52FE24F41A86F","F32D791EC9E6385A91B45942C230F52AFF1626DF","AD602039C6F0237D4A997D5640E92CE5E2B3BBA3","736A4CFAD1ED83A6A0B75B0474D5E01A3A36F950","E9B96E9B86FAD28D950CA428879168E0894D854F","23873BF2670CF64C2440058130548D4E4DA412DD")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("912342F1C840A42F6B74132F8A7C4FFE7D40FB77","61B25D11392172E587D8DA3045812A66C3385451","3C54C9A49A8DDCA02189FE15FEA52FE24F41A86F","F32D791EC9E6385A91B45942C230F52AFF1626DF","AD602039C6F0237D4A997D5640E92CE5E2B3BBA3","736A4CFAD1ED83A6A0B75B0474D5E01A3A36F950","E9B96E9B86FAD28D950CA428879168E0894D854F","23873BF2670CF64C2440058130548D4E4DA412DD")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("912342F1C840A42F6B74132F8A7C4FFE7D40FB77","61B25D11392172E587D8DA3045812A66C3385451","3C54C9A49A8DDCA02189FE15FEA52FE24F41A86F","F32D791EC9E6385A91B45942C230F52AFF1626DF","AD602039C6F0237D4A997D5640E92CE5E2B3BBA3","736A4CFAD1ED83A6A0B75B0474D5E01A3A36F950","E9B96E9B86FAD28D950CA428879168E0894D854F","23873BF2670CF64C2440058130548D4E4DA412DD")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("912342F1C840A42F6B74132F8A7C4FFE7D40FB77","61B25D11392172E587D8DA3045812A66C3385451","3C54C9A49A8DDCA02189FE15FEA52FE24F41A86F","F32D791EC9E6385A91B45942C230F52AFF1626DF","AD602039C6F0237D4A997D5640E92CE5E2B3BBA3","736A4CFAD1ED83A6A0B75B0474D5E01A3A36F950","E9B96E9B86FAD28D950CA428879168E0894D854F","23873BF2670CF64C2440058130548D4E4DA412DD")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("912342F1C840A42F6B74132F8A7C4FFE7D40FB77","61B25D11392172E587D8DA3045812A66C3385451","3C54C9A49A8DDCA02189FE15FEA52FE24F41A86F","F32D791EC9E6385A91B45942C230F52AFF1626DF","AD602039C6F0237D4A997D5640E92CE5E2B3BBA3","736A4CFAD1ED83A6A0B75B0474D5E01A3A36F950","E9B96E9B86FAD28D950CA428879168E0894D854F","23873BF2670CF64C2440058130548D4E4DA412DD")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("912342F1C840A42F6B74132F8A7C4FFE7D40FB77","61B25D11392172E587D8DA3045812A66C3385451","3C54C9A49A8DDCA02189FE15FEA52FE24F41A86F","F32D791EC9E6385A91B45942C230F52AFF1626DF","AD602039C6F0237D4A997D5640E92CE5E2B3BBA3","736A4CFAD1ED83A6A0B75B0474D5E01A3A36F950","E9B96E9B86FAD28D950CA428879168E0894D854F","23873BF2670CF64C2440058130548D4E4DA412DD")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("912342F1C840A42F6B74132F8A7C4FFE7D40FB77","61B25D11392172E587D8DA3045812A66C3385451","3C54C9A49A8DDCA02189FE15FEA52FE24F41A86F","F32D791EC9E6385A91B45942C230F52AFF1626DF","AD602039C6F0237D4A997D5640E92CE5E2B3BBA3","736A4CFAD1ED83A6A0B75B0474D5E01A3A36F950","E9B96E9B86FAD28D950CA428879168E0894D854F","23873BF2670CF64C2440058130548D4E4DA412DD")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("912342F1C840A42F6B74132F8A7C4FFE7D40FB77","61B25D11392172E587D8DA3045812A66C3385451","3C54C9A49A8DDCA02189FE15FEA52FE24F41A86F","F32D791EC9E6385A91B45942C230F52AFF1626DF","AD602039C6F0237D4A997D5640E92CE5E2B3BBA3","736A4CFAD1ED83A6A0B75B0474D5E01A3A36F950","E9B96E9B86FAD28D950CA428879168E0894D854F","23873BF2670CF64C2440058130548D4E4DA412DD")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("912342F1C840A42F6B74132F8A7C4FFE7D40FB77","61B25D11392172E587D8DA3045812A66C3385451","3C54C9A49A8DDCA02189FE15FEA52FE24F41A86F","F32D791EC9E6385A91B45942C230F52AFF1626DF","AD602039C6F0237D4A997D5640E92CE5E2B3BBA3","736A4CFAD1ED83A6A0B75B0474D5E01A3A36F950","E9B96E9B86FAD28D950CA428879168E0894D854F","23873BF2670CF64C2440058130548D4E4DA412DD")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("912342F1C840A42F6B74132F8A7C4FFE7D40FB77","61B25D11392172E587D8DA3045812A66C3385451","3C54C9A49A8DDCA02189FE15FEA52FE24F41A86F","F32D791EC9E6385A91B45942C230F52AFF1626DF","AD602039C6F0237D4A997D5640E92CE5E2B3BBA3","736A4CFAD1ED83A6A0B75B0474D5E01A3A36F950","E9B96E9B86FAD28D950CA428879168E0894D854F","23873BF2670CF64C2440058130548D4E4DA412DD")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("912342F1C840A42F6B74132F8A7C4FFE7D40FB77","61B25D11392172E587D8DA3045812A66C3385451","3C54C9A49A8DDCA02189FE15FEA52FE24F41A86F","F32D791EC9E6385A91B45942C230F52AFF1626DF","AD602039C6F0237D4A997D5640E92CE5E2B3BBA3","736A4CFAD1ED83A6A0B75B0474D5E01A3A36F950","E9B96E9B86FAD28D950CA428879168E0894D854F","23873BF2670CF64C2440058130548D4E4DA412DD")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("912342F1C840A42F6B74132F8A7C4FFE7D40FB77","61B25D11392172E587D8DA3045812A66C3385451","3C54C9A49A8DDCA02189FE15FEA52FE24F41A86F","F32D791EC9E6385A91B45942C230F52AFF1626DF","AD602039C6F0237D4A997D5640E92CE5E2B3BBA3","736A4CFAD1ED83A6A0B75B0474D5E01A3A36F950","E9B96E9B86FAD28D950CA428879168E0894D854F","23873BF2670CF64C2440058130548D4E4DA412DD")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("912342F1C840A42F6B74132F8A7C4FFE7D40FB77","61B25D11392172E587D8DA3045812A66C3385451","3C54C9A49A8DDCA02189FE15FEA52FE24F41A86F","F32D791EC9E6385A91B45942C230F52AFF1626DF","AD602039C6F0237D4A997D5640E92CE5E2B3BBA3","736A4CFAD1ED83A6A0B75B0474D5E01A3A36F950","E9B96E9B86FAD28D950CA428879168E0894D854F","23873BF2670CF64C2440058130548D4E4DA412DD")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("912342F1C840A42F6B74132F8A7C4FFE7D40FB77","61B25D11392172E587D8DA3045812A66C3385451","3C54C9A49A8DDCA02189FE15FEA52FE24F41A86F","F32D791EC9E6385A91B45942C230F52AFF1626DF","AD602039C6F0237D4A997D5640E92CE5E2B3BBA3","736A4CFAD1ED83A6A0B75B0474D5E01A3A36F950","E9B96E9B86FAD28D950CA428879168E0894D854F","23873BF2670CF64C2440058130548D4E4DA412DD")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("912342F1C840A42F6B74132F8A7C4FFE7D40FB77","61B25D11392172E587D8DA3045812A66C3385451","3C54C9A49A8DDCA02189FE15FEA52FE24F41A86F","F32D791EC9E6385A91B45942C230F52AFF1626DF","AD602039C6F0237D4A997D5640E92CE5E2B3BBA3","736A4CFAD1ED83A6A0B75B0474D5E01A3A36F950","E9B96E9B86FAD28D950CA428879168E0894D854F","23873BF2670CF64C2440058130548D4E4DA412DD")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("912342F1C840A42F6B74132F8A7C4FFE7D40FB77","61B25D11392172E587D8DA3045812A66C3385451","3C54C9A49A8DDCA02189FE15FEA52FE24F41A86F","F32D791EC9E6385A91B45942C230F52AFF1626DF","AD602039C6F0237D4A997D5640E92CE5E2B3BBA3","736A4CFAD1ED83A6A0B75B0474D5E01A3A36F950","E9B96E9B86FAD28D950CA428879168E0894D854F","23873BF2670CF64C2440058130548D4E4DA412DD")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("912342F1C840A42F6B74132F8A7C4FFE7D40FB77","61B25D11392172E587D8DA3045812A66C3385451","3C54C9A49A8DDCA02189FE15FEA52FE24F41A86F","F32D791EC9E6385A91B45942C230F52AFF1626DF","AD602039C6F0237D4A997D5640E92CE5E2B3BBA3","736A4CFAD1ED83A6A0B75B0474D5E01A3A36F950","E9B96E9B86FAD28D950CA428879168E0894D854F","23873BF2670CF64C2440058130548D4E4DA412DD")
