index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("bf41074e39bb3abbe4e4640401e7e655","b9dcf7fe7e8ba30d363a19c2c43fc3eea93d281b10f6ee89cffe2a3e533af442","326575e1df8e63ccc3f8283c6bf01b186dac7088")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("bf41074e39bb3abbe4e4640401e7e655","b9dcf7fe7e8ba30d363a19c2c43fc3eea93d281b10f6ee89cffe2a3e533af442","326575e1df8e63ccc3f8283c6bf01b186dac7088")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("bf41074e39bb3abbe4e4640401e7e655","b9dcf7fe7e8ba30d363a19c2c43fc3eea93d281b10f6ee89cffe2a3e533af442","326575e1df8e63ccc3f8283c6bf01b186dac7088")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring64 NOT NULL AND customstring64 IN ("bf41074e39bb3abbe4e4640401e7e655","b9dcf7fe7e8ba30d363a19c2c43fc3eea93d281b10f6ee89cffe2a3e533af442","326575e1df8e63ccc3f8283c6bf01b186dac7088")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("bf41074e39bb3abbe4e4640401e7e655","b9dcf7fe7e8ba30d363a19c2c43fc3eea93d281b10f6ee89cffe2a3e533af442","326575e1df8e63ccc3f8283c6bf01b186dac7088")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("bf41074e39bb3abbe4e4640401e7e655","b9dcf7fe7e8ba30d363a19c2c43fc3eea93d281b10f6ee89cffe2a3e533af442","326575e1df8e63ccc3f8283c6bf01b186dac7088")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("bf41074e39bb3abbe4e4640401e7e655","b9dcf7fe7e8ba30d363a19c2c43fc3eea93d281b10f6ee89cffe2a3e533af442","326575e1df8e63ccc3f8283c6bf01b186dac7088")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("bf41074e39bb3abbe4e4640401e7e655","b9dcf7fe7e8ba30d363a19c2c43fc3eea93d281b10f6ee89cffe2a3e533af442","326575e1df8e63ccc3f8283c6bf01b186dac7088")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("bf41074e39bb3abbe4e4640401e7e655","b9dcf7fe7e8ba30d363a19c2c43fc3eea93d281b10f6ee89cffe2a3e533af442","326575e1df8e63ccc3f8283c6bf01b186dac7088")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("bf41074e39bb3abbe4e4640401e7e655","b9dcf7fe7e8ba30d363a19c2c43fc3eea93d281b10f6ee89cffe2a3e533af442","326575e1df8e63ccc3f8283c6bf01b186dac7088")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("bf41074e39bb3abbe4e4640401e7e655","b9dcf7fe7e8ba30d363a19c2c43fc3eea93d281b10f6ee89cffe2a3e533af442","326575e1df8e63ccc3f8283c6bf01b186dac7088")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("bf41074e39bb3abbe4e4640401e7e655","b9dcf7fe7e8ba30d363a19c2c43fc3eea93d281b10f6ee89cffe2a3e533af442","326575e1df8e63ccc3f8283c6bf01b186dac7088")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("bf41074e39bb3abbe4e4640401e7e655","b9dcf7fe7e8ba30d363a19c2c43fc3eea93d281b10f6ee89cffe2a3e533af442","326575e1df8e63ccc3f8283c6bf01b186dac7088")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("bf41074e39bb3abbe4e4640401e7e655","b9dcf7fe7e8ba30d363a19c2c43fc3eea93d281b10f6ee89cffe2a3e533af442","326575e1df8e63ccc3f8283c6bf01b186dac7088")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("bf41074e39bb3abbe4e4640401e7e655","b9dcf7fe7e8ba30d363a19c2c43fc3eea93d281b10f6ee89cffe2a3e533af442","326575e1df8e63ccc3f8283c6bf01b186dac7088")
index=activity AND rg_functionality="Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("bf41074e39bb3abbe4e4640401e7e655","b9dcf7fe7e8ba30d363a19c2c43fc3eea93d281b10f6ee89cffe2a3e533af442","326575e1df8e63ccc3f8283c6bf01b186dac7088")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("bf41074e39bb3abbe4e4640401e7e655","b9dcf7fe7e8ba30d363a19c2c43fc3eea93d281b10f6ee89cffe2a3e533af442","326575e1df8e63ccc3f8283c6bf01b186dac7088")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("bf41074e39bb3abbe4e4640401e7e655","b9dcf7fe7e8ba30d363a19c2c43fc3eea93d281b10f6ee89cffe2a3e533af442","326575e1df8e63ccc3f8283c6bf01b186dac7088")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("bf41074e39bb3abbe4e4640401e7e655","b9dcf7fe7e8ba30d363a19c2c43fc3eea93d281b10f6ee89cffe2a3e533af442","326575e1df8e63ccc3f8283c6bf01b186dac7088")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("bf41074e39bb3abbe4e4640401e7e655","b9dcf7fe7e8ba30d363a19c2c43fc3eea93d281b10f6ee89cffe2a3e533af442","326575e1df8e63ccc3f8283c6bf01b186dac7088")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("bf41074e39bb3abbe4e4640401e7e655","b9dcf7fe7e8ba30d363a19c2c43fc3eea93d281b10f6ee89cffe2a3e533af442","326575e1df8e63ccc3f8283c6bf01b186dac7088")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("bf41074e39bb3abbe4e4640401e7e655","b9dcf7fe7e8ba30d363a19c2c43fc3eea93d281b10f6ee89cffe2a3e533af442","326575e1df8e63ccc3f8283c6bf01b186dac7088")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("bf41074e39bb3abbe4e4640401e7e655","b9dcf7fe7e8ba30d363a19c2c43fc3eea93d281b10f6ee89cffe2a3e533af442","326575e1df8e63ccc3f8283c6bf01b186dac7088")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring64 NOT NULL AND customstring64 IN ("bf41074e39bb3abbe4e4640401e7e655","b9dcf7fe7e8ba30d363a19c2c43fc3eea93d281b10f6ee89cffe2a3e533af442","326575e1df8e63ccc3f8283c6bf01b186dac7088")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("bf41074e39bb3abbe4e4640401e7e655","b9dcf7fe7e8ba30d363a19c2c43fc3eea93d281b10f6ee89cffe2a3e533af442","326575e1df8e63ccc3f8283c6bf01b186dac7088")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("bf41074e39bb3abbe4e4640401e7e655","b9dcf7fe7e8ba30d363a19c2c43fc3eea93d281b10f6ee89cffe2a3e533af442","326575e1df8e63ccc3f8283c6bf01b186dac7088")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("bf41074e39bb3abbe4e4640401e7e655","b9dcf7fe7e8ba30d363a19c2c43fc3eea93d281b10f6ee89cffe2a3e533af442","326575e1df8e63ccc3f8283c6bf01b186dac7088")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring64 NOT NULL AND customstring64 IN ("bf41074e39bb3abbe4e4640401e7e655","b9dcf7fe7e8ba30d363a19c2c43fc3eea93d281b10f6ee89cffe2a3e533af442","326575e1df8e63ccc3f8283c6bf01b186dac7088")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("bf41074e39bb3abbe4e4640401e7e655","b9dcf7fe7e8ba30d363a19c2c43fc3eea93d281b10f6ee89cffe2a3e533af442","326575e1df8e63ccc3f8283c6bf01b186dac7088")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("bf41074e39bb3abbe4e4640401e7e655","b9dcf7fe7e8ba30d363a19c2c43fc3eea93d281b10f6ee89cffe2a3e533af442","326575e1df8e63ccc3f8283c6bf01b186dac7088")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("bf41074e39bb3abbe4e4640401e7e655","b9dcf7fe7e8ba30d363a19c2c43fc3eea93d281b10f6ee89cffe2a3e533af442","326575e1df8e63ccc3f8283c6bf01b186dac7088")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring64 NOT NULL AND customstring64 IN ("bf41074e39bb3abbe4e4640401e7e655","b9dcf7fe7e8ba30d363a19c2c43fc3eea93d281b10f6ee89cffe2a3e533af442","326575e1df8e63ccc3f8283c6bf01b186dac7088")
