index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("d221b0a793cd10b00b0c1f943f6c1b63","c6936c5cf4307a8bb793dbc7a9dcb9f1","5cfee29eae9f476e8b32491f4ef8ae2f","6cfa3d34a929cabcc54229b6e100a633","bd7756138f48dc4ec8088e23ef6a4c80","0ef558c14d9894b6a011c9473c0f17c3","38bc0f4ac3bb83c5b7a041746b014910","f2e4746363ba1c940fa315f737dd8a46","5b672f45d525b56eb0c4c146214f267e","9043580b1766661d8fde0d3e88026de1")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("d221b0a793cd10b00b0c1f943f6c1b63","c6936c5cf4307a8bb793dbc7a9dcb9f1","5cfee29eae9f476e8b32491f4ef8ae2f","6cfa3d34a929cabcc54229b6e100a633","bd7756138f48dc4ec8088e23ef6a4c80","0ef558c14d9894b6a011c9473c0f17c3","38bc0f4ac3bb83c5b7a041746b014910","f2e4746363ba1c940fa315f737dd8a46","5b672f45d525b56eb0c4c146214f267e","9043580b1766661d8fde0d3e88026de1")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("d221b0a793cd10b00b0c1f943f6c1b63","c6936c5cf4307a8bb793dbc7a9dcb9f1","5cfee29eae9f476e8b32491f4ef8ae2f","6cfa3d34a929cabcc54229b6e100a633","bd7756138f48dc4ec8088e23ef6a4c80","0ef558c14d9894b6a011c9473c0f17c3","38bc0f4ac3bb83c5b7a041746b014910","f2e4746363ba1c940fa315f737dd8a46","5b672f45d525b56eb0c4c146214f267e","9043580b1766661d8fde0d3e88026de1")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring64 NOT NULL AND customstring64 IN ("d221b0a793cd10b00b0c1f943f6c1b63","c6936c5cf4307a8bb793dbc7a9dcb9f1","5cfee29eae9f476e8b32491f4ef8ae2f","6cfa3d34a929cabcc54229b6e100a633","bd7756138f48dc4ec8088e23ef6a4c80","0ef558c14d9894b6a011c9473c0f17c3","38bc0f4ac3bb83c5b7a041746b014910","f2e4746363ba1c940fa315f737dd8a46","5b672f45d525b56eb0c4c146214f267e","9043580b1766661d8fde0d3e88026de1")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("d221b0a793cd10b00b0c1f943f6c1b63","c6936c5cf4307a8bb793dbc7a9dcb9f1","5cfee29eae9f476e8b32491f4ef8ae2f","6cfa3d34a929cabcc54229b6e100a633","bd7756138f48dc4ec8088e23ef6a4c80","0ef558c14d9894b6a011c9473c0f17c3","38bc0f4ac3bb83c5b7a041746b014910","f2e4746363ba1c940fa315f737dd8a46","5b672f45d525b56eb0c4c146214f267e","9043580b1766661d8fde0d3e88026de1")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("d221b0a793cd10b00b0c1f943f6c1b63","c6936c5cf4307a8bb793dbc7a9dcb9f1","5cfee29eae9f476e8b32491f4ef8ae2f","6cfa3d34a929cabcc54229b6e100a633","bd7756138f48dc4ec8088e23ef6a4c80","0ef558c14d9894b6a011c9473c0f17c3","38bc0f4ac3bb83c5b7a041746b014910","f2e4746363ba1c940fa315f737dd8a46","5b672f45d525b56eb0c4c146214f267e","9043580b1766661d8fde0d3e88026de1")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("d221b0a793cd10b00b0c1f943f6c1b63","c6936c5cf4307a8bb793dbc7a9dcb9f1","5cfee29eae9f476e8b32491f4ef8ae2f","6cfa3d34a929cabcc54229b6e100a633","bd7756138f48dc4ec8088e23ef6a4c80","0ef558c14d9894b6a011c9473c0f17c3","38bc0f4ac3bb83c5b7a041746b014910","f2e4746363ba1c940fa315f737dd8a46","5b672f45d525b56eb0c4c146214f267e","9043580b1766661d8fde0d3e88026de1")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("d221b0a793cd10b00b0c1f943f6c1b63","c6936c5cf4307a8bb793dbc7a9dcb9f1","5cfee29eae9f476e8b32491f4ef8ae2f","6cfa3d34a929cabcc54229b6e100a633","bd7756138f48dc4ec8088e23ef6a4c80","0ef558c14d9894b6a011c9473c0f17c3","38bc0f4ac3bb83c5b7a041746b014910","f2e4746363ba1c940fa315f737dd8a46","5b672f45d525b56eb0c4c146214f267e","9043580b1766661d8fde0d3e88026de1")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("d221b0a793cd10b00b0c1f943f6c1b63","c6936c5cf4307a8bb793dbc7a9dcb9f1","5cfee29eae9f476e8b32491f4ef8ae2f","6cfa3d34a929cabcc54229b6e100a633","bd7756138f48dc4ec8088e23ef6a4c80","0ef558c14d9894b6a011c9473c0f17c3","38bc0f4ac3bb83c5b7a041746b014910","f2e4746363ba1c940fa315f737dd8a46","5b672f45d525b56eb0c4c146214f267e","9043580b1766661d8fde0d3e88026de1")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("d221b0a793cd10b00b0c1f943f6c1b63","c6936c5cf4307a8bb793dbc7a9dcb9f1","5cfee29eae9f476e8b32491f4ef8ae2f","6cfa3d34a929cabcc54229b6e100a633","bd7756138f48dc4ec8088e23ef6a4c80","0ef558c14d9894b6a011c9473c0f17c3","38bc0f4ac3bb83c5b7a041746b014910","f2e4746363ba1c940fa315f737dd8a46","5b672f45d525b56eb0c4c146214f267e","9043580b1766661d8fde0d3e88026de1")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("d221b0a793cd10b00b0c1f943f6c1b63","c6936c5cf4307a8bb793dbc7a9dcb9f1","5cfee29eae9f476e8b32491f4ef8ae2f","6cfa3d34a929cabcc54229b6e100a633","bd7756138f48dc4ec8088e23ef6a4c80","0ef558c14d9894b6a011c9473c0f17c3","38bc0f4ac3bb83c5b7a041746b014910","f2e4746363ba1c940fa315f737dd8a46","5b672f45d525b56eb0c4c146214f267e","9043580b1766661d8fde0d3e88026de1")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("d221b0a793cd10b00b0c1f943f6c1b63","c6936c5cf4307a8bb793dbc7a9dcb9f1","5cfee29eae9f476e8b32491f4ef8ae2f","6cfa3d34a929cabcc54229b6e100a633","bd7756138f48dc4ec8088e23ef6a4c80","0ef558c14d9894b6a011c9473c0f17c3","38bc0f4ac3bb83c5b7a041746b014910","f2e4746363ba1c940fa315f737dd8a46","5b672f45d525b56eb0c4c146214f267e","9043580b1766661d8fde0d3e88026de1")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("d221b0a793cd10b00b0c1f943f6c1b63","c6936c5cf4307a8bb793dbc7a9dcb9f1","5cfee29eae9f476e8b32491f4ef8ae2f","6cfa3d34a929cabcc54229b6e100a633","bd7756138f48dc4ec8088e23ef6a4c80","0ef558c14d9894b6a011c9473c0f17c3","38bc0f4ac3bb83c5b7a041746b014910","f2e4746363ba1c940fa315f737dd8a46","5b672f45d525b56eb0c4c146214f267e","9043580b1766661d8fde0d3e88026de1")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("d221b0a793cd10b00b0c1f943f6c1b63","c6936c5cf4307a8bb793dbc7a9dcb9f1","5cfee29eae9f476e8b32491f4ef8ae2f","6cfa3d34a929cabcc54229b6e100a633","bd7756138f48dc4ec8088e23ef6a4c80","0ef558c14d9894b6a011c9473c0f17c3","38bc0f4ac3bb83c5b7a041746b014910","f2e4746363ba1c940fa315f737dd8a46","5b672f45d525b56eb0c4c146214f267e","9043580b1766661d8fde0d3e88026de1")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("d221b0a793cd10b00b0c1f943f6c1b63","c6936c5cf4307a8bb793dbc7a9dcb9f1","5cfee29eae9f476e8b32491f4ef8ae2f","6cfa3d34a929cabcc54229b6e100a633","bd7756138f48dc4ec8088e23ef6a4c80","0ef558c14d9894b6a011c9473c0f17c3","38bc0f4ac3bb83c5b7a041746b014910","f2e4746363ba1c940fa315f737dd8a46","5b672f45d525b56eb0c4c146214f267e","9043580b1766661d8fde0d3e88026de1")
index=activity AND rg_functionality="Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("d221b0a793cd10b00b0c1f943f6c1b63","c6936c5cf4307a8bb793dbc7a9dcb9f1","5cfee29eae9f476e8b32491f4ef8ae2f","6cfa3d34a929cabcc54229b6e100a633","bd7756138f48dc4ec8088e23ef6a4c80","0ef558c14d9894b6a011c9473c0f17c3","38bc0f4ac3bb83c5b7a041746b014910","f2e4746363ba1c940fa315f737dd8a46","5b672f45d525b56eb0c4c146214f267e","9043580b1766661d8fde0d3e88026de1")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("d221b0a793cd10b00b0c1f943f6c1b63","c6936c5cf4307a8bb793dbc7a9dcb9f1","5cfee29eae9f476e8b32491f4ef8ae2f","6cfa3d34a929cabcc54229b6e100a633","bd7756138f48dc4ec8088e23ef6a4c80","0ef558c14d9894b6a011c9473c0f17c3","38bc0f4ac3bb83c5b7a041746b014910","f2e4746363ba1c940fa315f737dd8a46","5b672f45d525b56eb0c4c146214f267e","9043580b1766661d8fde0d3e88026de1")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("d221b0a793cd10b00b0c1f943f6c1b63","c6936c5cf4307a8bb793dbc7a9dcb9f1","5cfee29eae9f476e8b32491f4ef8ae2f","6cfa3d34a929cabcc54229b6e100a633","bd7756138f48dc4ec8088e23ef6a4c80","0ef558c14d9894b6a011c9473c0f17c3","38bc0f4ac3bb83c5b7a041746b014910","f2e4746363ba1c940fa315f737dd8a46","5b672f45d525b56eb0c4c146214f267e","9043580b1766661d8fde0d3e88026de1")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("d221b0a793cd10b00b0c1f943f6c1b63","c6936c5cf4307a8bb793dbc7a9dcb9f1","5cfee29eae9f476e8b32491f4ef8ae2f","6cfa3d34a929cabcc54229b6e100a633","bd7756138f48dc4ec8088e23ef6a4c80","0ef558c14d9894b6a011c9473c0f17c3","38bc0f4ac3bb83c5b7a041746b014910","f2e4746363ba1c940fa315f737dd8a46","5b672f45d525b56eb0c4c146214f267e","9043580b1766661d8fde0d3e88026de1")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("d221b0a793cd10b00b0c1f943f6c1b63","c6936c5cf4307a8bb793dbc7a9dcb9f1","5cfee29eae9f476e8b32491f4ef8ae2f","6cfa3d34a929cabcc54229b6e100a633","bd7756138f48dc4ec8088e23ef6a4c80","0ef558c14d9894b6a011c9473c0f17c3","38bc0f4ac3bb83c5b7a041746b014910","f2e4746363ba1c940fa315f737dd8a46","5b672f45d525b56eb0c4c146214f267e","9043580b1766661d8fde0d3e88026de1")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("d221b0a793cd10b00b0c1f943f6c1b63","c6936c5cf4307a8bb793dbc7a9dcb9f1","5cfee29eae9f476e8b32491f4ef8ae2f","6cfa3d34a929cabcc54229b6e100a633","bd7756138f48dc4ec8088e23ef6a4c80","0ef558c14d9894b6a011c9473c0f17c3","38bc0f4ac3bb83c5b7a041746b014910","f2e4746363ba1c940fa315f737dd8a46","5b672f45d525b56eb0c4c146214f267e","9043580b1766661d8fde0d3e88026de1")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("d221b0a793cd10b00b0c1f943f6c1b63","c6936c5cf4307a8bb793dbc7a9dcb9f1","5cfee29eae9f476e8b32491f4ef8ae2f","6cfa3d34a929cabcc54229b6e100a633","bd7756138f48dc4ec8088e23ef6a4c80","0ef558c14d9894b6a011c9473c0f17c3","38bc0f4ac3bb83c5b7a041746b014910","f2e4746363ba1c940fa315f737dd8a46","5b672f45d525b56eb0c4c146214f267e","9043580b1766661d8fde0d3e88026de1")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("d221b0a793cd10b00b0c1f943f6c1b63","c6936c5cf4307a8bb793dbc7a9dcb9f1","5cfee29eae9f476e8b32491f4ef8ae2f","6cfa3d34a929cabcc54229b6e100a633","bd7756138f48dc4ec8088e23ef6a4c80","0ef558c14d9894b6a011c9473c0f17c3","38bc0f4ac3bb83c5b7a041746b014910","f2e4746363ba1c940fa315f737dd8a46","5b672f45d525b56eb0c4c146214f267e","9043580b1766661d8fde0d3e88026de1")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring64 NOT NULL AND customstring64 IN ("d221b0a793cd10b00b0c1f943f6c1b63","c6936c5cf4307a8bb793dbc7a9dcb9f1","5cfee29eae9f476e8b32491f4ef8ae2f","6cfa3d34a929cabcc54229b6e100a633","bd7756138f48dc4ec8088e23ef6a4c80","0ef558c14d9894b6a011c9473c0f17c3","38bc0f4ac3bb83c5b7a041746b014910","f2e4746363ba1c940fa315f737dd8a46","5b672f45d525b56eb0c4c146214f267e","9043580b1766661d8fde0d3e88026de1")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("d221b0a793cd10b00b0c1f943f6c1b63","c6936c5cf4307a8bb793dbc7a9dcb9f1","5cfee29eae9f476e8b32491f4ef8ae2f","6cfa3d34a929cabcc54229b6e100a633","bd7756138f48dc4ec8088e23ef6a4c80","0ef558c14d9894b6a011c9473c0f17c3","38bc0f4ac3bb83c5b7a041746b014910","f2e4746363ba1c940fa315f737dd8a46","5b672f45d525b56eb0c4c146214f267e","9043580b1766661d8fde0d3e88026de1")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("d221b0a793cd10b00b0c1f943f6c1b63","c6936c5cf4307a8bb793dbc7a9dcb9f1","5cfee29eae9f476e8b32491f4ef8ae2f","6cfa3d34a929cabcc54229b6e100a633","bd7756138f48dc4ec8088e23ef6a4c80","0ef558c14d9894b6a011c9473c0f17c3","38bc0f4ac3bb83c5b7a041746b014910","f2e4746363ba1c940fa315f737dd8a46","5b672f45d525b56eb0c4c146214f267e","9043580b1766661d8fde0d3e88026de1")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("d221b0a793cd10b00b0c1f943f6c1b63","c6936c5cf4307a8bb793dbc7a9dcb9f1","5cfee29eae9f476e8b32491f4ef8ae2f","6cfa3d34a929cabcc54229b6e100a633","bd7756138f48dc4ec8088e23ef6a4c80","0ef558c14d9894b6a011c9473c0f17c3","38bc0f4ac3bb83c5b7a041746b014910","f2e4746363ba1c940fa315f737dd8a46","5b672f45d525b56eb0c4c146214f267e","9043580b1766661d8fde0d3e88026de1")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring64 NOT NULL AND customstring64 IN ("d221b0a793cd10b00b0c1f943f6c1b63","c6936c5cf4307a8bb793dbc7a9dcb9f1","5cfee29eae9f476e8b32491f4ef8ae2f","6cfa3d34a929cabcc54229b6e100a633","bd7756138f48dc4ec8088e23ef6a4c80","0ef558c14d9894b6a011c9473c0f17c3","38bc0f4ac3bb83c5b7a041746b014910","f2e4746363ba1c940fa315f737dd8a46","5b672f45d525b56eb0c4c146214f267e","9043580b1766661d8fde0d3e88026de1")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("d221b0a793cd10b00b0c1f943f6c1b63","c6936c5cf4307a8bb793dbc7a9dcb9f1","5cfee29eae9f476e8b32491f4ef8ae2f","6cfa3d34a929cabcc54229b6e100a633","bd7756138f48dc4ec8088e23ef6a4c80","0ef558c14d9894b6a011c9473c0f17c3","38bc0f4ac3bb83c5b7a041746b014910","f2e4746363ba1c940fa315f737dd8a46","5b672f45d525b56eb0c4c146214f267e","9043580b1766661d8fde0d3e88026de1")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("d221b0a793cd10b00b0c1f943f6c1b63","c6936c5cf4307a8bb793dbc7a9dcb9f1","5cfee29eae9f476e8b32491f4ef8ae2f","6cfa3d34a929cabcc54229b6e100a633","bd7756138f48dc4ec8088e23ef6a4c80","0ef558c14d9894b6a011c9473c0f17c3","38bc0f4ac3bb83c5b7a041746b014910","f2e4746363ba1c940fa315f737dd8a46","5b672f45d525b56eb0c4c146214f267e","9043580b1766661d8fde0d3e88026de1")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("d221b0a793cd10b00b0c1f943f6c1b63","c6936c5cf4307a8bb793dbc7a9dcb9f1","5cfee29eae9f476e8b32491f4ef8ae2f","6cfa3d34a929cabcc54229b6e100a633","bd7756138f48dc4ec8088e23ef6a4c80","0ef558c14d9894b6a011c9473c0f17c3","38bc0f4ac3bb83c5b7a041746b014910","f2e4746363ba1c940fa315f737dd8a46","5b672f45d525b56eb0c4c146214f267e","9043580b1766661d8fde0d3e88026de1")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring64 NOT NULL AND customstring64 IN ("d221b0a793cd10b00b0c1f943f6c1b63","c6936c5cf4307a8bb793dbc7a9dcb9f1","5cfee29eae9f476e8b32491f4ef8ae2f","6cfa3d34a929cabcc54229b6e100a633","bd7756138f48dc4ec8088e23ef6a4c80","0ef558c14d9894b6a011c9473c0f17c3","38bc0f4ac3bb83c5b7a041746b014910","f2e4746363ba1c940fa315f737dd8a46","5b672f45d525b56eb0c4c146214f267e","9043580b1766661d8fde0d3e88026de1")
