index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("2abc874435c16aa5cfd431b0d9c26095ef4b9429bd82306f054c367e96df49b2","69d761bdde73ea8e33384cf986d7e9c2d9011f7aad8933e8af64e60a77091e11","b08877f6f1c6c097240a6a8aa4a23243e3b14a1432170bc3fa5fa9886a2b19b4","9b8a896aa2057f46e17b18bbe091d85fb816b1d3232a3178d6aba94df3a92f6a","81b35152768f28a479ba9f7e27d66042b0d7edcd79355481aa401f3f47a7733b","3a524bc40ca7c11b68283504f0119caeefd7589edea621d43d5d0cd973354675","e303d0c6c59b4dc55edc0212a9319702e9db7fa03185ae9177777b874c02d4c1","7cc7aed51adb426e55d82fd74c55b78f6ecbb895a315be721ef149a17f4b3a9b","235dc2d8c92661e5e2797a03bccd2653272ca1ac93401d194d7784930ca17a5a")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("2abc874435c16aa5cfd431b0d9c26095ef4b9429bd82306f054c367e96df49b2","69d761bdde73ea8e33384cf986d7e9c2d9011f7aad8933e8af64e60a77091e11","b08877f6f1c6c097240a6a8aa4a23243e3b14a1432170bc3fa5fa9886a2b19b4","9b8a896aa2057f46e17b18bbe091d85fb816b1d3232a3178d6aba94df3a92f6a","81b35152768f28a479ba9f7e27d66042b0d7edcd79355481aa401f3f47a7733b","3a524bc40ca7c11b68283504f0119caeefd7589edea621d43d5d0cd973354675","e303d0c6c59b4dc55edc0212a9319702e9db7fa03185ae9177777b874c02d4c1","7cc7aed51adb426e55d82fd74c55b78f6ecbb895a315be721ef149a17f4b3a9b","235dc2d8c92661e5e2797a03bccd2653272ca1ac93401d194d7784930ca17a5a")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("2abc874435c16aa5cfd431b0d9c26095ef4b9429bd82306f054c367e96df49b2","69d761bdde73ea8e33384cf986d7e9c2d9011f7aad8933e8af64e60a77091e11","b08877f6f1c6c097240a6a8aa4a23243e3b14a1432170bc3fa5fa9886a2b19b4","9b8a896aa2057f46e17b18bbe091d85fb816b1d3232a3178d6aba94df3a92f6a","81b35152768f28a479ba9f7e27d66042b0d7edcd79355481aa401f3f47a7733b","3a524bc40ca7c11b68283504f0119caeefd7589edea621d43d5d0cd973354675","e303d0c6c59b4dc55edc0212a9319702e9db7fa03185ae9177777b874c02d4c1","7cc7aed51adb426e55d82fd74c55b78f6ecbb895a315be721ef149a17f4b3a9b","235dc2d8c92661e5e2797a03bccd2653272ca1ac93401d194d7784930ca17a5a")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring64 NOT NULL AND customstring64 IN ("2abc874435c16aa5cfd431b0d9c26095ef4b9429bd82306f054c367e96df49b2","69d761bdde73ea8e33384cf986d7e9c2d9011f7aad8933e8af64e60a77091e11","b08877f6f1c6c097240a6a8aa4a23243e3b14a1432170bc3fa5fa9886a2b19b4","9b8a896aa2057f46e17b18bbe091d85fb816b1d3232a3178d6aba94df3a92f6a","81b35152768f28a479ba9f7e27d66042b0d7edcd79355481aa401f3f47a7733b","3a524bc40ca7c11b68283504f0119caeefd7589edea621d43d5d0cd973354675","e303d0c6c59b4dc55edc0212a9319702e9db7fa03185ae9177777b874c02d4c1","7cc7aed51adb426e55d82fd74c55b78f6ecbb895a315be721ef149a17f4b3a9b","235dc2d8c92661e5e2797a03bccd2653272ca1ac93401d194d7784930ca17a5a")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("2abc874435c16aa5cfd431b0d9c26095ef4b9429bd82306f054c367e96df49b2","69d761bdde73ea8e33384cf986d7e9c2d9011f7aad8933e8af64e60a77091e11","b08877f6f1c6c097240a6a8aa4a23243e3b14a1432170bc3fa5fa9886a2b19b4","9b8a896aa2057f46e17b18bbe091d85fb816b1d3232a3178d6aba94df3a92f6a","81b35152768f28a479ba9f7e27d66042b0d7edcd79355481aa401f3f47a7733b","3a524bc40ca7c11b68283504f0119caeefd7589edea621d43d5d0cd973354675","e303d0c6c59b4dc55edc0212a9319702e9db7fa03185ae9177777b874c02d4c1","7cc7aed51adb426e55d82fd74c55b78f6ecbb895a315be721ef149a17f4b3a9b","235dc2d8c92661e5e2797a03bccd2653272ca1ac93401d194d7784930ca17a5a")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("2abc874435c16aa5cfd431b0d9c26095ef4b9429bd82306f054c367e96df49b2","69d761bdde73ea8e33384cf986d7e9c2d9011f7aad8933e8af64e60a77091e11","b08877f6f1c6c097240a6a8aa4a23243e3b14a1432170bc3fa5fa9886a2b19b4","9b8a896aa2057f46e17b18bbe091d85fb816b1d3232a3178d6aba94df3a92f6a","81b35152768f28a479ba9f7e27d66042b0d7edcd79355481aa401f3f47a7733b","3a524bc40ca7c11b68283504f0119caeefd7589edea621d43d5d0cd973354675","e303d0c6c59b4dc55edc0212a9319702e9db7fa03185ae9177777b874c02d4c1","7cc7aed51adb426e55d82fd74c55b78f6ecbb895a315be721ef149a17f4b3a9b","235dc2d8c92661e5e2797a03bccd2653272ca1ac93401d194d7784930ca17a5a")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("2abc874435c16aa5cfd431b0d9c26095ef4b9429bd82306f054c367e96df49b2","69d761bdde73ea8e33384cf986d7e9c2d9011f7aad8933e8af64e60a77091e11","b08877f6f1c6c097240a6a8aa4a23243e3b14a1432170bc3fa5fa9886a2b19b4","9b8a896aa2057f46e17b18bbe091d85fb816b1d3232a3178d6aba94df3a92f6a","81b35152768f28a479ba9f7e27d66042b0d7edcd79355481aa401f3f47a7733b","3a524bc40ca7c11b68283504f0119caeefd7589edea621d43d5d0cd973354675","e303d0c6c59b4dc55edc0212a9319702e9db7fa03185ae9177777b874c02d4c1","7cc7aed51adb426e55d82fd74c55b78f6ecbb895a315be721ef149a17f4b3a9b","235dc2d8c92661e5e2797a03bccd2653272ca1ac93401d194d7784930ca17a5a")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("2abc874435c16aa5cfd431b0d9c26095ef4b9429bd82306f054c367e96df49b2","69d761bdde73ea8e33384cf986d7e9c2d9011f7aad8933e8af64e60a77091e11","b08877f6f1c6c097240a6a8aa4a23243e3b14a1432170bc3fa5fa9886a2b19b4","9b8a896aa2057f46e17b18bbe091d85fb816b1d3232a3178d6aba94df3a92f6a","81b35152768f28a479ba9f7e27d66042b0d7edcd79355481aa401f3f47a7733b","3a524bc40ca7c11b68283504f0119caeefd7589edea621d43d5d0cd973354675","e303d0c6c59b4dc55edc0212a9319702e9db7fa03185ae9177777b874c02d4c1","7cc7aed51adb426e55d82fd74c55b78f6ecbb895a315be721ef149a17f4b3a9b","235dc2d8c92661e5e2797a03bccd2653272ca1ac93401d194d7784930ca17a5a")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("2abc874435c16aa5cfd431b0d9c26095ef4b9429bd82306f054c367e96df49b2","69d761bdde73ea8e33384cf986d7e9c2d9011f7aad8933e8af64e60a77091e11","b08877f6f1c6c097240a6a8aa4a23243e3b14a1432170bc3fa5fa9886a2b19b4","9b8a896aa2057f46e17b18bbe091d85fb816b1d3232a3178d6aba94df3a92f6a","81b35152768f28a479ba9f7e27d66042b0d7edcd79355481aa401f3f47a7733b","3a524bc40ca7c11b68283504f0119caeefd7589edea621d43d5d0cd973354675","e303d0c6c59b4dc55edc0212a9319702e9db7fa03185ae9177777b874c02d4c1","7cc7aed51adb426e55d82fd74c55b78f6ecbb895a315be721ef149a17f4b3a9b","235dc2d8c92661e5e2797a03bccd2653272ca1ac93401d194d7784930ca17a5a")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("2abc874435c16aa5cfd431b0d9c26095ef4b9429bd82306f054c367e96df49b2","69d761bdde73ea8e33384cf986d7e9c2d9011f7aad8933e8af64e60a77091e11","b08877f6f1c6c097240a6a8aa4a23243e3b14a1432170bc3fa5fa9886a2b19b4","9b8a896aa2057f46e17b18bbe091d85fb816b1d3232a3178d6aba94df3a92f6a","81b35152768f28a479ba9f7e27d66042b0d7edcd79355481aa401f3f47a7733b","3a524bc40ca7c11b68283504f0119caeefd7589edea621d43d5d0cd973354675","e303d0c6c59b4dc55edc0212a9319702e9db7fa03185ae9177777b874c02d4c1","7cc7aed51adb426e55d82fd74c55b78f6ecbb895a315be721ef149a17f4b3a9b","235dc2d8c92661e5e2797a03bccd2653272ca1ac93401d194d7784930ca17a5a")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("2abc874435c16aa5cfd431b0d9c26095ef4b9429bd82306f054c367e96df49b2","69d761bdde73ea8e33384cf986d7e9c2d9011f7aad8933e8af64e60a77091e11","b08877f6f1c6c097240a6a8aa4a23243e3b14a1432170bc3fa5fa9886a2b19b4","9b8a896aa2057f46e17b18bbe091d85fb816b1d3232a3178d6aba94df3a92f6a","81b35152768f28a479ba9f7e27d66042b0d7edcd79355481aa401f3f47a7733b","3a524bc40ca7c11b68283504f0119caeefd7589edea621d43d5d0cd973354675","e303d0c6c59b4dc55edc0212a9319702e9db7fa03185ae9177777b874c02d4c1","7cc7aed51adb426e55d82fd74c55b78f6ecbb895a315be721ef149a17f4b3a9b","235dc2d8c92661e5e2797a03bccd2653272ca1ac93401d194d7784930ca17a5a")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("2abc874435c16aa5cfd431b0d9c26095ef4b9429bd82306f054c367e96df49b2","69d761bdde73ea8e33384cf986d7e9c2d9011f7aad8933e8af64e60a77091e11","b08877f6f1c6c097240a6a8aa4a23243e3b14a1432170bc3fa5fa9886a2b19b4","9b8a896aa2057f46e17b18bbe091d85fb816b1d3232a3178d6aba94df3a92f6a","81b35152768f28a479ba9f7e27d66042b0d7edcd79355481aa401f3f47a7733b","3a524bc40ca7c11b68283504f0119caeefd7589edea621d43d5d0cd973354675","e303d0c6c59b4dc55edc0212a9319702e9db7fa03185ae9177777b874c02d4c1","7cc7aed51adb426e55d82fd74c55b78f6ecbb895a315be721ef149a17f4b3a9b","235dc2d8c92661e5e2797a03bccd2653272ca1ac93401d194d7784930ca17a5a")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("2abc874435c16aa5cfd431b0d9c26095ef4b9429bd82306f054c367e96df49b2","69d761bdde73ea8e33384cf986d7e9c2d9011f7aad8933e8af64e60a77091e11","b08877f6f1c6c097240a6a8aa4a23243e3b14a1432170bc3fa5fa9886a2b19b4","9b8a896aa2057f46e17b18bbe091d85fb816b1d3232a3178d6aba94df3a92f6a","81b35152768f28a479ba9f7e27d66042b0d7edcd79355481aa401f3f47a7733b","3a524bc40ca7c11b68283504f0119caeefd7589edea621d43d5d0cd973354675","e303d0c6c59b4dc55edc0212a9319702e9db7fa03185ae9177777b874c02d4c1","7cc7aed51adb426e55d82fd74c55b78f6ecbb895a315be721ef149a17f4b3a9b","235dc2d8c92661e5e2797a03bccd2653272ca1ac93401d194d7784930ca17a5a")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("2abc874435c16aa5cfd431b0d9c26095ef4b9429bd82306f054c367e96df49b2","69d761bdde73ea8e33384cf986d7e9c2d9011f7aad8933e8af64e60a77091e11","b08877f6f1c6c097240a6a8aa4a23243e3b14a1432170bc3fa5fa9886a2b19b4","9b8a896aa2057f46e17b18bbe091d85fb816b1d3232a3178d6aba94df3a92f6a","81b35152768f28a479ba9f7e27d66042b0d7edcd79355481aa401f3f47a7733b","3a524bc40ca7c11b68283504f0119caeefd7589edea621d43d5d0cd973354675","e303d0c6c59b4dc55edc0212a9319702e9db7fa03185ae9177777b874c02d4c1","7cc7aed51adb426e55d82fd74c55b78f6ecbb895a315be721ef149a17f4b3a9b","235dc2d8c92661e5e2797a03bccd2653272ca1ac93401d194d7784930ca17a5a")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("2abc874435c16aa5cfd431b0d9c26095ef4b9429bd82306f054c367e96df49b2","69d761bdde73ea8e33384cf986d7e9c2d9011f7aad8933e8af64e60a77091e11","b08877f6f1c6c097240a6a8aa4a23243e3b14a1432170bc3fa5fa9886a2b19b4","9b8a896aa2057f46e17b18bbe091d85fb816b1d3232a3178d6aba94df3a92f6a","81b35152768f28a479ba9f7e27d66042b0d7edcd79355481aa401f3f47a7733b","3a524bc40ca7c11b68283504f0119caeefd7589edea621d43d5d0cd973354675","e303d0c6c59b4dc55edc0212a9319702e9db7fa03185ae9177777b874c02d4c1","7cc7aed51adb426e55d82fd74c55b78f6ecbb895a315be721ef149a17f4b3a9b","235dc2d8c92661e5e2797a03bccd2653272ca1ac93401d194d7784930ca17a5a")
index=activity AND rg_functionality="Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("2abc874435c16aa5cfd431b0d9c26095ef4b9429bd82306f054c367e96df49b2","69d761bdde73ea8e33384cf986d7e9c2d9011f7aad8933e8af64e60a77091e11","b08877f6f1c6c097240a6a8aa4a23243e3b14a1432170bc3fa5fa9886a2b19b4","9b8a896aa2057f46e17b18bbe091d85fb816b1d3232a3178d6aba94df3a92f6a","81b35152768f28a479ba9f7e27d66042b0d7edcd79355481aa401f3f47a7733b","3a524bc40ca7c11b68283504f0119caeefd7589edea621d43d5d0cd973354675","e303d0c6c59b4dc55edc0212a9319702e9db7fa03185ae9177777b874c02d4c1","7cc7aed51adb426e55d82fd74c55b78f6ecbb895a315be721ef149a17f4b3a9b","235dc2d8c92661e5e2797a03bccd2653272ca1ac93401d194d7784930ca17a5a")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("2abc874435c16aa5cfd431b0d9c26095ef4b9429bd82306f054c367e96df49b2","69d761bdde73ea8e33384cf986d7e9c2d9011f7aad8933e8af64e60a77091e11","b08877f6f1c6c097240a6a8aa4a23243e3b14a1432170bc3fa5fa9886a2b19b4","9b8a896aa2057f46e17b18bbe091d85fb816b1d3232a3178d6aba94df3a92f6a","81b35152768f28a479ba9f7e27d66042b0d7edcd79355481aa401f3f47a7733b","3a524bc40ca7c11b68283504f0119caeefd7589edea621d43d5d0cd973354675","e303d0c6c59b4dc55edc0212a9319702e9db7fa03185ae9177777b874c02d4c1","7cc7aed51adb426e55d82fd74c55b78f6ecbb895a315be721ef149a17f4b3a9b","235dc2d8c92661e5e2797a03bccd2653272ca1ac93401d194d7784930ca17a5a")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("2abc874435c16aa5cfd431b0d9c26095ef4b9429bd82306f054c367e96df49b2","69d761bdde73ea8e33384cf986d7e9c2d9011f7aad8933e8af64e60a77091e11","b08877f6f1c6c097240a6a8aa4a23243e3b14a1432170bc3fa5fa9886a2b19b4","9b8a896aa2057f46e17b18bbe091d85fb816b1d3232a3178d6aba94df3a92f6a","81b35152768f28a479ba9f7e27d66042b0d7edcd79355481aa401f3f47a7733b","3a524bc40ca7c11b68283504f0119caeefd7589edea621d43d5d0cd973354675","e303d0c6c59b4dc55edc0212a9319702e9db7fa03185ae9177777b874c02d4c1","7cc7aed51adb426e55d82fd74c55b78f6ecbb895a315be721ef149a17f4b3a9b","235dc2d8c92661e5e2797a03bccd2653272ca1ac93401d194d7784930ca17a5a")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("2abc874435c16aa5cfd431b0d9c26095ef4b9429bd82306f054c367e96df49b2","69d761bdde73ea8e33384cf986d7e9c2d9011f7aad8933e8af64e60a77091e11","b08877f6f1c6c097240a6a8aa4a23243e3b14a1432170bc3fa5fa9886a2b19b4","9b8a896aa2057f46e17b18bbe091d85fb816b1d3232a3178d6aba94df3a92f6a","81b35152768f28a479ba9f7e27d66042b0d7edcd79355481aa401f3f47a7733b","3a524bc40ca7c11b68283504f0119caeefd7589edea621d43d5d0cd973354675","e303d0c6c59b4dc55edc0212a9319702e9db7fa03185ae9177777b874c02d4c1","7cc7aed51adb426e55d82fd74c55b78f6ecbb895a315be721ef149a17f4b3a9b","235dc2d8c92661e5e2797a03bccd2653272ca1ac93401d194d7784930ca17a5a")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("2abc874435c16aa5cfd431b0d9c26095ef4b9429bd82306f054c367e96df49b2","69d761bdde73ea8e33384cf986d7e9c2d9011f7aad8933e8af64e60a77091e11","b08877f6f1c6c097240a6a8aa4a23243e3b14a1432170bc3fa5fa9886a2b19b4","9b8a896aa2057f46e17b18bbe091d85fb816b1d3232a3178d6aba94df3a92f6a","81b35152768f28a479ba9f7e27d66042b0d7edcd79355481aa401f3f47a7733b","3a524bc40ca7c11b68283504f0119caeefd7589edea621d43d5d0cd973354675","e303d0c6c59b4dc55edc0212a9319702e9db7fa03185ae9177777b874c02d4c1","7cc7aed51adb426e55d82fd74c55b78f6ecbb895a315be721ef149a17f4b3a9b","235dc2d8c92661e5e2797a03bccd2653272ca1ac93401d194d7784930ca17a5a")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("2abc874435c16aa5cfd431b0d9c26095ef4b9429bd82306f054c367e96df49b2","69d761bdde73ea8e33384cf986d7e9c2d9011f7aad8933e8af64e60a77091e11","b08877f6f1c6c097240a6a8aa4a23243e3b14a1432170bc3fa5fa9886a2b19b4","9b8a896aa2057f46e17b18bbe091d85fb816b1d3232a3178d6aba94df3a92f6a","81b35152768f28a479ba9f7e27d66042b0d7edcd79355481aa401f3f47a7733b","3a524bc40ca7c11b68283504f0119caeefd7589edea621d43d5d0cd973354675","e303d0c6c59b4dc55edc0212a9319702e9db7fa03185ae9177777b874c02d4c1","7cc7aed51adb426e55d82fd74c55b78f6ecbb895a315be721ef149a17f4b3a9b","235dc2d8c92661e5e2797a03bccd2653272ca1ac93401d194d7784930ca17a5a")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("2abc874435c16aa5cfd431b0d9c26095ef4b9429bd82306f054c367e96df49b2","69d761bdde73ea8e33384cf986d7e9c2d9011f7aad8933e8af64e60a77091e11","b08877f6f1c6c097240a6a8aa4a23243e3b14a1432170bc3fa5fa9886a2b19b4","9b8a896aa2057f46e17b18bbe091d85fb816b1d3232a3178d6aba94df3a92f6a","81b35152768f28a479ba9f7e27d66042b0d7edcd79355481aa401f3f47a7733b","3a524bc40ca7c11b68283504f0119caeefd7589edea621d43d5d0cd973354675","e303d0c6c59b4dc55edc0212a9319702e9db7fa03185ae9177777b874c02d4c1","7cc7aed51adb426e55d82fd74c55b78f6ecbb895a315be721ef149a17f4b3a9b","235dc2d8c92661e5e2797a03bccd2653272ca1ac93401d194d7784930ca17a5a")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("2abc874435c16aa5cfd431b0d9c26095ef4b9429bd82306f054c367e96df49b2","69d761bdde73ea8e33384cf986d7e9c2d9011f7aad8933e8af64e60a77091e11","b08877f6f1c6c097240a6a8aa4a23243e3b14a1432170bc3fa5fa9886a2b19b4","9b8a896aa2057f46e17b18bbe091d85fb816b1d3232a3178d6aba94df3a92f6a","81b35152768f28a479ba9f7e27d66042b0d7edcd79355481aa401f3f47a7733b","3a524bc40ca7c11b68283504f0119caeefd7589edea621d43d5d0cd973354675","e303d0c6c59b4dc55edc0212a9319702e9db7fa03185ae9177777b874c02d4c1","7cc7aed51adb426e55d82fd74c55b78f6ecbb895a315be721ef149a17f4b3a9b","235dc2d8c92661e5e2797a03bccd2653272ca1ac93401d194d7784930ca17a5a")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring64 NOT NULL AND customstring64 IN ("2abc874435c16aa5cfd431b0d9c26095ef4b9429bd82306f054c367e96df49b2","69d761bdde73ea8e33384cf986d7e9c2d9011f7aad8933e8af64e60a77091e11","b08877f6f1c6c097240a6a8aa4a23243e3b14a1432170bc3fa5fa9886a2b19b4","9b8a896aa2057f46e17b18bbe091d85fb816b1d3232a3178d6aba94df3a92f6a","81b35152768f28a479ba9f7e27d66042b0d7edcd79355481aa401f3f47a7733b","3a524bc40ca7c11b68283504f0119caeefd7589edea621d43d5d0cd973354675","e303d0c6c59b4dc55edc0212a9319702e9db7fa03185ae9177777b874c02d4c1","7cc7aed51adb426e55d82fd74c55b78f6ecbb895a315be721ef149a17f4b3a9b","235dc2d8c92661e5e2797a03bccd2653272ca1ac93401d194d7784930ca17a5a")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("2abc874435c16aa5cfd431b0d9c26095ef4b9429bd82306f054c367e96df49b2","69d761bdde73ea8e33384cf986d7e9c2d9011f7aad8933e8af64e60a77091e11","b08877f6f1c6c097240a6a8aa4a23243e3b14a1432170bc3fa5fa9886a2b19b4","9b8a896aa2057f46e17b18bbe091d85fb816b1d3232a3178d6aba94df3a92f6a","81b35152768f28a479ba9f7e27d66042b0d7edcd79355481aa401f3f47a7733b","3a524bc40ca7c11b68283504f0119caeefd7589edea621d43d5d0cd973354675","e303d0c6c59b4dc55edc0212a9319702e9db7fa03185ae9177777b874c02d4c1","7cc7aed51adb426e55d82fd74c55b78f6ecbb895a315be721ef149a17f4b3a9b","235dc2d8c92661e5e2797a03bccd2653272ca1ac93401d194d7784930ca17a5a")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("2abc874435c16aa5cfd431b0d9c26095ef4b9429bd82306f054c367e96df49b2","69d761bdde73ea8e33384cf986d7e9c2d9011f7aad8933e8af64e60a77091e11","b08877f6f1c6c097240a6a8aa4a23243e3b14a1432170bc3fa5fa9886a2b19b4","9b8a896aa2057f46e17b18bbe091d85fb816b1d3232a3178d6aba94df3a92f6a","81b35152768f28a479ba9f7e27d66042b0d7edcd79355481aa401f3f47a7733b","3a524bc40ca7c11b68283504f0119caeefd7589edea621d43d5d0cd973354675","e303d0c6c59b4dc55edc0212a9319702e9db7fa03185ae9177777b874c02d4c1","7cc7aed51adb426e55d82fd74c55b78f6ecbb895a315be721ef149a17f4b3a9b","235dc2d8c92661e5e2797a03bccd2653272ca1ac93401d194d7784930ca17a5a")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("2abc874435c16aa5cfd431b0d9c26095ef4b9429bd82306f054c367e96df49b2","69d761bdde73ea8e33384cf986d7e9c2d9011f7aad8933e8af64e60a77091e11","b08877f6f1c6c097240a6a8aa4a23243e3b14a1432170bc3fa5fa9886a2b19b4","9b8a896aa2057f46e17b18bbe091d85fb816b1d3232a3178d6aba94df3a92f6a","81b35152768f28a479ba9f7e27d66042b0d7edcd79355481aa401f3f47a7733b","3a524bc40ca7c11b68283504f0119caeefd7589edea621d43d5d0cd973354675","e303d0c6c59b4dc55edc0212a9319702e9db7fa03185ae9177777b874c02d4c1","7cc7aed51adb426e55d82fd74c55b78f6ecbb895a315be721ef149a17f4b3a9b","235dc2d8c92661e5e2797a03bccd2653272ca1ac93401d194d7784930ca17a5a")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring64 NOT NULL AND customstring64 IN ("2abc874435c16aa5cfd431b0d9c26095ef4b9429bd82306f054c367e96df49b2","69d761bdde73ea8e33384cf986d7e9c2d9011f7aad8933e8af64e60a77091e11","b08877f6f1c6c097240a6a8aa4a23243e3b14a1432170bc3fa5fa9886a2b19b4","9b8a896aa2057f46e17b18bbe091d85fb816b1d3232a3178d6aba94df3a92f6a","81b35152768f28a479ba9f7e27d66042b0d7edcd79355481aa401f3f47a7733b","3a524bc40ca7c11b68283504f0119caeefd7589edea621d43d5d0cd973354675","e303d0c6c59b4dc55edc0212a9319702e9db7fa03185ae9177777b874c02d4c1","7cc7aed51adb426e55d82fd74c55b78f6ecbb895a315be721ef149a17f4b3a9b","235dc2d8c92661e5e2797a03bccd2653272ca1ac93401d194d7784930ca17a5a")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("2abc874435c16aa5cfd431b0d9c26095ef4b9429bd82306f054c367e96df49b2","69d761bdde73ea8e33384cf986d7e9c2d9011f7aad8933e8af64e60a77091e11","b08877f6f1c6c097240a6a8aa4a23243e3b14a1432170bc3fa5fa9886a2b19b4","9b8a896aa2057f46e17b18bbe091d85fb816b1d3232a3178d6aba94df3a92f6a","81b35152768f28a479ba9f7e27d66042b0d7edcd79355481aa401f3f47a7733b","3a524bc40ca7c11b68283504f0119caeefd7589edea621d43d5d0cd973354675","e303d0c6c59b4dc55edc0212a9319702e9db7fa03185ae9177777b874c02d4c1","7cc7aed51adb426e55d82fd74c55b78f6ecbb895a315be721ef149a17f4b3a9b","235dc2d8c92661e5e2797a03bccd2653272ca1ac93401d194d7784930ca17a5a")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("2abc874435c16aa5cfd431b0d9c26095ef4b9429bd82306f054c367e96df49b2","69d761bdde73ea8e33384cf986d7e9c2d9011f7aad8933e8af64e60a77091e11","b08877f6f1c6c097240a6a8aa4a23243e3b14a1432170bc3fa5fa9886a2b19b4","9b8a896aa2057f46e17b18bbe091d85fb816b1d3232a3178d6aba94df3a92f6a","81b35152768f28a479ba9f7e27d66042b0d7edcd79355481aa401f3f47a7733b","3a524bc40ca7c11b68283504f0119caeefd7589edea621d43d5d0cd973354675","e303d0c6c59b4dc55edc0212a9319702e9db7fa03185ae9177777b874c02d4c1","7cc7aed51adb426e55d82fd74c55b78f6ecbb895a315be721ef149a17f4b3a9b","235dc2d8c92661e5e2797a03bccd2653272ca1ac93401d194d7784930ca17a5a")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("2abc874435c16aa5cfd431b0d9c26095ef4b9429bd82306f054c367e96df49b2","69d761bdde73ea8e33384cf986d7e9c2d9011f7aad8933e8af64e60a77091e11","b08877f6f1c6c097240a6a8aa4a23243e3b14a1432170bc3fa5fa9886a2b19b4","9b8a896aa2057f46e17b18bbe091d85fb816b1d3232a3178d6aba94df3a92f6a","81b35152768f28a479ba9f7e27d66042b0d7edcd79355481aa401f3f47a7733b","3a524bc40ca7c11b68283504f0119caeefd7589edea621d43d5d0cd973354675","e303d0c6c59b4dc55edc0212a9319702e9db7fa03185ae9177777b874c02d4c1","7cc7aed51adb426e55d82fd74c55b78f6ecbb895a315be721ef149a17f4b3a9b","235dc2d8c92661e5e2797a03bccd2653272ca1ac93401d194d7784930ca17a5a")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring64 NOT NULL AND customstring64 IN ("2abc874435c16aa5cfd431b0d9c26095ef4b9429bd82306f054c367e96df49b2","69d761bdde73ea8e33384cf986d7e9c2d9011f7aad8933e8af64e60a77091e11","b08877f6f1c6c097240a6a8aa4a23243e3b14a1432170bc3fa5fa9886a2b19b4","9b8a896aa2057f46e17b18bbe091d85fb816b1d3232a3178d6aba94df3a92f6a","81b35152768f28a479ba9f7e27d66042b0d7edcd79355481aa401f3f47a7733b","3a524bc40ca7c11b68283504f0119caeefd7589edea621d43d5d0cd973354675","e303d0c6c59b4dc55edc0212a9319702e9db7fa03185ae9177777b874c02d4c1","7cc7aed51adb426e55d82fd74c55b78f6ecbb895a315be721ef149a17f4b3a9b","235dc2d8c92661e5e2797a03bccd2653272ca1ac93401d194d7784930ca17a5a")
index=activity AND rg_functionality="O365 General" AND filehash NOT NULL AND filehash IN ("2abc874435c16aa5cfd431b0d9c26095ef4b9429bd82306f054c367e96df49b2","69d761bdde73ea8e33384cf986d7e9c2d9011f7aad8933e8af64e60a77091e11","b08877f6f1c6c097240a6a8aa4a23243e3b14a1432170bc3fa5fa9886a2b19b4","9b8a896aa2057f46e17b18bbe091d85fb816b1d3232a3178d6aba94df3a92f6a","81b35152768f28a479ba9f7e27d66042b0d7edcd79355481aa401f3f47a7733b","3a524bc40ca7c11b68283504f0119caeefd7589edea621d43d5d0cd973354675","e303d0c6c59b4dc55edc0212a9319702e9db7fa03185ae9177777b874c02d4c1","7cc7aed51adb426e55d82fd74c55b78f6ecbb895a315be721ef149a17f4b3a9b","235dc2d8c92661e5e2797a03bccd2653272ca1ac93401d194d7784930ca17a5a")
index=activity AND rg_functionality="O365 General" AND oldfilehash NOT NULL AND oldfilehash IN ("2abc874435c16aa5cfd431b0d9c26095ef4b9429bd82306f054c367e96df49b2","69d761bdde73ea8e33384cf986d7e9c2d9011f7aad8933e8af64e60a77091e11","b08877f6f1c6c097240a6a8aa4a23243e3b14a1432170bc3fa5fa9886a2b19b4","9b8a896aa2057f46e17b18bbe091d85fb816b1d3232a3178d6aba94df3a92f6a","81b35152768f28a479ba9f7e27d66042b0d7edcd79355481aa401f3f47a7733b","3a524bc40ca7c11b68283504f0119caeefd7589edea621d43d5d0cd973354675","e303d0c6c59b4dc55edc0212a9319702e9db7fa03185ae9177777b874c02d4c1","7cc7aed51adb426e55d82fd74c55b78f6ecbb895a315be721ef149a17f4b3a9b","235dc2d8c92661e5e2797a03bccd2653272ca1ac93401d194d7784930ca17a5a")
index=activity AND rg_functionality="O365 General" AND customstring3 NOT NULL AND customstring3 IN ("2abc874435c16aa5cfd431b0d9c26095ef4b9429bd82306f054c367e96df49b2","69d761bdde73ea8e33384cf986d7e9c2d9011f7aad8933e8af64e60a77091e11","b08877f6f1c6c097240a6a8aa4a23243e3b14a1432170bc3fa5fa9886a2b19b4","9b8a896aa2057f46e17b18bbe091d85fb816b1d3232a3178d6aba94df3a92f6a","81b35152768f28a479ba9f7e27d66042b0d7edcd79355481aa401f3f47a7733b","3a524bc40ca7c11b68283504f0119caeefd7589edea621d43d5d0cd973354675","e303d0c6c59b4dc55edc0212a9319702e9db7fa03185ae9177777b874c02d4c1","7cc7aed51adb426e55d82fd74c55b78f6ecbb895a315be721ef149a17f4b3a9b","235dc2d8c92661e5e2797a03bccd2653272ca1ac93401d194d7784930ca17a5a")
index=activity AND rg_functionality="O365 General" AND customstring64 NOT NULL AND customstring64 IN ("2abc874435c16aa5cfd431b0d9c26095ef4b9429bd82306f054c367e96df49b2","69d761bdde73ea8e33384cf986d7e9c2d9011f7aad8933e8af64e60a77091e11","b08877f6f1c6c097240a6a8aa4a23243e3b14a1432170bc3fa5fa9886a2b19b4","9b8a896aa2057f46e17b18bbe091d85fb816b1d3232a3178d6aba94df3a92f6a","81b35152768f28a479ba9f7e27d66042b0d7edcd79355481aa401f3f47a7733b","3a524bc40ca7c11b68283504f0119caeefd7589edea621d43d5d0cd973354675","e303d0c6c59b4dc55edc0212a9319702e9db7fa03185ae9177777b874c02d4c1","7cc7aed51adb426e55d82fd74c55b78f6ecbb895a315be721ef149a17f4b3a9b","235dc2d8c92661e5e2797a03bccd2653272ca1ac93401d194d7784930ca17a5a")
