index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("85c66835657e3ee6a478a2e0b1fd3d87119bebadc43a16814c30eb94c53766bb","7c3ada3f63a32f4727c62067d13e40bcb9aa9cbec8fb7e99a319931fc5a9332e","9445da674e59ef27624cd5c8ffa0bd6c837de0d90dd2857cf28b16a08fd7dba6","5e6041374f5b1e6c05393ea28468a91c41c38dc6b5a5230795a61c2b60ed14bc","6d2d30d5295ad99018146c8e67ea12f4aaa2ca1a170ad287a579876bf03c2950","e594bca43ade76bbaab2592e9eabeb8dca8a72ed27afd5e26d857659ec173261","14b0c90a2eff6b94b9c5160875fcf29aff15dcfdfd3402d953441d9b0dca8b39")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("85c66835657e3ee6a478a2e0b1fd3d87119bebadc43a16814c30eb94c53766bb","7c3ada3f63a32f4727c62067d13e40bcb9aa9cbec8fb7e99a319931fc5a9332e","9445da674e59ef27624cd5c8ffa0bd6c837de0d90dd2857cf28b16a08fd7dba6","5e6041374f5b1e6c05393ea28468a91c41c38dc6b5a5230795a61c2b60ed14bc","6d2d30d5295ad99018146c8e67ea12f4aaa2ca1a170ad287a579876bf03c2950","e594bca43ade76bbaab2592e9eabeb8dca8a72ed27afd5e26d857659ec173261","14b0c90a2eff6b94b9c5160875fcf29aff15dcfdfd3402d953441d9b0dca8b39")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("85c66835657e3ee6a478a2e0b1fd3d87119bebadc43a16814c30eb94c53766bb","7c3ada3f63a32f4727c62067d13e40bcb9aa9cbec8fb7e99a319931fc5a9332e","9445da674e59ef27624cd5c8ffa0bd6c837de0d90dd2857cf28b16a08fd7dba6","5e6041374f5b1e6c05393ea28468a91c41c38dc6b5a5230795a61c2b60ed14bc","6d2d30d5295ad99018146c8e67ea12f4aaa2ca1a170ad287a579876bf03c2950","e594bca43ade76bbaab2592e9eabeb8dca8a72ed27afd5e26d857659ec173261","14b0c90a2eff6b94b9c5160875fcf29aff15dcfdfd3402d953441d9b0dca8b39")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring64 NOT NULL AND customstring64 IN ("85c66835657e3ee6a478a2e0b1fd3d87119bebadc43a16814c30eb94c53766bb","7c3ada3f63a32f4727c62067d13e40bcb9aa9cbec8fb7e99a319931fc5a9332e","9445da674e59ef27624cd5c8ffa0bd6c837de0d90dd2857cf28b16a08fd7dba6","5e6041374f5b1e6c05393ea28468a91c41c38dc6b5a5230795a61c2b60ed14bc","6d2d30d5295ad99018146c8e67ea12f4aaa2ca1a170ad287a579876bf03c2950","e594bca43ade76bbaab2592e9eabeb8dca8a72ed27afd5e26d857659ec173261","14b0c90a2eff6b94b9c5160875fcf29aff15dcfdfd3402d953441d9b0dca8b39")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("85c66835657e3ee6a478a2e0b1fd3d87119bebadc43a16814c30eb94c53766bb","7c3ada3f63a32f4727c62067d13e40bcb9aa9cbec8fb7e99a319931fc5a9332e","9445da674e59ef27624cd5c8ffa0bd6c837de0d90dd2857cf28b16a08fd7dba6","5e6041374f5b1e6c05393ea28468a91c41c38dc6b5a5230795a61c2b60ed14bc","6d2d30d5295ad99018146c8e67ea12f4aaa2ca1a170ad287a579876bf03c2950","e594bca43ade76bbaab2592e9eabeb8dca8a72ed27afd5e26d857659ec173261","14b0c90a2eff6b94b9c5160875fcf29aff15dcfdfd3402d953441d9b0dca8b39")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("85c66835657e3ee6a478a2e0b1fd3d87119bebadc43a16814c30eb94c53766bb","7c3ada3f63a32f4727c62067d13e40bcb9aa9cbec8fb7e99a319931fc5a9332e","9445da674e59ef27624cd5c8ffa0bd6c837de0d90dd2857cf28b16a08fd7dba6","5e6041374f5b1e6c05393ea28468a91c41c38dc6b5a5230795a61c2b60ed14bc","6d2d30d5295ad99018146c8e67ea12f4aaa2ca1a170ad287a579876bf03c2950","e594bca43ade76bbaab2592e9eabeb8dca8a72ed27afd5e26d857659ec173261","14b0c90a2eff6b94b9c5160875fcf29aff15dcfdfd3402d953441d9b0dca8b39")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("85c66835657e3ee6a478a2e0b1fd3d87119bebadc43a16814c30eb94c53766bb","7c3ada3f63a32f4727c62067d13e40bcb9aa9cbec8fb7e99a319931fc5a9332e","9445da674e59ef27624cd5c8ffa0bd6c837de0d90dd2857cf28b16a08fd7dba6","5e6041374f5b1e6c05393ea28468a91c41c38dc6b5a5230795a61c2b60ed14bc","6d2d30d5295ad99018146c8e67ea12f4aaa2ca1a170ad287a579876bf03c2950","e594bca43ade76bbaab2592e9eabeb8dca8a72ed27afd5e26d857659ec173261","14b0c90a2eff6b94b9c5160875fcf29aff15dcfdfd3402d953441d9b0dca8b39")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("85c66835657e3ee6a478a2e0b1fd3d87119bebadc43a16814c30eb94c53766bb","7c3ada3f63a32f4727c62067d13e40bcb9aa9cbec8fb7e99a319931fc5a9332e","9445da674e59ef27624cd5c8ffa0bd6c837de0d90dd2857cf28b16a08fd7dba6","5e6041374f5b1e6c05393ea28468a91c41c38dc6b5a5230795a61c2b60ed14bc","6d2d30d5295ad99018146c8e67ea12f4aaa2ca1a170ad287a579876bf03c2950","e594bca43ade76bbaab2592e9eabeb8dca8a72ed27afd5e26d857659ec173261","14b0c90a2eff6b94b9c5160875fcf29aff15dcfdfd3402d953441d9b0dca8b39")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("85c66835657e3ee6a478a2e0b1fd3d87119bebadc43a16814c30eb94c53766bb","7c3ada3f63a32f4727c62067d13e40bcb9aa9cbec8fb7e99a319931fc5a9332e","9445da674e59ef27624cd5c8ffa0bd6c837de0d90dd2857cf28b16a08fd7dba6","5e6041374f5b1e6c05393ea28468a91c41c38dc6b5a5230795a61c2b60ed14bc","6d2d30d5295ad99018146c8e67ea12f4aaa2ca1a170ad287a579876bf03c2950","e594bca43ade76bbaab2592e9eabeb8dca8a72ed27afd5e26d857659ec173261","14b0c90a2eff6b94b9c5160875fcf29aff15dcfdfd3402d953441d9b0dca8b39")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("85c66835657e3ee6a478a2e0b1fd3d87119bebadc43a16814c30eb94c53766bb","7c3ada3f63a32f4727c62067d13e40bcb9aa9cbec8fb7e99a319931fc5a9332e","9445da674e59ef27624cd5c8ffa0bd6c837de0d90dd2857cf28b16a08fd7dba6","5e6041374f5b1e6c05393ea28468a91c41c38dc6b5a5230795a61c2b60ed14bc","6d2d30d5295ad99018146c8e67ea12f4aaa2ca1a170ad287a579876bf03c2950","e594bca43ade76bbaab2592e9eabeb8dca8a72ed27afd5e26d857659ec173261","14b0c90a2eff6b94b9c5160875fcf29aff15dcfdfd3402d953441d9b0dca8b39")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("85c66835657e3ee6a478a2e0b1fd3d87119bebadc43a16814c30eb94c53766bb","7c3ada3f63a32f4727c62067d13e40bcb9aa9cbec8fb7e99a319931fc5a9332e","9445da674e59ef27624cd5c8ffa0bd6c837de0d90dd2857cf28b16a08fd7dba6","5e6041374f5b1e6c05393ea28468a91c41c38dc6b5a5230795a61c2b60ed14bc","6d2d30d5295ad99018146c8e67ea12f4aaa2ca1a170ad287a579876bf03c2950","e594bca43ade76bbaab2592e9eabeb8dca8a72ed27afd5e26d857659ec173261","14b0c90a2eff6b94b9c5160875fcf29aff15dcfdfd3402d953441d9b0dca8b39")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("85c66835657e3ee6a478a2e0b1fd3d87119bebadc43a16814c30eb94c53766bb","7c3ada3f63a32f4727c62067d13e40bcb9aa9cbec8fb7e99a319931fc5a9332e","9445da674e59ef27624cd5c8ffa0bd6c837de0d90dd2857cf28b16a08fd7dba6","5e6041374f5b1e6c05393ea28468a91c41c38dc6b5a5230795a61c2b60ed14bc","6d2d30d5295ad99018146c8e67ea12f4aaa2ca1a170ad287a579876bf03c2950","e594bca43ade76bbaab2592e9eabeb8dca8a72ed27afd5e26d857659ec173261","14b0c90a2eff6b94b9c5160875fcf29aff15dcfdfd3402d953441d9b0dca8b39")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("85c66835657e3ee6a478a2e0b1fd3d87119bebadc43a16814c30eb94c53766bb","7c3ada3f63a32f4727c62067d13e40bcb9aa9cbec8fb7e99a319931fc5a9332e","9445da674e59ef27624cd5c8ffa0bd6c837de0d90dd2857cf28b16a08fd7dba6","5e6041374f5b1e6c05393ea28468a91c41c38dc6b5a5230795a61c2b60ed14bc","6d2d30d5295ad99018146c8e67ea12f4aaa2ca1a170ad287a579876bf03c2950","e594bca43ade76bbaab2592e9eabeb8dca8a72ed27afd5e26d857659ec173261","14b0c90a2eff6b94b9c5160875fcf29aff15dcfdfd3402d953441d9b0dca8b39")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("85c66835657e3ee6a478a2e0b1fd3d87119bebadc43a16814c30eb94c53766bb","7c3ada3f63a32f4727c62067d13e40bcb9aa9cbec8fb7e99a319931fc5a9332e","9445da674e59ef27624cd5c8ffa0bd6c837de0d90dd2857cf28b16a08fd7dba6","5e6041374f5b1e6c05393ea28468a91c41c38dc6b5a5230795a61c2b60ed14bc","6d2d30d5295ad99018146c8e67ea12f4aaa2ca1a170ad287a579876bf03c2950","e594bca43ade76bbaab2592e9eabeb8dca8a72ed27afd5e26d857659ec173261","14b0c90a2eff6b94b9c5160875fcf29aff15dcfdfd3402d953441d9b0dca8b39")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("85c66835657e3ee6a478a2e0b1fd3d87119bebadc43a16814c30eb94c53766bb","7c3ada3f63a32f4727c62067d13e40bcb9aa9cbec8fb7e99a319931fc5a9332e","9445da674e59ef27624cd5c8ffa0bd6c837de0d90dd2857cf28b16a08fd7dba6","5e6041374f5b1e6c05393ea28468a91c41c38dc6b5a5230795a61c2b60ed14bc","6d2d30d5295ad99018146c8e67ea12f4aaa2ca1a170ad287a579876bf03c2950","e594bca43ade76bbaab2592e9eabeb8dca8a72ed27afd5e26d857659ec173261","14b0c90a2eff6b94b9c5160875fcf29aff15dcfdfd3402d953441d9b0dca8b39")
index=activity AND rg_functionality="Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("85c66835657e3ee6a478a2e0b1fd3d87119bebadc43a16814c30eb94c53766bb","7c3ada3f63a32f4727c62067d13e40bcb9aa9cbec8fb7e99a319931fc5a9332e","9445da674e59ef27624cd5c8ffa0bd6c837de0d90dd2857cf28b16a08fd7dba6","5e6041374f5b1e6c05393ea28468a91c41c38dc6b5a5230795a61c2b60ed14bc","6d2d30d5295ad99018146c8e67ea12f4aaa2ca1a170ad287a579876bf03c2950","e594bca43ade76bbaab2592e9eabeb8dca8a72ed27afd5e26d857659ec173261","14b0c90a2eff6b94b9c5160875fcf29aff15dcfdfd3402d953441d9b0dca8b39")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("85c66835657e3ee6a478a2e0b1fd3d87119bebadc43a16814c30eb94c53766bb","7c3ada3f63a32f4727c62067d13e40bcb9aa9cbec8fb7e99a319931fc5a9332e","9445da674e59ef27624cd5c8ffa0bd6c837de0d90dd2857cf28b16a08fd7dba6","5e6041374f5b1e6c05393ea28468a91c41c38dc6b5a5230795a61c2b60ed14bc","6d2d30d5295ad99018146c8e67ea12f4aaa2ca1a170ad287a579876bf03c2950","e594bca43ade76bbaab2592e9eabeb8dca8a72ed27afd5e26d857659ec173261","14b0c90a2eff6b94b9c5160875fcf29aff15dcfdfd3402d953441d9b0dca8b39")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("85c66835657e3ee6a478a2e0b1fd3d87119bebadc43a16814c30eb94c53766bb","7c3ada3f63a32f4727c62067d13e40bcb9aa9cbec8fb7e99a319931fc5a9332e","9445da674e59ef27624cd5c8ffa0bd6c837de0d90dd2857cf28b16a08fd7dba6","5e6041374f5b1e6c05393ea28468a91c41c38dc6b5a5230795a61c2b60ed14bc","6d2d30d5295ad99018146c8e67ea12f4aaa2ca1a170ad287a579876bf03c2950","e594bca43ade76bbaab2592e9eabeb8dca8a72ed27afd5e26d857659ec173261","14b0c90a2eff6b94b9c5160875fcf29aff15dcfdfd3402d953441d9b0dca8b39")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("85c66835657e3ee6a478a2e0b1fd3d87119bebadc43a16814c30eb94c53766bb","7c3ada3f63a32f4727c62067d13e40bcb9aa9cbec8fb7e99a319931fc5a9332e","9445da674e59ef27624cd5c8ffa0bd6c837de0d90dd2857cf28b16a08fd7dba6","5e6041374f5b1e6c05393ea28468a91c41c38dc6b5a5230795a61c2b60ed14bc","6d2d30d5295ad99018146c8e67ea12f4aaa2ca1a170ad287a579876bf03c2950","e594bca43ade76bbaab2592e9eabeb8dca8a72ed27afd5e26d857659ec173261","14b0c90a2eff6b94b9c5160875fcf29aff15dcfdfd3402d953441d9b0dca8b39")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("85c66835657e3ee6a478a2e0b1fd3d87119bebadc43a16814c30eb94c53766bb","7c3ada3f63a32f4727c62067d13e40bcb9aa9cbec8fb7e99a319931fc5a9332e","9445da674e59ef27624cd5c8ffa0bd6c837de0d90dd2857cf28b16a08fd7dba6","5e6041374f5b1e6c05393ea28468a91c41c38dc6b5a5230795a61c2b60ed14bc","6d2d30d5295ad99018146c8e67ea12f4aaa2ca1a170ad287a579876bf03c2950","e594bca43ade76bbaab2592e9eabeb8dca8a72ed27afd5e26d857659ec173261","14b0c90a2eff6b94b9c5160875fcf29aff15dcfdfd3402d953441d9b0dca8b39")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("85c66835657e3ee6a478a2e0b1fd3d87119bebadc43a16814c30eb94c53766bb","7c3ada3f63a32f4727c62067d13e40bcb9aa9cbec8fb7e99a319931fc5a9332e","9445da674e59ef27624cd5c8ffa0bd6c837de0d90dd2857cf28b16a08fd7dba6","5e6041374f5b1e6c05393ea28468a91c41c38dc6b5a5230795a61c2b60ed14bc","6d2d30d5295ad99018146c8e67ea12f4aaa2ca1a170ad287a579876bf03c2950","e594bca43ade76bbaab2592e9eabeb8dca8a72ed27afd5e26d857659ec173261","14b0c90a2eff6b94b9c5160875fcf29aff15dcfdfd3402d953441d9b0dca8b39")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("85c66835657e3ee6a478a2e0b1fd3d87119bebadc43a16814c30eb94c53766bb","7c3ada3f63a32f4727c62067d13e40bcb9aa9cbec8fb7e99a319931fc5a9332e","9445da674e59ef27624cd5c8ffa0bd6c837de0d90dd2857cf28b16a08fd7dba6","5e6041374f5b1e6c05393ea28468a91c41c38dc6b5a5230795a61c2b60ed14bc","6d2d30d5295ad99018146c8e67ea12f4aaa2ca1a170ad287a579876bf03c2950","e594bca43ade76bbaab2592e9eabeb8dca8a72ed27afd5e26d857659ec173261","14b0c90a2eff6b94b9c5160875fcf29aff15dcfdfd3402d953441d9b0dca8b39")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("85c66835657e3ee6a478a2e0b1fd3d87119bebadc43a16814c30eb94c53766bb","7c3ada3f63a32f4727c62067d13e40bcb9aa9cbec8fb7e99a319931fc5a9332e","9445da674e59ef27624cd5c8ffa0bd6c837de0d90dd2857cf28b16a08fd7dba6","5e6041374f5b1e6c05393ea28468a91c41c38dc6b5a5230795a61c2b60ed14bc","6d2d30d5295ad99018146c8e67ea12f4aaa2ca1a170ad287a579876bf03c2950","e594bca43ade76bbaab2592e9eabeb8dca8a72ed27afd5e26d857659ec173261","14b0c90a2eff6b94b9c5160875fcf29aff15dcfdfd3402d953441d9b0dca8b39")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring64 NOT NULL AND customstring64 IN ("85c66835657e3ee6a478a2e0b1fd3d87119bebadc43a16814c30eb94c53766bb","7c3ada3f63a32f4727c62067d13e40bcb9aa9cbec8fb7e99a319931fc5a9332e","9445da674e59ef27624cd5c8ffa0bd6c837de0d90dd2857cf28b16a08fd7dba6","5e6041374f5b1e6c05393ea28468a91c41c38dc6b5a5230795a61c2b60ed14bc","6d2d30d5295ad99018146c8e67ea12f4aaa2ca1a170ad287a579876bf03c2950","e594bca43ade76bbaab2592e9eabeb8dca8a72ed27afd5e26d857659ec173261","14b0c90a2eff6b94b9c5160875fcf29aff15dcfdfd3402d953441d9b0dca8b39")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("85c66835657e3ee6a478a2e0b1fd3d87119bebadc43a16814c30eb94c53766bb","7c3ada3f63a32f4727c62067d13e40bcb9aa9cbec8fb7e99a319931fc5a9332e","9445da674e59ef27624cd5c8ffa0bd6c837de0d90dd2857cf28b16a08fd7dba6","5e6041374f5b1e6c05393ea28468a91c41c38dc6b5a5230795a61c2b60ed14bc","6d2d30d5295ad99018146c8e67ea12f4aaa2ca1a170ad287a579876bf03c2950","e594bca43ade76bbaab2592e9eabeb8dca8a72ed27afd5e26d857659ec173261","14b0c90a2eff6b94b9c5160875fcf29aff15dcfdfd3402d953441d9b0dca8b39")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("85c66835657e3ee6a478a2e0b1fd3d87119bebadc43a16814c30eb94c53766bb","7c3ada3f63a32f4727c62067d13e40bcb9aa9cbec8fb7e99a319931fc5a9332e","9445da674e59ef27624cd5c8ffa0bd6c837de0d90dd2857cf28b16a08fd7dba6","5e6041374f5b1e6c05393ea28468a91c41c38dc6b5a5230795a61c2b60ed14bc","6d2d30d5295ad99018146c8e67ea12f4aaa2ca1a170ad287a579876bf03c2950","e594bca43ade76bbaab2592e9eabeb8dca8a72ed27afd5e26d857659ec173261","14b0c90a2eff6b94b9c5160875fcf29aff15dcfdfd3402d953441d9b0dca8b39")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("85c66835657e3ee6a478a2e0b1fd3d87119bebadc43a16814c30eb94c53766bb","7c3ada3f63a32f4727c62067d13e40bcb9aa9cbec8fb7e99a319931fc5a9332e","9445da674e59ef27624cd5c8ffa0bd6c837de0d90dd2857cf28b16a08fd7dba6","5e6041374f5b1e6c05393ea28468a91c41c38dc6b5a5230795a61c2b60ed14bc","6d2d30d5295ad99018146c8e67ea12f4aaa2ca1a170ad287a579876bf03c2950","e594bca43ade76bbaab2592e9eabeb8dca8a72ed27afd5e26d857659ec173261","14b0c90a2eff6b94b9c5160875fcf29aff15dcfdfd3402d953441d9b0dca8b39")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring64 NOT NULL AND customstring64 IN ("85c66835657e3ee6a478a2e0b1fd3d87119bebadc43a16814c30eb94c53766bb","7c3ada3f63a32f4727c62067d13e40bcb9aa9cbec8fb7e99a319931fc5a9332e","9445da674e59ef27624cd5c8ffa0bd6c837de0d90dd2857cf28b16a08fd7dba6","5e6041374f5b1e6c05393ea28468a91c41c38dc6b5a5230795a61c2b60ed14bc","6d2d30d5295ad99018146c8e67ea12f4aaa2ca1a170ad287a579876bf03c2950","e594bca43ade76bbaab2592e9eabeb8dca8a72ed27afd5e26d857659ec173261","14b0c90a2eff6b94b9c5160875fcf29aff15dcfdfd3402d953441d9b0dca8b39")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("85c66835657e3ee6a478a2e0b1fd3d87119bebadc43a16814c30eb94c53766bb","7c3ada3f63a32f4727c62067d13e40bcb9aa9cbec8fb7e99a319931fc5a9332e","9445da674e59ef27624cd5c8ffa0bd6c837de0d90dd2857cf28b16a08fd7dba6","5e6041374f5b1e6c05393ea28468a91c41c38dc6b5a5230795a61c2b60ed14bc","6d2d30d5295ad99018146c8e67ea12f4aaa2ca1a170ad287a579876bf03c2950","e594bca43ade76bbaab2592e9eabeb8dca8a72ed27afd5e26d857659ec173261","14b0c90a2eff6b94b9c5160875fcf29aff15dcfdfd3402d953441d9b0dca8b39")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("85c66835657e3ee6a478a2e0b1fd3d87119bebadc43a16814c30eb94c53766bb","7c3ada3f63a32f4727c62067d13e40bcb9aa9cbec8fb7e99a319931fc5a9332e","9445da674e59ef27624cd5c8ffa0bd6c837de0d90dd2857cf28b16a08fd7dba6","5e6041374f5b1e6c05393ea28468a91c41c38dc6b5a5230795a61c2b60ed14bc","6d2d30d5295ad99018146c8e67ea12f4aaa2ca1a170ad287a579876bf03c2950","e594bca43ade76bbaab2592e9eabeb8dca8a72ed27afd5e26d857659ec173261","14b0c90a2eff6b94b9c5160875fcf29aff15dcfdfd3402d953441d9b0dca8b39")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("85c66835657e3ee6a478a2e0b1fd3d87119bebadc43a16814c30eb94c53766bb","7c3ada3f63a32f4727c62067d13e40bcb9aa9cbec8fb7e99a319931fc5a9332e","9445da674e59ef27624cd5c8ffa0bd6c837de0d90dd2857cf28b16a08fd7dba6","5e6041374f5b1e6c05393ea28468a91c41c38dc6b5a5230795a61c2b60ed14bc","6d2d30d5295ad99018146c8e67ea12f4aaa2ca1a170ad287a579876bf03c2950","e594bca43ade76bbaab2592e9eabeb8dca8a72ed27afd5e26d857659ec173261","14b0c90a2eff6b94b9c5160875fcf29aff15dcfdfd3402d953441d9b0dca8b39")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring64 NOT NULL AND customstring64 IN ("85c66835657e3ee6a478a2e0b1fd3d87119bebadc43a16814c30eb94c53766bb","7c3ada3f63a32f4727c62067d13e40bcb9aa9cbec8fb7e99a319931fc5a9332e","9445da674e59ef27624cd5c8ffa0bd6c837de0d90dd2857cf28b16a08fd7dba6","5e6041374f5b1e6c05393ea28468a91c41c38dc6b5a5230795a61c2b60ed14bc","6d2d30d5295ad99018146c8e67ea12f4aaa2ca1a170ad287a579876bf03c2950","e594bca43ade76bbaab2592e9eabeb8dca8a72ed27afd5e26d857659ec173261","14b0c90a2eff6b94b9c5160875fcf29aff15dcfdfd3402d953441d9b0dca8b39")
index=activity AND rg_functionality="O365 General" AND filehash NOT NULL AND filehash IN ("85c66835657e3ee6a478a2e0b1fd3d87119bebadc43a16814c30eb94c53766bb","7c3ada3f63a32f4727c62067d13e40bcb9aa9cbec8fb7e99a319931fc5a9332e","9445da674e59ef27624cd5c8ffa0bd6c837de0d90dd2857cf28b16a08fd7dba6","5e6041374f5b1e6c05393ea28468a91c41c38dc6b5a5230795a61c2b60ed14bc","6d2d30d5295ad99018146c8e67ea12f4aaa2ca1a170ad287a579876bf03c2950","e594bca43ade76bbaab2592e9eabeb8dca8a72ed27afd5e26d857659ec173261","14b0c90a2eff6b94b9c5160875fcf29aff15dcfdfd3402d953441d9b0dca8b39")
index=activity AND rg_functionality="O365 General" AND oldfilehash NOT NULL AND oldfilehash IN ("85c66835657e3ee6a478a2e0b1fd3d87119bebadc43a16814c30eb94c53766bb","7c3ada3f63a32f4727c62067d13e40bcb9aa9cbec8fb7e99a319931fc5a9332e","9445da674e59ef27624cd5c8ffa0bd6c837de0d90dd2857cf28b16a08fd7dba6","5e6041374f5b1e6c05393ea28468a91c41c38dc6b5a5230795a61c2b60ed14bc","6d2d30d5295ad99018146c8e67ea12f4aaa2ca1a170ad287a579876bf03c2950","e594bca43ade76bbaab2592e9eabeb8dca8a72ed27afd5e26d857659ec173261","14b0c90a2eff6b94b9c5160875fcf29aff15dcfdfd3402d953441d9b0dca8b39")
index=activity AND rg_functionality="O365 General" AND customstring3 NOT NULL AND customstring3 IN ("85c66835657e3ee6a478a2e0b1fd3d87119bebadc43a16814c30eb94c53766bb","7c3ada3f63a32f4727c62067d13e40bcb9aa9cbec8fb7e99a319931fc5a9332e","9445da674e59ef27624cd5c8ffa0bd6c837de0d90dd2857cf28b16a08fd7dba6","5e6041374f5b1e6c05393ea28468a91c41c38dc6b5a5230795a61c2b60ed14bc","6d2d30d5295ad99018146c8e67ea12f4aaa2ca1a170ad287a579876bf03c2950","e594bca43ade76bbaab2592e9eabeb8dca8a72ed27afd5e26d857659ec173261","14b0c90a2eff6b94b9c5160875fcf29aff15dcfdfd3402d953441d9b0dca8b39")
index=activity AND rg_functionality="O365 General" AND customstring64 NOT NULL AND customstring64 IN ("85c66835657e3ee6a478a2e0b1fd3d87119bebadc43a16814c30eb94c53766bb","7c3ada3f63a32f4727c62067d13e40bcb9aa9cbec8fb7e99a319931fc5a9332e","9445da674e59ef27624cd5c8ffa0bd6c837de0d90dd2857cf28b16a08fd7dba6","5e6041374f5b1e6c05393ea28468a91c41c38dc6b5a5230795a61c2b60ed14bc","6d2d30d5295ad99018146c8e67ea12f4aaa2ca1a170ad287a579876bf03c2950","e594bca43ade76bbaab2592e9eabeb8dca8a72ed27afd5e26d857659ec173261","14b0c90a2eff6b94b9c5160875fcf29aff15dcfdfd3402d953441d9b0dca8b39")
