index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("6030c4381b8b5d5c5734341292316723a89f1bdbd2d10bb67c4d06b1242afd05","858efe4f9037e5efebadaaa70aa8ad096f7244c4c4aeade72c51ddad23d05bfe","9c21adbcb2888daf14ef55c4fa1f41eaa6cbfbe20d85c3e1da61a96a53ba18f9","6d7374b4f977f689389c7155192b5db70ee44a7645625ecf8163c00da8828388","b2cba01ae6707ce694073018d948f82340b9c41fb2b2bc49769f9a0be37071e1","293b455b5b7e1c2063a8781f3c169cf8ef2b1d06e6b7a086b7b44f37f55729bd","af260c172baffd0e8b2671fd0c84e607ac9b2c8beb57df43cf5df6e103cbb7ad","430d1364d0d0a60facd9b73e674faddf63a8f77649cd10ba855df7e49189980b","ba05d05d51d4f7bfceb3821a3754e7432248f5c3d5a450391a0631d56bbce4c2","b3ee068bf282575ac7eb715dd779254889e0b8a55aba2b7a1700fc8aa4dcb1da")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("6030c4381b8b5d5c5734341292316723a89f1bdbd2d10bb67c4d06b1242afd05","858efe4f9037e5efebadaaa70aa8ad096f7244c4c4aeade72c51ddad23d05bfe","9c21adbcb2888daf14ef55c4fa1f41eaa6cbfbe20d85c3e1da61a96a53ba18f9","6d7374b4f977f689389c7155192b5db70ee44a7645625ecf8163c00da8828388","b2cba01ae6707ce694073018d948f82340b9c41fb2b2bc49769f9a0be37071e1","293b455b5b7e1c2063a8781f3c169cf8ef2b1d06e6b7a086b7b44f37f55729bd","af260c172baffd0e8b2671fd0c84e607ac9b2c8beb57df43cf5df6e103cbb7ad","430d1364d0d0a60facd9b73e674faddf63a8f77649cd10ba855df7e49189980b","ba05d05d51d4f7bfceb3821a3754e7432248f5c3d5a450391a0631d56bbce4c2","b3ee068bf282575ac7eb715dd779254889e0b8a55aba2b7a1700fc8aa4dcb1da")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("6030c4381b8b5d5c5734341292316723a89f1bdbd2d10bb67c4d06b1242afd05","858efe4f9037e5efebadaaa70aa8ad096f7244c4c4aeade72c51ddad23d05bfe","9c21adbcb2888daf14ef55c4fa1f41eaa6cbfbe20d85c3e1da61a96a53ba18f9","6d7374b4f977f689389c7155192b5db70ee44a7645625ecf8163c00da8828388","b2cba01ae6707ce694073018d948f82340b9c41fb2b2bc49769f9a0be37071e1","293b455b5b7e1c2063a8781f3c169cf8ef2b1d06e6b7a086b7b44f37f55729bd","af260c172baffd0e8b2671fd0c84e607ac9b2c8beb57df43cf5df6e103cbb7ad","430d1364d0d0a60facd9b73e674faddf63a8f77649cd10ba855df7e49189980b","ba05d05d51d4f7bfceb3821a3754e7432248f5c3d5a450391a0631d56bbce4c2","b3ee068bf282575ac7eb715dd779254889e0b8a55aba2b7a1700fc8aa4dcb1da")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring64 NOT NULL AND customstring64 IN ("6030c4381b8b5d5c5734341292316723a89f1bdbd2d10bb67c4d06b1242afd05","858efe4f9037e5efebadaaa70aa8ad096f7244c4c4aeade72c51ddad23d05bfe","9c21adbcb2888daf14ef55c4fa1f41eaa6cbfbe20d85c3e1da61a96a53ba18f9","6d7374b4f977f689389c7155192b5db70ee44a7645625ecf8163c00da8828388","b2cba01ae6707ce694073018d948f82340b9c41fb2b2bc49769f9a0be37071e1","293b455b5b7e1c2063a8781f3c169cf8ef2b1d06e6b7a086b7b44f37f55729bd","af260c172baffd0e8b2671fd0c84e607ac9b2c8beb57df43cf5df6e103cbb7ad","430d1364d0d0a60facd9b73e674faddf63a8f77649cd10ba855df7e49189980b","ba05d05d51d4f7bfceb3821a3754e7432248f5c3d5a450391a0631d56bbce4c2","b3ee068bf282575ac7eb715dd779254889e0b8a55aba2b7a1700fc8aa4dcb1da")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("6030c4381b8b5d5c5734341292316723a89f1bdbd2d10bb67c4d06b1242afd05","858efe4f9037e5efebadaaa70aa8ad096f7244c4c4aeade72c51ddad23d05bfe","9c21adbcb2888daf14ef55c4fa1f41eaa6cbfbe20d85c3e1da61a96a53ba18f9","6d7374b4f977f689389c7155192b5db70ee44a7645625ecf8163c00da8828388","b2cba01ae6707ce694073018d948f82340b9c41fb2b2bc49769f9a0be37071e1","293b455b5b7e1c2063a8781f3c169cf8ef2b1d06e6b7a086b7b44f37f55729bd","af260c172baffd0e8b2671fd0c84e607ac9b2c8beb57df43cf5df6e103cbb7ad","430d1364d0d0a60facd9b73e674faddf63a8f77649cd10ba855df7e49189980b","ba05d05d51d4f7bfceb3821a3754e7432248f5c3d5a450391a0631d56bbce4c2","b3ee068bf282575ac7eb715dd779254889e0b8a55aba2b7a1700fc8aa4dcb1da")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("6030c4381b8b5d5c5734341292316723a89f1bdbd2d10bb67c4d06b1242afd05","858efe4f9037e5efebadaaa70aa8ad096f7244c4c4aeade72c51ddad23d05bfe","9c21adbcb2888daf14ef55c4fa1f41eaa6cbfbe20d85c3e1da61a96a53ba18f9","6d7374b4f977f689389c7155192b5db70ee44a7645625ecf8163c00da8828388","b2cba01ae6707ce694073018d948f82340b9c41fb2b2bc49769f9a0be37071e1","293b455b5b7e1c2063a8781f3c169cf8ef2b1d06e6b7a086b7b44f37f55729bd","af260c172baffd0e8b2671fd0c84e607ac9b2c8beb57df43cf5df6e103cbb7ad","430d1364d0d0a60facd9b73e674faddf63a8f77649cd10ba855df7e49189980b","ba05d05d51d4f7bfceb3821a3754e7432248f5c3d5a450391a0631d56bbce4c2","b3ee068bf282575ac7eb715dd779254889e0b8a55aba2b7a1700fc8aa4dcb1da")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("6030c4381b8b5d5c5734341292316723a89f1bdbd2d10bb67c4d06b1242afd05","858efe4f9037e5efebadaaa70aa8ad096f7244c4c4aeade72c51ddad23d05bfe","9c21adbcb2888daf14ef55c4fa1f41eaa6cbfbe20d85c3e1da61a96a53ba18f9","6d7374b4f977f689389c7155192b5db70ee44a7645625ecf8163c00da8828388","b2cba01ae6707ce694073018d948f82340b9c41fb2b2bc49769f9a0be37071e1","293b455b5b7e1c2063a8781f3c169cf8ef2b1d06e6b7a086b7b44f37f55729bd","af260c172baffd0e8b2671fd0c84e607ac9b2c8beb57df43cf5df6e103cbb7ad","430d1364d0d0a60facd9b73e674faddf63a8f77649cd10ba855df7e49189980b","ba05d05d51d4f7bfceb3821a3754e7432248f5c3d5a450391a0631d56bbce4c2","b3ee068bf282575ac7eb715dd779254889e0b8a55aba2b7a1700fc8aa4dcb1da")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("6030c4381b8b5d5c5734341292316723a89f1bdbd2d10bb67c4d06b1242afd05","858efe4f9037e5efebadaaa70aa8ad096f7244c4c4aeade72c51ddad23d05bfe","9c21adbcb2888daf14ef55c4fa1f41eaa6cbfbe20d85c3e1da61a96a53ba18f9","6d7374b4f977f689389c7155192b5db70ee44a7645625ecf8163c00da8828388","b2cba01ae6707ce694073018d948f82340b9c41fb2b2bc49769f9a0be37071e1","293b455b5b7e1c2063a8781f3c169cf8ef2b1d06e6b7a086b7b44f37f55729bd","af260c172baffd0e8b2671fd0c84e607ac9b2c8beb57df43cf5df6e103cbb7ad","430d1364d0d0a60facd9b73e674faddf63a8f77649cd10ba855df7e49189980b","ba05d05d51d4f7bfceb3821a3754e7432248f5c3d5a450391a0631d56bbce4c2","b3ee068bf282575ac7eb715dd779254889e0b8a55aba2b7a1700fc8aa4dcb1da")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("6030c4381b8b5d5c5734341292316723a89f1bdbd2d10bb67c4d06b1242afd05","858efe4f9037e5efebadaaa70aa8ad096f7244c4c4aeade72c51ddad23d05bfe","9c21adbcb2888daf14ef55c4fa1f41eaa6cbfbe20d85c3e1da61a96a53ba18f9","6d7374b4f977f689389c7155192b5db70ee44a7645625ecf8163c00da8828388","b2cba01ae6707ce694073018d948f82340b9c41fb2b2bc49769f9a0be37071e1","293b455b5b7e1c2063a8781f3c169cf8ef2b1d06e6b7a086b7b44f37f55729bd","af260c172baffd0e8b2671fd0c84e607ac9b2c8beb57df43cf5df6e103cbb7ad","430d1364d0d0a60facd9b73e674faddf63a8f77649cd10ba855df7e49189980b","ba05d05d51d4f7bfceb3821a3754e7432248f5c3d5a450391a0631d56bbce4c2","b3ee068bf282575ac7eb715dd779254889e0b8a55aba2b7a1700fc8aa4dcb1da")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("6030c4381b8b5d5c5734341292316723a89f1bdbd2d10bb67c4d06b1242afd05","858efe4f9037e5efebadaaa70aa8ad096f7244c4c4aeade72c51ddad23d05bfe","9c21adbcb2888daf14ef55c4fa1f41eaa6cbfbe20d85c3e1da61a96a53ba18f9","6d7374b4f977f689389c7155192b5db70ee44a7645625ecf8163c00da8828388","b2cba01ae6707ce694073018d948f82340b9c41fb2b2bc49769f9a0be37071e1","293b455b5b7e1c2063a8781f3c169cf8ef2b1d06e6b7a086b7b44f37f55729bd","af260c172baffd0e8b2671fd0c84e607ac9b2c8beb57df43cf5df6e103cbb7ad","430d1364d0d0a60facd9b73e674faddf63a8f77649cd10ba855df7e49189980b","ba05d05d51d4f7bfceb3821a3754e7432248f5c3d5a450391a0631d56bbce4c2","b3ee068bf282575ac7eb715dd779254889e0b8a55aba2b7a1700fc8aa4dcb1da")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("6030c4381b8b5d5c5734341292316723a89f1bdbd2d10bb67c4d06b1242afd05","858efe4f9037e5efebadaaa70aa8ad096f7244c4c4aeade72c51ddad23d05bfe","9c21adbcb2888daf14ef55c4fa1f41eaa6cbfbe20d85c3e1da61a96a53ba18f9","6d7374b4f977f689389c7155192b5db70ee44a7645625ecf8163c00da8828388","b2cba01ae6707ce694073018d948f82340b9c41fb2b2bc49769f9a0be37071e1","293b455b5b7e1c2063a8781f3c169cf8ef2b1d06e6b7a086b7b44f37f55729bd","af260c172baffd0e8b2671fd0c84e607ac9b2c8beb57df43cf5df6e103cbb7ad","430d1364d0d0a60facd9b73e674faddf63a8f77649cd10ba855df7e49189980b","ba05d05d51d4f7bfceb3821a3754e7432248f5c3d5a450391a0631d56bbce4c2","b3ee068bf282575ac7eb715dd779254889e0b8a55aba2b7a1700fc8aa4dcb1da")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("6030c4381b8b5d5c5734341292316723a89f1bdbd2d10bb67c4d06b1242afd05","858efe4f9037e5efebadaaa70aa8ad096f7244c4c4aeade72c51ddad23d05bfe","9c21adbcb2888daf14ef55c4fa1f41eaa6cbfbe20d85c3e1da61a96a53ba18f9","6d7374b4f977f689389c7155192b5db70ee44a7645625ecf8163c00da8828388","b2cba01ae6707ce694073018d948f82340b9c41fb2b2bc49769f9a0be37071e1","293b455b5b7e1c2063a8781f3c169cf8ef2b1d06e6b7a086b7b44f37f55729bd","af260c172baffd0e8b2671fd0c84e607ac9b2c8beb57df43cf5df6e103cbb7ad","430d1364d0d0a60facd9b73e674faddf63a8f77649cd10ba855df7e49189980b","ba05d05d51d4f7bfceb3821a3754e7432248f5c3d5a450391a0631d56bbce4c2","b3ee068bf282575ac7eb715dd779254889e0b8a55aba2b7a1700fc8aa4dcb1da")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("6030c4381b8b5d5c5734341292316723a89f1bdbd2d10bb67c4d06b1242afd05","858efe4f9037e5efebadaaa70aa8ad096f7244c4c4aeade72c51ddad23d05bfe","9c21adbcb2888daf14ef55c4fa1f41eaa6cbfbe20d85c3e1da61a96a53ba18f9","6d7374b4f977f689389c7155192b5db70ee44a7645625ecf8163c00da8828388","b2cba01ae6707ce694073018d948f82340b9c41fb2b2bc49769f9a0be37071e1","293b455b5b7e1c2063a8781f3c169cf8ef2b1d06e6b7a086b7b44f37f55729bd","af260c172baffd0e8b2671fd0c84e607ac9b2c8beb57df43cf5df6e103cbb7ad","430d1364d0d0a60facd9b73e674faddf63a8f77649cd10ba855df7e49189980b","ba05d05d51d4f7bfceb3821a3754e7432248f5c3d5a450391a0631d56bbce4c2","b3ee068bf282575ac7eb715dd779254889e0b8a55aba2b7a1700fc8aa4dcb1da")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("6030c4381b8b5d5c5734341292316723a89f1bdbd2d10bb67c4d06b1242afd05","858efe4f9037e5efebadaaa70aa8ad096f7244c4c4aeade72c51ddad23d05bfe","9c21adbcb2888daf14ef55c4fa1f41eaa6cbfbe20d85c3e1da61a96a53ba18f9","6d7374b4f977f689389c7155192b5db70ee44a7645625ecf8163c00da8828388","b2cba01ae6707ce694073018d948f82340b9c41fb2b2bc49769f9a0be37071e1","293b455b5b7e1c2063a8781f3c169cf8ef2b1d06e6b7a086b7b44f37f55729bd","af260c172baffd0e8b2671fd0c84e607ac9b2c8beb57df43cf5df6e103cbb7ad","430d1364d0d0a60facd9b73e674faddf63a8f77649cd10ba855df7e49189980b","ba05d05d51d4f7bfceb3821a3754e7432248f5c3d5a450391a0631d56bbce4c2","b3ee068bf282575ac7eb715dd779254889e0b8a55aba2b7a1700fc8aa4dcb1da")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("6030c4381b8b5d5c5734341292316723a89f1bdbd2d10bb67c4d06b1242afd05","858efe4f9037e5efebadaaa70aa8ad096f7244c4c4aeade72c51ddad23d05bfe","9c21adbcb2888daf14ef55c4fa1f41eaa6cbfbe20d85c3e1da61a96a53ba18f9","6d7374b4f977f689389c7155192b5db70ee44a7645625ecf8163c00da8828388","b2cba01ae6707ce694073018d948f82340b9c41fb2b2bc49769f9a0be37071e1","293b455b5b7e1c2063a8781f3c169cf8ef2b1d06e6b7a086b7b44f37f55729bd","af260c172baffd0e8b2671fd0c84e607ac9b2c8beb57df43cf5df6e103cbb7ad","430d1364d0d0a60facd9b73e674faddf63a8f77649cd10ba855df7e49189980b","ba05d05d51d4f7bfceb3821a3754e7432248f5c3d5a450391a0631d56bbce4c2","b3ee068bf282575ac7eb715dd779254889e0b8a55aba2b7a1700fc8aa4dcb1da")
index=activity AND rg_functionality="Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("6030c4381b8b5d5c5734341292316723a89f1bdbd2d10bb67c4d06b1242afd05","858efe4f9037e5efebadaaa70aa8ad096f7244c4c4aeade72c51ddad23d05bfe","9c21adbcb2888daf14ef55c4fa1f41eaa6cbfbe20d85c3e1da61a96a53ba18f9","6d7374b4f977f689389c7155192b5db70ee44a7645625ecf8163c00da8828388","b2cba01ae6707ce694073018d948f82340b9c41fb2b2bc49769f9a0be37071e1","293b455b5b7e1c2063a8781f3c169cf8ef2b1d06e6b7a086b7b44f37f55729bd","af260c172baffd0e8b2671fd0c84e607ac9b2c8beb57df43cf5df6e103cbb7ad","430d1364d0d0a60facd9b73e674faddf63a8f77649cd10ba855df7e49189980b","ba05d05d51d4f7bfceb3821a3754e7432248f5c3d5a450391a0631d56bbce4c2","b3ee068bf282575ac7eb715dd779254889e0b8a55aba2b7a1700fc8aa4dcb1da")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("6030c4381b8b5d5c5734341292316723a89f1bdbd2d10bb67c4d06b1242afd05","858efe4f9037e5efebadaaa70aa8ad096f7244c4c4aeade72c51ddad23d05bfe","9c21adbcb2888daf14ef55c4fa1f41eaa6cbfbe20d85c3e1da61a96a53ba18f9","6d7374b4f977f689389c7155192b5db70ee44a7645625ecf8163c00da8828388","b2cba01ae6707ce694073018d948f82340b9c41fb2b2bc49769f9a0be37071e1","293b455b5b7e1c2063a8781f3c169cf8ef2b1d06e6b7a086b7b44f37f55729bd","af260c172baffd0e8b2671fd0c84e607ac9b2c8beb57df43cf5df6e103cbb7ad","430d1364d0d0a60facd9b73e674faddf63a8f77649cd10ba855df7e49189980b","ba05d05d51d4f7bfceb3821a3754e7432248f5c3d5a450391a0631d56bbce4c2","b3ee068bf282575ac7eb715dd779254889e0b8a55aba2b7a1700fc8aa4dcb1da")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("6030c4381b8b5d5c5734341292316723a89f1bdbd2d10bb67c4d06b1242afd05","858efe4f9037e5efebadaaa70aa8ad096f7244c4c4aeade72c51ddad23d05bfe","9c21adbcb2888daf14ef55c4fa1f41eaa6cbfbe20d85c3e1da61a96a53ba18f9","6d7374b4f977f689389c7155192b5db70ee44a7645625ecf8163c00da8828388","b2cba01ae6707ce694073018d948f82340b9c41fb2b2bc49769f9a0be37071e1","293b455b5b7e1c2063a8781f3c169cf8ef2b1d06e6b7a086b7b44f37f55729bd","af260c172baffd0e8b2671fd0c84e607ac9b2c8beb57df43cf5df6e103cbb7ad","430d1364d0d0a60facd9b73e674faddf63a8f77649cd10ba855df7e49189980b","ba05d05d51d4f7bfceb3821a3754e7432248f5c3d5a450391a0631d56bbce4c2","b3ee068bf282575ac7eb715dd779254889e0b8a55aba2b7a1700fc8aa4dcb1da")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("6030c4381b8b5d5c5734341292316723a89f1bdbd2d10bb67c4d06b1242afd05","858efe4f9037e5efebadaaa70aa8ad096f7244c4c4aeade72c51ddad23d05bfe","9c21adbcb2888daf14ef55c4fa1f41eaa6cbfbe20d85c3e1da61a96a53ba18f9","6d7374b4f977f689389c7155192b5db70ee44a7645625ecf8163c00da8828388","b2cba01ae6707ce694073018d948f82340b9c41fb2b2bc49769f9a0be37071e1","293b455b5b7e1c2063a8781f3c169cf8ef2b1d06e6b7a086b7b44f37f55729bd","af260c172baffd0e8b2671fd0c84e607ac9b2c8beb57df43cf5df6e103cbb7ad","430d1364d0d0a60facd9b73e674faddf63a8f77649cd10ba855df7e49189980b","ba05d05d51d4f7bfceb3821a3754e7432248f5c3d5a450391a0631d56bbce4c2","b3ee068bf282575ac7eb715dd779254889e0b8a55aba2b7a1700fc8aa4dcb1da")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("6030c4381b8b5d5c5734341292316723a89f1bdbd2d10bb67c4d06b1242afd05","858efe4f9037e5efebadaaa70aa8ad096f7244c4c4aeade72c51ddad23d05bfe","9c21adbcb2888daf14ef55c4fa1f41eaa6cbfbe20d85c3e1da61a96a53ba18f9","6d7374b4f977f689389c7155192b5db70ee44a7645625ecf8163c00da8828388","b2cba01ae6707ce694073018d948f82340b9c41fb2b2bc49769f9a0be37071e1","293b455b5b7e1c2063a8781f3c169cf8ef2b1d06e6b7a086b7b44f37f55729bd","af260c172baffd0e8b2671fd0c84e607ac9b2c8beb57df43cf5df6e103cbb7ad","430d1364d0d0a60facd9b73e674faddf63a8f77649cd10ba855df7e49189980b","ba05d05d51d4f7bfceb3821a3754e7432248f5c3d5a450391a0631d56bbce4c2","b3ee068bf282575ac7eb715dd779254889e0b8a55aba2b7a1700fc8aa4dcb1da")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("6030c4381b8b5d5c5734341292316723a89f1bdbd2d10bb67c4d06b1242afd05","858efe4f9037e5efebadaaa70aa8ad096f7244c4c4aeade72c51ddad23d05bfe","9c21adbcb2888daf14ef55c4fa1f41eaa6cbfbe20d85c3e1da61a96a53ba18f9","6d7374b4f977f689389c7155192b5db70ee44a7645625ecf8163c00da8828388","b2cba01ae6707ce694073018d948f82340b9c41fb2b2bc49769f9a0be37071e1","293b455b5b7e1c2063a8781f3c169cf8ef2b1d06e6b7a086b7b44f37f55729bd","af260c172baffd0e8b2671fd0c84e607ac9b2c8beb57df43cf5df6e103cbb7ad","430d1364d0d0a60facd9b73e674faddf63a8f77649cd10ba855df7e49189980b","ba05d05d51d4f7bfceb3821a3754e7432248f5c3d5a450391a0631d56bbce4c2","b3ee068bf282575ac7eb715dd779254889e0b8a55aba2b7a1700fc8aa4dcb1da")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("6030c4381b8b5d5c5734341292316723a89f1bdbd2d10bb67c4d06b1242afd05","858efe4f9037e5efebadaaa70aa8ad096f7244c4c4aeade72c51ddad23d05bfe","9c21adbcb2888daf14ef55c4fa1f41eaa6cbfbe20d85c3e1da61a96a53ba18f9","6d7374b4f977f689389c7155192b5db70ee44a7645625ecf8163c00da8828388","b2cba01ae6707ce694073018d948f82340b9c41fb2b2bc49769f9a0be37071e1","293b455b5b7e1c2063a8781f3c169cf8ef2b1d06e6b7a086b7b44f37f55729bd","af260c172baffd0e8b2671fd0c84e607ac9b2c8beb57df43cf5df6e103cbb7ad","430d1364d0d0a60facd9b73e674faddf63a8f77649cd10ba855df7e49189980b","ba05d05d51d4f7bfceb3821a3754e7432248f5c3d5a450391a0631d56bbce4c2","b3ee068bf282575ac7eb715dd779254889e0b8a55aba2b7a1700fc8aa4dcb1da")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("6030c4381b8b5d5c5734341292316723a89f1bdbd2d10bb67c4d06b1242afd05","858efe4f9037e5efebadaaa70aa8ad096f7244c4c4aeade72c51ddad23d05bfe","9c21adbcb2888daf14ef55c4fa1f41eaa6cbfbe20d85c3e1da61a96a53ba18f9","6d7374b4f977f689389c7155192b5db70ee44a7645625ecf8163c00da8828388","b2cba01ae6707ce694073018d948f82340b9c41fb2b2bc49769f9a0be37071e1","293b455b5b7e1c2063a8781f3c169cf8ef2b1d06e6b7a086b7b44f37f55729bd","af260c172baffd0e8b2671fd0c84e607ac9b2c8beb57df43cf5df6e103cbb7ad","430d1364d0d0a60facd9b73e674faddf63a8f77649cd10ba855df7e49189980b","ba05d05d51d4f7bfceb3821a3754e7432248f5c3d5a450391a0631d56bbce4c2","b3ee068bf282575ac7eb715dd779254889e0b8a55aba2b7a1700fc8aa4dcb1da")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring64 NOT NULL AND customstring64 IN ("6030c4381b8b5d5c5734341292316723a89f1bdbd2d10bb67c4d06b1242afd05","858efe4f9037e5efebadaaa70aa8ad096f7244c4c4aeade72c51ddad23d05bfe","9c21adbcb2888daf14ef55c4fa1f41eaa6cbfbe20d85c3e1da61a96a53ba18f9","6d7374b4f977f689389c7155192b5db70ee44a7645625ecf8163c00da8828388","b2cba01ae6707ce694073018d948f82340b9c41fb2b2bc49769f9a0be37071e1","293b455b5b7e1c2063a8781f3c169cf8ef2b1d06e6b7a086b7b44f37f55729bd","af260c172baffd0e8b2671fd0c84e607ac9b2c8beb57df43cf5df6e103cbb7ad","430d1364d0d0a60facd9b73e674faddf63a8f77649cd10ba855df7e49189980b","ba05d05d51d4f7bfceb3821a3754e7432248f5c3d5a450391a0631d56bbce4c2","b3ee068bf282575ac7eb715dd779254889e0b8a55aba2b7a1700fc8aa4dcb1da")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("6030c4381b8b5d5c5734341292316723a89f1bdbd2d10bb67c4d06b1242afd05","858efe4f9037e5efebadaaa70aa8ad096f7244c4c4aeade72c51ddad23d05bfe","9c21adbcb2888daf14ef55c4fa1f41eaa6cbfbe20d85c3e1da61a96a53ba18f9","6d7374b4f977f689389c7155192b5db70ee44a7645625ecf8163c00da8828388","b2cba01ae6707ce694073018d948f82340b9c41fb2b2bc49769f9a0be37071e1","293b455b5b7e1c2063a8781f3c169cf8ef2b1d06e6b7a086b7b44f37f55729bd","af260c172baffd0e8b2671fd0c84e607ac9b2c8beb57df43cf5df6e103cbb7ad","430d1364d0d0a60facd9b73e674faddf63a8f77649cd10ba855df7e49189980b","ba05d05d51d4f7bfceb3821a3754e7432248f5c3d5a450391a0631d56bbce4c2","b3ee068bf282575ac7eb715dd779254889e0b8a55aba2b7a1700fc8aa4dcb1da")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("6030c4381b8b5d5c5734341292316723a89f1bdbd2d10bb67c4d06b1242afd05","858efe4f9037e5efebadaaa70aa8ad096f7244c4c4aeade72c51ddad23d05bfe","9c21adbcb2888daf14ef55c4fa1f41eaa6cbfbe20d85c3e1da61a96a53ba18f9","6d7374b4f977f689389c7155192b5db70ee44a7645625ecf8163c00da8828388","b2cba01ae6707ce694073018d948f82340b9c41fb2b2bc49769f9a0be37071e1","293b455b5b7e1c2063a8781f3c169cf8ef2b1d06e6b7a086b7b44f37f55729bd","af260c172baffd0e8b2671fd0c84e607ac9b2c8beb57df43cf5df6e103cbb7ad","430d1364d0d0a60facd9b73e674faddf63a8f77649cd10ba855df7e49189980b","ba05d05d51d4f7bfceb3821a3754e7432248f5c3d5a450391a0631d56bbce4c2","b3ee068bf282575ac7eb715dd779254889e0b8a55aba2b7a1700fc8aa4dcb1da")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("6030c4381b8b5d5c5734341292316723a89f1bdbd2d10bb67c4d06b1242afd05","858efe4f9037e5efebadaaa70aa8ad096f7244c4c4aeade72c51ddad23d05bfe","9c21adbcb2888daf14ef55c4fa1f41eaa6cbfbe20d85c3e1da61a96a53ba18f9","6d7374b4f977f689389c7155192b5db70ee44a7645625ecf8163c00da8828388","b2cba01ae6707ce694073018d948f82340b9c41fb2b2bc49769f9a0be37071e1","293b455b5b7e1c2063a8781f3c169cf8ef2b1d06e6b7a086b7b44f37f55729bd","af260c172baffd0e8b2671fd0c84e607ac9b2c8beb57df43cf5df6e103cbb7ad","430d1364d0d0a60facd9b73e674faddf63a8f77649cd10ba855df7e49189980b","ba05d05d51d4f7bfceb3821a3754e7432248f5c3d5a450391a0631d56bbce4c2","b3ee068bf282575ac7eb715dd779254889e0b8a55aba2b7a1700fc8aa4dcb1da")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring64 NOT NULL AND customstring64 IN ("6030c4381b8b5d5c5734341292316723a89f1bdbd2d10bb67c4d06b1242afd05","858efe4f9037e5efebadaaa70aa8ad096f7244c4c4aeade72c51ddad23d05bfe","9c21adbcb2888daf14ef55c4fa1f41eaa6cbfbe20d85c3e1da61a96a53ba18f9","6d7374b4f977f689389c7155192b5db70ee44a7645625ecf8163c00da8828388","b2cba01ae6707ce694073018d948f82340b9c41fb2b2bc49769f9a0be37071e1","293b455b5b7e1c2063a8781f3c169cf8ef2b1d06e6b7a086b7b44f37f55729bd","af260c172baffd0e8b2671fd0c84e607ac9b2c8beb57df43cf5df6e103cbb7ad","430d1364d0d0a60facd9b73e674faddf63a8f77649cd10ba855df7e49189980b","ba05d05d51d4f7bfceb3821a3754e7432248f5c3d5a450391a0631d56bbce4c2","b3ee068bf282575ac7eb715dd779254889e0b8a55aba2b7a1700fc8aa4dcb1da")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("6030c4381b8b5d5c5734341292316723a89f1bdbd2d10bb67c4d06b1242afd05","858efe4f9037e5efebadaaa70aa8ad096f7244c4c4aeade72c51ddad23d05bfe","9c21adbcb2888daf14ef55c4fa1f41eaa6cbfbe20d85c3e1da61a96a53ba18f9","6d7374b4f977f689389c7155192b5db70ee44a7645625ecf8163c00da8828388","b2cba01ae6707ce694073018d948f82340b9c41fb2b2bc49769f9a0be37071e1","293b455b5b7e1c2063a8781f3c169cf8ef2b1d06e6b7a086b7b44f37f55729bd","af260c172baffd0e8b2671fd0c84e607ac9b2c8beb57df43cf5df6e103cbb7ad","430d1364d0d0a60facd9b73e674faddf63a8f77649cd10ba855df7e49189980b","ba05d05d51d4f7bfceb3821a3754e7432248f5c3d5a450391a0631d56bbce4c2","b3ee068bf282575ac7eb715dd779254889e0b8a55aba2b7a1700fc8aa4dcb1da")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("6030c4381b8b5d5c5734341292316723a89f1bdbd2d10bb67c4d06b1242afd05","858efe4f9037e5efebadaaa70aa8ad096f7244c4c4aeade72c51ddad23d05bfe","9c21adbcb2888daf14ef55c4fa1f41eaa6cbfbe20d85c3e1da61a96a53ba18f9","6d7374b4f977f689389c7155192b5db70ee44a7645625ecf8163c00da8828388","b2cba01ae6707ce694073018d948f82340b9c41fb2b2bc49769f9a0be37071e1","293b455b5b7e1c2063a8781f3c169cf8ef2b1d06e6b7a086b7b44f37f55729bd","af260c172baffd0e8b2671fd0c84e607ac9b2c8beb57df43cf5df6e103cbb7ad","430d1364d0d0a60facd9b73e674faddf63a8f77649cd10ba855df7e49189980b","ba05d05d51d4f7bfceb3821a3754e7432248f5c3d5a450391a0631d56bbce4c2","b3ee068bf282575ac7eb715dd779254889e0b8a55aba2b7a1700fc8aa4dcb1da")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("6030c4381b8b5d5c5734341292316723a89f1bdbd2d10bb67c4d06b1242afd05","858efe4f9037e5efebadaaa70aa8ad096f7244c4c4aeade72c51ddad23d05bfe","9c21adbcb2888daf14ef55c4fa1f41eaa6cbfbe20d85c3e1da61a96a53ba18f9","6d7374b4f977f689389c7155192b5db70ee44a7645625ecf8163c00da8828388","b2cba01ae6707ce694073018d948f82340b9c41fb2b2bc49769f9a0be37071e1","293b455b5b7e1c2063a8781f3c169cf8ef2b1d06e6b7a086b7b44f37f55729bd","af260c172baffd0e8b2671fd0c84e607ac9b2c8beb57df43cf5df6e103cbb7ad","430d1364d0d0a60facd9b73e674faddf63a8f77649cd10ba855df7e49189980b","ba05d05d51d4f7bfceb3821a3754e7432248f5c3d5a450391a0631d56bbce4c2","b3ee068bf282575ac7eb715dd779254889e0b8a55aba2b7a1700fc8aa4dcb1da")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring64 NOT NULL AND customstring64 IN ("6030c4381b8b5d5c5734341292316723a89f1bdbd2d10bb67c4d06b1242afd05","858efe4f9037e5efebadaaa70aa8ad096f7244c4c4aeade72c51ddad23d05bfe","9c21adbcb2888daf14ef55c4fa1f41eaa6cbfbe20d85c3e1da61a96a53ba18f9","6d7374b4f977f689389c7155192b5db70ee44a7645625ecf8163c00da8828388","b2cba01ae6707ce694073018d948f82340b9c41fb2b2bc49769f9a0be37071e1","293b455b5b7e1c2063a8781f3c169cf8ef2b1d06e6b7a086b7b44f37f55729bd","af260c172baffd0e8b2671fd0c84e607ac9b2c8beb57df43cf5df6e103cbb7ad","430d1364d0d0a60facd9b73e674faddf63a8f77649cd10ba855df7e49189980b","ba05d05d51d4f7bfceb3821a3754e7432248f5c3d5a450391a0631d56bbce4c2","b3ee068bf282575ac7eb715dd779254889e0b8a55aba2b7a1700fc8aa4dcb1da")
index=activity AND rg_functionality="O365 General" AND filehash NOT NULL AND filehash IN ("6030c4381b8b5d5c5734341292316723a89f1bdbd2d10bb67c4d06b1242afd05","858efe4f9037e5efebadaaa70aa8ad096f7244c4c4aeade72c51ddad23d05bfe","9c21adbcb2888daf14ef55c4fa1f41eaa6cbfbe20d85c3e1da61a96a53ba18f9","6d7374b4f977f689389c7155192b5db70ee44a7645625ecf8163c00da8828388","b2cba01ae6707ce694073018d948f82340b9c41fb2b2bc49769f9a0be37071e1","293b455b5b7e1c2063a8781f3c169cf8ef2b1d06e6b7a086b7b44f37f55729bd","af260c172baffd0e8b2671fd0c84e607ac9b2c8beb57df43cf5df6e103cbb7ad","430d1364d0d0a60facd9b73e674faddf63a8f77649cd10ba855df7e49189980b","ba05d05d51d4f7bfceb3821a3754e7432248f5c3d5a450391a0631d56bbce4c2","b3ee068bf282575ac7eb715dd779254889e0b8a55aba2b7a1700fc8aa4dcb1da")
index=activity AND rg_functionality="O365 General" AND oldfilehash NOT NULL AND oldfilehash IN ("6030c4381b8b5d5c5734341292316723a89f1bdbd2d10bb67c4d06b1242afd05","858efe4f9037e5efebadaaa70aa8ad096f7244c4c4aeade72c51ddad23d05bfe","9c21adbcb2888daf14ef55c4fa1f41eaa6cbfbe20d85c3e1da61a96a53ba18f9","6d7374b4f977f689389c7155192b5db70ee44a7645625ecf8163c00da8828388","b2cba01ae6707ce694073018d948f82340b9c41fb2b2bc49769f9a0be37071e1","293b455b5b7e1c2063a8781f3c169cf8ef2b1d06e6b7a086b7b44f37f55729bd","af260c172baffd0e8b2671fd0c84e607ac9b2c8beb57df43cf5df6e103cbb7ad","430d1364d0d0a60facd9b73e674faddf63a8f77649cd10ba855df7e49189980b","ba05d05d51d4f7bfceb3821a3754e7432248f5c3d5a450391a0631d56bbce4c2","b3ee068bf282575ac7eb715dd779254889e0b8a55aba2b7a1700fc8aa4dcb1da")
index=activity AND rg_functionality="O365 General" AND customstring3 NOT NULL AND customstring3 IN ("6030c4381b8b5d5c5734341292316723a89f1bdbd2d10bb67c4d06b1242afd05","858efe4f9037e5efebadaaa70aa8ad096f7244c4c4aeade72c51ddad23d05bfe","9c21adbcb2888daf14ef55c4fa1f41eaa6cbfbe20d85c3e1da61a96a53ba18f9","6d7374b4f977f689389c7155192b5db70ee44a7645625ecf8163c00da8828388","b2cba01ae6707ce694073018d948f82340b9c41fb2b2bc49769f9a0be37071e1","293b455b5b7e1c2063a8781f3c169cf8ef2b1d06e6b7a086b7b44f37f55729bd","af260c172baffd0e8b2671fd0c84e607ac9b2c8beb57df43cf5df6e103cbb7ad","430d1364d0d0a60facd9b73e674faddf63a8f77649cd10ba855df7e49189980b","ba05d05d51d4f7bfceb3821a3754e7432248f5c3d5a450391a0631d56bbce4c2","b3ee068bf282575ac7eb715dd779254889e0b8a55aba2b7a1700fc8aa4dcb1da")
index=activity AND rg_functionality="O365 General" AND customstring64 NOT NULL AND customstring64 IN ("6030c4381b8b5d5c5734341292316723a89f1bdbd2d10bb67c4d06b1242afd05","858efe4f9037e5efebadaaa70aa8ad096f7244c4c4aeade72c51ddad23d05bfe","9c21adbcb2888daf14ef55c4fa1f41eaa6cbfbe20d85c3e1da61a96a53ba18f9","6d7374b4f977f689389c7155192b5db70ee44a7645625ecf8163c00da8828388","b2cba01ae6707ce694073018d948f82340b9c41fb2b2bc49769f9a0be37071e1","293b455b5b7e1c2063a8781f3c169cf8ef2b1d06e6b7a086b7b44f37f55729bd","af260c172baffd0e8b2671fd0c84e607ac9b2c8beb57df43cf5df6e103cbb7ad","430d1364d0d0a60facd9b73e674faddf63a8f77649cd10ba855df7e49189980b","ba05d05d51d4f7bfceb3821a3754e7432248f5c3d5a450391a0631d56bbce4c2","b3ee068bf282575ac7eb715dd779254889e0b8a55aba2b7a1700fc8aa4dcb1da")
