index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("4aae231fb5357c0647483181aeae47956ac66e42b6b134f5b90da76d8ec0ac63","b73a7e25d224778172e394426c98b86215087d815296c71a3f76f738c720c1b0","a31e075bd5a2652917f91714fea4d272816c028d7734b36c84899cd583181b3d","3b3bd81232f517ba6d65c7838c205b301b0f27572fcfef9e5b86dd30a1d55a0d","2408be22f6184cdccec7a34e2e79711ff4957e42f1ed7b7ad63f914d37dba625","b0903921e666ca3ffd45100a38c11d7e5c53ab38646715eafc6d1851ad41b92e")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("4aae231fb5357c0647483181aeae47956ac66e42b6b134f5b90da76d8ec0ac63","b73a7e25d224778172e394426c98b86215087d815296c71a3f76f738c720c1b0","a31e075bd5a2652917f91714fea4d272816c028d7734b36c84899cd583181b3d","3b3bd81232f517ba6d65c7838c205b301b0f27572fcfef9e5b86dd30a1d55a0d","2408be22f6184cdccec7a34e2e79711ff4957e42f1ed7b7ad63f914d37dba625","b0903921e666ca3ffd45100a38c11d7e5c53ab38646715eafc6d1851ad41b92e")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("4aae231fb5357c0647483181aeae47956ac66e42b6b134f5b90da76d8ec0ac63","b73a7e25d224778172e394426c98b86215087d815296c71a3f76f738c720c1b0","a31e075bd5a2652917f91714fea4d272816c028d7734b36c84899cd583181b3d","3b3bd81232f517ba6d65c7838c205b301b0f27572fcfef9e5b86dd30a1d55a0d","2408be22f6184cdccec7a34e2e79711ff4957e42f1ed7b7ad63f914d37dba625","b0903921e666ca3ffd45100a38c11d7e5c53ab38646715eafc6d1851ad41b92e")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring64 NOT NULL AND customstring64 IN ("4aae231fb5357c0647483181aeae47956ac66e42b6b134f5b90da76d8ec0ac63","b73a7e25d224778172e394426c98b86215087d815296c71a3f76f738c720c1b0","a31e075bd5a2652917f91714fea4d272816c028d7734b36c84899cd583181b3d","3b3bd81232f517ba6d65c7838c205b301b0f27572fcfef9e5b86dd30a1d55a0d","2408be22f6184cdccec7a34e2e79711ff4957e42f1ed7b7ad63f914d37dba625","b0903921e666ca3ffd45100a38c11d7e5c53ab38646715eafc6d1851ad41b92e")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("4aae231fb5357c0647483181aeae47956ac66e42b6b134f5b90da76d8ec0ac63","b73a7e25d224778172e394426c98b86215087d815296c71a3f76f738c720c1b0","a31e075bd5a2652917f91714fea4d272816c028d7734b36c84899cd583181b3d","3b3bd81232f517ba6d65c7838c205b301b0f27572fcfef9e5b86dd30a1d55a0d","2408be22f6184cdccec7a34e2e79711ff4957e42f1ed7b7ad63f914d37dba625","b0903921e666ca3ffd45100a38c11d7e5c53ab38646715eafc6d1851ad41b92e")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("4aae231fb5357c0647483181aeae47956ac66e42b6b134f5b90da76d8ec0ac63","b73a7e25d224778172e394426c98b86215087d815296c71a3f76f738c720c1b0","a31e075bd5a2652917f91714fea4d272816c028d7734b36c84899cd583181b3d","3b3bd81232f517ba6d65c7838c205b301b0f27572fcfef9e5b86dd30a1d55a0d","2408be22f6184cdccec7a34e2e79711ff4957e42f1ed7b7ad63f914d37dba625","b0903921e666ca3ffd45100a38c11d7e5c53ab38646715eafc6d1851ad41b92e")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("4aae231fb5357c0647483181aeae47956ac66e42b6b134f5b90da76d8ec0ac63","b73a7e25d224778172e394426c98b86215087d815296c71a3f76f738c720c1b0","a31e075bd5a2652917f91714fea4d272816c028d7734b36c84899cd583181b3d","3b3bd81232f517ba6d65c7838c205b301b0f27572fcfef9e5b86dd30a1d55a0d","2408be22f6184cdccec7a34e2e79711ff4957e42f1ed7b7ad63f914d37dba625","b0903921e666ca3ffd45100a38c11d7e5c53ab38646715eafc6d1851ad41b92e")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("4aae231fb5357c0647483181aeae47956ac66e42b6b134f5b90da76d8ec0ac63","b73a7e25d224778172e394426c98b86215087d815296c71a3f76f738c720c1b0","a31e075bd5a2652917f91714fea4d272816c028d7734b36c84899cd583181b3d","3b3bd81232f517ba6d65c7838c205b301b0f27572fcfef9e5b86dd30a1d55a0d","2408be22f6184cdccec7a34e2e79711ff4957e42f1ed7b7ad63f914d37dba625","b0903921e666ca3ffd45100a38c11d7e5c53ab38646715eafc6d1851ad41b92e")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("4aae231fb5357c0647483181aeae47956ac66e42b6b134f5b90da76d8ec0ac63","b73a7e25d224778172e394426c98b86215087d815296c71a3f76f738c720c1b0","a31e075bd5a2652917f91714fea4d272816c028d7734b36c84899cd583181b3d","3b3bd81232f517ba6d65c7838c205b301b0f27572fcfef9e5b86dd30a1d55a0d","2408be22f6184cdccec7a34e2e79711ff4957e42f1ed7b7ad63f914d37dba625","b0903921e666ca3ffd45100a38c11d7e5c53ab38646715eafc6d1851ad41b92e")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("4aae231fb5357c0647483181aeae47956ac66e42b6b134f5b90da76d8ec0ac63","b73a7e25d224778172e394426c98b86215087d815296c71a3f76f738c720c1b0","a31e075bd5a2652917f91714fea4d272816c028d7734b36c84899cd583181b3d","3b3bd81232f517ba6d65c7838c205b301b0f27572fcfef9e5b86dd30a1d55a0d","2408be22f6184cdccec7a34e2e79711ff4957e42f1ed7b7ad63f914d37dba625","b0903921e666ca3ffd45100a38c11d7e5c53ab38646715eafc6d1851ad41b92e")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("4aae231fb5357c0647483181aeae47956ac66e42b6b134f5b90da76d8ec0ac63","b73a7e25d224778172e394426c98b86215087d815296c71a3f76f738c720c1b0","a31e075bd5a2652917f91714fea4d272816c028d7734b36c84899cd583181b3d","3b3bd81232f517ba6d65c7838c205b301b0f27572fcfef9e5b86dd30a1d55a0d","2408be22f6184cdccec7a34e2e79711ff4957e42f1ed7b7ad63f914d37dba625","b0903921e666ca3ffd45100a38c11d7e5c53ab38646715eafc6d1851ad41b92e")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("4aae231fb5357c0647483181aeae47956ac66e42b6b134f5b90da76d8ec0ac63","b73a7e25d224778172e394426c98b86215087d815296c71a3f76f738c720c1b0","a31e075bd5a2652917f91714fea4d272816c028d7734b36c84899cd583181b3d","3b3bd81232f517ba6d65c7838c205b301b0f27572fcfef9e5b86dd30a1d55a0d","2408be22f6184cdccec7a34e2e79711ff4957e42f1ed7b7ad63f914d37dba625","b0903921e666ca3ffd45100a38c11d7e5c53ab38646715eafc6d1851ad41b92e")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("4aae231fb5357c0647483181aeae47956ac66e42b6b134f5b90da76d8ec0ac63","b73a7e25d224778172e394426c98b86215087d815296c71a3f76f738c720c1b0","a31e075bd5a2652917f91714fea4d272816c028d7734b36c84899cd583181b3d","3b3bd81232f517ba6d65c7838c205b301b0f27572fcfef9e5b86dd30a1d55a0d","2408be22f6184cdccec7a34e2e79711ff4957e42f1ed7b7ad63f914d37dba625","b0903921e666ca3ffd45100a38c11d7e5c53ab38646715eafc6d1851ad41b92e")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("4aae231fb5357c0647483181aeae47956ac66e42b6b134f5b90da76d8ec0ac63","b73a7e25d224778172e394426c98b86215087d815296c71a3f76f738c720c1b0","a31e075bd5a2652917f91714fea4d272816c028d7734b36c84899cd583181b3d","3b3bd81232f517ba6d65c7838c205b301b0f27572fcfef9e5b86dd30a1d55a0d","2408be22f6184cdccec7a34e2e79711ff4957e42f1ed7b7ad63f914d37dba625","b0903921e666ca3ffd45100a38c11d7e5c53ab38646715eafc6d1851ad41b92e")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("4aae231fb5357c0647483181aeae47956ac66e42b6b134f5b90da76d8ec0ac63","b73a7e25d224778172e394426c98b86215087d815296c71a3f76f738c720c1b0","a31e075bd5a2652917f91714fea4d272816c028d7734b36c84899cd583181b3d","3b3bd81232f517ba6d65c7838c205b301b0f27572fcfef9e5b86dd30a1d55a0d","2408be22f6184cdccec7a34e2e79711ff4957e42f1ed7b7ad63f914d37dba625","b0903921e666ca3ffd45100a38c11d7e5c53ab38646715eafc6d1851ad41b92e")
index=activity AND rg_functionality="Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("4aae231fb5357c0647483181aeae47956ac66e42b6b134f5b90da76d8ec0ac63","b73a7e25d224778172e394426c98b86215087d815296c71a3f76f738c720c1b0","a31e075bd5a2652917f91714fea4d272816c028d7734b36c84899cd583181b3d","3b3bd81232f517ba6d65c7838c205b301b0f27572fcfef9e5b86dd30a1d55a0d","2408be22f6184cdccec7a34e2e79711ff4957e42f1ed7b7ad63f914d37dba625","b0903921e666ca3ffd45100a38c11d7e5c53ab38646715eafc6d1851ad41b92e")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("4aae231fb5357c0647483181aeae47956ac66e42b6b134f5b90da76d8ec0ac63","b73a7e25d224778172e394426c98b86215087d815296c71a3f76f738c720c1b0","a31e075bd5a2652917f91714fea4d272816c028d7734b36c84899cd583181b3d","3b3bd81232f517ba6d65c7838c205b301b0f27572fcfef9e5b86dd30a1d55a0d","2408be22f6184cdccec7a34e2e79711ff4957e42f1ed7b7ad63f914d37dba625","b0903921e666ca3ffd45100a38c11d7e5c53ab38646715eafc6d1851ad41b92e")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("4aae231fb5357c0647483181aeae47956ac66e42b6b134f5b90da76d8ec0ac63","b73a7e25d224778172e394426c98b86215087d815296c71a3f76f738c720c1b0","a31e075bd5a2652917f91714fea4d272816c028d7734b36c84899cd583181b3d","3b3bd81232f517ba6d65c7838c205b301b0f27572fcfef9e5b86dd30a1d55a0d","2408be22f6184cdccec7a34e2e79711ff4957e42f1ed7b7ad63f914d37dba625","b0903921e666ca3ffd45100a38c11d7e5c53ab38646715eafc6d1851ad41b92e")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("4aae231fb5357c0647483181aeae47956ac66e42b6b134f5b90da76d8ec0ac63","b73a7e25d224778172e394426c98b86215087d815296c71a3f76f738c720c1b0","a31e075bd5a2652917f91714fea4d272816c028d7734b36c84899cd583181b3d","3b3bd81232f517ba6d65c7838c205b301b0f27572fcfef9e5b86dd30a1d55a0d","2408be22f6184cdccec7a34e2e79711ff4957e42f1ed7b7ad63f914d37dba625","b0903921e666ca3ffd45100a38c11d7e5c53ab38646715eafc6d1851ad41b92e")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("4aae231fb5357c0647483181aeae47956ac66e42b6b134f5b90da76d8ec0ac63","b73a7e25d224778172e394426c98b86215087d815296c71a3f76f738c720c1b0","a31e075bd5a2652917f91714fea4d272816c028d7734b36c84899cd583181b3d","3b3bd81232f517ba6d65c7838c205b301b0f27572fcfef9e5b86dd30a1d55a0d","2408be22f6184cdccec7a34e2e79711ff4957e42f1ed7b7ad63f914d37dba625","b0903921e666ca3ffd45100a38c11d7e5c53ab38646715eafc6d1851ad41b92e")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("4aae231fb5357c0647483181aeae47956ac66e42b6b134f5b90da76d8ec0ac63","b73a7e25d224778172e394426c98b86215087d815296c71a3f76f738c720c1b0","a31e075bd5a2652917f91714fea4d272816c028d7734b36c84899cd583181b3d","3b3bd81232f517ba6d65c7838c205b301b0f27572fcfef9e5b86dd30a1d55a0d","2408be22f6184cdccec7a34e2e79711ff4957e42f1ed7b7ad63f914d37dba625","b0903921e666ca3ffd45100a38c11d7e5c53ab38646715eafc6d1851ad41b92e")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("4aae231fb5357c0647483181aeae47956ac66e42b6b134f5b90da76d8ec0ac63","b73a7e25d224778172e394426c98b86215087d815296c71a3f76f738c720c1b0","a31e075bd5a2652917f91714fea4d272816c028d7734b36c84899cd583181b3d","3b3bd81232f517ba6d65c7838c205b301b0f27572fcfef9e5b86dd30a1d55a0d","2408be22f6184cdccec7a34e2e79711ff4957e42f1ed7b7ad63f914d37dba625","b0903921e666ca3ffd45100a38c11d7e5c53ab38646715eafc6d1851ad41b92e")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("4aae231fb5357c0647483181aeae47956ac66e42b6b134f5b90da76d8ec0ac63","b73a7e25d224778172e394426c98b86215087d815296c71a3f76f738c720c1b0","a31e075bd5a2652917f91714fea4d272816c028d7734b36c84899cd583181b3d","3b3bd81232f517ba6d65c7838c205b301b0f27572fcfef9e5b86dd30a1d55a0d","2408be22f6184cdccec7a34e2e79711ff4957e42f1ed7b7ad63f914d37dba625","b0903921e666ca3ffd45100a38c11d7e5c53ab38646715eafc6d1851ad41b92e")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring64 NOT NULL AND customstring64 IN ("4aae231fb5357c0647483181aeae47956ac66e42b6b134f5b90da76d8ec0ac63","b73a7e25d224778172e394426c98b86215087d815296c71a3f76f738c720c1b0","a31e075bd5a2652917f91714fea4d272816c028d7734b36c84899cd583181b3d","3b3bd81232f517ba6d65c7838c205b301b0f27572fcfef9e5b86dd30a1d55a0d","2408be22f6184cdccec7a34e2e79711ff4957e42f1ed7b7ad63f914d37dba625","b0903921e666ca3ffd45100a38c11d7e5c53ab38646715eafc6d1851ad41b92e")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("4aae231fb5357c0647483181aeae47956ac66e42b6b134f5b90da76d8ec0ac63","b73a7e25d224778172e394426c98b86215087d815296c71a3f76f738c720c1b0","a31e075bd5a2652917f91714fea4d272816c028d7734b36c84899cd583181b3d","3b3bd81232f517ba6d65c7838c205b301b0f27572fcfef9e5b86dd30a1d55a0d","2408be22f6184cdccec7a34e2e79711ff4957e42f1ed7b7ad63f914d37dba625","b0903921e666ca3ffd45100a38c11d7e5c53ab38646715eafc6d1851ad41b92e")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("4aae231fb5357c0647483181aeae47956ac66e42b6b134f5b90da76d8ec0ac63","b73a7e25d224778172e394426c98b86215087d815296c71a3f76f738c720c1b0","a31e075bd5a2652917f91714fea4d272816c028d7734b36c84899cd583181b3d","3b3bd81232f517ba6d65c7838c205b301b0f27572fcfef9e5b86dd30a1d55a0d","2408be22f6184cdccec7a34e2e79711ff4957e42f1ed7b7ad63f914d37dba625","b0903921e666ca3ffd45100a38c11d7e5c53ab38646715eafc6d1851ad41b92e")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("4aae231fb5357c0647483181aeae47956ac66e42b6b134f5b90da76d8ec0ac63","b73a7e25d224778172e394426c98b86215087d815296c71a3f76f738c720c1b0","a31e075bd5a2652917f91714fea4d272816c028d7734b36c84899cd583181b3d","3b3bd81232f517ba6d65c7838c205b301b0f27572fcfef9e5b86dd30a1d55a0d","2408be22f6184cdccec7a34e2e79711ff4957e42f1ed7b7ad63f914d37dba625","b0903921e666ca3ffd45100a38c11d7e5c53ab38646715eafc6d1851ad41b92e")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring64 NOT NULL AND customstring64 IN ("4aae231fb5357c0647483181aeae47956ac66e42b6b134f5b90da76d8ec0ac63","b73a7e25d224778172e394426c98b86215087d815296c71a3f76f738c720c1b0","a31e075bd5a2652917f91714fea4d272816c028d7734b36c84899cd583181b3d","3b3bd81232f517ba6d65c7838c205b301b0f27572fcfef9e5b86dd30a1d55a0d","2408be22f6184cdccec7a34e2e79711ff4957e42f1ed7b7ad63f914d37dba625","b0903921e666ca3ffd45100a38c11d7e5c53ab38646715eafc6d1851ad41b92e")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("4aae231fb5357c0647483181aeae47956ac66e42b6b134f5b90da76d8ec0ac63","b73a7e25d224778172e394426c98b86215087d815296c71a3f76f738c720c1b0","a31e075bd5a2652917f91714fea4d272816c028d7734b36c84899cd583181b3d","3b3bd81232f517ba6d65c7838c205b301b0f27572fcfef9e5b86dd30a1d55a0d","2408be22f6184cdccec7a34e2e79711ff4957e42f1ed7b7ad63f914d37dba625","b0903921e666ca3ffd45100a38c11d7e5c53ab38646715eafc6d1851ad41b92e")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("4aae231fb5357c0647483181aeae47956ac66e42b6b134f5b90da76d8ec0ac63","b73a7e25d224778172e394426c98b86215087d815296c71a3f76f738c720c1b0","a31e075bd5a2652917f91714fea4d272816c028d7734b36c84899cd583181b3d","3b3bd81232f517ba6d65c7838c205b301b0f27572fcfef9e5b86dd30a1d55a0d","2408be22f6184cdccec7a34e2e79711ff4957e42f1ed7b7ad63f914d37dba625","b0903921e666ca3ffd45100a38c11d7e5c53ab38646715eafc6d1851ad41b92e")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("4aae231fb5357c0647483181aeae47956ac66e42b6b134f5b90da76d8ec0ac63","b73a7e25d224778172e394426c98b86215087d815296c71a3f76f738c720c1b0","a31e075bd5a2652917f91714fea4d272816c028d7734b36c84899cd583181b3d","3b3bd81232f517ba6d65c7838c205b301b0f27572fcfef9e5b86dd30a1d55a0d","2408be22f6184cdccec7a34e2e79711ff4957e42f1ed7b7ad63f914d37dba625","b0903921e666ca3ffd45100a38c11d7e5c53ab38646715eafc6d1851ad41b92e")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring64 NOT NULL AND customstring64 IN ("4aae231fb5357c0647483181aeae47956ac66e42b6b134f5b90da76d8ec0ac63","b73a7e25d224778172e394426c98b86215087d815296c71a3f76f738c720c1b0","a31e075bd5a2652917f91714fea4d272816c028d7734b36c84899cd583181b3d","3b3bd81232f517ba6d65c7838c205b301b0f27572fcfef9e5b86dd30a1d55a0d","2408be22f6184cdccec7a34e2e79711ff4957e42f1ed7b7ad63f914d37dba625","b0903921e666ca3ffd45100a38c11d7e5c53ab38646715eafc6d1851ad41b92e")
