index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("d5fb0799ac7aa3bf1a888de502b1c7d3f1e060a8","4d3245814983811719fe402530d331abbf4d1698","d80e431a2f7c88772ed985011820b0f517136264","0a94bc7146db582d7e0a9949f67f9227b081df15","88bf3680b48dbe841df2205f63ad5a16fff1f84f","89f3fdb44f9f049a9bde0fd0cb41ede719ee907f","d08830be94236f72929a1cf986f1515689e9d3e4","af51273444b5aa1b8737dff445e487efe87017c5","cfb1380b8ee93d9570982a2de675e7e67bb51eb8","edcfb10ec5d27dbe0ed4182e68d214b421ace9d9","ef839ac2a2dfb08b8650fba66e3fe12d320cab72","18a5b775e9f86549466d11d3e9bd1cd2d36caf42","73d12f822bc37e6355b74e8403456c82cee35ec6","de602888e519a04fc280df41a1e4ea77a94c4908","83176c39ae6a04dadec5068cafccb8cbe7919cf4","767a5016dff3286465a323ae1b96ab7b21b3cc1f")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("d5fb0799ac7aa3bf1a888de502b1c7d3f1e060a8","4d3245814983811719fe402530d331abbf4d1698","d80e431a2f7c88772ed985011820b0f517136264","0a94bc7146db582d7e0a9949f67f9227b081df15","88bf3680b48dbe841df2205f63ad5a16fff1f84f","89f3fdb44f9f049a9bde0fd0cb41ede719ee907f","d08830be94236f72929a1cf986f1515689e9d3e4","af51273444b5aa1b8737dff445e487efe87017c5","cfb1380b8ee93d9570982a2de675e7e67bb51eb8","edcfb10ec5d27dbe0ed4182e68d214b421ace9d9","ef839ac2a2dfb08b8650fba66e3fe12d320cab72","18a5b775e9f86549466d11d3e9bd1cd2d36caf42","73d12f822bc37e6355b74e8403456c82cee35ec6","de602888e519a04fc280df41a1e4ea77a94c4908","83176c39ae6a04dadec5068cafccb8cbe7919cf4","767a5016dff3286465a323ae1b96ab7b21b3cc1f")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("d5fb0799ac7aa3bf1a888de502b1c7d3f1e060a8","4d3245814983811719fe402530d331abbf4d1698","d80e431a2f7c88772ed985011820b0f517136264","0a94bc7146db582d7e0a9949f67f9227b081df15","88bf3680b48dbe841df2205f63ad5a16fff1f84f","89f3fdb44f9f049a9bde0fd0cb41ede719ee907f","d08830be94236f72929a1cf986f1515689e9d3e4","af51273444b5aa1b8737dff445e487efe87017c5","cfb1380b8ee93d9570982a2de675e7e67bb51eb8","edcfb10ec5d27dbe0ed4182e68d214b421ace9d9","ef839ac2a2dfb08b8650fba66e3fe12d320cab72","18a5b775e9f86549466d11d3e9bd1cd2d36caf42","73d12f822bc37e6355b74e8403456c82cee35ec6","de602888e519a04fc280df41a1e4ea77a94c4908","83176c39ae6a04dadec5068cafccb8cbe7919cf4","767a5016dff3286465a323ae1b96ab7b21b3cc1f")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring64 NOT NULL AND customstring64 IN ("d5fb0799ac7aa3bf1a888de502b1c7d3f1e060a8","4d3245814983811719fe402530d331abbf4d1698","d80e431a2f7c88772ed985011820b0f517136264","0a94bc7146db582d7e0a9949f67f9227b081df15","88bf3680b48dbe841df2205f63ad5a16fff1f84f","89f3fdb44f9f049a9bde0fd0cb41ede719ee907f","d08830be94236f72929a1cf986f1515689e9d3e4","af51273444b5aa1b8737dff445e487efe87017c5","cfb1380b8ee93d9570982a2de675e7e67bb51eb8","edcfb10ec5d27dbe0ed4182e68d214b421ace9d9","ef839ac2a2dfb08b8650fba66e3fe12d320cab72","18a5b775e9f86549466d11d3e9bd1cd2d36caf42","73d12f822bc37e6355b74e8403456c82cee35ec6","de602888e519a04fc280df41a1e4ea77a94c4908","83176c39ae6a04dadec5068cafccb8cbe7919cf4","767a5016dff3286465a323ae1b96ab7b21b3cc1f")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("d5fb0799ac7aa3bf1a888de502b1c7d3f1e060a8","4d3245814983811719fe402530d331abbf4d1698","d80e431a2f7c88772ed985011820b0f517136264","0a94bc7146db582d7e0a9949f67f9227b081df15","88bf3680b48dbe841df2205f63ad5a16fff1f84f","89f3fdb44f9f049a9bde0fd0cb41ede719ee907f","d08830be94236f72929a1cf986f1515689e9d3e4","af51273444b5aa1b8737dff445e487efe87017c5","cfb1380b8ee93d9570982a2de675e7e67bb51eb8","edcfb10ec5d27dbe0ed4182e68d214b421ace9d9","ef839ac2a2dfb08b8650fba66e3fe12d320cab72","18a5b775e9f86549466d11d3e9bd1cd2d36caf42","73d12f822bc37e6355b74e8403456c82cee35ec6","de602888e519a04fc280df41a1e4ea77a94c4908","83176c39ae6a04dadec5068cafccb8cbe7919cf4","767a5016dff3286465a323ae1b96ab7b21b3cc1f")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("d5fb0799ac7aa3bf1a888de502b1c7d3f1e060a8","4d3245814983811719fe402530d331abbf4d1698","d80e431a2f7c88772ed985011820b0f517136264","0a94bc7146db582d7e0a9949f67f9227b081df15","88bf3680b48dbe841df2205f63ad5a16fff1f84f","89f3fdb44f9f049a9bde0fd0cb41ede719ee907f","d08830be94236f72929a1cf986f1515689e9d3e4","af51273444b5aa1b8737dff445e487efe87017c5","cfb1380b8ee93d9570982a2de675e7e67bb51eb8","edcfb10ec5d27dbe0ed4182e68d214b421ace9d9","ef839ac2a2dfb08b8650fba66e3fe12d320cab72","18a5b775e9f86549466d11d3e9bd1cd2d36caf42","73d12f822bc37e6355b74e8403456c82cee35ec6","de602888e519a04fc280df41a1e4ea77a94c4908","83176c39ae6a04dadec5068cafccb8cbe7919cf4","767a5016dff3286465a323ae1b96ab7b21b3cc1f")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("d5fb0799ac7aa3bf1a888de502b1c7d3f1e060a8","4d3245814983811719fe402530d331abbf4d1698","d80e431a2f7c88772ed985011820b0f517136264","0a94bc7146db582d7e0a9949f67f9227b081df15","88bf3680b48dbe841df2205f63ad5a16fff1f84f","89f3fdb44f9f049a9bde0fd0cb41ede719ee907f","d08830be94236f72929a1cf986f1515689e9d3e4","af51273444b5aa1b8737dff445e487efe87017c5","cfb1380b8ee93d9570982a2de675e7e67bb51eb8","edcfb10ec5d27dbe0ed4182e68d214b421ace9d9","ef839ac2a2dfb08b8650fba66e3fe12d320cab72","18a5b775e9f86549466d11d3e9bd1cd2d36caf42","73d12f822bc37e6355b74e8403456c82cee35ec6","de602888e519a04fc280df41a1e4ea77a94c4908","83176c39ae6a04dadec5068cafccb8cbe7919cf4","767a5016dff3286465a323ae1b96ab7b21b3cc1f")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("d5fb0799ac7aa3bf1a888de502b1c7d3f1e060a8","4d3245814983811719fe402530d331abbf4d1698","d80e431a2f7c88772ed985011820b0f517136264","0a94bc7146db582d7e0a9949f67f9227b081df15","88bf3680b48dbe841df2205f63ad5a16fff1f84f","89f3fdb44f9f049a9bde0fd0cb41ede719ee907f","d08830be94236f72929a1cf986f1515689e9d3e4","af51273444b5aa1b8737dff445e487efe87017c5","cfb1380b8ee93d9570982a2de675e7e67bb51eb8","edcfb10ec5d27dbe0ed4182e68d214b421ace9d9","ef839ac2a2dfb08b8650fba66e3fe12d320cab72","18a5b775e9f86549466d11d3e9bd1cd2d36caf42","73d12f822bc37e6355b74e8403456c82cee35ec6","de602888e519a04fc280df41a1e4ea77a94c4908","83176c39ae6a04dadec5068cafccb8cbe7919cf4","767a5016dff3286465a323ae1b96ab7b21b3cc1f")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("d5fb0799ac7aa3bf1a888de502b1c7d3f1e060a8","4d3245814983811719fe402530d331abbf4d1698","d80e431a2f7c88772ed985011820b0f517136264","0a94bc7146db582d7e0a9949f67f9227b081df15","88bf3680b48dbe841df2205f63ad5a16fff1f84f","89f3fdb44f9f049a9bde0fd0cb41ede719ee907f","d08830be94236f72929a1cf986f1515689e9d3e4","af51273444b5aa1b8737dff445e487efe87017c5","cfb1380b8ee93d9570982a2de675e7e67bb51eb8","edcfb10ec5d27dbe0ed4182e68d214b421ace9d9","ef839ac2a2dfb08b8650fba66e3fe12d320cab72","18a5b775e9f86549466d11d3e9bd1cd2d36caf42","73d12f822bc37e6355b74e8403456c82cee35ec6","de602888e519a04fc280df41a1e4ea77a94c4908","83176c39ae6a04dadec5068cafccb8cbe7919cf4","767a5016dff3286465a323ae1b96ab7b21b3cc1f")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("d5fb0799ac7aa3bf1a888de502b1c7d3f1e060a8","4d3245814983811719fe402530d331abbf4d1698","d80e431a2f7c88772ed985011820b0f517136264","0a94bc7146db582d7e0a9949f67f9227b081df15","88bf3680b48dbe841df2205f63ad5a16fff1f84f","89f3fdb44f9f049a9bde0fd0cb41ede719ee907f","d08830be94236f72929a1cf986f1515689e9d3e4","af51273444b5aa1b8737dff445e487efe87017c5","cfb1380b8ee93d9570982a2de675e7e67bb51eb8","edcfb10ec5d27dbe0ed4182e68d214b421ace9d9","ef839ac2a2dfb08b8650fba66e3fe12d320cab72","18a5b775e9f86549466d11d3e9bd1cd2d36caf42","73d12f822bc37e6355b74e8403456c82cee35ec6","de602888e519a04fc280df41a1e4ea77a94c4908","83176c39ae6a04dadec5068cafccb8cbe7919cf4","767a5016dff3286465a323ae1b96ab7b21b3cc1f")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("d5fb0799ac7aa3bf1a888de502b1c7d3f1e060a8","4d3245814983811719fe402530d331abbf4d1698","d80e431a2f7c88772ed985011820b0f517136264","0a94bc7146db582d7e0a9949f67f9227b081df15","88bf3680b48dbe841df2205f63ad5a16fff1f84f","89f3fdb44f9f049a9bde0fd0cb41ede719ee907f","d08830be94236f72929a1cf986f1515689e9d3e4","af51273444b5aa1b8737dff445e487efe87017c5","cfb1380b8ee93d9570982a2de675e7e67bb51eb8","edcfb10ec5d27dbe0ed4182e68d214b421ace9d9","ef839ac2a2dfb08b8650fba66e3fe12d320cab72","18a5b775e9f86549466d11d3e9bd1cd2d36caf42","73d12f822bc37e6355b74e8403456c82cee35ec6","de602888e519a04fc280df41a1e4ea77a94c4908","83176c39ae6a04dadec5068cafccb8cbe7919cf4","767a5016dff3286465a323ae1b96ab7b21b3cc1f")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("d5fb0799ac7aa3bf1a888de502b1c7d3f1e060a8","4d3245814983811719fe402530d331abbf4d1698","d80e431a2f7c88772ed985011820b0f517136264","0a94bc7146db582d7e0a9949f67f9227b081df15","88bf3680b48dbe841df2205f63ad5a16fff1f84f","89f3fdb44f9f049a9bde0fd0cb41ede719ee907f","d08830be94236f72929a1cf986f1515689e9d3e4","af51273444b5aa1b8737dff445e487efe87017c5","cfb1380b8ee93d9570982a2de675e7e67bb51eb8","edcfb10ec5d27dbe0ed4182e68d214b421ace9d9","ef839ac2a2dfb08b8650fba66e3fe12d320cab72","18a5b775e9f86549466d11d3e9bd1cd2d36caf42","73d12f822bc37e6355b74e8403456c82cee35ec6","de602888e519a04fc280df41a1e4ea77a94c4908","83176c39ae6a04dadec5068cafccb8cbe7919cf4","767a5016dff3286465a323ae1b96ab7b21b3cc1f")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("d5fb0799ac7aa3bf1a888de502b1c7d3f1e060a8","4d3245814983811719fe402530d331abbf4d1698","d80e431a2f7c88772ed985011820b0f517136264","0a94bc7146db582d7e0a9949f67f9227b081df15","88bf3680b48dbe841df2205f63ad5a16fff1f84f","89f3fdb44f9f049a9bde0fd0cb41ede719ee907f","d08830be94236f72929a1cf986f1515689e9d3e4","af51273444b5aa1b8737dff445e487efe87017c5","cfb1380b8ee93d9570982a2de675e7e67bb51eb8","edcfb10ec5d27dbe0ed4182e68d214b421ace9d9","ef839ac2a2dfb08b8650fba66e3fe12d320cab72","18a5b775e9f86549466d11d3e9bd1cd2d36caf42","73d12f822bc37e6355b74e8403456c82cee35ec6","de602888e519a04fc280df41a1e4ea77a94c4908","83176c39ae6a04dadec5068cafccb8cbe7919cf4","767a5016dff3286465a323ae1b96ab7b21b3cc1f")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("d5fb0799ac7aa3bf1a888de502b1c7d3f1e060a8","4d3245814983811719fe402530d331abbf4d1698","d80e431a2f7c88772ed985011820b0f517136264","0a94bc7146db582d7e0a9949f67f9227b081df15","88bf3680b48dbe841df2205f63ad5a16fff1f84f","89f3fdb44f9f049a9bde0fd0cb41ede719ee907f","d08830be94236f72929a1cf986f1515689e9d3e4","af51273444b5aa1b8737dff445e487efe87017c5","cfb1380b8ee93d9570982a2de675e7e67bb51eb8","edcfb10ec5d27dbe0ed4182e68d214b421ace9d9","ef839ac2a2dfb08b8650fba66e3fe12d320cab72","18a5b775e9f86549466d11d3e9bd1cd2d36caf42","73d12f822bc37e6355b74e8403456c82cee35ec6","de602888e519a04fc280df41a1e4ea77a94c4908","83176c39ae6a04dadec5068cafccb8cbe7919cf4","767a5016dff3286465a323ae1b96ab7b21b3cc1f")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("d5fb0799ac7aa3bf1a888de502b1c7d3f1e060a8","4d3245814983811719fe402530d331abbf4d1698","d80e431a2f7c88772ed985011820b0f517136264","0a94bc7146db582d7e0a9949f67f9227b081df15","88bf3680b48dbe841df2205f63ad5a16fff1f84f","89f3fdb44f9f049a9bde0fd0cb41ede719ee907f","d08830be94236f72929a1cf986f1515689e9d3e4","af51273444b5aa1b8737dff445e487efe87017c5","cfb1380b8ee93d9570982a2de675e7e67bb51eb8","edcfb10ec5d27dbe0ed4182e68d214b421ace9d9","ef839ac2a2dfb08b8650fba66e3fe12d320cab72","18a5b775e9f86549466d11d3e9bd1cd2d36caf42","73d12f822bc37e6355b74e8403456c82cee35ec6","de602888e519a04fc280df41a1e4ea77a94c4908","83176c39ae6a04dadec5068cafccb8cbe7919cf4","767a5016dff3286465a323ae1b96ab7b21b3cc1f")
index=activity AND rg_functionality="Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("d5fb0799ac7aa3bf1a888de502b1c7d3f1e060a8","4d3245814983811719fe402530d331abbf4d1698","d80e431a2f7c88772ed985011820b0f517136264","0a94bc7146db582d7e0a9949f67f9227b081df15","88bf3680b48dbe841df2205f63ad5a16fff1f84f","89f3fdb44f9f049a9bde0fd0cb41ede719ee907f","d08830be94236f72929a1cf986f1515689e9d3e4","af51273444b5aa1b8737dff445e487efe87017c5","cfb1380b8ee93d9570982a2de675e7e67bb51eb8","edcfb10ec5d27dbe0ed4182e68d214b421ace9d9","ef839ac2a2dfb08b8650fba66e3fe12d320cab72","18a5b775e9f86549466d11d3e9bd1cd2d36caf42","73d12f822bc37e6355b74e8403456c82cee35ec6","de602888e519a04fc280df41a1e4ea77a94c4908","83176c39ae6a04dadec5068cafccb8cbe7919cf4","767a5016dff3286465a323ae1b96ab7b21b3cc1f")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("d5fb0799ac7aa3bf1a888de502b1c7d3f1e060a8","4d3245814983811719fe402530d331abbf4d1698","d80e431a2f7c88772ed985011820b0f517136264","0a94bc7146db582d7e0a9949f67f9227b081df15","88bf3680b48dbe841df2205f63ad5a16fff1f84f","89f3fdb44f9f049a9bde0fd0cb41ede719ee907f","d08830be94236f72929a1cf986f1515689e9d3e4","af51273444b5aa1b8737dff445e487efe87017c5","cfb1380b8ee93d9570982a2de675e7e67bb51eb8","edcfb10ec5d27dbe0ed4182e68d214b421ace9d9","ef839ac2a2dfb08b8650fba66e3fe12d320cab72","18a5b775e9f86549466d11d3e9bd1cd2d36caf42","73d12f822bc37e6355b74e8403456c82cee35ec6","de602888e519a04fc280df41a1e4ea77a94c4908","83176c39ae6a04dadec5068cafccb8cbe7919cf4","767a5016dff3286465a323ae1b96ab7b21b3cc1f")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("d5fb0799ac7aa3bf1a888de502b1c7d3f1e060a8","4d3245814983811719fe402530d331abbf4d1698","d80e431a2f7c88772ed985011820b0f517136264","0a94bc7146db582d7e0a9949f67f9227b081df15","88bf3680b48dbe841df2205f63ad5a16fff1f84f","89f3fdb44f9f049a9bde0fd0cb41ede719ee907f","d08830be94236f72929a1cf986f1515689e9d3e4","af51273444b5aa1b8737dff445e487efe87017c5","cfb1380b8ee93d9570982a2de675e7e67bb51eb8","edcfb10ec5d27dbe0ed4182e68d214b421ace9d9","ef839ac2a2dfb08b8650fba66e3fe12d320cab72","18a5b775e9f86549466d11d3e9bd1cd2d36caf42","73d12f822bc37e6355b74e8403456c82cee35ec6","de602888e519a04fc280df41a1e4ea77a94c4908","83176c39ae6a04dadec5068cafccb8cbe7919cf4","767a5016dff3286465a323ae1b96ab7b21b3cc1f")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("d5fb0799ac7aa3bf1a888de502b1c7d3f1e060a8","4d3245814983811719fe402530d331abbf4d1698","d80e431a2f7c88772ed985011820b0f517136264","0a94bc7146db582d7e0a9949f67f9227b081df15","88bf3680b48dbe841df2205f63ad5a16fff1f84f","89f3fdb44f9f049a9bde0fd0cb41ede719ee907f","d08830be94236f72929a1cf986f1515689e9d3e4","af51273444b5aa1b8737dff445e487efe87017c5","cfb1380b8ee93d9570982a2de675e7e67bb51eb8","edcfb10ec5d27dbe0ed4182e68d214b421ace9d9","ef839ac2a2dfb08b8650fba66e3fe12d320cab72","18a5b775e9f86549466d11d3e9bd1cd2d36caf42","73d12f822bc37e6355b74e8403456c82cee35ec6","de602888e519a04fc280df41a1e4ea77a94c4908","83176c39ae6a04dadec5068cafccb8cbe7919cf4","767a5016dff3286465a323ae1b96ab7b21b3cc1f")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("d5fb0799ac7aa3bf1a888de502b1c7d3f1e060a8","4d3245814983811719fe402530d331abbf4d1698","d80e431a2f7c88772ed985011820b0f517136264","0a94bc7146db582d7e0a9949f67f9227b081df15","88bf3680b48dbe841df2205f63ad5a16fff1f84f","89f3fdb44f9f049a9bde0fd0cb41ede719ee907f","d08830be94236f72929a1cf986f1515689e9d3e4","af51273444b5aa1b8737dff445e487efe87017c5","cfb1380b8ee93d9570982a2de675e7e67bb51eb8","edcfb10ec5d27dbe0ed4182e68d214b421ace9d9","ef839ac2a2dfb08b8650fba66e3fe12d320cab72","18a5b775e9f86549466d11d3e9bd1cd2d36caf42","73d12f822bc37e6355b74e8403456c82cee35ec6","de602888e519a04fc280df41a1e4ea77a94c4908","83176c39ae6a04dadec5068cafccb8cbe7919cf4","767a5016dff3286465a323ae1b96ab7b21b3cc1f")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("d5fb0799ac7aa3bf1a888de502b1c7d3f1e060a8","4d3245814983811719fe402530d331abbf4d1698","d80e431a2f7c88772ed985011820b0f517136264","0a94bc7146db582d7e0a9949f67f9227b081df15","88bf3680b48dbe841df2205f63ad5a16fff1f84f","89f3fdb44f9f049a9bde0fd0cb41ede719ee907f","d08830be94236f72929a1cf986f1515689e9d3e4","af51273444b5aa1b8737dff445e487efe87017c5","cfb1380b8ee93d9570982a2de675e7e67bb51eb8","edcfb10ec5d27dbe0ed4182e68d214b421ace9d9","ef839ac2a2dfb08b8650fba66e3fe12d320cab72","18a5b775e9f86549466d11d3e9bd1cd2d36caf42","73d12f822bc37e6355b74e8403456c82cee35ec6","de602888e519a04fc280df41a1e4ea77a94c4908","83176c39ae6a04dadec5068cafccb8cbe7919cf4","767a5016dff3286465a323ae1b96ab7b21b3cc1f")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("d5fb0799ac7aa3bf1a888de502b1c7d3f1e060a8","4d3245814983811719fe402530d331abbf4d1698","d80e431a2f7c88772ed985011820b0f517136264","0a94bc7146db582d7e0a9949f67f9227b081df15","88bf3680b48dbe841df2205f63ad5a16fff1f84f","89f3fdb44f9f049a9bde0fd0cb41ede719ee907f","d08830be94236f72929a1cf986f1515689e9d3e4","af51273444b5aa1b8737dff445e487efe87017c5","cfb1380b8ee93d9570982a2de675e7e67bb51eb8","edcfb10ec5d27dbe0ed4182e68d214b421ace9d9","ef839ac2a2dfb08b8650fba66e3fe12d320cab72","18a5b775e9f86549466d11d3e9bd1cd2d36caf42","73d12f822bc37e6355b74e8403456c82cee35ec6","de602888e519a04fc280df41a1e4ea77a94c4908","83176c39ae6a04dadec5068cafccb8cbe7919cf4","767a5016dff3286465a323ae1b96ab7b21b3cc1f")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("d5fb0799ac7aa3bf1a888de502b1c7d3f1e060a8","4d3245814983811719fe402530d331abbf4d1698","d80e431a2f7c88772ed985011820b0f517136264","0a94bc7146db582d7e0a9949f67f9227b081df15","88bf3680b48dbe841df2205f63ad5a16fff1f84f","89f3fdb44f9f049a9bde0fd0cb41ede719ee907f","d08830be94236f72929a1cf986f1515689e9d3e4","af51273444b5aa1b8737dff445e487efe87017c5","cfb1380b8ee93d9570982a2de675e7e67bb51eb8","edcfb10ec5d27dbe0ed4182e68d214b421ace9d9","ef839ac2a2dfb08b8650fba66e3fe12d320cab72","18a5b775e9f86549466d11d3e9bd1cd2d36caf42","73d12f822bc37e6355b74e8403456c82cee35ec6","de602888e519a04fc280df41a1e4ea77a94c4908","83176c39ae6a04dadec5068cafccb8cbe7919cf4","767a5016dff3286465a323ae1b96ab7b21b3cc1f")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring64 NOT NULL AND customstring64 IN ("d5fb0799ac7aa3bf1a888de502b1c7d3f1e060a8","4d3245814983811719fe402530d331abbf4d1698","d80e431a2f7c88772ed985011820b0f517136264","0a94bc7146db582d7e0a9949f67f9227b081df15","88bf3680b48dbe841df2205f63ad5a16fff1f84f","89f3fdb44f9f049a9bde0fd0cb41ede719ee907f","d08830be94236f72929a1cf986f1515689e9d3e4","af51273444b5aa1b8737dff445e487efe87017c5","cfb1380b8ee93d9570982a2de675e7e67bb51eb8","edcfb10ec5d27dbe0ed4182e68d214b421ace9d9","ef839ac2a2dfb08b8650fba66e3fe12d320cab72","18a5b775e9f86549466d11d3e9bd1cd2d36caf42","73d12f822bc37e6355b74e8403456c82cee35ec6","de602888e519a04fc280df41a1e4ea77a94c4908","83176c39ae6a04dadec5068cafccb8cbe7919cf4","767a5016dff3286465a323ae1b96ab7b21b3cc1f")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("d5fb0799ac7aa3bf1a888de502b1c7d3f1e060a8","4d3245814983811719fe402530d331abbf4d1698","d80e431a2f7c88772ed985011820b0f517136264","0a94bc7146db582d7e0a9949f67f9227b081df15","88bf3680b48dbe841df2205f63ad5a16fff1f84f","89f3fdb44f9f049a9bde0fd0cb41ede719ee907f","d08830be94236f72929a1cf986f1515689e9d3e4","af51273444b5aa1b8737dff445e487efe87017c5","cfb1380b8ee93d9570982a2de675e7e67bb51eb8","edcfb10ec5d27dbe0ed4182e68d214b421ace9d9","ef839ac2a2dfb08b8650fba66e3fe12d320cab72","18a5b775e9f86549466d11d3e9bd1cd2d36caf42","73d12f822bc37e6355b74e8403456c82cee35ec6","de602888e519a04fc280df41a1e4ea77a94c4908","83176c39ae6a04dadec5068cafccb8cbe7919cf4","767a5016dff3286465a323ae1b96ab7b21b3cc1f")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("d5fb0799ac7aa3bf1a888de502b1c7d3f1e060a8","4d3245814983811719fe402530d331abbf4d1698","d80e431a2f7c88772ed985011820b0f517136264","0a94bc7146db582d7e0a9949f67f9227b081df15","88bf3680b48dbe841df2205f63ad5a16fff1f84f","89f3fdb44f9f049a9bde0fd0cb41ede719ee907f","d08830be94236f72929a1cf986f1515689e9d3e4","af51273444b5aa1b8737dff445e487efe87017c5","cfb1380b8ee93d9570982a2de675e7e67bb51eb8","edcfb10ec5d27dbe0ed4182e68d214b421ace9d9","ef839ac2a2dfb08b8650fba66e3fe12d320cab72","18a5b775e9f86549466d11d3e9bd1cd2d36caf42","73d12f822bc37e6355b74e8403456c82cee35ec6","de602888e519a04fc280df41a1e4ea77a94c4908","83176c39ae6a04dadec5068cafccb8cbe7919cf4","767a5016dff3286465a323ae1b96ab7b21b3cc1f")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("d5fb0799ac7aa3bf1a888de502b1c7d3f1e060a8","4d3245814983811719fe402530d331abbf4d1698","d80e431a2f7c88772ed985011820b0f517136264","0a94bc7146db582d7e0a9949f67f9227b081df15","88bf3680b48dbe841df2205f63ad5a16fff1f84f","89f3fdb44f9f049a9bde0fd0cb41ede719ee907f","d08830be94236f72929a1cf986f1515689e9d3e4","af51273444b5aa1b8737dff445e487efe87017c5","cfb1380b8ee93d9570982a2de675e7e67bb51eb8","edcfb10ec5d27dbe0ed4182e68d214b421ace9d9","ef839ac2a2dfb08b8650fba66e3fe12d320cab72","18a5b775e9f86549466d11d3e9bd1cd2d36caf42","73d12f822bc37e6355b74e8403456c82cee35ec6","de602888e519a04fc280df41a1e4ea77a94c4908","83176c39ae6a04dadec5068cafccb8cbe7919cf4","767a5016dff3286465a323ae1b96ab7b21b3cc1f")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring64 NOT NULL AND customstring64 IN ("d5fb0799ac7aa3bf1a888de502b1c7d3f1e060a8","4d3245814983811719fe402530d331abbf4d1698","d80e431a2f7c88772ed985011820b0f517136264","0a94bc7146db582d7e0a9949f67f9227b081df15","88bf3680b48dbe841df2205f63ad5a16fff1f84f","89f3fdb44f9f049a9bde0fd0cb41ede719ee907f","d08830be94236f72929a1cf986f1515689e9d3e4","af51273444b5aa1b8737dff445e487efe87017c5","cfb1380b8ee93d9570982a2de675e7e67bb51eb8","edcfb10ec5d27dbe0ed4182e68d214b421ace9d9","ef839ac2a2dfb08b8650fba66e3fe12d320cab72","18a5b775e9f86549466d11d3e9bd1cd2d36caf42","73d12f822bc37e6355b74e8403456c82cee35ec6","de602888e519a04fc280df41a1e4ea77a94c4908","83176c39ae6a04dadec5068cafccb8cbe7919cf4","767a5016dff3286465a323ae1b96ab7b21b3cc1f")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("d5fb0799ac7aa3bf1a888de502b1c7d3f1e060a8","4d3245814983811719fe402530d331abbf4d1698","d80e431a2f7c88772ed985011820b0f517136264","0a94bc7146db582d7e0a9949f67f9227b081df15","88bf3680b48dbe841df2205f63ad5a16fff1f84f","89f3fdb44f9f049a9bde0fd0cb41ede719ee907f","d08830be94236f72929a1cf986f1515689e9d3e4","af51273444b5aa1b8737dff445e487efe87017c5","cfb1380b8ee93d9570982a2de675e7e67bb51eb8","edcfb10ec5d27dbe0ed4182e68d214b421ace9d9","ef839ac2a2dfb08b8650fba66e3fe12d320cab72","18a5b775e9f86549466d11d3e9bd1cd2d36caf42","73d12f822bc37e6355b74e8403456c82cee35ec6","de602888e519a04fc280df41a1e4ea77a94c4908","83176c39ae6a04dadec5068cafccb8cbe7919cf4","767a5016dff3286465a323ae1b96ab7b21b3cc1f")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("d5fb0799ac7aa3bf1a888de502b1c7d3f1e060a8","4d3245814983811719fe402530d331abbf4d1698","d80e431a2f7c88772ed985011820b0f517136264","0a94bc7146db582d7e0a9949f67f9227b081df15","88bf3680b48dbe841df2205f63ad5a16fff1f84f","89f3fdb44f9f049a9bde0fd0cb41ede719ee907f","d08830be94236f72929a1cf986f1515689e9d3e4","af51273444b5aa1b8737dff445e487efe87017c5","cfb1380b8ee93d9570982a2de675e7e67bb51eb8","edcfb10ec5d27dbe0ed4182e68d214b421ace9d9","ef839ac2a2dfb08b8650fba66e3fe12d320cab72","18a5b775e9f86549466d11d3e9bd1cd2d36caf42","73d12f822bc37e6355b74e8403456c82cee35ec6","de602888e519a04fc280df41a1e4ea77a94c4908","83176c39ae6a04dadec5068cafccb8cbe7919cf4","767a5016dff3286465a323ae1b96ab7b21b3cc1f")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("d5fb0799ac7aa3bf1a888de502b1c7d3f1e060a8","4d3245814983811719fe402530d331abbf4d1698","d80e431a2f7c88772ed985011820b0f517136264","0a94bc7146db582d7e0a9949f67f9227b081df15","88bf3680b48dbe841df2205f63ad5a16fff1f84f","89f3fdb44f9f049a9bde0fd0cb41ede719ee907f","d08830be94236f72929a1cf986f1515689e9d3e4","af51273444b5aa1b8737dff445e487efe87017c5","cfb1380b8ee93d9570982a2de675e7e67bb51eb8","edcfb10ec5d27dbe0ed4182e68d214b421ace9d9","ef839ac2a2dfb08b8650fba66e3fe12d320cab72","18a5b775e9f86549466d11d3e9bd1cd2d36caf42","73d12f822bc37e6355b74e8403456c82cee35ec6","de602888e519a04fc280df41a1e4ea77a94c4908","83176c39ae6a04dadec5068cafccb8cbe7919cf4","767a5016dff3286465a323ae1b96ab7b21b3cc1f")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring64 NOT NULL AND customstring64 IN ("d5fb0799ac7aa3bf1a888de502b1c7d3f1e060a8","4d3245814983811719fe402530d331abbf4d1698","d80e431a2f7c88772ed985011820b0f517136264","0a94bc7146db582d7e0a9949f67f9227b081df15","88bf3680b48dbe841df2205f63ad5a16fff1f84f","89f3fdb44f9f049a9bde0fd0cb41ede719ee907f","d08830be94236f72929a1cf986f1515689e9d3e4","af51273444b5aa1b8737dff445e487efe87017c5","cfb1380b8ee93d9570982a2de675e7e67bb51eb8","edcfb10ec5d27dbe0ed4182e68d214b421ace9d9","ef839ac2a2dfb08b8650fba66e3fe12d320cab72","18a5b775e9f86549466d11d3e9bd1cd2d36caf42","73d12f822bc37e6355b74e8403456c82cee35ec6","de602888e519a04fc280df41a1e4ea77a94c4908","83176c39ae6a04dadec5068cafccb8cbe7919cf4","767a5016dff3286465a323ae1b96ab7b21b3cc1f")
index=activity AND rg_functionality="O365 General" AND filehash NOT NULL AND filehash IN ("d5fb0799ac7aa3bf1a888de502b1c7d3f1e060a8","4d3245814983811719fe402530d331abbf4d1698","d80e431a2f7c88772ed985011820b0f517136264","0a94bc7146db582d7e0a9949f67f9227b081df15","88bf3680b48dbe841df2205f63ad5a16fff1f84f","89f3fdb44f9f049a9bde0fd0cb41ede719ee907f","d08830be94236f72929a1cf986f1515689e9d3e4","af51273444b5aa1b8737dff445e487efe87017c5","cfb1380b8ee93d9570982a2de675e7e67bb51eb8","edcfb10ec5d27dbe0ed4182e68d214b421ace9d9","ef839ac2a2dfb08b8650fba66e3fe12d320cab72","18a5b775e9f86549466d11d3e9bd1cd2d36caf42","73d12f822bc37e6355b74e8403456c82cee35ec6","de602888e519a04fc280df41a1e4ea77a94c4908","83176c39ae6a04dadec5068cafccb8cbe7919cf4","767a5016dff3286465a323ae1b96ab7b21b3cc1f")
index=activity AND rg_functionality="O365 General" AND oldfilehash NOT NULL AND oldfilehash IN ("d5fb0799ac7aa3bf1a888de502b1c7d3f1e060a8","4d3245814983811719fe402530d331abbf4d1698","d80e431a2f7c88772ed985011820b0f517136264","0a94bc7146db582d7e0a9949f67f9227b081df15","88bf3680b48dbe841df2205f63ad5a16fff1f84f","89f3fdb44f9f049a9bde0fd0cb41ede719ee907f","d08830be94236f72929a1cf986f1515689e9d3e4","af51273444b5aa1b8737dff445e487efe87017c5","cfb1380b8ee93d9570982a2de675e7e67bb51eb8","edcfb10ec5d27dbe0ed4182e68d214b421ace9d9","ef839ac2a2dfb08b8650fba66e3fe12d320cab72","18a5b775e9f86549466d11d3e9bd1cd2d36caf42","73d12f822bc37e6355b74e8403456c82cee35ec6","de602888e519a04fc280df41a1e4ea77a94c4908","83176c39ae6a04dadec5068cafccb8cbe7919cf4","767a5016dff3286465a323ae1b96ab7b21b3cc1f")
index=activity AND rg_functionality="O365 General" AND customstring3 NOT NULL AND customstring3 IN ("d5fb0799ac7aa3bf1a888de502b1c7d3f1e060a8","4d3245814983811719fe402530d331abbf4d1698","d80e431a2f7c88772ed985011820b0f517136264","0a94bc7146db582d7e0a9949f67f9227b081df15","88bf3680b48dbe841df2205f63ad5a16fff1f84f","89f3fdb44f9f049a9bde0fd0cb41ede719ee907f","d08830be94236f72929a1cf986f1515689e9d3e4","af51273444b5aa1b8737dff445e487efe87017c5","cfb1380b8ee93d9570982a2de675e7e67bb51eb8","edcfb10ec5d27dbe0ed4182e68d214b421ace9d9","ef839ac2a2dfb08b8650fba66e3fe12d320cab72","18a5b775e9f86549466d11d3e9bd1cd2d36caf42","73d12f822bc37e6355b74e8403456c82cee35ec6","de602888e519a04fc280df41a1e4ea77a94c4908","83176c39ae6a04dadec5068cafccb8cbe7919cf4","767a5016dff3286465a323ae1b96ab7b21b3cc1f")
index=activity AND rg_functionality="O365 General" AND customstring64 NOT NULL AND customstring64 IN ("d5fb0799ac7aa3bf1a888de502b1c7d3f1e060a8","4d3245814983811719fe402530d331abbf4d1698","d80e431a2f7c88772ed985011820b0f517136264","0a94bc7146db582d7e0a9949f67f9227b081df15","88bf3680b48dbe841df2205f63ad5a16fff1f84f","89f3fdb44f9f049a9bde0fd0cb41ede719ee907f","d08830be94236f72929a1cf986f1515689e9d3e4","af51273444b5aa1b8737dff445e487efe87017c5","cfb1380b8ee93d9570982a2de675e7e67bb51eb8","edcfb10ec5d27dbe0ed4182e68d214b421ace9d9","ef839ac2a2dfb08b8650fba66e3fe12d320cab72","18a5b775e9f86549466d11d3e9bd1cd2d36caf42","73d12f822bc37e6355b74e8403456c82cee35ec6","de602888e519a04fc280df41a1e4ea77a94c4908","83176c39ae6a04dadec5068cafccb8cbe7919cf4","767a5016dff3286465a323ae1b96ab7b21b3cc1f")
