index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("f4e1149360174b4fcf0dcc6e61898c8180324893","0b8697f8e81956e7c0c5383806fa69630c38ad33","e07457e36bf9aab1dc2b54acd30ec8f9e5c60c84","9719d1e076ab67a18f231889cad4b451f539ce72")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("f4e1149360174b4fcf0dcc6e61898c8180324893","0b8697f8e81956e7c0c5383806fa69630c38ad33","e07457e36bf9aab1dc2b54acd30ec8f9e5c60c84","9719d1e076ab67a18f231889cad4b451f539ce72")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("f4e1149360174b4fcf0dcc6e61898c8180324893","0b8697f8e81956e7c0c5383806fa69630c38ad33","e07457e36bf9aab1dc2b54acd30ec8f9e5c60c84","9719d1e076ab67a18f231889cad4b451f539ce72")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring64 NOT NULL AND customstring64 IN ("f4e1149360174b4fcf0dcc6e61898c8180324893","0b8697f8e81956e7c0c5383806fa69630c38ad33","e07457e36bf9aab1dc2b54acd30ec8f9e5c60c84","9719d1e076ab67a18f231889cad4b451f539ce72")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("f4e1149360174b4fcf0dcc6e61898c8180324893","0b8697f8e81956e7c0c5383806fa69630c38ad33","e07457e36bf9aab1dc2b54acd30ec8f9e5c60c84","9719d1e076ab67a18f231889cad4b451f539ce72")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("f4e1149360174b4fcf0dcc6e61898c8180324893","0b8697f8e81956e7c0c5383806fa69630c38ad33","e07457e36bf9aab1dc2b54acd30ec8f9e5c60c84","9719d1e076ab67a18f231889cad4b451f539ce72")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("f4e1149360174b4fcf0dcc6e61898c8180324893","0b8697f8e81956e7c0c5383806fa69630c38ad33","e07457e36bf9aab1dc2b54acd30ec8f9e5c60c84","9719d1e076ab67a18f231889cad4b451f539ce72")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("f4e1149360174b4fcf0dcc6e61898c8180324893","0b8697f8e81956e7c0c5383806fa69630c38ad33","e07457e36bf9aab1dc2b54acd30ec8f9e5c60c84","9719d1e076ab67a18f231889cad4b451f539ce72")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("f4e1149360174b4fcf0dcc6e61898c8180324893","0b8697f8e81956e7c0c5383806fa69630c38ad33","e07457e36bf9aab1dc2b54acd30ec8f9e5c60c84","9719d1e076ab67a18f231889cad4b451f539ce72")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("f4e1149360174b4fcf0dcc6e61898c8180324893","0b8697f8e81956e7c0c5383806fa69630c38ad33","e07457e36bf9aab1dc2b54acd30ec8f9e5c60c84","9719d1e076ab67a18f231889cad4b451f539ce72")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("f4e1149360174b4fcf0dcc6e61898c8180324893","0b8697f8e81956e7c0c5383806fa69630c38ad33","e07457e36bf9aab1dc2b54acd30ec8f9e5c60c84","9719d1e076ab67a18f231889cad4b451f539ce72")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("f4e1149360174b4fcf0dcc6e61898c8180324893","0b8697f8e81956e7c0c5383806fa69630c38ad33","e07457e36bf9aab1dc2b54acd30ec8f9e5c60c84","9719d1e076ab67a18f231889cad4b451f539ce72")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("f4e1149360174b4fcf0dcc6e61898c8180324893","0b8697f8e81956e7c0c5383806fa69630c38ad33","e07457e36bf9aab1dc2b54acd30ec8f9e5c60c84","9719d1e076ab67a18f231889cad4b451f539ce72")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("f4e1149360174b4fcf0dcc6e61898c8180324893","0b8697f8e81956e7c0c5383806fa69630c38ad33","e07457e36bf9aab1dc2b54acd30ec8f9e5c60c84","9719d1e076ab67a18f231889cad4b451f539ce72")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("f4e1149360174b4fcf0dcc6e61898c8180324893","0b8697f8e81956e7c0c5383806fa69630c38ad33","e07457e36bf9aab1dc2b54acd30ec8f9e5c60c84","9719d1e076ab67a18f231889cad4b451f539ce72")
index=activity AND rg_functionality="Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("f4e1149360174b4fcf0dcc6e61898c8180324893","0b8697f8e81956e7c0c5383806fa69630c38ad33","e07457e36bf9aab1dc2b54acd30ec8f9e5c60c84","9719d1e076ab67a18f231889cad4b451f539ce72")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("f4e1149360174b4fcf0dcc6e61898c8180324893","0b8697f8e81956e7c0c5383806fa69630c38ad33","e07457e36bf9aab1dc2b54acd30ec8f9e5c60c84","9719d1e076ab67a18f231889cad4b451f539ce72")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("f4e1149360174b4fcf0dcc6e61898c8180324893","0b8697f8e81956e7c0c5383806fa69630c38ad33","e07457e36bf9aab1dc2b54acd30ec8f9e5c60c84","9719d1e076ab67a18f231889cad4b451f539ce72")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("f4e1149360174b4fcf0dcc6e61898c8180324893","0b8697f8e81956e7c0c5383806fa69630c38ad33","e07457e36bf9aab1dc2b54acd30ec8f9e5c60c84","9719d1e076ab67a18f231889cad4b451f539ce72")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("f4e1149360174b4fcf0dcc6e61898c8180324893","0b8697f8e81956e7c0c5383806fa69630c38ad33","e07457e36bf9aab1dc2b54acd30ec8f9e5c60c84","9719d1e076ab67a18f231889cad4b451f539ce72")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("f4e1149360174b4fcf0dcc6e61898c8180324893","0b8697f8e81956e7c0c5383806fa69630c38ad33","e07457e36bf9aab1dc2b54acd30ec8f9e5c60c84","9719d1e076ab67a18f231889cad4b451f539ce72")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("f4e1149360174b4fcf0dcc6e61898c8180324893","0b8697f8e81956e7c0c5383806fa69630c38ad33","e07457e36bf9aab1dc2b54acd30ec8f9e5c60c84","9719d1e076ab67a18f231889cad4b451f539ce72")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("f4e1149360174b4fcf0dcc6e61898c8180324893","0b8697f8e81956e7c0c5383806fa69630c38ad33","e07457e36bf9aab1dc2b54acd30ec8f9e5c60c84","9719d1e076ab67a18f231889cad4b451f539ce72")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring64 NOT NULL AND customstring64 IN ("f4e1149360174b4fcf0dcc6e61898c8180324893","0b8697f8e81956e7c0c5383806fa69630c38ad33","e07457e36bf9aab1dc2b54acd30ec8f9e5c60c84","9719d1e076ab67a18f231889cad4b451f539ce72")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("f4e1149360174b4fcf0dcc6e61898c8180324893","0b8697f8e81956e7c0c5383806fa69630c38ad33","e07457e36bf9aab1dc2b54acd30ec8f9e5c60c84","9719d1e076ab67a18f231889cad4b451f539ce72")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("f4e1149360174b4fcf0dcc6e61898c8180324893","0b8697f8e81956e7c0c5383806fa69630c38ad33","e07457e36bf9aab1dc2b54acd30ec8f9e5c60c84","9719d1e076ab67a18f231889cad4b451f539ce72")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("f4e1149360174b4fcf0dcc6e61898c8180324893","0b8697f8e81956e7c0c5383806fa69630c38ad33","e07457e36bf9aab1dc2b54acd30ec8f9e5c60c84","9719d1e076ab67a18f231889cad4b451f539ce72")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring64 NOT NULL AND customstring64 IN ("f4e1149360174b4fcf0dcc6e61898c8180324893","0b8697f8e81956e7c0c5383806fa69630c38ad33","e07457e36bf9aab1dc2b54acd30ec8f9e5c60c84","9719d1e076ab67a18f231889cad4b451f539ce72")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("f4e1149360174b4fcf0dcc6e61898c8180324893","0b8697f8e81956e7c0c5383806fa69630c38ad33","e07457e36bf9aab1dc2b54acd30ec8f9e5c60c84","9719d1e076ab67a18f231889cad4b451f539ce72")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("f4e1149360174b4fcf0dcc6e61898c8180324893","0b8697f8e81956e7c0c5383806fa69630c38ad33","e07457e36bf9aab1dc2b54acd30ec8f9e5c60c84","9719d1e076ab67a18f231889cad4b451f539ce72")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("f4e1149360174b4fcf0dcc6e61898c8180324893","0b8697f8e81956e7c0c5383806fa69630c38ad33","e07457e36bf9aab1dc2b54acd30ec8f9e5c60c84","9719d1e076ab67a18f231889cad4b451f539ce72")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring64 NOT NULL AND customstring64 IN ("f4e1149360174b4fcf0dcc6e61898c8180324893","0b8697f8e81956e7c0c5383806fa69630c38ad33","e07457e36bf9aab1dc2b54acd30ec8f9e5c60c84","9719d1e076ab67a18f231889cad4b451f539ce72")
index=activity AND rg_functionality="O365 General" AND filehash NOT NULL AND filehash IN ("f4e1149360174b4fcf0dcc6e61898c8180324893","0b8697f8e81956e7c0c5383806fa69630c38ad33","e07457e36bf9aab1dc2b54acd30ec8f9e5c60c84","9719d1e076ab67a18f231889cad4b451f539ce72")
index=activity AND rg_functionality="O365 General" AND oldfilehash NOT NULL AND oldfilehash IN ("f4e1149360174b4fcf0dcc6e61898c8180324893","0b8697f8e81956e7c0c5383806fa69630c38ad33","e07457e36bf9aab1dc2b54acd30ec8f9e5c60c84","9719d1e076ab67a18f231889cad4b451f539ce72")
index=activity AND rg_functionality="O365 General" AND customstring3 NOT NULL AND customstring3 IN ("f4e1149360174b4fcf0dcc6e61898c8180324893","0b8697f8e81956e7c0c5383806fa69630c38ad33","e07457e36bf9aab1dc2b54acd30ec8f9e5c60c84","9719d1e076ab67a18f231889cad4b451f539ce72")
index=activity AND rg_functionality="O365 General" AND customstring64 NOT NULL AND customstring64 IN ("f4e1149360174b4fcf0dcc6e61898c8180324893","0b8697f8e81956e7c0c5383806fa69630c38ad33","e07457e36bf9aab1dc2b54acd30ec8f9e5c60c84","9719d1e076ab67a18f231889cad4b451f539ce72")
