index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("c71cd27efcdb8c44ab8c29d51f033a22","71f70d61af00542b2e9ad64abd2dda7e437536ff","6455de74ae15071fa98f18cdbc3148c967755e69df7dee747bc31d0387751162","3f28196675dc8cb20cf5b5f80ea29310","7ace663c22b3e800fc17c1477d54b533f7002833","823b079c75f4e6a5905d9eea9a60c62e1f0995bfc25764d1ba0407a5bd78c962")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("c71cd27efcdb8c44ab8c29d51f033a22","71f70d61af00542b2e9ad64abd2dda7e437536ff","6455de74ae15071fa98f18cdbc3148c967755e69df7dee747bc31d0387751162","3f28196675dc8cb20cf5b5f80ea29310","7ace663c22b3e800fc17c1477d54b533f7002833","823b079c75f4e6a5905d9eea9a60c62e1f0995bfc25764d1ba0407a5bd78c962")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("c71cd27efcdb8c44ab8c29d51f033a22","71f70d61af00542b2e9ad64abd2dda7e437536ff","6455de74ae15071fa98f18cdbc3148c967755e69df7dee747bc31d0387751162","3f28196675dc8cb20cf5b5f80ea29310","7ace663c22b3e800fc17c1477d54b533f7002833","823b079c75f4e6a5905d9eea9a60c62e1f0995bfc25764d1ba0407a5bd78c962")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring64 NOT NULL AND customstring64 IN ("c71cd27efcdb8c44ab8c29d51f033a22","71f70d61af00542b2e9ad64abd2dda7e437536ff","6455de74ae15071fa98f18cdbc3148c967755e69df7dee747bc31d0387751162","3f28196675dc8cb20cf5b5f80ea29310","7ace663c22b3e800fc17c1477d54b533f7002833","823b079c75f4e6a5905d9eea9a60c62e1f0995bfc25764d1ba0407a5bd78c962")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("c71cd27efcdb8c44ab8c29d51f033a22","71f70d61af00542b2e9ad64abd2dda7e437536ff","6455de74ae15071fa98f18cdbc3148c967755e69df7dee747bc31d0387751162","3f28196675dc8cb20cf5b5f80ea29310","7ace663c22b3e800fc17c1477d54b533f7002833","823b079c75f4e6a5905d9eea9a60c62e1f0995bfc25764d1ba0407a5bd78c962")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("c71cd27efcdb8c44ab8c29d51f033a22","71f70d61af00542b2e9ad64abd2dda7e437536ff","6455de74ae15071fa98f18cdbc3148c967755e69df7dee747bc31d0387751162","3f28196675dc8cb20cf5b5f80ea29310","7ace663c22b3e800fc17c1477d54b533f7002833","823b079c75f4e6a5905d9eea9a60c62e1f0995bfc25764d1ba0407a5bd78c962")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("c71cd27efcdb8c44ab8c29d51f033a22","71f70d61af00542b2e9ad64abd2dda7e437536ff","6455de74ae15071fa98f18cdbc3148c967755e69df7dee747bc31d0387751162","3f28196675dc8cb20cf5b5f80ea29310","7ace663c22b3e800fc17c1477d54b533f7002833","823b079c75f4e6a5905d9eea9a60c62e1f0995bfc25764d1ba0407a5bd78c962")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("c71cd27efcdb8c44ab8c29d51f033a22","71f70d61af00542b2e9ad64abd2dda7e437536ff","6455de74ae15071fa98f18cdbc3148c967755e69df7dee747bc31d0387751162","3f28196675dc8cb20cf5b5f80ea29310","7ace663c22b3e800fc17c1477d54b533f7002833","823b079c75f4e6a5905d9eea9a60c62e1f0995bfc25764d1ba0407a5bd78c962")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("c71cd27efcdb8c44ab8c29d51f033a22","71f70d61af00542b2e9ad64abd2dda7e437536ff","6455de74ae15071fa98f18cdbc3148c967755e69df7dee747bc31d0387751162","3f28196675dc8cb20cf5b5f80ea29310","7ace663c22b3e800fc17c1477d54b533f7002833","823b079c75f4e6a5905d9eea9a60c62e1f0995bfc25764d1ba0407a5bd78c962")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("c71cd27efcdb8c44ab8c29d51f033a22","71f70d61af00542b2e9ad64abd2dda7e437536ff","6455de74ae15071fa98f18cdbc3148c967755e69df7dee747bc31d0387751162","3f28196675dc8cb20cf5b5f80ea29310","7ace663c22b3e800fc17c1477d54b533f7002833","823b079c75f4e6a5905d9eea9a60c62e1f0995bfc25764d1ba0407a5bd78c962")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("c71cd27efcdb8c44ab8c29d51f033a22","71f70d61af00542b2e9ad64abd2dda7e437536ff","6455de74ae15071fa98f18cdbc3148c967755e69df7dee747bc31d0387751162","3f28196675dc8cb20cf5b5f80ea29310","7ace663c22b3e800fc17c1477d54b533f7002833","823b079c75f4e6a5905d9eea9a60c62e1f0995bfc25764d1ba0407a5bd78c962")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("c71cd27efcdb8c44ab8c29d51f033a22","71f70d61af00542b2e9ad64abd2dda7e437536ff","6455de74ae15071fa98f18cdbc3148c967755e69df7dee747bc31d0387751162","3f28196675dc8cb20cf5b5f80ea29310","7ace663c22b3e800fc17c1477d54b533f7002833","823b079c75f4e6a5905d9eea9a60c62e1f0995bfc25764d1ba0407a5bd78c962")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("c71cd27efcdb8c44ab8c29d51f033a22","71f70d61af00542b2e9ad64abd2dda7e437536ff","6455de74ae15071fa98f18cdbc3148c967755e69df7dee747bc31d0387751162","3f28196675dc8cb20cf5b5f80ea29310","7ace663c22b3e800fc17c1477d54b533f7002833","823b079c75f4e6a5905d9eea9a60c62e1f0995bfc25764d1ba0407a5bd78c962")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("c71cd27efcdb8c44ab8c29d51f033a22","71f70d61af00542b2e9ad64abd2dda7e437536ff","6455de74ae15071fa98f18cdbc3148c967755e69df7dee747bc31d0387751162","3f28196675dc8cb20cf5b5f80ea29310","7ace663c22b3e800fc17c1477d54b533f7002833","823b079c75f4e6a5905d9eea9a60c62e1f0995bfc25764d1ba0407a5bd78c962")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("c71cd27efcdb8c44ab8c29d51f033a22","71f70d61af00542b2e9ad64abd2dda7e437536ff","6455de74ae15071fa98f18cdbc3148c967755e69df7dee747bc31d0387751162","3f28196675dc8cb20cf5b5f80ea29310","7ace663c22b3e800fc17c1477d54b533f7002833","823b079c75f4e6a5905d9eea9a60c62e1f0995bfc25764d1ba0407a5bd78c962")
index=activity AND rg_functionality="Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("c71cd27efcdb8c44ab8c29d51f033a22","71f70d61af00542b2e9ad64abd2dda7e437536ff","6455de74ae15071fa98f18cdbc3148c967755e69df7dee747bc31d0387751162","3f28196675dc8cb20cf5b5f80ea29310","7ace663c22b3e800fc17c1477d54b533f7002833","823b079c75f4e6a5905d9eea9a60c62e1f0995bfc25764d1ba0407a5bd78c962")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("c71cd27efcdb8c44ab8c29d51f033a22","71f70d61af00542b2e9ad64abd2dda7e437536ff","6455de74ae15071fa98f18cdbc3148c967755e69df7dee747bc31d0387751162","3f28196675dc8cb20cf5b5f80ea29310","7ace663c22b3e800fc17c1477d54b533f7002833","823b079c75f4e6a5905d9eea9a60c62e1f0995bfc25764d1ba0407a5bd78c962")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("c71cd27efcdb8c44ab8c29d51f033a22","71f70d61af00542b2e9ad64abd2dda7e437536ff","6455de74ae15071fa98f18cdbc3148c967755e69df7dee747bc31d0387751162","3f28196675dc8cb20cf5b5f80ea29310","7ace663c22b3e800fc17c1477d54b533f7002833","823b079c75f4e6a5905d9eea9a60c62e1f0995bfc25764d1ba0407a5bd78c962")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("c71cd27efcdb8c44ab8c29d51f033a22","71f70d61af00542b2e9ad64abd2dda7e437536ff","6455de74ae15071fa98f18cdbc3148c967755e69df7dee747bc31d0387751162","3f28196675dc8cb20cf5b5f80ea29310","7ace663c22b3e800fc17c1477d54b533f7002833","823b079c75f4e6a5905d9eea9a60c62e1f0995bfc25764d1ba0407a5bd78c962")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("c71cd27efcdb8c44ab8c29d51f033a22","71f70d61af00542b2e9ad64abd2dda7e437536ff","6455de74ae15071fa98f18cdbc3148c967755e69df7dee747bc31d0387751162","3f28196675dc8cb20cf5b5f80ea29310","7ace663c22b3e800fc17c1477d54b533f7002833","823b079c75f4e6a5905d9eea9a60c62e1f0995bfc25764d1ba0407a5bd78c962")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("c71cd27efcdb8c44ab8c29d51f033a22","71f70d61af00542b2e9ad64abd2dda7e437536ff","6455de74ae15071fa98f18cdbc3148c967755e69df7dee747bc31d0387751162","3f28196675dc8cb20cf5b5f80ea29310","7ace663c22b3e800fc17c1477d54b533f7002833","823b079c75f4e6a5905d9eea9a60c62e1f0995bfc25764d1ba0407a5bd78c962")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("c71cd27efcdb8c44ab8c29d51f033a22","71f70d61af00542b2e9ad64abd2dda7e437536ff","6455de74ae15071fa98f18cdbc3148c967755e69df7dee747bc31d0387751162","3f28196675dc8cb20cf5b5f80ea29310","7ace663c22b3e800fc17c1477d54b533f7002833","823b079c75f4e6a5905d9eea9a60c62e1f0995bfc25764d1ba0407a5bd78c962")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("c71cd27efcdb8c44ab8c29d51f033a22","71f70d61af00542b2e9ad64abd2dda7e437536ff","6455de74ae15071fa98f18cdbc3148c967755e69df7dee747bc31d0387751162","3f28196675dc8cb20cf5b5f80ea29310","7ace663c22b3e800fc17c1477d54b533f7002833","823b079c75f4e6a5905d9eea9a60c62e1f0995bfc25764d1ba0407a5bd78c962")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring64 NOT NULL AND customstring64 IN ("c71cd27efcdb8c44ab8c29d51f033a22","71f70d61af00542b2e9ad64abd2dda7e437536ff","6455de74ae15071fa98f18cdbc3148c967755e69df7dee747bc31d0387751162","3f28196675dc8cb20cf5b5f80ea29310","7ace663c22b3e800fc17c1477d54b533f7002833","823b079c75f4e6a5905d9eea9a60c62e1f0995bfc25764d1ba0407a5bd78c962")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("c71cd27efcdb8c44ab8c29d51f033a22","71f70d61af00542b2e9ad64abd2dda7e437536ff","6455de74ae15071fa98f18cdbc3148c967755e69df7dee747bc31d0387751162","3f28196675dc8cb20cf5b5f80ea29310","7ace663c22b3e800fc17c1477d54b533f7002833","823b079c75f4e6a5905d9eea9a60c62e1f0995bfc25764d1ba0407a5bd78c962")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("c71cd27efcdb8c44ab8c29d51f033a22","71f70d61af00542b2e9ad64abd2dda7e437536ff","6455de74ae15071fa98f18cdbc3148c967755e69df7dee747bc31d0387751162","3f28196675dc8cb20cf5b5f80ea29310","7ace663c22b3e800fc17c1477d54b533f7002833","823b079c75f4e6a5905d9eea9a60c62e1f0995bfc25764d1ba0407a5bd78c962")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("c71cd27efcdb8c44ab8c29d51f033a22","71f70d61af00542b2e9ad64abd2dda7e437536ff","6455de74ae15071fa98f18cdbc3148c967755e69df7dee747bc31d0387751162","3f28196675dc8cb20cf5b5f80ea29310","7ace663c22b3e800fc17c1477d54b533f7002833","823b079c75f4e6a5905d9eea9a60c62e1f0995bfc25764d1ba0407a5bd78c962")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring64 NOT NULL AND customstring64 IN ("c71cd27efcdb8c44ab8c29d51f033a22","71f70d61af00542b2e9ad64abd2dda7e437536ff","6455de74ae15071fa98f18cdbc3148c967755e69df7dee747bc31d0387751162","3f28196675dc8cb20cf5b5f80ea29310","7ace663c22b3e800fc17c1477d54b533f7002833","823b079c75f4e6a5905d9eea9a60c62e1f0995bfc25764d1ba0407a5bd78c962")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("c71cd27efcdb8c44ab8c29d51f033a22","71f70d61af00542b2e9ad64abd2dda7e437536ff","6455de74ae15071fa98f18cdbc3148c967755e69df7dee747bc31d0387751162","3f28196675dc8cb20cf5b5f80ea29310","7ace663c22b3e800fc17c1477d54b533f7002833","823b079c75f4e6a5905d9eea9a60c62e1f0995bfc25764d1ba0407a5bd78c962")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("c71cd27efcdb8c44ab8c29d51f033a22","71f70d61af00542b2e9ad64abd2dda7e437536ff","6455de74ae15071fa98f18cdbc3148c967755e69df7dee747bc31d0387751162","3f28196675dc8cb20cf5b5f80ea29310","7ace663c22b3e800fc17c1477d54b533f7002833","823b079c75f4e6a5905d9eea9a60c62e1f0995bfc25764d1ba0407a5bd78c962")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("c71cd27efcdb8c44ab8c29d51f033a22","71f70d61af00542b2e9ad64abd2dda7e437536ff","6455de74ae15071fa98f18cdbc3148c967755e69df7dee747bc31d0387751162","3f28196675dc8cb20cf5b5f80ea29310","7ace663c22b3e800fc17c1477d54b533f7002833","823b079c75f4e6a5905d9eea9a60c62e1f0995bfc25764d1ba0407a5bd78c962")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring64 NOT NULL AND customstring64 IN ("c71cd27efcdb8c44ab8c29d51f033a22","71f70d61af00542b2e9ad64abd2dda7e437536ff","6455de74ae15071fa98f18cdbc3148c967755e69df7dee747bc31d0387751162","3f28196675dc8cb20cf5b5f80ea29310","7ace663c22b3e800fc17c1477d54b533f7002833","823b079c75f4e6a5905d9eea9a60c62e1f0995bfc25764d1ba0407a5bd78c962")
