index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("be10d1f0565240319903cbbe2590d898721fbdd8ce2062e790185fbfd16486d2","37aff6406e6a0d5caccec17202737e4b0610d19560a6c791aad95385cb1581fb","ecef9075c8075eaf9163fa5ee12ccf6d72f1c241c6ca9c87f545925b2aea4f24","99b785c4820157cab314a0a46e00aad5daf0c4af21975ea1d2fe4e59972139ce","cbaf9a050e9ac61aa48a68284458dc296256b857c05c7f436329df8d2605bcc5","512c7d9380272efe0fdcb1735b22ef03b502924f495f5e075fe548c79bb3d44b")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("be10d1f0565240319903cbbe2590d898721fbdd8ce2062e790185fbfd16486d2","37aff6406e6a0d5caccec17202737e4b0610d19560a6c791aad95385cb1581fb","ecef9075c8075eaf9163fa5ee12ccf6d72f1c241c6ca9c87f545925b2aea4f24","99b785c4820157cab314a0a46e00aad5daf0c4af21975ea1d2fe4e59972139ce","cbaf9a050e9ac61aa48a68284458dc296256b857c05c7f436329df8d2605bcc5","512c7d9380272efe0fdcb1735b22ef03b502924f495f5e075fe548c79bb3d44b")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("be10d1f0565240319903cbbe2590d898721fbdd8ce2062e790185fbfd16486d2","37aff6406e6a0d5caccec17202737e4b0610d19560a6c791aad95385cb1581fb","ecef9075c8075eaf9163fa5ee12ccf6d72f1c241c6ca9c87f545925b2aea4f24","99b785c4820157cab314a0a46e00aad5daf0c4af21975ea1d2fe4e59972139ce","cbaf9a050e9ac61aa48a68284458dc296256b857c05c7f436329df8d2605bcc5","512c7d9380272efe0fdcb1735b22ef03b502924f495f5e075fe548c79bb3d44b")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring64 NOT NULL AND customstring64 IN ("be10d1f0565240319903cbbe2590d898721fbdd8ce2062e790185fbfd16486d2","37aff6406e6a0d5caccec17202737e4b0610d19560a6c791aad95385cb1581fb","ecef9075c8075eaf9163fa5ee12ccf6d72f1c241c6ca9c87f545925b2aea4f24","99b785c4820157cab314a0a46e00aad5daf0c4af21975ea1d2fe4e59972139ce","cbaf9a050e9ac61aa48a68284458dc296256b857c05c7f436329df8d2605bcc5","512c7d9380272efe0fdcb1735b22ef03b502924f495f5e075fe548c79bb3d44b")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("be10d1f0565240319903cbbe2590d898721fbdd8ce2062e790185fbfd16486d2","37aff6406e6a0d5caccec17202737e4b0610d19560a6c791aad95385cb1581fb","ecef9075c8075eaf9163fa5ee12ccf6d72f1c241c6ca9c87f545925b2aea4f24","99b785c4820157cab314a0a46e00aad5daf0c4af21975ea1d2fe4e59972139ce","cbaf9a050e9ac61aa48a68284458dc296256b857c05c7f436329df8d2605bcc5","512c7d9380272efe0fdcb1735b22ef03b502924f495f5e075fe548c79bb3d44b")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("be10d1f0565240319903cbbe2590d898721fbdd8ce2062e790185fbfd16486d2","37aff6406e6a0d5caccec17202737e4b0610d19560a6c791aad95385cb1581fb","ecef9075c8075eaf9163fa5ee12ccf6d72f1c241c6ca9c87f545925b2aea4f24","99b785c4820157cab314a0a46e00aad5daf0c4af21975ea1d2fe4e59972139ce","cbaf9a050e9ac61aa48a68284458dc296256b857c05c7f436329df8d2605bcc5","512c7d9380272efe0fdcb1735b22ef03b502924f495f5e075fe548c79bb3d44b")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("be10d1f0565240319903cbbe2590d898721fbdd8ce2062e790185fbfd16486d2","37aff6406e6a0d5caccec17202737e4b0610d19560a6c791aad95385cb1581fb","ecef9075c8075eaf9163fa5ee12ccf6d72f1c241c6ca9c87f545925b2aea4f24","99b785c4820157cab314a0a46e00aad5daf0c4af21975ea1d2fe4e59972139ce","cbaf9a050e9ac61aa48a68284458dc296256b857c05c7f436329df8d2605bcc5","512c7d9380272efe0fdcb1735b22ef03b502924f495f5e075fe548c79bb3d44b")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("be10d1f0565240319903cbbe2590d898721fbdd8ce2062e790185fbfd16486d2","37aff6406e6a0d5caccec17202737e4b0610d19560a6c791aad95385cb1581fb","ecef9075c8075eaf9163fa5ee12ccf6d72f1c241c6ca9c87f545925b2aea4f24","99b785c4820157cab314a0a46e00aad5daf0c4af21975ea1d2fe4e59972139ce","cbaf9a050e9ac61aa48a68284458dc296256b857c05c7f436329df8d2605bcc5","512c7d9380272efe0fdcb1735b22ef03b502924f495f5e075fe548c79bb3d44b")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("be10d1f0565240319903cbbe2590d898721fbdd8ce2062e790185fbfd16486d2","37aff6406e6a0d5caccec17202737e4b0610d19560a6c791aad95385cb1581fb","ecef9075c8075eaf9163fa5ee12ccf6d72f1c241c6ca9c87f545925b2aea4f24","99b785c4820157cab314a0a46e00aad5daf0c4af21975ea1d2fe4e59972139ce","cbaf9a050e9ac61aa48a68284458dc296256b857c05c7f436329df8d2605bcc5","512c7d9380272efe0fdcb1735b22ef03b502924f495f5e075fe548c79bb3d44b")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("be10d1f0565240319903cbbe2590d898721fbdd8ce2062e790185fbfd16486d2","37aff6406e6a0d5caccec17202737e4b0610d19560a6c791aad95385cb1581fb","ecef9075c8075eaf9163fa5ee12ccf6d72f1c241c6ca9c87f545925b2aea4f24","99b785c4820157cab314a0a46e00aad5daf0c4af21975ea1d2fe4e59972139ce","cbaf9a050e9ac61aa48a68284458dc296256b857c05c7f436329df8d2605bcc5","512c7d9380272efe0fdcb1735b22ef03b502924f495f5e075fe548c79bb3d44b")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("be10d1f0565240319903cbbe2590d898721fbdd8ce2062e790185fbfd16486d2","37aff6406e6a0d5caccec17202737e4b0610d19560a6c791aad95385cb1581fb","ecef9075c8075eaf9163fa5ee12ccf6d72f1c241c6ca9c87f545925b2aea4f24","99b785c4820157cab314a0a46e00aad5daf0c4af21975ea1d2fe4e59972139ce","cbaf9a050e9ac61aa48a68284458dc296256b857c05c7f436329df8d2605bcc5","512c7d9380272efe0fdcb1735b22ef03b502924f495f5e075fe548c79bb3d44b")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("be10d1f0565240319903cbbe2590d898721fbdd8ce2062e790185fbfd16486d2","37aff6406e6a0d5caccec17202737e4b0610d19560a6c791aad95385cb1581fb","ecef9075c8075eaf9163fa5ee12ccf6d72f1c241c6ca9c87f545925b2aea4f24","99b785c4820157cab314a0a46e00aad5daf0c4af21975ea1d2fe4e59972139ce","cbaf9a050e9ac61aa48a68284458dc296256b857c05c7f436329df8d2605bcc5","512c7d9380272efe0fdcb1735b22ef03b502924f495f5e075fe548c79bb3d44b")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("be10d1f0565240319903cbbe2590d898721fbdd8ce2062e790185fbfd16486d2","37aff6406e6a0d5caccec17202737e4b0610d19560a6c791aad95385cb1581fb","ecef9075c8075eaf9163fa5ee12ccf6d72f1c241c6ca9c87f545925b2aea4f24","99b785c4820157cab314a0a46e00aad5daf0c4af21975ea1d2fe4e59972139ce","cbaf9a050e9ac61aa48a68284458dc296256b857c05c7f436329df8d2605bcc5","512c7d9380272efe0fdcb1735b22ef03b502924f495f5e075fe548c79bb3d44b")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("be10d1f0565240319903cbbe2590d898721fbdd8ce2062e790185fbfd16486d2","37aff6406e6a0d5caccec17202737e4b0610d19560a6c791aad95385cb1581fb","ecef9075c8075eaf9163fa5ee12ccf6d72f1c241c6ca9c87f545925b2aea4f24","99b785c4820157cab314a0a46e00aad5daf0c4af21975ea1d2fe4e59972139ce","cbaf9a050e9ac61aa48a68284458dc296256b857c05c7f436329df8d2605bcc5","512c7d9380272efe0fdcb1735b22ef03b502924f495f5e075fe548c79bb3d44b")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("be10d1f0565240319903cbbe2590d898721fbdd8ce2062e790185fbfd16486d2","37aff6406e6a0d5caccec17202737e4b0610d19560a6c791aad95385cb1581fb","ecef9075c8075eaf9163fa5ee12ccf6d72f1c241c6ca9c87f545925b2aea4f24","99b785c4820157cab314a0a46e00aad5daf0c4af21975ea1d2fe4e59972139ce","cbaf9a050e9ac61aa48a68284458dc296256b857c05c7f436329df8d2605bcc5","512c7d9380272efe0fdcb1735b22ef03b502924f495f5e075fe548c79bb3d44b")
index=activity AND rg_functionality="Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("be10d1f0565240319903cbbe2590d898721fbdd8ce2062e790185fbfd16486d2","37aff6406e6a0d5caccec17202737e4b0610d19560a6c791aad95385cb1581fb","ecef9075c8075eaf9163fa5ee12ccf6d72f1c241c6ca9c87f545925b2aea4f24","99b785c4820157cab314a0a46e00aad5daf0c4af21975ea1d2fe4e59972139ce","cbaf9a050e9ac61aa48a68284458dc296256b857c05c7f436329df8d2605bcc5","512c7d9380272efe0fdcb1735b22ef03b502924f495f5e075fe548c79bb3d44b")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("be10d1f0565240319903cbbe2590d898721fbdd8ce2062e790185fbfd16486d2","37aff6406e6a0d5caccec17202737e4b0610d19560a6c791aad95385cb1581fb","ecef9075c8075eaf9163fa5ee12ccf6d72f1c241c6ca9c87f545925b2aea4f24","99b785c4820157cab314a0a46e00aad5daf0c4af21975ea1d2fe4e59972139ce","cbaf9a050e9ac61aa48a68284458dc296256b857c05c7f436329df8d2605bcc5","512c7d9380272efe0fdcb1735b22ef03b502924f495f5e075fe548c79bb3d44b")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("be10d1f0565240319903cbbe2590d898721fbdd8ce2062e790185fbfd16486d2","37aff6406e6a0d5caccec17202737e4b0610d19560a6c791aad95385cb1581fb","ecef9075c8075eaf9163fa5ee12ccf6d72f1c241c6ca9c87f545925b2aea4f24","99b785c4820157cab314a0a46e00aad5daf0c4af21975ea1d2fe4e59972139ce","cbaf9a050e9ac61aa48a68284458dc296256b857c05c7f436329df8d2605bcc5","512c7d9380272efe0fdcb1735b22ef03b502924f495f5e075fe548c79bb3d44b")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("be10d1f0565240319903cbbe2590d898721fbdd8ce2062e790185fbfd16486d2","37aff6406e6a0d5caccec17202737e4b0610d19560a6c791aad95385cb1581fb","ecef9075c8075eaf9163fa5ee12ccf6d72f1c241c6ca9c87f545925b2aea4f24","99b785c4820157cab314a0a46e00aad5daf0c4af21975ea1d2fe4e59972139ce","cbaf9a050e9ac61aa48a68284458dc296256b857c05c7f436329df8d2605bcc5","512c7d9380272efe0fdcb1735b22ef03b502924f495f5e075fe548c79bb3d44b")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("be10d1f0565240319903cbbe2590d898721fbdd8ce2062e790185fbfd16486d2","37aff6406e6a0d5caccec17202737e4b0610d19560a6c791aad95385cb1581fb","ecef9075c8075eaf9163fa5ee12ccf6d72f1c241c6ca9c87f545925b2aea4f24","99b785c4820157cab314a0a46e00aad5daf0c4af21975ea1d2fe4e59972139ce","cbaf9a050e9ac61aa48a68284458dc296256b857c05c7f436329df8d2605bcc5","512c7d9380272efe0fdcb1735b22ef03b502924f495f5e075fe548c79bb3d44b")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("be10d1f0565240319903cbbe2590d898721fbdd8ce2062e790185fbfd16486d2","37aff6406e6a0d5caccec17202737e4b0610d19560a6c791aad95385cb1581fb","ecef9075c8075eaf9163fa5ee12ccf6d72f1c241c6ca9c87f545925b2aea4f24","99b785c4820157cab314a0a46e00aad5daf0c4af21975ea1d2fe4e59972139ce","cbaf9a050e9ac61aa48a68284458dc296256b857c05c7f436329df8d2605bcc5","512c7d9380272efe0fdcb1735b22ef03b502924f495f5e075fe548c79bb3d44b")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("be10d1f0565240319903cbbe2590d898721fbdd8ce2062e790185fbfd16486d2","37aff6406e6a0d5caccec17202737e4b0610d19560a6c791aad95385cb1581fb","ecef9075c8075eaf9163fa5ee12ccf6d72f1c241c6ca9c87f545925b2aea4f24","99b785c4820157cab314a0a46e00aad5daf0c4af21975ea1d2fe4e59972139ce","cbaf9a050e9ac61aa48a68284458dc296256b857c05c7f436329df8d2605bcc5","512c7d9380272efe0fdcb1735b22ef03b502924f495f5e075fe548c79bb3d44b")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("be10d1f0565240319903cbbe2590d898721fbdd8ce2062e790185fbfd16486d2","37aff6406e6a0d5caccec17202737e4b0610d19560a6c791aad95385cb1581fb","ecef9075c8075eaf9163fa5ee12ccf6d72f1c241c6ca9c87f545925b2aea4f24","99b785c4820157cab314a0a46e00aad5daf0c4af21975ea1d2fe4e59972139ce","cbaf9a050e9ac61aa48a68284458dc296256b857c05c7f436329df8d2605bcc5","512c7d9380272efe0fdcb1735b22ef03b502924f495f5e075fe548c79bb3d44b")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring64 NOT NULL AND customstring64 IN ("be10d1f0565240319903cbbe2590d898721fbdd8ce2062e790185fbfd16486d2","37aff6406e6a0d5caccec17202737e4b0610d19560a6c791aad95385cb1581fb","ecef9075c8075eaf9163fa5ee12ccf6d72f1c241c6ca9c87f545925b2aea4f24","99b785c4820157cab314a0a46e00aad5daf0c4af21975ea1d2fe4e59972139ce","cbaf9a050e9ac61aa48a68284458dc296256b857c05c7f436329df8d2605bcc5","512c7d9380272efe0fdcb1735b22ef03b502924f495f5e075fe548c79bb3d44b")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("be10d1f0565240319903cbbe2590d898721fbdd8ce2062e790185fbfd16486d2","37aff6406e6a0d5caccec17202737e4b0610d19560a6c791aad95385cb1581fb","ecef9075c8075eaf9163fa5ee12ccf6d72f1c241c6ca9c87f545925b2aea4f24","99b785c4820157cab314a0a46e00aad5daf0c4af21975ea1d2fe4e59972139ce","cbaf9a050e9ac61aa48a68284458dc296256b857c05c7f436329df8d2605bcc5","512c7d9380272efe0fdcb1735b22ef03b502924f495f5e075fe548c79bb3d44b")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("be10d1f0565240319903cbbe2590d898721fbdd8ce2062e790185fbfd16486d2","37aff6406e6a0d5caccec17202737e4b0610d19560a6c791aad95385cb1581fb","ecef9075c8075eaf9163fa5ee12ccf6d72f1c241c6ca9c87f545925b2aea4f24","99b785c4820157cab314a0a46e00aad5daf0c4af21975ea1d2fe4e59972139ce","cbaf9a050e9ac61aa48a68284458dc296256b857c05c7f436329df8d2605bcc5","512c7d9380272efe0fdcb1735b22ef03b502924f495f5e075fe548c79bb3d44b")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("be10d1f0565240319903cbbe2590d898721fbdd8ce2062e790185fbfd16486d2","37aff6406e6a0d5caccec17202737e4b0610d19560a6c791aad95385cb1581fb","ecef9075c8075eaf9163fa5ee12ccf6d72f1c241c6ca9c87f545925b2aea4f24","99b785c4820157cab314a0a46e00aad5daf0c4af21975ea1d2fe4e59972139ce","cbaf9a050e9ac61aa48a68284458dc296256b857c05c7f436329df8d2605bcc5","512c7d9380272efe0fdcb1735b22ef03b502924f495f5e075fe548c79bb3d44b")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring64 NOT NULL AND customstring64 IN ("be10d1f0565240319903cbbe2590d898721fbdd8ce2062e790185fbfd16486d2","37aff6406e6a0d5caccec17202737e4b0610d19560a6c791aad95385cb1581fb","ecef9075c8075eaf9163fa5ee12ccf6d72f1c241c6ca9c87f545925b2aea4f24","99b785c4820157cab314a0a46e00aad5daf0c4af21975ea1d2fe4e59972139ce","cbaf9a050e9ac61aa48a68284458dc296256b857c05c7f436329df8d2605bcc5","512c7d9380272efe0fdcb1735b22ef03b502924f495f5e075fe548c79bb3d44b")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("be10d1f0565240319903cbbe2590d898721fbdd8ce2062e790185fbfd16486d2","37aff6406e6a0d5caccec17202737e4b0610d19560a6c791aad95385cb1581fb","ecef9075c8075eaf9163fa5ee12ccf6d72f1c241c6ca9c87f545925b2aea4f24","99b785c4820157cab314a0a46e00aad5daf0c4af21975ea1d2fe4e59972139ce","cbaf9a050e9ac61aa48a68284458dc296256b857c05c7f436329df8d2605bcc5","512c7d9380272efe0fdcb1735b22ef03b502924f495f5e075fe548c79bb3d44b")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("be10d1f0565240319903cbbe2590d898721fbdd8ce2062e790185fbfd16486d2","37aff6406e6a0d5caccec17202737e4b0610d19560a6c791aad95385cb1581fb","ecef9075c8075eaf9163fa5ee12ccf6d72f1c241c6ca9c87f545925b2aea4f24","99b785c4820157cab314a0a46e00aad5daf0c4af21975ea1d2fe4e59972139ce","cbaf9a050e9ac61aa48a68284458dc296256b857c05c7f436329df8d2605bcc5","512c7d9380272efe0fdcb1735b22ef03b502924f495f5e075fe548c79bb3d44b")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("be10d1f0565240319903cbbe2590d898721fbdd8ce2062e790185fbfd16486d2","37aff6406e6a0d5caccec17202737e4b0610d19560a6c791aad95385cb1581fb","ecef9075c8075eaf9163fa5ee12ccf6d72f1c241c6ca9c87f545925b2aea4f24","99b785c4820157cab314a0a46e00aad5daf0c4af21975ea1d2fe4e59972139ce","cbaf9a050e9ac61aa48a68284458dc296256b857c05c7f436329df8d2605bcc5","512c7d9380272efe0fdcb1735b22ef03b502924f495f5e075fe548c79bb3d44b")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring64 NOT NULL AND customstring64 IN ("be10d1f0565240319903cbbe2590d898721fbdd8ce2062e790185fbfd16486d2","37aff6406e6a0d5caccec17202737e4b0610d19560a6c791aad95385cb1581fb","ecef9075c8075eaf9163fa5ee12ccf6d72f1c241c6ca9c87f545925b2aea4f24","99b785c4820157cab314a0a46e00aad5daf0c4af21975ea1d2fe4e59972139ce","cbaf9a050e9ac61aa48a68284458dc296256b857c05c7f436329df8d2605bcc5","512c7d9380272efe0fdcb1735b22ef03b502924f495f5e075fe548c79bb3d44b")
