index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("31c3574456573c89d444478772597db40f075e25c67b8de39926d2faa63ca1d8","c9707a3bc0f177e1d1a5587c61699975b1153406962d187c9a732f97d8f867c5","13cda19a9bf493f168d0eb6e8b2300828017b0ef437f75548a6c50bfb4a42a09","a7f2a21c0cd5681eab30265432367cf4b649d2b340963a977e70a16738e955ac")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("31c3574456573c89d444478772597db40f075e25c67b8de39926d2faa63ca1d8","c9707a3bc0f177e1d1a5587c61699975b1153406962d187c9a732f97d8f867c5","13cda19a9bf493f168d0eb6e8b2300828017b0ef437f75548a6c50bfb4a42a09","a7f2a21c0cd5681eab30265432367cf4b649d2b340963a977e70a16738e955ac")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("31c3574456573c89d444478772597db40f075e25c67b8de39926d2faa63ca1d8","c9707a3bc0f177e1d1a5587c61699975b1153406962d187c9a732f97d8f867c5","13cda19a9bf493f168d0eb6e8b2300828017b0ef437f75548a6c50bfb4a42a09","a7f2a21c0cd5681eab30265432367cf4b649d2b340963a977e70a16738e955ac")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring64 NOT NULL AND customstring64 IN ("31c3574456573c89d444478772597db40f075e25c67b8de39926d2faa63ca1d8","c9707a3bc0f177e1d1a5587c61699975b1153406962d187c9a732f97d8f867c5","13cda19a9bf493f168d0eb6e8b2300828017b0ef437f75548a6c50bfb4a42a09","a7f2a21c0cd5681eab30265432367cf4b649d2b340963a977e70a16738e955ac")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("31c3574456573c89d444478772597db40f075e25c67b8de39926d2faa63ca1d8","c9707a3bc0f177e1d1a5587c61699975b1153406962d187c9a732f97d8f867c5","13cda19a9bf493f168d0eb6e8b2300828017b0ef437f75548a6c50bfb4a42a09","a7f2a21c0cd5681eab30265432367cf4b649d2b340963a977e70a16738e955ac")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("31c3574456573c89d444478772597db40f075e25c67b8de39926d2faa63ca1d8","c9707a3bc0f177e1d1a5587c61699975b1153406962d187c9a732f97d8f867c5","13cda19a9bf493f168d0eb6e8b2300828017b0ef437f75548a6c50bfb4a42a09","a7f2a21c0cd5681eab30265432367cf4b649d2b340963a977e70a16738e955ac")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("31c3574456573c89d444478772597db40f075e25c67b8de39926d2faa63ca1d8","c9707a3bc0f177e1d1a5587c61699975b1153406962d187c9a732f97d8f867c5","13cda19a9bf493f168d0eb6e8b2300828017b0ef437f75548a6c50bfb4a42a09","a7f2a21c0cd5681eab30265432367cf4b649d2b340963a977e70a16738e955ac")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("31c3574456573c89d444478772597db40f075e25c67b8de39926d2faa63ca1d8","c9707a3bc0f177e1d1a5587c61699975b1153406962d187c9a732f97d8f867c5","13cda19a9bf493f168d0eb6e8b2300828017b0ef437f75548a6c50bfb4a42a09","a7f2a21c0cd5681eab30265432367cf4b649d2b340963a977e70a16738e955ac")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("31c3574456573c89d444478772597db40f075e25c67b8de39926d2faa63ca1d8","c9707a3bc0f177e1d1a5587c61699975b1153406962d187c9a732f97d8f867c5","13cda19a9bf493f168d0eb6e8b2300828017b0ef437f75548a6c50bfb4a42a09","a7f2a21c0cd5681eab30265432367cf4b649d2b340963a977e70a16738e955ac")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("31c3574456573c89d444478772597db40f075e25c67b8de39926d2faa63ca1d8","c9707a3bc0f177e1d1a5587c61699975b1153406962d187c9a732f97d8f867c5","13cda19a9bf493f168d0eb6e8b2300828017b0ef437f75548a6c50bfb4a42a09","a7f2a21c0cd5681eab30265432367cf4b649d2b340963a977e70a16738e955ac")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("31c3574456573c89d444478772597db40f075e25c67b8de39926d2faa63ca1d8","c9707a3bc0f177e1d1a5587c61699975b1153406962d187c9a732f97d8f867c5","13cda19a9bf493f168d0eb6e8b2300828017b0ef437f75548a6c50bfb4a42a09","a7f2a21c0cd5681eab30265432367cf4b649d2b340963a977e70a16738e955ac")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("31c3574456573c89d444478772597db40f075e25c67b8de39926d2faa63ca1d8","c9707a3bc0f177e1d1a5587c61699975b1153406962d187c9a732f97d8f867c5","13cda19a9bf493f168d0eb6e8b2300828017b0ef437f75548a6c50bfb4a42a09","a7f2a21c0cd5681eab30265432367cf4b649d2b340963a977e70a16738e955ac")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("31c3574456573c89d444478772597db40f075e25c67b8de39926d2faa63ca1d8","c9707a3bc0f177e1d1a5587c61699975b1153406962d187c9a732f97d8f867c5","13cda19a9bf493f168d0eb6e8b2300828017b0ef437f75548a6c50bfb4a42a09","a7f2a21c0cd5681eab30265432367cf4b649d2b340963a977e70a16738e955ac")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("31c3574456573c89d444478772597db40f075e25c67b8de39926d2faa63ca1d8","c9707a3bc0f177e1d1a5587c61699975b1153406962d187c9a732f97d8f867c5","13cda19a9bf493f168d0eb6e8b2300828017b0ef437f75548a6c50bfb4a42a09","a7f2a21c0cd5681eab30265432367cf4b649d2b340963a977e70a16738e955ac")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("31c3574456573c89d444478772597db40f075e25c67b8de39926d2faa63ca1d8","c9707a3bc0f177e1d1a5587c61699975b1153406962d187c9a732f97d8f867c5","13cda19a9bf493f168d0eb6e8b2300828017b0ef437f75548a6c50bfb4a42a09","a7f2a21c0cd5681eab30265432367cf4b649d2b340963a977e70a16738e955ac")
index=activity AND rg_functionality="Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("31c3574456573c89d444478772597db40f075e25c67b8de39926d2faa63ca1d8","c9707a3bc0f177e1d1a5587c61699975b1153406962d187c9a732f97d8f867c5","13cda19a9bf493f168d0eb6e8b2300828017b0ef437f75548a6c50bfb4a42a09","a7f2a21c0cd5681eab30265432367cf4b649d2b340963a977e70a16738e955ac")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("31c3574456573c89d444478772597db40f075e25c67b8de39926d2faa63ca1d8","c9707a3bc0f177e1d1a5587c61699975b1153406962d187c9a732f97d8f867c5","13cda19a9bf493f168d0eb6e8b2300828017b0ef437f75548a6c50bfb4a42a09","a7f2a21c0cd5681eab30265432367cf4b649d2b340963a977e70a16738e955ac")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("31c3574456573c89d444478772597db40f075e25c67b8de39926d2faa63ca1d8","c9707a3bc0f177e1d1a5587c61699975b1153406962d187c9a732f97d8f867c5","13cda19a9bf493f168d0eb6e8b2300828017b0ef437f75548a6c50bfb4a42a09","a7f2a21c0cd5681eab30265432367cf4b649d2b340963a977e70a16738e955ac")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("31c3574456573c89d444478772597db40f075e25c67b8de39926d2faa63ca1d8","c9707a3bc0f177e1d1a5587c61699975b1153406962d187c9a732f97d8f867c5","13cda19a9bf493f168d0eb6e8b2300828017b0ef437f75548a6c50bfb4a42a09","a7f2a21c0cd5681eab30265432367cf4b649d2b340963a977e70a16738e955ac")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("31c3574456573c89d444478772597db40f075e25c67b8de39926d2faa63ca1d8","c9707a3bc0f177e1d1a5587c61699975b1153406962d187c9a732f97d8f867c5","13cda19a9bf493f168d0eb6e8b2300828017b0ef437f75548a6c50bfb4a42a09","a7f2a21c0cd5681eab30265432367cf4b649d2b340963a977e70a16738e955ac")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("31c3574456573c89d444478772597db40f075e25c67b8de39926d2faa63ca1d8","c9707a3bc0f177e1d1a5587c61699975b1153406962d187c9a732f97d8f867c5","13cda19a9bf493f168d0eb6e8b2300828017b0ef437f75548a6c50bfb4a42a09","a7f2a21c0cd5681eab30265432367cf4b649d2b340963a977e70a16738e955ac")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("31c3574456573c89d444478772597db40f075e25c67b8de39926d2faa63ca1d8","c9707a3bc0f177e1d1a5587c61699975b1153406962d187c9a732f97d8f867c5","13cda19a9bf493f168d0eb6e8b2300828017b0ef437f75548a6c50bfb4a42a09","a7f2a21c0cd5681eab30265432367cf4b649d2b340963a977e70a16738e955ac")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("31c3574456573c89d444478772597db40f075e25c67b8de39926d2faa63ca1d8","c9707a3bc0f177e1d1a5587c61699975b1153406962d187c9a732f97d8f867c5","13cda19a9bf493f168d0eb6e8b2300828017b0ef437f75548a6c50bfb4a42a09","a7f2a21c0cd5681eab30265432367cf4b649d2b340963a977e70a16738e955ac")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring64 NOT NULL AND customstring64 IN ("31c3574456573c89d444478772597db40f075e25c67b8de39926d2faa63ca1d8","c9707a3bc0f177e1d1a5587c61699975b1153406962d187c9a732f97d8f867c5","13cda19a9bf493f168d0eb6e8b2300828017b0ef437f75548a6c50bfb4a42a09","a7f2a21c0cd5681eab30265432367cf4b649d2b340963a977e70a16738e955ac")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("31c3574456573c89d444478772597db40f075e25c67b8de39926d2faa63ca1d8","c9707a3bc0f177e1d1a5587c61699975b1153406962d187c9a732f97d8f867c5","13cda19a9bf493f168d0eb6e8b2300828017b0ef437f75548a6c50bfb4a42a09","a7f2a21c0cd5681eab30265432367cf4b649d2b340963a977e70a16738e955ac")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("31c3574456573c89d444478772597db40f075e25c67b8de39926d2faa63ca1d8","c9707a3bc0f177e1d1a5587c61699975b1153406962d187c9a732f97d8f867c5","13cda19a9bf493f168d0eb6e8b2300828017b0ef437f75548a6c50bfb4a42a09","a7f2a21c0cd5681eab30265432367cf4b649d2b340963a977e70a16738e955ac")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("31c3574456573c89d444478772597db40f075e25c67b8de39926d2faa63ca1d8","c9707a3bc0f177e1d1a5587c61699975b1153406962d187c9a732f97d8f867c5","13cda19a9bf493f168d0eb6e8b2300828017b0ef437f75548a6c50bfb4a42a09","a7f2a21c0cd5681eab30265432367cf4b649d2b340963a977e70a16738e955ac")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring64 NOT NULL AND customstring64 IN ("31c3574456573c89d444478772597db40f075e25c67b8de39926d2faa63ca1d8","c9707a3bc0f177e1d1a5587c61699975b1153406962d187c9a732f97d8f867c5","13cda19a9bf493f168d0eb6e8b2300828017b0ef437f75548a6c50bfb4a42a09","a7f2a21c0cd5681eab30265432367cf4b649d2b340963a977e70a16738e955ac")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("31c3574456573c89d444478772597db40f075e25c67b8de39926d2faa63ca1d8","c9707a3bc0f177e1d1a5587c61699975b1153406962d187c9a732f97d8f867c5","13cda19a9bf493f168d0eb6e8b2300828017b0ef437f75548a6c50bfb4a42a09","a7f2a21c0cd5681eab30265432367cf4b649d2b340963a977e70a16738e955ac")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("31c3574456573c89d444478772597db40f075e25c67b8de39926d2faa63ca1d8","c9707a3bc0f177e1d1a5587c61699975b1153406962d187c9a732f97d8f867c5","13cda19a9bf493f168d0eb6e8b2300828017b0ef437f75548a6c50bfb4a42a09","a7f2a21c0cd5681eab30265432367cf4b649d2b340963a977e70a16738e955ac")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("31c3574456573c89d444478772597db40f075e25c67b8de39926d2faa63ca1d8","c9707a3bc0f177e1d1a5587c61699975b1153406962d187c9a732f97d8f867c5","13cda19a9bf493f168d0eb6e8b2300828017b0ef437f75548a6c50bfb4a42a09","a7f2a21c0cd5681eab30265432367cf4b649d2b340963a977e70a16738e955ac")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring64 NOT NULL AND customstring64 IN ("31c3574456573c89d444478772597db40f075e25c67b8de39926d2faa63ca1d8","c9707a3bc0f177e1d1a5587c61699975b1153406962d187c9a732f97d8f867c5","13cda19a9bf493f168d0eb6e8b2300828017b0ef437f75548a6c50bfb4a42a09","a7f2a21c0cd5681eab30265432367cf4b649d2b340963a977e70a16738e955ac")
index=activity AND rg_functionality="O365 General" AND filehash NOT NULL AND filehash IN ("31c3574456573c89d444478772597db40f075e25c67b8de39926d2faa63ca1d8","c9707a3bc0f177e1d1a5587c61699975b1153406962d187c9a732f97d8f867c5","13cda19a9bf493f168d0eb6e8b2300828017b0ef437f75548a6c50bfb4a42a09","a7f2a21c0cd5681eab30265432367cf4b649d2b340963a977e70a16738e955ac")
index=activity AND rg_functionality="O365 General" AND oldfilehash NOT NULL AND oldfilehash IN ("31c3574456573c89d444478772597db40f075e25c67b8de39926d2faa63ca1d8","c9707a3bc0f177e1d1a5587c61699975b1153406962d187c9a732f97d8f867c5","13cda19a9bf493f168d0eb6e8b2300828017b0ef437f75548a6c50bfb4a42a09","a7f2a21c0cd5681eab30265432367cf4b649d2b340963a977e70a16738e955ac")
index=activity AND rg_functionality="O365 General" AND customstring3 NOT NULL AND customstring3 IN ("31c3574456573c89d444478772597db40f075e25c67b8de39926d2faa63ca1d8","c9707a3bc0f177e1d1a5587c61699975b1153406962d187c9a732f97d8f867c5","13cda19a9bf493f168d0eb6e8b2300828017b0ef437f75548a6c50bfb4a42a09","a7f2a21c0cd5681eab30265432367cf4b649d2b340963a977e70a16738e955ac")
index=activity AND rg_functionality="O365 General" AND customstring64 NOT NULL AND customstring64 IN ("31c3574456573c89d444478772597db40f075e25c67b8de39926d2faa63ca1d8","c9707a3bc0f177e1d1a5587c61699975b1153406962d187c9a732f97d8f867c5","13cda19a9bf493f168d0eb6e8b2300828017b0ef437f75548a6c50bfb4a42a09","a7f2a21c0cd5681eab30265432367cf4b649d2b340963a977e70a16738e955ac")
