index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("eba5bfca73c2754fbf93ed64fa224132","b746c91e014205db94f775bb6db480387c9ebc20","ec45ebd938e363e36cacb42e968a960fbe4e21ced511f0ea2c0790b743ff3c67","6f3a658fc32b4a378716ac167ebaf5ac","19138d3c197ee1e59756d1f4fc3fd66809f44c1b","25117dcb2d852df15fe44c5757147e7038f289e6156b0f6ab86d02c0e97328cb","a768244ca664349a6d1af84a712083c0","39300863bcaad71e5d4efc9a1cae118440aa778f","e14ba0fb92e16bb7db3b1efac4b13aee178542c6994543e7535d8efaa589870c","8e0b1f8390acb832dbf3abadeb7e5fd3","02e6ff95949fdf341daee846820d40289ab65985","4775dfb24f85f5d776f538018a98cc6a9853a1840f5c00b7d0c54695f03a11d9","1cc1534b70b8d2b99b69a721c83e586a","6ac2d77631f775797cd0029e199a5dfe83f47b4c","ffd09a5c27938d1f7424ed66d1474cfeb3df72daabdf10e09f161ed1ffd21271")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("eba5bfca73c2754fbf93ed64fa224132","b746c91e014205db94f775bb6db480387c9ebc20","ec45ebd938e363e36cacb42e968a960fbe4e21ced511f0ea2c0790b743ff3c67","6f3a658fc32b4a378716ac167ebaf5ac","19138d3c197ee1e59756d1f4fc3fd66809f44c1b","25117dcb2d852df15fe44c5757147e7038f289e6156b0f6ab86d02c0e97328cb","a768244ca664349a6d1af84a712083c0","39300863bcaad71e5d4efc9a1cae118440aa778f","e14ba0fb92e16bb7db3b1efac4b13aee178542c6994543e7535d8efaa589870c","8e0b1f8390acb832dbf3abadeb7e5fd3","02e6ff95949fdf341daee846820d40289ab65985","4775dfb24f85f5d776f538018a98cc6a9853a1840f5c00b7d0c54695f03a11d9","1cc1534b70b8d2b99b69a721c83e586a","6ac2d77631f775797cd0029e199a5dfe83f47b4c","ffd09a5c27938d1f7424ed66d1474cfeb3df72daabdf10e09f161ed1ffd21271")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("eba5bfca73c2754fbf93ed64fa224132","b746c91e014205db94f775bb6db480387c9ebc20","ec45ebd938e363e36cacb42e968a960fbe4e21ced511f0ea2c0790b743ff3c67","6f3a658fc32b4a378716ac167ebaf5ac","19138d3c197ee1e59756d1f4fc3fd66809f44c1b","25117dcb2d852df15fe44c5757147e7038f289e6156b0f6ab86d02c0e97328cb","a768244ca664349a6d1af84a712083c0","39300863bcaad71e5d4efc9a1cae118440aa778f","e14ba0fb92e16bb7db3b1efac4b13aee178542c6994543e7535d8efaa589870c","8e0b1f8390acb832dbf3abadeb7e5fd3","02e6ff95949fdf341daee846820d40289ab65985","4775dfb24f85f5d776f538018a98cc6a9853a1840f5c00b7d0c54695f03a11d9","1cc1534b70b8d2b99b69a721c83e586a","6ac2d77631f775797cd0029e199a5dfe83f47b4c","ffd09a5c27938d1f7424ed66d1474cfeb3df72daabdf10e09f161ed1ffd21271")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring64 NOT NULL AND customstring64 IN ("eba5bfca73c2754fbf93ed64fa224132","b746c91e014205db94f775bb6db480387c9ebc20","ec45ebd938e363e36cacb42e968a960fbe4e21ced511f0ea2c0790b743ff3c67","6f3a658fc32b4a378716ac167ebaf5ac","19138d3c197ee1e59756d1f4fc3fd66809f44c1b","25117dcb2d852df15fe44c5757147e7038f289e6156b0f6ab86d02c0e97328cb","a768244ca664349a6d1af84a712083c0","39300863bcaad71e5d4efc9a1cae118440aa778f","e14ba0fb92e16bb7db3b1efac4b13aee178542c6994543e7535d8efaa589870c","8e0b1f8390acb832dbf3abadeb7e5fd3","02e6ff95949fdf341daee846820d40289ab65985","4775dfb24f85f5d776f538018a98cc6a9853a1840f5c00b7d0c54695f03a11d9","1cc1534b70b8d2b99b69a721c83e586a","6ac2d77631f775797cd0029e199a5dfe83f47b4c","ffd09a5c27938d1f7424ed66d1474cfeb3df72daabdf10e09f161ed1ffd21271")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("eba5bfca73c2754fbf93ed64fa224132","b746c91e014205db94f775bb6db480387c9ebc20","ec45ebd938e363e36cacb42e968a960fbe4e21ced511f0ea2c0790b743ff3c67","6f3a658fc32b4a378716ac167ebaf5ac","19138d3c197ee1e59756d1f4fc3fd66809f44c1b","25117dcb2d852df15fe44c5757147e7038f289e6156b0f6ab86d02c0e97328cb","a768244ca664349a6d1af84a712083c0","39300863bcaad71e5d4efc9a1cae118440aa778f","e14ba0fb92e16bb7db3b1efac4b13aee178542c6994543e7535d8efaa589870c","8e0b1f8390acb832dbf3abadeb7e5fd3","02e6ff95949fdf341daee846820d40289ab65985","4775dfb24f85f5d776f538018a98cc6a9853a1840f5c00b7d0c54695f03a11d9","1cc1534b70b8d2b99b69a721c83e586a","6ac2d77631f775797cd0029e199a5dfe83f47b4c","ffd09a5c27938d1f7424ed66d1474cfeb3df72daabdf10e09f161ed1ffd21271")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("eba5bfca73c2754fbf93ed64fa224132","b746c91e014205db94f775bb6db480387c9ebc20","ec45ebd938e363e36cacb42e968a960fbe4e21ced511f0ea2c0790b743ff3c67","6f3a658fc32b4a378716ac167ebaf5ac","19138d3c197ee1e59756d1f4fc3fd66809f44c1b","25117dcb2d852df15fe44c5757147e7038f289e6156b0f6ab86d02c0e97328cb","a768244ca664349a6d1af84a712083c0","39300863bcaad71e5d4efc9a1cae118440aa778f","e14ba0fb92e16bb7db3b1efac4b13aee178542c6994543e7535d8efaa589870c","8e0b1f8390acb832dbf3abadeb7e5fd3","02e6ff95949fdf341daee846820d40289ab65985","4775dfb24f85f5d776f538018a98cc6a9853a1840f5c00b7d0c54695f03a11d9","1cc1534b70b8d2b99b69a721c83e586a","6ac2d77631f775797cd0029e199a5dfe83f47b4c","ffd09a5c27938d1f7424ed66d1474cfeb3df72daabdf10e09f161ed1ffd21271")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("eba5bfca73c2754fbf93ed64fa224132","b746c91e014205db94f775bb6db480387c9ebc20","ec45ebd938e363e36cacb42e968a960fbe4e21ced511f0ea2c0790b743ff3c67","6f3a658fc32b4a378716ac167ebaf5ac","19138d3c197ee1e59756d1f4fc3fd66809f44c1b","25117dcb2d852df15fe44c5757147e7038f289e6156b0f6ab86d02c0e97328cb","a768244ca664349a6d1af84a712083c0","39300863bcaad71e5d4efc9a1cae118440aa778f","e14ba0fb92e16bb7db3b1efac4b13aee178542c6994543e7535d8efaa589870c","8e0b1f8390acb832dbf3abadeb7e5fd3","02e6ff95949fdf341daee846820d40289ab65985","4775dfb24f85f5d776f538018a98cc6a9853a1840f5c00b7d0c54695f03a11d9","1cc1534b70b8d2b99b69a721c83e586a","6ac2d77631f775797cd0029e199a5dfe83f47b4c","ffd09a5c27938d1f7424ed66d1474cfeb3df72daabdf10e09f161ed1ffd21271")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("eba5bfca73c2754fbf93ed64fa224132","b746c91e014205db94f775bb6db480387c9ebc20","ec45ebd938e363e36cacb42e968a960fbe4e21ced511f0ea2c0790b743ff3c67","6f3a658fc32b4a378716ac167ebaf5ac","19138d3c197ee1e59756d1f4fc3fd66809f44c1b","25117dcb2d852df15fe44c5757147e7038f289e6156b0f6ab86d02c0e97328cb","a768244ca664349a6d1af84a712083c0","39300863bcaad71e5d4efc9a1cae118440aa778f","e14ba0fb92e16bb7db3b1efac4b13aee178542c6994543e7535d8efaa589870c","8e0b1f8390acb832dbf3abadeb7e5fd3","02e6ff95949fdf341daee846820d40289ab65985","4775dfb24f85f5d776f538018a98cc6a9853a1840f5c00b7d0c54695f03a11d9","1cc1534b70b8d2b99b69a721c83e586a","6ac2d77631f775797cd0029e199a5dfe83f47b4c","ffd09a5c27938d1f7424ed66d1474cfeb3df72daabdf10e09f161ed1ffd21271")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("eba5bfca73c2754fbf93ed64fa224132","b746c91e014205db94f775bb6db480387c9ebc20","ec45ebd938e363e36cacb42e968a960fbe4e21ced511f0ea2c0790b743ff3c67","6f3a658fc32b4a378716ac167ebaf5ac","19138d3c197ee1e59756d1f4fc3fd66809f44c1b","25117dcb2d852df15fe44c5757147e7038f289e6156b0f6ab86d02c0e97328cb","a768244ca664349a6d1af84a712083c0","39300863bcaad71e5d4efc9a1cae118440aa778f","e14ba0fb92e16bb7db3b1efac4b13aee178542c6994543e7535d8efaa589870c","8e0b1f8390acb832dbf3abadeb7e5fd3","02e6ff95949fdf341daee846820d40289ab65985","4775dfb24f85f5d776f538018a98cc6a9853a1840f5c00b7d0c54695f03a11d9","1cc1534b70b8d2b99b69a721c83e586a","6ac2d77631f775797cd0029e199a5dfe83f47b4c","ffd09a5c27938d1f7424ed66d1474cfeb3df72daabdf10e09f161ed1ffd21271")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("eba5bfca73c2754fbf93ed64fa224132","b746c91e014205db94f775bb6db480387c9ebc20","ec45ebd938e363e36cacb42e968a960fbe4e21ced511f0ea2c0790b743ff3c67","6f3a658fc32b4a378716ac167ebaf5ac","19138d3c197ee1e59756d1f4fc3fd66809f44c1b","25117dcb2d852df15fe44c5757147e7038f289e6156b0f6ab86d02c0e97328cb","a768244ca664349a6d1af84a712083c0","39300863bcaad71e5d4efc9a1cae118440aa778f","e14ba0fb92e16bb7db3b1efac4b13aee178542c6994543e7535d8efaa589870c","8e0b1f8390acb832dbf3abadeb7e5fd3","02e6ff95949fdf341daee846820d40289ab65985","4775dfb24f85f5d776f538018a98cc6a9853a1840f5c00b7d0c54695f03a11d9","1cc1534b70b8d2b99b69a721c83e586a","6ac2d77631f775797cd0029e199a5dfe83f47b4c","ffd09a5c27938d1f7424ed66d1474cfeb3df72daabdf10e09f161ed1ffd21271")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("eba5bfca73c2754fbf93ed64fa224132","b746c91e014205db94f775bb6db480387c9ebc20","ec45ebd938e363e36cacb42e968a960fbe4e21ced511f0ea2c0790b743ff3c67","6f3a658fc32b4a378716ac167ebaf5ac","19138d3c197ee1e59756d1f4fc3fd66809f44c1b","25117dcb2d852df15fe44c5757147e7038f289e6156b0f6ab86d02c0e97328cb","a768244ca664349a6d1af84a712083c0","39300863bcaad71e5d4efc9a1cae118440aa778f","e14ba0fb92e16bb7db3b1efac4b13aee178542c6994543e7535d8efaa589870c","8e0b1f8390acb832dbf3abadeb7e5fd3","02e6ff95949fdf341daee846820d40289ab65985","4775dfb24f85f5d776f538018a98cc6a9853a1840f5c00b7d0c54695f03a11d9","1cc1534b70b8d2b99b69a721c83e586a","6ac2d77631f775797cd0029e199a5dfe83f47b4c","ffd09a5c27938d1f7424ed66d1474cfeb3df72daabdf10e09f161ed1ffd21271")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("eba5bfca73c2754fbf93ed64fa224132","b746c91e014205db94f775bb6db480387c9ebc20","ec45ebd938e363e36cacb42e968a960fbe4e21ced511f0ea2c0790b743ff3c67","6f3a658fc32b4a378716ac167ebaf5ac","19138d3c197ee1e59756d1f4fc3fd66809f44c1b","25117dcb2d852df15fe44c5757147e7038f289e6156b0f6ab86d02c0e97328cb","a768244ca664349a6d1af84a712083c0","39300863bcaad71e5d4efc9a1cae118440aa778f","e14ba0fb92e16bb7db3b1efac4b13aee178542c6994543e7535d8efaa589870c","8e0b1f8390acb832dbf3abadeb7e5fd3","02e6ff95949fdf341daee846820d40289ab65985","4775dfb24f85f5d776f538018a98cc6a9853a1840f5c00b7d0c54695f03a11d9","1cc1534b70b8d2b99b69a721c83e586a","6ac2d77631f775797cd0029e199a5dfe83f47b4c","ffd09a5c27938d1f7424ed66d1474cfeb3df72daabdf10e09f161ed1ffd21271")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("eba5bfca73c2754fbf93ed64fa224132","b746c91e014205db94f775bb6db480387c9ebc20","ec45ebd938e363e36cacb42e968a960fbe4e21ced511f0ea2c0790b743ff3c67","6f3a658fc32b4a378716ac167ebaf5ac","19138d3c197ee1e59756d1f4fc3fd66809f44c1b","25117dcb2d852df15fe44c5757147e7038f289e6156b0f6ab86d02c0e97328cb","a768244ca664349a6d1af84a712083c0","39300863bcaad71e5d4efc9a1cae118440aa778f","e14ba0fb92e16bb7db3b1efac4b13aee178542c6994543e7535d8efaa589870c","8e0b1f8390acb832dbf3abadeb7e5fd3","02e6ff95949fdf341daee846820d40289ab65985","4775dfb24f85f5d776f538018a98cc6a9853a1840f5c00b7d0c54695f03a11d9","1cc1534b70b8d2b99b69a721c83e586a","6ac2d77631f775797cd0029e199a5dfe83f47b4c","ffd09a5c27938d1f7424ed66d1474cfeb3df72daabdf10e09f161ed1ffd21271")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("eba5bfca73c2754fbf93ed64fa224132","b746c91e014205db94f775bb6db480387c9ebc20","ec45ebd938e363e36cacb42e968a960fbe4e21ced511f0ea2c0790b743ff3c67","6f3a658fc32b4a378716ac167ebaf5ac","19138d3c197ee1e59756d1f4fc3fd66809f44c1b","25117dcb2d852df15fe44c5757147e7038f289e6156b0f6ab86d02c0e97328cb","a768244ca664349a6d1af84a712083c0","39300863bcaad71e5d4efc9a1cae118440aa778f","e14ba0fb92e16bb7db3b1efac4b13aee178542c6994543e7535d8efaa589870c","8e0b1f8390acb832dbf3abadeb7e5fd3","02e6ff95949fdf341daee846820d40289ab65985","4775dfb24f85f5d776f538018a98cc6a9853a1840f5c00b7d0c54695f03a11d9","1cc1534b70b8d2b99b69a721c83e586a","6ac2d77631f775797cd0029e199a5dfe83f47b4c","ffd09a5c27938d1f7424ed66d1474cfeb3df72daabdf10e09f161ed1ffd21271")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("eba5bfca73c2754fbf93ed64fa224132","b746c91e014205db94f775bb6db480387c9ebc20","ec45ebd938e363e36cacb42e968a960fbe4e21ced511f0ea2c0790b743ff3c67","6f3a658fc32b4a378716ac167ebaf5ac","19138d3c197ee1e59756d1f4fc3fd66809f44c1b","25117dcb2d852df15fe44c5757147e7038f289e6156b0f6ab86d02c0e97328cb","a768244ca664349a6d1af84a712083c0","39300863bcaad71e5d4efc9a1cae118440aa778f","e14ba0fb92e16bb7db3b1efac4b13aee178542c6994543e7535d8efaa589870c","8e0b1f8390acb832dbf3abadeb7e5fd3","02e6ff95949fdf341daee846820d40289ab65985","4775dfb24f85f5d776f538018a98cc6a9853a1840f5c00b7d0c54695f03a11d9","1cc1534b70b8d2b99b69a721c83e586a","6ac2d77631f775797cd0029e199a5dfe83f47b4c","ffd09a5c27938d1f7424ed66d1474cfeb3df72daabdf10e09f161ed1ffd21271")
index=activity AND rg_functionality="Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("eba5bfca73c2754fbf93ed64fa224132","b746c91e014205db94f775bb6db480387c9ebc20","ec45ebd938e363e36cacb42e968a960fbe4e21ced511f0ea2c0790b743ff3c67","6f3a658fc32b4a378716ac167ebaf5ac","19138d3c197ee1e59756d1f4fc3fd66809f44c1b","25117dcb2d852df15fe44c5757147e7038f289e6156b0f6ab86d02c0e97328cb","a768244ca664349a6d1af84a712083c0","39300863bcaad71e5d4efc9a1cae118440aa778f","e14ba0fb92e16bb7db3b1efac4b13aee178542c6994543e7535d8efaa589870c","8e0b1f8390acb832dbf3abadeb7e5fd3","02e6ff95949fdf341daee846820d40289ab65985","4775dfb24f85f5d776f538018a98cc6a9853a1840f5c00b7d0c54695f03a11d9","1cc1534b70b8d2b99b69a721c83e586a","6ac2d77631f775797cd0029e199a5dfe83f47b4c","ffd09a5c27938d1f7424ed66d1474cfeb3df72daabdf10e09f161ed1ffd21271")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("eba5bfca73c2754fbf93ed64fa224132","b746c91e014205db94f775bb6db480387c9ebc20","ec45ebd938e363e36cacb42e968a960fbe4e21ced511f0ea2c0790b743ff3c67","6f3a658fc32b4a378716ac167ebaf5ac","19138d3c197ee1e59756d1f4fc3fd66809f44c1b","25117dcb2d852df15fe44c5757147e7038f289e6156b0f6ab86d02c0e97328cb","a768244ca664349a6d1af84a712083c0","39300863bcaad71e5d4efc9a1cae118440aa778f","e14ba0fb92e16bb7db3b1efac4b13aee178542c6994543e7535d8efaa589870c","8e0b1f8390acb832dbf3abadeb7e5fd3","02e6ff95949fdf341daee846820d40289ab65985","4775dfb24f85f5d776f538018a98cc6a9853a1840f5c00b7d0c54695f03a11d9","1cc1534b70b8d2b99b69a721c83e586a","6ac2d77631f775797cd0029e199a5dfe83f47b4c","ffd09a5c27938d1f7424ed66d1474cfeb3df72daabdf10e09f161ed1ffd21271")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("eba5bfca73c2754fbf93ed64fa224132","b746c91e014205db94f775bb6db480387c9ebc20","ec45ebd938e363e36cacb42e968a960fbe4e21ced511f0ea2c0790b743ff3c67","6f3a658fc32b4a378716ac167ebaf5ac","19138d3c197ee1e59756d1f4fc3fd66809f44c1b","25117dcb2d852df15fe44c5757147e7038f289e6156b0f6ab86d02c0e97328cb","a768244ca664349a6d1af84a712083c0","39300863bcaad71e5d4efc9a1cae118440aa778f","e14ba0fb92e16bb7db3b1efac4b13aee178542c6994543e7535d8efaa589870c","8e0b1f8390acb832dbf3abadeb7e5fd3","02e6ff95949fdf341daee846820d40289ab65985","4775dfb24f85f5d776f538018a98cc6a9853a1840f5c00b7d0c54695f03a11d9","1cc1534b70b8d2b99b69a721c83e586a","6ac2d77631f775797cd0029e199a5dfe83f47b4c","ffd09a5c27938d1f7424ed66d1474cfeb3df72daabdf10e09f161ed1ffd21271")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("eba5bfca73c2754fbf93ed64fa224132","b746c91e014205db94f775bb6db480387c9ebc20","ec45ebd938e363e36cacb42e968a960fbe4e21ced511f0ea2c0790b743ff3c67","6f3a658fc32b4a378716ac167ebaf5ac","19138d3c197ee1e59756d1f4fc3fd66809f44c1b","25117dcb2d852df15fe44c5757147e7038f289e6156b0f6ab86d02c0e97328cb","a768244ca664349a6d1af84a712083c0","39300863bcaad71e5d4efc9a1cae118440aa778f","e14ba0fb92e16bb7db3b1efac4b13aee178542c6994543e7535d8efaa589870c","8e0b1f8390acb832dbf3abadeb7e5fd3","02e6ff95949fdf341daee846820d40289ab65985","4775dfb24f85f5d776f538018a98cc6a9853a1840f5c00b7d0c54695f03a11d9","1cc1534b70b8d2b99b69a721c83e586a","6ac2d77631f775797cd0029e199a5dfe83f47b4c","ffd09a5c27938d1f7424ed66d1474cfeb3df72daabdf10e09f161ed1ffd21271")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("eba5bfca73c2754fbf93ed64fa224132","b746c91e014205db94f775bb6db480387c9ebc20","ec45ebd938e363e36cacb42e968a960fbe4e21ced511f0ea2c0790b743ff3c67","6f3a658fc32b4a378716ac167ebaf5ac","19138d3c197ee1e59756d1f4fc3fd66809f44c1b","25117dcb2d852df15fe44c5757147e7038f289e6156b0f6ab86d02c0e97328cb","a768244ca664349a6d1af84a712083c0","39300863bcaad71e5d4efc9a1cae118440aa778f","e14ba0fb92e16bb7db3b1efac4b13aee178542c6994543e7535d8efaa589870c","8e0b1f8390acb832dbf3abadeb7e5fd3","02e6ff95949fdf341daee846820d40289ab65985","4775dfb24f85f5d776f538018a98cc6a9853a1840f5c00b7d0c54695f03a11d9","1cc1534b70b8d2b99b69a721c83e586a","6ac2d77631f775797cd0029e199a5dfe83f47b4c","ffd09a5c27938d1f7424ed66d1474cfeb3df72daabdf10e09f161ed1ffd21271")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("eba5bfca73c2754fbf93ed64fa224132","b746c91e014205db94f775bb6db480387c9ebc20","ec45ebd938e363e36cacb42e968a960fbe4e21ced511f0ea2c0790b743ff3c67","6f3a658fc32b4a378716ac167ebaf5ac","19138d3c197ee1e59756d1f4fc3fd66809f44c1b","25117dcb2d852df15fe44c5757147e7038f289e6156b0f6ab86d02c0e97328cb","a768244ca664349a6d1af84a712083c0","39300863bcaad71e5d4efc9a1cae118440aa778f","e14ba0fb92e16bb7db3b1efac4b13aee178542c6994543e7535d8efaa589870c","8e0b1f8390acb832dbf3abadeb7e5fd3","02e6ff95949fdf341daee846820d40289ab65985","4775dfb24f85f5d776f538018a98cc6a9853a1840f5c00b7d0c54695f03a11d9","1cc1534b70b8d2b99b69a721c83e586a","6ac2d77631f775797cd0029e199a5dfe83f47b4c","ffd09a5c27938d1f7424ed66d1474cfeb3df72daabdf10e09f161ed1ffd21271")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("eba5bfca73c2754fbf93ed64fa224132","b746c91e014205db94f775bb6db480387c9ebc20","ec45ebd938e363e36cacb42e968a960fbe4e21ced511f0ea2c0790b743ff3c67","6f3a658fc32b4a378716ac167ebaf5ac","19138d3c197ee1e59756d1f4fc3fd66809f44c1b","25117dcb2d852df15fe44c5757147e7038f289e6156b0f6ab86d02c0e97328cb","a768244ca664349a6d1af84a712083c0","39300863bcaad71e5d4efc9a1cae118440aa778f","e14ba0fb92e16bb7db3b1efac4b13aee178542c6994543e7535d8efaa589870c","8e0b1f8390acb832dbf3abadeb7e5fd3","02e6ff95949fdf341daee846820d40289ab65985","4775dfb24f85f5d776f538018a98cc6a9853a1840f5c00b7d0c54695f03a11d9","1cc1534b70b8d2b99b69a721c83e586a","6ac2d77631f775797cd0029e199a5dfe83f47b4c","ffd09a5c27938d1f7424ed66d1474cfeb3df72daabdf10e09f161ed1ffd21271")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("eba5bfca73c2754fbf93ed64fa224132","b746c91e014205db94f775bb6db480387c9ebc20","ec45ebd938e363e36cacb42e968a960fbe4e21ced511f0ea2c0790b743ff3c67","6f3a658fc32b4a378716ac167ebaf5ac","19138d3c197ee1e59756d1f4fc3fd66809f44c1b","25117dcb2d852df15fe44c5757147e7038f289e6156b0f6ab86d02c0e97328cb","a768244ca664349a6d1af84a712083c0","39300863bcaad71e5d4efc9a1cae118440aa778f","e14ba0fb92e16bb7db3b1efac4b13aee178542c6994543e7535d8efaa589870c","8e0b1f8390acb832dbf3abadeb7e5fd3","02e6ff95949fdf341daee846820d40289ab65985","4775dfb24f85f5d776f538018a98cc6a9853a1840f5c00b7d0c54695f03a11d9","1cc1534b70b8d2b99b69a721c83e586a","6ac2d77631f775797cd0029e199a5dfe83f47b4c","ffd09a5c27938d1f7424ed66d1474cfeb3df72daabdf10e09f161ed1ffd21271")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring64 NOT NULL AND customstring64 IN ("eba5bfca73c2754fbf93ed64fa224132","b746c91e014205db94f775bb6db480387c9ebc20","ec45ebd938e363e36cacb42e968a960fbe4e21ced511f0ea2c0790b743ff3c67","6f3a658fc32b4a378716ac167ebaf5ac","19138d3c197ee1e59756d1f4fc3fd66809f44c1b","25117dcb2d852df15fe44c5757147e7038f289e6156b0f6ab86d02c0e97328cb","a768244ca664349a6d1af84a712083c0","39300863bcaad71e5d4efc9a1cae118440aa778f","e14ba0fb92e16bb7db3b1efac4b13aee178542c6994543e7535d8efaa589870c","8e0b1f8390acb832dbf3abadeb7e5fd3","02e6ff95949fdf341daee846820d40289ab65985","4775dfb24f85f5d776f538018a98cc6a9853a1840f5c00b7d0c54695f03a11d9","1cc1534b70b8d2b99b69a721c83e586a","6ac2d77631f775797cd0029e199a5dfe83f47b4c","ffd09a5c27938d1f7424ed66d1474cfeb3df72daabdf10e09f161ed1ffd21271")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("eba5bfca73c2754fbf93ed64fa224132","b746c91e014205db94f775bb6db480387c9ebc20","ec45ebd938e363e36cacb42e968a960fbe4e21ced511f0ea2c0790b743ff3c67","6f3a658fc32b4a378716ac167ebaf5ac","19138d3c197ee1e59756d1f4fc3fd66809f44c1b","25117dcb2d852df15fe44c5757147e7038f289e6156b0f6ab86d02c0e97328cb","a768244ca664349a6d1af84a712083c0","39300863bcaad71e5d4efc9a1cae118440aa778f","e14ba0fb92e16bb7db3b1efac4b13aee178542c6994543e7535d8efaa589870c","8e0b1f8390acb832dbf3abadeb7e5fd3","02e6ff95949fdf341daee846820d40289ab65985","4775dfb24f85f5d776f538018a98cc6a9853a1840f5c00b7d0c54695f03a11d9","1cc1534b70b8d2b99b69a721c83e586a","6ac2d77631f775797cd0029e199a5dfe83f47b4c","ffd09a5c27938d1f7424ed66d1474cfeb3df72daabdf10e09f161ed1ffd21271")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("eba5bfca73c2754fbf93ed64fa224132","b746c91e014205db94f775bb6db480387c9ebc20","ec45ebd938e363e36cacb42e968a960fbe4e21ced511f0ea2c0790b743ff3c67","6f3a658fc32b4a378716ac167ebaf5ac","19138d3c197ee1e59756d1f4fc3fd66809f44c1b","25117dcb2d852df15fe44c5757147e7038f289e6156b0f6ab86d02c0e97328cb","a768244ca664349a6d1af84a712083c0","39300863bcaad71e5d4efc9a1cae118440aa778f","e14ba0fb92e16bb7db3b1efac4b13aee178542c6994543e7535d8efaa589870c","8e0b1f8390acb832dbf3abadeb7e5fd3","02e6ff95949fdf341daee846820d40289ab65985","4775dfb24f85f5d776f538018a98cc6a9853a1840f5c00b7d0c54695f03a11d9","1cc1534b70b8d2b99b69a721c83e586a","6ac2d77631f775797cd0029e199a5dfe83f47b4c","ffd09a5c27938d1f7424ed66d1474cfeb3df72daabdf10e09f161ed1ffd21271")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("eba5bfca73c2754fbf93ed64fa224132","b746c91e014205db94f775bb6db480387c9ebc20","ec45ebd938e363e36cacb42e968a960fbe4e21ced511f0ea2c0790b743ff3c67","6f3a658fc32b4a378716ac167ebaf5ac","19138d3c197ee1e59756d1f4fc3fd66809f44c1b","25117dcb2d852df15fe44c5757147e7038f289e6156b0f6ab86d02c0e97328cb","a768244ca664349a6d1af84a712083c0","39300863bcaad71e5d4efc9a1cae118440aa778f","e14ba0fb92e16bb7db3b1efac4b13aee178542c6994543e7535d8efaa589870c","8e0b1f8390acb832dbf3abadeb7e5fd3","02e6ff95949fdf341daee846820d40289ab65985","4775dfb24f85f5d776f538018a98cc6a9853a1840f5c00b7d0c54695f03a11d9","1cc1534b70b8d2b99b69a721c83e586a","6ac2d77631f775797cd0029e199a5dfe83f47b4c","ffd09a5c27938d1f7424ed66d1474cfeb3df72daabdf10e09f161ed1ffd21271")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring64 NOT NULL AND customstring64 IN ("eba5bfca73c2754fbf93ed64fa224132","b746c91e014205db94f775bb6db480387c9ebc20","ec45ebd938e363e36cacb42e968a960fbe4e21ced511f0ea2c0790b743ff3c67","6f3a658fc32b4a378716ac167ebaf5ac","19138d3c197ee1e59756d1f4fc3fd66809f44c1b","25117dcb2d852df15fe44c5757147e7038f289e6156b0f6ab86d02c0e97328cb","a768244ca664349a6d1af84a712083c0","39300863bcaad71e5d4efc9a1cae118440aa778f","e14ba0fb92e16bb7db3b1efac4b13aee178542c6994543e7535d8efaa589870c","8e0b1f8390acb832dbf3abadeb7e5fd3","02e6ff95949fdf341daee846820d40289ab65985","4775dfb24f85f5d776f538018a98cc6a9853a1840f5c00b7d0c54695f03a11d9","1cc1534b70b8d2b99b69a721c83e586a","6ac2d77631f775797cd0029e199a5dfe83f47b4c","ffd09a5c27938d1f7424ed66d1474cfeb3df72daabdf10e09f161ed1ffd21271")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("eba5bfca73c2754fbf93ed64fa224132","b746c91e014205db94f775bb6db480387c9ebc20","ec45ebd938e363e36cacb42e968a960fbe4e21ced511f0ea2c0790b743ff3c67","6f3a658fc32b4a378716ac167ebaf5ac","19138d3c197ee1e59756d1f4fc3fd66809f44c1b","25117dcb2d852df15fe44c5757147e7038f289e6156b0f6ab86d02c0e97328cb","a768244ca664349a6d1af84a712083c0","39300863bcaad71e5d4efc9a1cae118440aa778f","e14ba0fb92e16bb7db3b1efac4b13aee178542c6994543e7535d8efaa589870c","8e0b1f8390acb832dbf3abadeb7e5fd3","02e6ff95949fdf341daee846820d40289ab65985","4775dfb24f85f5d776f538018a98cc6a9853a1840f5c00b7d0c54695f03a11d9","1cc1534b70b8d2b99b69a721c83e586a","6ac2d77631f775797cd0029e199a5dfe83f47b4c","ffd09a5c27938d1f7424ed66d1474cfeb3df72daabdf10e09f161ed1ffd21271")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("eba5bfca73c2754fbf93ed64fa224132","b746c91e014205db94f775bb6db480387c9ebc20","ec45ebd938e363e36cacb42e968a960fbe4e21ced511f0ea2c0790b743ff3c67","6f3a658fc32b4a378716ac167ebaf5ac","19138d3c197ee1e59756d1f4fc3fd66809f44c1b","25117dcb2d852df15fe44c5757147e7038f289e6156b0f6ab86d02c0e97328cb","a768244ca664349a6d1af84a712083c0","39300863bcaad71e5d4efc9a1cae118440aa778f","e14ba0fb92e16bb7db3b1efac4b13aee178542c6994543e7535d8efaa589870c","8e0b1f8390acb832dbf3abadeb7e5fd3","02e6ff95949fdf341daee846820d40289ab65985","4775dfb24f85f5d776f538018a98cc6a9853a1840f5c00b7d0c54695f03a11d9","1cc1534b70b8d2b99b69a721c83e586a","6ac2d77631f775797cd0029e199a5dfe83f47b4c","ffd09a5c27938d1f7424ed66d1474cfeb3df72daabdf10e09f161ed1ffd21271")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("eba5bfca73c2754fbf93ed64fa224132","b746c91e014205db94f775bb6db480387c9ebc20","ec45ebd938e363e36cacb42e968a960fbe4e21ced511f0ea2c0790b743ff3c67","6f3a658fc32b4a378716ac167ebaf5ac","19138d3c197ee1e59756d1f4fc3fd66809f44c1b","25117dcb2d852df15fe44c5757147e7038f289e6156b0f6ab86d02c0e97328cb","a768244ca664349a6d1af84a712083c0","39300863bcaad71e5d4efc9a1cae118440aa778f","e14ba0fb92e16bb7db3b1efac4b13aee178542c6994543e7535d8efaa589870c","8e0b1f8390acb832dbf3abadeb7e5fd3","02e6ff95949fdf341daee846820d40289ab65985","4775dfb24f85f5d776f538018a98cc6a9853a1840f5c00b7d0c54695f03a11d9","1cc1534b70b8d2b99b69a721c83e586a","6ac2d77631f775797cd0029e199a5dfe83f47b4c","ffd09a5c27938d1f7424ed66d1474cfeb3df72daabdf10e09f161ed1ffd21271")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring64 NOT NULL AND customstring64 IN ("eba5bfca73c2754fbf93ed64fa224132","b746c91e014205db94f775bb6db480387c9ebc20","ec45ebd938e363e36cacb42e968a960fbe4e21ced511f0ea2c0790b743ff3c67","6f3a658fc32b4a378716ac167ebaf5ac","19138d3c197ee1e59756d1f4fc3fd66809f44c1b","25117dcb2d852df15fe44c5757147e7038f289e6156b0f6ab86d02c0e97328cb","a768244ca664349a6d1af84a712083c0","39300863bcaad71e5d4efc9a1cae118440aa778f","e14ba0fb92e16bb7db3b1efac4b13aee178542c6994543e7535d8efaa589870c","8e0b1f8390acb832dbf3abadeb7e5fd3","02e6ff95949fdf341daee846820d40289ab65985","4775dfb24f85f5d776f538018a98cc6a9853a1840f5c00b7d0c54695f03a11d9","1cc1534b70b8d2b99b69a721c83e586a","6ac2d77631f775797cd0029e199a5dfe83f47b4c","ffd09a5c27938d1f7424ed66d1474cfeb3df72daabdf10e09f161ed1ffd21271")
index=activity AND rg_functionality="O365 General" AND filehash NOT NULL AND filehash IN ("eba5bfca73c2754fbf93ed64fa224132","b746c91e014205db94f775bb6db480387c9ebc20","ec45ebd938e363e36cacb42e968a960fbe4e21ced511f0ea2c0790b743ff3c67","6f3a658fc32b4a378716ac167ebaf5ac","19138d3c197ee1e59756d1f4fc3fd66809f44c1b","25117dcb2d852df15fe44c5757147e7038f289e6156b0f6ab86d02c0e97328cb","a768244ca664349a6d1af84a712083c0","39300863bcaad71e5d4efc9a1cae118440aa778f","e14ba0fb92e16bb7db3b1efac4b13aee178542c6994543e7535d8efaa589870c","8e0b1f8390acb832dbf3abadeb7e5fd3","02e6ff95949fdf341daee846820d40289ab65985","4775dfb24f85f5d776f538018a98cc6a9853a1840f5c00b7d0c54695f03a11d9","1cc1534b70b8d2b99b69a721c83e586a","6ac2d77631f775797cd0029e199a5dfe83f47b4c","ffd09a5c27938d1f7424ed66d1474cfeb3df72daabdf10e09f161ed1ffd21271")
index=activity AND rg_functionality="O365 General" AND oldfilehash NOT NULL AND oldfilehash IN ("eba5bfca73c2754fbf93ed64fa224132","b746c91e014205db94f775bb6db480387c9ebc20","ec45ebd938e363e36cacb42e968a960fbe4e21ced511f0ea2c0790b743ff3c67","6f3a658fc32b4a378716ac167ebaf5ac","19138d3c197ee1e59756d1f4fc3fd66809f44c1b","25117dcb2d852df15fe44c5757147e7038f289e6156b0f6ab86d02c0e97328cb","a768244ca664349a6d1af84a712083c0","39300863bcaad71e5d4efc9a1cae118440aa778f","e14ba0fb92e16bb7db3b1efac4b13aee178542c6994543e7535d8efaa589870c","8e0b1f8390acb832dbf3abadeb7e5fd3","02e6ff95949fdf341daee846820d40289ab65985","4775dfb24f85f5d776f538018a98cc6a9853a1840f5c00b7d0c54695f03a11d9","1cc1534b70b8d2b99b69a721c83e586a","6ac2d77631f775797cd0029e199a5dfe83f47b4c","ffd09a5c27938d1f7424ed66d1474cfeb3df72daabdf10e09f161ed1ffd21271")
index=activity AND rg_functionality="O365 General" AND customstring3 NOT NULL AND customstring3 IN ("eba5bfca73c2754fbf93ed64fa224132","b746c91e014205db94f775bb6db480387c9ebc20","ec45ebd938e363e36cacb42e968a960fbe4e21ced511f0ea2c0790b743ff3c67","6f3a658fc32b4a378716ac167ebaf5ac","19138d3c197ee1e59756d1f4fc3fd66809f44c1b","25117dcb2d852df15fe44c5757147e7038f289e6156b0f6ab86d02c0e97328cb","a768244ca664349a6d1af84a712083c0","39300863bcaad71e5d4efc9a1cae118440aa778f","e14ba0fb92e16bb7db3b1efac4b13aee178542c6994543e7535d8efaa589870c","8e0b1f8390acb832dbf3abadeb7e5fd3","02e6ff95949fdf341daee846820d40289ab65985","4775dfb24f85f5d776f538018a98cc6a9853a1840f5c00b7d0c54695f03a11d9","1cc1534b70b8d2b99b69a721c83e586a","6ac2d77631f775797cd0029e199a5dfe83f47b4c","ffd09a5c27938d1f7424ed66d1474cfeb3df72daabdf10e09f161ed1ffd21271")
index=activity AND rg_functionality="O365 General" AND customstring64 NOT NULL AND customstring64 IN ("eba5bfca73c2754fbf93ed64fa224132","b746c91e014205db94f775bb6db480387c9ebc20","ec45ebd938e363e36cacb42e968a960fbe4e21ced511f0ea2c0790b743ff3c67","6f3a658fc32b4a378716ac167ebaf5ac","19138d3c197ee1e59756d1f4fc3fd66809f44c1b","25117dcb2d852df15fe44c5757147e7038f289e6156b0f6ab86d02c0e97328cb","a768244ca664349a6d1af84a712083c0","39300863bcaad71e5d4efc9a1cae118440aa778f","e14ba0fb92e16bb7db3b1efac4b13aee178542c6994543e7535d8efaa589870c","8e0b1f8390acb832dbf3abadeb7e5fd3","02e6ff95949fdf341daee846820d40289ab65985","4775dfb24f85f5d776f538018a98cc6a9853a1840f5c00b7d0c54695f03a11d9","1cc1534b70b8d2b99b69a721c83e586a","6ac2d77631f775797cd0029e199a5dfe83f47b4c","ffd09a5c27938d1f7424ed66d1474cfeb3df72daabdf10e09f161ed1ffd21271")
