index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("274685C591E96CB1F9CAE91EC8E7073F3A4CB113","D4FFD891B9FC1AE212489ABBA43D76E2D58E6782","F47D9EC9C2515761E2BC40287B299420A86AF6AB","0466E90BF0E83B776CA8716E01D35A8A2E5F96D3","1ED1174E6E5545AAA081A480156485156B9D3A13","2CF9376B057E187B9F465BDAF1C50FDBA9BA66E6","ccb219be156551464a2b91dfc5cddaf0c3e8321f","7617511adda7cb03f317f0df61624b5ecbffcd87")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("274685C591E96CB1F9CAE91EC8E7073F3A4CB113","D4FFD891B9FC1AE212489ABBA43D76E2D58E6782","F47D9EC9C2515761E2BC40287B299420A86AF6AB","0466E90BF0E83B776CA8716E01D35A8A2E5F96D3","1ED1174E6E5545AAA081A480156485156B9D3A13","2CF9376B057E187B9F465BDAF1C50FDBA9BA66E6","ccb219be156551464a2b91dfc5cddaf0c3e8321f","7617511adda7cb03f317f0df61624b5ecbffcd87")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("274685C591E96CB1F9CAE91EC8E7073F3A4CB113","D4FFD891B9FC1AE212489ABBA43D76E2D58E6782","F47D9EC9C2515761E2BC40287B299420A86AF6AB","0466E90BF0E83B776CA8716E01D35A8A2E5F96D3","1ED1174E6E5545AAA081A480156485156B9D3A13","2CF9376B057E187B9F465BDAF1C50FDBA9BA66E6","ccb219be156551464a2b91dfc5cddaf0c3e8321f","7617511adda7cb03f317f0df61624b5ecbffcd87")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("274685C591E96CB1F9CAE91EC8E7073F3A4CB113","D4FFD891B9FC1AE212489ABBA43D76E2D58E6782","F47D9EC9C2515761E2BC40287B299420A86AF6AB","0466E90BF0E83B776CA8716E01D35A8A2E5F96D3","1ED1174E6E5545AAA081A480156485156B9D3A13","2CF9376B057E187B9F465BDAF1C50FDBA9BA66E6","ccb219be156551464a2b91dfc5cddaf0c3e8321f","7617511adda7cb03f317f0df61624b5ecbffcd87")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("274685C591E96CB1F9CAE91EC8E7073F3A4CB113","D4FFD891B9FC1AE212489ABBA43D76E2D58E6782","F47D9EC9C2515761E2BC40287B299420A86AF6AB","0466E90BF0E83B776CA8716E01D35A8A2E5F96D3","1ED1174E6E5545AAA081A480156485156B9D3A13","2CF9376B057E187B9F465BDAF1C50FDBA9BA66E6","ccb219be156551464a2b91dfc5cddaf0c3e8321f","7617511adda7cb03f317f0df61624b5ecbffcd87")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("274685C591E96CB1F9CAE91EC8E7073F3A4CB113","D4FFD891B9FC1AE212489ABBA43D76E2D58E6782","F47D9EC9C2515761E2BC40287B299420A86AF6AB","0466E90BF0E83B776CA8716E01D35A8A2E5F96D3","1ED1174E6E5545AAA081A480156485156B9D3A13","2CF9376B057E187B9F465BDAF1C50FDBA9BA66E6","ccb219be156551464a2b91dfc5cddaf0c3e8321f","7617511adda7cb03f317f0df61624b5ecbffcd87")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("274685C591E96CB1F9CAE91EC8E7073F3A4CB113","D4FFD891B9FC1AE212489ABBA43D76E2D58E6782","F47D9EC9C2515761E2BC40287B299420A86AF6AB","0466E90BF0E83B776CA8716E01D35A8A2E5F96D3","1ED1174E6E5545AAA081A480156485156B9D3A13","2CF9376B057E187B9F465BDAF1C50FDBA9BA66E6","ccb219be156551464a2b91dfc5cddaf0c3e8321f","7617511adda7cb03f317f0df61624b5ecbffcd87")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("274685C591E96CB1F9CAE91EC8E7073F3A4CB113","D4FFD891B9FC1AE212489ABBA43D76E2D58E6782","F47D9EC9C2515761E2BC40287B299420A86AF6AB","0466E90BF0E83B776CA8716E01D35A8A2E5F96D3","1ED1174E6E5545AAA081A480156485156B9D3A13","2CF9376B057E187B9F465BDAF1C50FDBA9BA66E6","ccb219be156551464a2b91dfc5cddaf0c3e8321f","7617511adda7cb03f317f0df61624b5ecbffcd87")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("274685C591E96CB1F9CAE91EC8E7073F3A4CB113","D4FFD891B9FC1AE212489ABBA43D76E2D58E6782","F47D9EC9C2515761E2BC40287B299420A86AF6AB","0466E90BF0E83B776CA8716E01D35A8A2E5F96D3","1ED1174E6E5545AAA081A480156485156B9D3A13","2CF9376B057E187B9F465BDAF1C50FDBA9BA66E6","ccb219be156551464a2b91dfc5cddaf0c3e8321f","7617511adda7cb03f317f0df61624b5ecbffcd87")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("274685C591E96CB1F9CAE91EC8E7073F3A4CB113","D4FFD891B9FC1AE212489ABBA43D76E2D58E6782","F47D9EC9C2515761E2BC40287B299420A86AF6AB","0466E90BF0E83B776CA8716E01D35A8A2E5F96D3","1ED1174E6E5545AAA081A480156485156B9D3A13","2CF9376B057E187B9F465BDAF1C50FDBA9BA66E6","ccb219be156551464a2b91dfc5cddaf0c3e8321f","7617511adda7cb03f317f0df61624b5ecbffcd87")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("274685C591E96CB1F9CAE91EC8E7073F3A4CB113","D4FFD891B9FC1AE212489ABBA43D76E2D58E6782","F47D9EC9C2515761E2BC40287B299420A86AF6AB","0466E90BF0E83B776CA8716E01D35A8A2E5F96D3","1ED1174E6E5545AAA081A480156485156B9D3A13","2CF9376B057E187B9F465BDAF1C50FDBA9BA66E6","ccb219be156551464a2b91dfc5cddaf0c3e8321f","7617511adda7cb03f317f0df61624b5ecbffcd87")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("274685C591E96CB1F9CAE91EC8E7073F3A4CB113","D4FFD891B9FC1AE212489ABBA43D76E2D58E6782","F47D9EC9C2515761E2BC40287B299420A86AF6AB","0466E90BF0E83B776CA8716E01D35A8A2E5F96D3","1ED1174E6E5545AAA081A480156485156B9D3A13","2CF9376B057E187B9F465BDAF1C50FDBA9BA66E6","ccb219be156551464a2b91dfc5cddaf0c3e8321f","7617511adda7cb03f317f0df61624b5ecbffcd87")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("274685C591E96CB1F9CAE91EC8E7073F3A4CB113","D4FFD891B9FC1AE212489ABBA43D76E2D58E6782","F47D9EC9C2515761E2BC40287B299420A86AF6AB","0466E90BF0E83B776CA8716E01D35A8A2E5F96D3","1ED1174E6E5545AAA081A480156485156B9D3A13","2CF9376B057E187B9F465BDAF1C50FDBA9BA66E6","ccb219be156551464a2b91dfc5cddaf0c3e8321f","7617511adda7cb03f317f0df61624b5ecbffcd87")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("274685C591E96CB1F9CAE91EC8E7073F3A4CB113","D4FFD891B9FC1AE212489ABBA43D76E2D58E6782","F47D9EC9C2515761E2BC40287B299420A86AF6AB","0466E90BF0E83B776CA8716E01D35A8A2E5F96D3","1ED1174E6E5545AAA081A480156485156B9D3A13","2CF9376B057E187B9F465BDAF1C50FDBA9BA66E6","ccb219be156551464a2b91dfc5cddaf0c3e8321f","7617511adda7cb03f317f0df61624b5ecbffcd87")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("274685C591E96CB1F9CAE91EC8E7073F3A4CB113","D4FFD891B9FC1AE212489ABBA43D76E2D58E6782","F47D9EC9C2515761E2BC40287B299420A86AF6AB","0466E90BF0E83B776CA8716E01D35A8A2E5F96D3","1ED1174E6E5545AAA081A480156485156B9D3A13","2CF9376B057E187B9F465BDAF1C50FDBA9BA66E6","ccb219be156551464a2b91dfc5cddaf0c3e8321f","7617511adda7cb03f317f0df61624b5ecbffcd87")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("274685C591E96CB1F9CAE91EC8E7073F3A4CB113","D4FFD891B9FC1AE212489ABBA43D76E2D58E6782","F47D9EC9C2515761E2BC40287B299420A86AF6AB","0466E90BF0E83B776CA8716E01D35A8A2E5F96D3","1ED1174E6E5545AAA081A480156485156B9D3A13","2CF9376B057E187B9F465BDAF1C50FDBA9BA66E6","ccb219be156551464a2b91dfc5cddaf0c3e8321f","7617511adda7cb03f317f0df61624b5ecbffcd87")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("274685C591E96CB1F9CAE91EC8E7073F3A4CB113","D4FFD891B9FC1AE212489ABBA43D76E2D58E6782","F47D9EC9C2515761E2BC40287B299420A86AF6AB","0466E90BF0E83B776CA8716E01D35A8A2E5F96D3","1ED1174E6E5545AAA081A480156485156B9D3A13","2CF9376B057E187B9F465BDAF1C50FDBA9BA66E6","ccb219be156551464a2b91dfc5cddaf0c3e8321f","7617511adda7cb03f317f0df61624b5ecbffcd87")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("274685C591E96CB1F9CAE91EC8E7073F3A4CB113","D4FFD891B9FC1AE212489ABBA43D76E2D58E6782","F47D9EC9C2515761E2BC40287B299420A86AF6AB","0466E90BF0E83B776CA8716E01D35A8A2E5F96D3","1ED1174E6E5545AAA081A480156485156B9D3A13","2CF9376B057E187B9F465BDAF1C50FDBA9BA66E6","ccb219be156551464a2b91dfc5cddaf0c3e8321f","7617511adda7cb03f317f0df61624b5ecbffcd87")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("274685C591E96CB1F9CAE91EC8E7073F3A4CB113","D4FFD891B9FC1AE212489ABBA43D76E2D58E6782","F47D9EC9C2515761E2BC40287B299420A86AF6AB","0466E90BF0E83B776CA8716E01D35A8A2E5F96D3","1ED1174E6E5545AAA081A480156485156B9D3A13","2CF9376B057E187B9F465BDAF1C50FDBA9BA66E6","ccb219be156551464a2b91dfc5cddaf0c3e8321f","7617511adda7cb03f317f0df61624b5ecbffcd87")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("274685C591E96CB1F9CAE91EC8E7073F3A4CB113","D4FFD891B9FC1AE212489ABBA43D76E2D58E6782","F47D9EC9C2515761E2BC40287B299420A86AF6AB","0466E90BF0E83B776CA8716E01D35A8A2E5F96D3","1ED1174E6E5545AAA081A480156485156B9D3A13","2CF9376B057E187B9F465BDAF1C50FDBA9BA66E6","ccb219be156551464a2b91dfc5cddaf0c3e8321f","7617511adda7cb03f317f0df61624b5ecbffcd87")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("274685C591E96CB1F9CAE91EC8E7073F3A4CB113","D4FFD891B9FC1AE212489ABBA43D76E2D58E6782","F47D9EC9C2515761E2BC40287B299420A86AF6AB","0466E90BF0E83B776CA8716E01D35A8A2E5F96D3","1ED1174E6E5545AAA081A480156485156B9D3A13","2CF9376B057E187B9F465BDAF1C50FDBA9BA66E6","ccb219be156551464a2b91dfc5cddaf0c3e8321f","7617511adda7cb03f317f0df61624b5ecbffcd87")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("274685C591E96CB1F9CAE91EC8E7073F3A4CB113","D4FFD891B9FC1AE212489ABBA43D76E2D58E6782","F47D9EC9C2515761E2BC40287B299420A86AF6AB","0466E90BF0E83B776CA8716E01D35A8A2E5F96D3","1ED1174E6E5545AAA081A480156485156B9D3A13","2CF9376B057E187B9F465BDAF1C50FDBA9BA66E6","ccb219be156551464a2b91dfc5cddaf0c3e8321f","7617511adda7cb03f317f0df61624b5ecbffcd87")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("274685C591E96CB1F9CAE91EC8E7073F3A4CB113","D4FFD891B9FC1AE212489ABBA43D76E2D58E6782","F47D9EC9C2515761E2BC40287B299420A86AF6AB","0466E90BF0E83B776CA8716E01D35A8A2E5F96D3","1ED1174E6E5545AAA081A480156485156B9D3A13","2CF9376B057E187B9F465BDAF1C50FDBA9BA66E6","ccb219be156551464a2b91dfc5cddaf0c3e8321f","7617511adda7cb03f317f0df61624b5ecbffcd87")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("274685C591E96CB1F9CAE91EC8E7073F3A4CB113","D4FFD891B9FC1AE212489ABBA43D76E2D58E6782","F47D9EC9C2515761E2BC40287B299420A86AF6AB","0466E90BF0E83B776CA8716E01D35A8A2E5F96D3","1ED1174E6E5545AAA081A480156485156B9D3A13","2CF9376B057E187B9F465BDAF1C50FDBA9BA66E6","ccb219be156551464a2b91dfc5cddaf0c3e8321f","7617511adda7cb03f317f0df61624b5ecbffcd87")
