index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("b7a182db3ba75e737f75bda1bc76331a","cf0fe28214ad4106c48ec5867327319eaa82b3c3","f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5","f2fa9a3ce883a7f5b43ba5c9ff7bdf75","da6a7e9d39f6a9c802bbd1ce60909de2b6e2a2aa","039e1765de1cdec65ad5e49266ab794f8e5642adb0bdeb78d8c0b77e8b34ae09")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("b7a182db3ba75e737f75bda1bc76331a","cf0fe28214ad4106c48ec5867327319eaa82b3c3","f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5","f2fa9a3ce883a7f5b43ba5c9ff7bdf75","da6a7e9d39f6a9c802bbd1ce60909de2b6e2a2aa","039e1765de1cdec65ad5e49266ab794f8e5642adb0bdeb78d8c0b77e8b34ae09")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("b7a182db3ba75e737f75bda1bc76331a","cf0fe28214ad4106c48ec5867327319eaa82b3c3","f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5","f2fa9a3ce883a7f5b43ba5c9ff7bdf75","da6a7e9d39f6a9c802bbd1ce60909de2b6e2a2aa","039e1765de1cdec65ad5e49266ab794f8e5642adb0bdeb78d8c0b77e8b34ae09")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("b7a182db3ba75e737f75bda1bc76331a","cf0fe28214ad4106c48ec5867327319eaa82b3c3","f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5","f2fa9a3ce883a7f5b43ba5c9ff7bdf75","da6a7e9d39f6a9c802bbd1ce60909de2b6e2a2aa","039e1765de1cdec65ad5e49266ab794f8e5642adb0bdeb78d8c0b77e8b34ae09")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("b7a182db3ba75e737f75bda1bc76331a","cf0fe28214ad4106c48ec5867327319eaa82b3c3","f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5","f2fa9a3ce883a7f5b43ba5c9ff7bdf75","da6a7e9d39f6a9c802bbd1ce60909de2b6e2a2aa","039e1765de1cdec65ad5e49266ab794f8e5642adb0bdeb78d8c0b77e8b34ae09")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("b7a182db3ba75e737f75bda1bc76331a","cf0fe28214ad4106c48ec5867327319eaa82b3c3","f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5","f2fa9a3ce883a7f5b43ba5c9ff7bdf75","da6a7e9d39f6a9c802bbd1ce60909de2b6e2a2aa","039e1765de1cdec65ad5e49266ab794f8e5642adb0bdeb78d8c0b77e8b34ae09")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("b7a182db3ba75e737f75bda1bc76331a","cf0fe28214ad4106c48ec5867327319eaa82b3c3","f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5","f2fa9a3ce883a7f5b43ba5c9ff7bdf75","da6a7e9d39f6a9c802bbd1ce60909de2b6e2a2aa","039e1765de1cdec65ad5e49266ab794f8e5642adb0bdeb78d8c0b77e8b34ae09")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("b7a182db3ba75e737f75bda1bc76331a","cf0fe28214ad4106c48ec5867327319eaa82b3c3","f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5","f2fa9a3ce883a7f5b43ba5c9ff7bdf75","da6a7e9d39f6a9c802bbd1ce60909de2b6e2a2aa","039e1765de1cdec65ad5e49266ab794f8e5642adb0bdeb78d8c0b77e8b34ae09")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("b7a182db3ba75e737f75bda1bc76331a","cf0fe28214ad4106c48ec5867327319eaa82b3c3","f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5","f2fa9a3ce883a7f5b43ba5c9ff7bdf75","da6a7e9d39f6a9c802bbd1ce60909de2b6e2a2aa","039e1765de1cdec65ad5e49266ab794f8e5642adb0bdeb78d8c0b77e8b34ae09")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("b7a182db3ba75e737f75bda1bc76331a","cf0fe28214ad4106c48ec5867327319eaa82b3c3","f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5","f2fa9a3ce883a7f5b43ba5c9ff7bdf75","da6a7e9d39f6a9c802bbd1ce60909de2b6e2a2aa","039e1765de1cdec65ad5e49266ab794f8e5642adb0bdeb78d8c0b77e8b34ae09")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("b7a182db3ba75e737f75bda1bc76331a","cf0fe28214ad4106c48ec5867327319eaa82b3c3","f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5","f2fa9a3ce883a7f5b43ba5c9ff7bdf75","da6a7e9d39f6a9c802bbd1ce60909de2b6e2a2aa","039e1765de1cdec65ad5e49266ab794f8e5642adb0bdeb78d8c0b77e8b34ae09")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("b7a182db3ba75e737f75bda1bc76331a","cf0fe28214ad4106c48ec5867327319eaa82b3c3","f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5","f2fa9a3ce883a7f5b43ba5c9ff7bdf75","da6a7e9d39f6a9c802bbd1ce60909de2b6e2a2aa","039e1765de1cdec65ad5e49266ab794f8e5642adb0bdeb78d8c0b77e8b34ae09")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("b7a182db3ba75e737f75bda1bc76331a","cf0fe28214ad4106c48ec5867327319eaa82b3c3","f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5","f2fa9a3ce883a7f5b43ba5c9ff7bdf75","da6a7e9d39f6a9c802bbd1ce60909de2b6e2a2aa","039e1765de1cdec65ad5e49266ab794f8e5642adb0bdeb78d8c0b77e8b34ae09")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("b7a182db3ba75e737f75bda1bc76331a","cf0fe28214ad4106c48ec5867327319eaa82b3c3","f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5","f2fa9a3ce883a7f5b43ba5c9ff7bdf75","da6a7e9d39f6a9c802bbd1ce60909de2b6e2a2aa","039e1765de1cdec65ad5e49266ab794f8e5642adb0bdeb78d8c0b77e8b34ae09")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("b7a182db3ba75e737f75bda1bc76331a","cf0fe28214ad4106c48ec5867327319eaa82b3c3","f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5","f2fa9a3ce883a7f5b43ba5c9ff7bdf75","da6a7e9d39f6a9c802bbd1ce60909de2b6e2a2aa","039e1765de1cdec65ad5e49266ab794f8e5642adb0bdeb78d8c0b77e8b34ae09")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("b7a182db3ba75e737f75bda1bc76331a","cf0fe28214ad4106c48ec5867327319eaa82b3c3","f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5","f2fa9a3ce883a7f5b43ba5c9ff7bdf75","da6a7e9d39f6a9c802bbd1ce60909de2b6e2a2aa","039e1765de1cdec65ad5e49266ab794f8e5642adb0bdeb78d8c0b77e8b34ae09")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("b7a182db3ba75e737f75bda1bc76331a","cf0fe28214ad4106c48ec5867327319eaa82b3c3","f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5","f2fa9a3ce883a7f5b43ba5c9ff7bdf75","da6a7e9d39f6a9c802bbd1ce60909de2b6e2a2aa","039e1765de1cdec65ad5e49266ab794f8e5642adb0bdeb78d8c0b77e8b34ae09")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("b7a182db3ba75e737f75bda1bc76331a","cf0fe28214ad4106c48ec5867327319eaa82b3c3","f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5","f2fa9a3ce883a7f5b43ba5c9ff7bdf75","da6a7e9d39f6a9c802bbd1ce60909de2b6e2a2aa","039e1765de1cdec65ad5e49266ab794f8e5642adb0bdeb78d8c0b77e8b34ae09")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("b7a182db3ba75e737f75bda1bc76331a","cf0fe28214ad4106c48ec5867327319eaa82b3c3","f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5","f2fa9a3ce883a7f5b43ba5c9ff7bdf75","da6a7e9d39f6a9c802bbd1ce60909de2b6e2a2aa","039e1765de1cdec65ad5e49266ab794f8e5642adb0bdeb78d8c0b77e8b34ae09")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("b7a182db3ba75e737f75bda1bc76331a","cf0fe28214ad4106c48ec5867327319eaa82b3c3","f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5","f2fa9a3ce883a7f5b43ba5c9ff7bdf75","da6a7e9d39f6a9c802bbd1ce60909de2b6e2a2aa","039e1765de1cdec65ad5e49266ab794f8e5642adb0bdeb78d8c0b77e8b34ae09")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("b7a182db3ba75e737f75bda1bc76331a","cf0fe28214ad4106c48ec5867327319eaa82b3c3","f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5","f2fa9a3ce883a7f5b43ba5c9ff7bdf75","da6a7e9d39f6a9c802bbd1ce60909de2b6e2a2aa","039e1765de1cdec65ad5e49266ab794f8e5642adb0bdeb78d8c0b77e8b34ae09")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("b7a182db3ba75e737f75bda1bc76331a","cf0fe28214ad4106c48ec5867327319eaa82b3c3","f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5","f2fa9a3ce883a7f5b43ba5c9ff7bdf75","da6a7e9d39f6a9c802bbd1ce60909de2b6e2a2aa","039e1765de1cdec65ad5e49266ab794f8e5642adb0bdeb78d8c0b77e8b34ae09")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("b7a182db3ba75e737f75bda1bc76331a","cf0fe28214ad4106c48ec5867327319eaa82b3c3","f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5","f2fa9a3ce883a7f5b43ba5c9ff7bdf75","da6a7e9d39f6a9c802bbd1ce60909de2b6e2a2aa","039e1765de1cdec65ad5e49266ab794f8e5642adb0bdeb78d8c0b77e8b34ae09")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("b7a182db3ba75e737f75bda1bc76331a","cf0fe28214ad4106c48ec5867327319eaa82b3c3","f3caa040efb298878b99f883a898f76d92554e07a8958e90ff70e7ff3cfabdf5","f2fa9a3ce883a7f5b43ba5c9ff7bdf75","da6a7e9d39f6a9c802bbd1ce60909de2b6e2a2aa","039e1765de1cdec65ad5e49266ab794f8e5642adb0bdeb78d8c0b77e8b34ae09")
