index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("1178e2b691fd266ccd29867acf134c855241b18b730b766da0ae69c53d4b9776","56a13812819c8426941c9bd8b63d3a9f","9aa9290d337d68136030fc8182f7d499951a207e","4368f30798a1caa0a7b30735111e143068678a0547dfd38c050926619869c73a","4b01f0d2de0b557cd13e42a36b78894f","b8a0d70e602684067b2dc5565a5f6a786fb298fa","bf8f74a05e4a10ab893c73bc95ed16c3b5c6ffe6e257c098b33c04c3a893acb9","cd513de769a9c385b218306e7affc131","1a22bc573674186f234dd541b9fccaf938195b33","86bd9cdfdb425266c477544a5cf951fdc56733d46f1a7b44f8188168b5e2fb15","cd4b9ae02fdddfdb555ee45591deca4f","e6f98d1666896c84279db4fb6af5c5e6d815bb75")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("1178e2b691fd266ccd29867acf134c855241b18b730b766da0ae69c53d4b9776","56a13812819c8426941c9bd8b63d3a9f","9aa9290d337d68136030fc8182f7d499951a207e","4368f30798a1caa0a7b30735111e143068678a0547dfd38c050926619869c73a","4b01f0d2de0b557cd13e42a36b78894f","b8a0d70e602684067b2dc5565a5f6a786fb298fa","bf8f74a05e4a10ab893c73bc95ed16c3b5c6ffe6e257c098b33c04c3a893acb9","cd513de769a9c385b218306e7affc131","1a22bc573674186f234dd541b9fccaf938195b33","86bd9cdfdb425266c477544a5cf951fdc56733d46f1a7b44f8188168b5e2fb15","cd4b9ae02fdddfdb555ee45591deca4f","e6f98d1666896c84279db4fb6af5c5e6d815bb75")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("1178e2b691fd266ccd29867acf134c855241b18b730b766da0ae69c53d4b9776","56a13812819c8426941c9bd8b63d3a9f","9aa9290d337d68136030fc8182f7d499951a207e","4368f30798a1caa0a7b30735111e143068678a0547dfd38c050926619869c73a","4b01f0d2de0b557cd13e42a36b78894f","b8a0d70e602684067b2dc5565a5f6a786fb298fa","bf8f74a05e4a10ab893c73bc95ed16c3b5c6ffe6e257c098b33c04c3a893acb9","cd513de769a9c385b218306e7affc131","1a22bc573674186f234dd541b9fccaf938195b33","86bd9cdfdb425266c477544a5cf951fdc56733d46f1a7b44f8188168b5e2fb15","cd4b9ae02fdddfdb555ee45591deca4f","e6f98d1666896c84279db4fb6af5c5e6d815bb75")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("1178e2b691fd266ccd29867acf134c855241b18b730b766da0ae69c53d4b9776","56a13812819c8426941c9bd8b63d3a9f","9aa9290d337d68136030fc8182f7d499951a207e","4368f30798a1caa0a7b30735111e143068678a0547dfd38c050926619869c73a","4b01f0d2de0b557cd13e42a36b78894f","b8a0d70e602684067b2dc5565a5f6a786fb298fa","bf8f74a05e4a10ab893c73bc95ed16c3b5c6ffe6e257c098b33c04c3a893acb9","cd513de769a9c385b218306e7affc131","1a22bc573674186f234dd541b9fccaf938195b33","86bd9cdfdb425266c477544a5cf951fdc56733d46f1a7b44f8188168b5e2fb15","cd4b9ae02fdddfdb555ee45591deca4f","e6f98d1666896c84279db4fb6af5c5e6d815bb75")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("1178e2b691fd266ccd29867acf134c855241b18b730b766da0ae69c53d4b9776","56a13812819c8426941c9bd8b63d3a9f","9aa9290d337d68136030fc8182f7d499951a207e","4368f30798a1caa0a7b30735111e143068678a0547dfd38c050926619869c73a","4b01f0d2de0b557cd13e42a36b78894f","b8a0d70e602684067b2dc5565a5f6a786fb298fa","bf8f74a05e4a10ab893c73bc95ed16c3b5c6ffe6e257c098b33c04c3a893acb9","cd513de769a9c385b218306e7affc131","1a22bc573674186f234dd541b9fccaf938195b33","86bd9cdfdb425266c477544a5cf951fdc56733d46f1a7b44f8188168b5e2fb15","cd4b9ae02fdddfdb555ee45591deca4f","e6f98d1666896c84279db4fb6af5c5e6d815bb75")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("1178e2b691fd266ccd29867acf134c855241b18b730b766da0ae69c53d4b9776","56a13812819c8426941c9bd8b63d3a9f","9aa9290d337d68136030fc8182f7d499951a207e","4368f30798a1caa0a7b30735111e143068678a0547dfd38c050926619869c73a","4b01f0d2de0b557cd13e42a36b78894f","b8a0d70e602684067b2dc5565a5f6a786fb298fa","bf8f74a05e4a10ab893c73bc95ed16c3b5c6ffe6e257c098b33c04c3a893acb9","cd513de769a9c385b218306e7affc131","1a22bc573674186f234dd541b9fccaf938195b33","86bd9cdfdb425266c477544a5cf951fdc56733d46f1a7b44f8188168b5e2fb15","cd4b9ae02fdddfdb555ee45591deca4f","e6f98d1666896c84279db4fb6af5c5e6d815bb75")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("1178e2b691fd266ccd29867acf134c855241b18b730b766da0ae69c53d4b9776","56a13812819c8426941c9bd8b63d3a9f","9aa9290d337d68136030fc8182f7d499951a207e","4368f30798a1caa0a7b30735111e143068678a0547dfd38c050926619869c73a","4b01f0d2de0b557cd13e42a36b78894f","b8a0d70e602684067b2dc5565a5f6a786fb298fa","bf8f74a05e4a10ab893c73bc95ed16c3b5c6ffe6e257c098b33c04c3a893acb9","cd513de769a9c385b218306e7affc131","1a22bc573674186f234dd541b9fccaf938195b33","86bd9cdfdb425266c477544a5cf951fdc56733d46f1a7b44f8188168b5e2fb15","cd4b9ae02fdddfdb555ee45591deca4f","e6f98d1666896c84279db4fb6af5c5e6d815bb75")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("1178e2b691fd266ccd29867acf134c855241b18b730b766da0ae69c53d4b9776","56a13812819c8426941c9bd8b63d3a9f","9aa9290d337d68136030fc8182f7d499951a207e","4368f30798a1caa0a7b30735111e143068678a0547dfd38c050926619869c73a","4b01f0d2de0b557cd13e42a36b78894f","b8a0d70e602684067b2dc5565a5f6a786fb298fa","bf8f74a05e4a10ab893c73bc95ed16c3b5c6ffe6e257c098b33c04c3a893acb9","cd513de769a9c385b218306e7affc131","1a22bc573674186f234dd541b9fccaf938195b33","86bd9cdfdb425266c477544a5cf951fdc56733d46f1a7b44f8188168b5e2fb15","cd4b9ae02fdddfdb555ee45591deca4f","e6f98d1666896c84279db4fb6af5c5e6d815bb75")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("1178e2b691fd266ccd29867acf134c855241b18b730b766da0ae69c53d4b9776","56a13812819c8426941c9bd8b63d3a9f","9aa9290d337d68136030fc8182f7d499951a207e","4368f30798a1caa0a7b30735111e143068678a0547dfd38c050926619869c73a","4b01f0d2de0b557cd13e42a36b78894f","b8a0d70e602684067b2dc5565a5f6a786fb298fa","bf8f74a05e4a10ab893c73bc95ed16c3b5c6ffe6e257c098b33c04c3a893acb9","cd513de769a9c385b218306e7affc131","1a22bc573674186f234dd541b9fccaf938195b33","86bd9cdfdb425266c477544a5cf951fdc56733d46f1a7b44f8188168b5e2fb15","cd4b9ae02fdddfdb555ee45591deca4f","e6f98d1666896c84279db4fb6af5c5e6d815bb75")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("1178e2b691fd266ccd29867acf134c855241b18b730b766da0ae69c53d4b9776","56a13812819c8426941c9bd8b63d3a9f","9aa9290d337d68136030fc8182f7d499951a207e","4368f30798a1caa0a7b30735111e143068678a0547dfd38c050926619869c73a","4b01f0d2de0b557cd13e42a36b78894f","b8a0d70e602684067b2dc5565a5f6a786fb298fa","bf8f74a05e4a10ab893c73bc95ed16c3b5c6ffe6e257c098b33c04c3a893acb9","cd513de769a9c385b218306e7affc131","1a22bc573674186f234dd541b9fccaf938195b33","86bd9cdfdb425266c477544a5cf951fdc56733d46f1a7b44f8188168b5e2fb15","cd4b9ae02fdddfdb555ee45591deca4f","e6f98d1666896c84279db4fb6af5c5e6d815bb75")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("1178e2b691fd266ccd29867acf134c855241b18b730b766da0ae69c53d4b9776","56a13812819c8426941c9bd8b63d3a9f","9aa9290d337d68136030fc8182f7d499951a207e","4368f30798a1caa0a7b30735111e143068678a0547dfd38c050926619869c73a","4b01f0d2de0b557cd13e42a36b78894f","b8a0d70e602684067b2dc5565a5f6a786fb298fa","bf8f74a05e4a10ab893c73bc95ed16c3b5c6ffe6e257c098b33c04c3a893acb9","cd513de769a9c385b218306e7affc131","1a22bc573674186f234dd541b9fccaf938195b33","86bd9cdfdb425266c477544a5cf951fdc56733d46f1a7b44f8188168b5e2fb15","cd4b9ae02fdddfdb555ee45591deca4f","e6f98d1666896c84279db4fb6af5c5e6d815bb75")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("1178e2b691fd266ccd29867acf134c855241b18b730b766da0ae69c53d4b9776","56a13812819c8426941c9bd8b63d3a9f","9aa9290d337d68136030fc8182f7d499951a207e","4368f30798a1caa0a7b30735111e143068678a0547dfd38c050926619869c73a","4b01f0d2de0b557cd13e42a36b78894f","b8a0d70e602684067b2dc5565a5f6a786fb298fa","bf8f74a05e4a10ab893c73bc95ed16c3b5c6ffe6e257c098b33c04c3a893acb9","cd513de769a9c385b218306e7affc131","1a22bc573674186f234dd541b9fccaf938195b33","86bd9cdfdb425266c477544a5cf951fdc56733d46f1a7b44f8188168b5e2fb15","cd4b9ae02fdddfdb555ee45591deca4f","e6f98d1666896c84279db4fb6af5c5e6d815bb75")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("1178e2b691fd266ccd29867acf134c855241b18b730b766da0ae69c53d4b9776","56a13812819c8426941c9bd8b63d3a9f","9aa9290d337d68136030fc8182f7d499951a207e","4368f30798a1caa0a7b30735111e143068678a0547dfd38c050926619869c73a","4b01f0d2de0b557cd13e42a36b78894f","b8a0d70e602684067b2dc5565a5f6a786fb298fa","bf8f74a05e4a10ab893c73bc95ed16c3b5c6ffe6e257c098b33c04c3a893acb9","cd513de769a9c385b218306e7affc131","1a22bc573674186f234dd541b9fccaf938195b33","86bd9cdfdb425266c477544a5cf951fdc56733d46f1a7b44f8188168b5e2fb15","cd4b9ae02fdddfdb555ee45591deca4f","e6f98d1666896c84279db4fb6af5c5e6d815bb75")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("1178e2b691fd266ccd29867acf134c855241b18b730b766da0ae69c53d4b9776","56a13812819c8426941c9bd8b63d3a9f","9aa9290d337d68136030fc8182f7d499951a207e","4368f30798a1caa0a7b30735111e143068678a0547dfd38c050926619869c73a","4b01f0d2de0b557cd13e42a36b78894f","b8a0d70e602684067b2dc5565a5f6a786fb298fa","bf8f74a05e4a10ab893c73bc95ed16c3b5c6ffe6e257c098b33c04c3a893acb9","cd513de769a9c385b218306e7affc131","1a22bc573674186f234dd541b9fccaf938195b33","86bd9cdfdb425266c477544a5cf951fdc56733d46f1a7b44f8188168b5e2fb15","cd4b9ae02fdddfdb555ee45591deca4f","e6f98d1666896c84279db4fb6af5c5e6d815bb75")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("1178e2b691fd266ccd29867acf134c855241b18b730b766da0ae69c53d4b9776","56a13812819c8426941c9bd8b63d3a9f","9aa9290d337d68136030fc8182f7d499951a207e","4368f30798a1caa0a7b30735111e143068678a0547dfd38c050926619869c73a","4b01f0d2de0b557cd13e42a36b78894f","b8a0d70e602684067b2dc5565a5f6a786fb298fa","bf8f74a05e4a10ab893c73bc95ed16c3b5c6ffe6e257c098b33c04c3a893acb9","cd513de769a9c385b218306e7affc131","1a22bc573674186f234dd541b9fccaf938195b33","86bd9cdfdb425266c477544a5cf951fdc56733d46f1a7b44f8188168b5e2fb15","cd4b9ae02fdddfdb555ee45591deca4f","e6f98d1666896c84279db4fb6af5c5e6d815bb75")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("1178e2b691fd266ccd29867acf134c855241b18b730b766da0ae69c53d4b9776","56a13812819c8426941c9bd8b63d3a9f","9aa9290d337d68136030fc8182f7d499951a207e","4368f30798a1caa0a7b30735111e143068678a0547dfd38c050926619869c73a","4b01f0d2de0b557cd13e42a36b78894f","b8a0d70e602684067b2dc5565a5f6a786fb298fa","bf8f74a05e4a10ab893c73bc95ed16c3b5c6ffe6e257c098b33c04c3a893acb9","cd513de769a9c385b218306e7affc131","1a22bc573674186f234dd541b9fccaf938195b33","86bd9cdfdb425266c477544a5cf951fdc56733d46f1a7b44f8188168b5e2fb15","cd4b9ae02fdddfdb555ee45591deca4f","e6f98d1666896c84279db4fb6af5c5e6d815bb75")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("1178e2b691fd266ccd29867acf134c855241b18b730b766da0ae69c53d4b9776","56a13812819c8426941c9bd8b63d3a9f","9aa9290d337d68136030fc8182f7d499951a207e","4368f30798a1caa0a7b30735111e143068678a0547dfd38c050926619869c73a","4b01f0d2de0b557cd13e42a36b78894f","b8a0d70e602684067b2dc5565a5f6a786fb298fa","bf8f74a05e4a10ab893c73bc95ed16c3b5c6ffe6e257c098b33c04c3a893acb9","cd513de769a9c385b218306e7affc131","1a22bc573674186f234dd541b9fccaf938195b33","86bd9cdfdb425266c477544a5cf951fdc56733d46f1a7b44f8188168b5e2fb15","cd4b9ae02fdddfdb555ee45591deca4f","e6f98d1666896c84279db4fb6af5c5e6d815bb75")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("1178e2b691fd266ccd29867acf134c855241b18b730b766da0ae69c53d4b9776","56a13812819c8426941c9bd8b63d3a9f","9aa9290d337d68136030fc8182f7d499951a207e","4368f30798a1caa0a7b30735111e143068678a0547dfd38c050926619869c73a","4b01f0d2de0b557cd13e42a36b78894f","b8a0d70e602684067b2dc5565a5f6a786fb298fa","bf8f74a05e4a10ab893c73bc95ed16c3b5c6ffe6e257c098b33c04c3a893acb9","cd513de769a9c385b218306e7affc131","1a22bc573674186f234dd541b9fccaf938195b33","86bd9cdfdb425266c477544a5cf951fdc56733d46f1a7b44f8188168b5e2fb15","cd4b9ae02fdddfdb555ee45591deca4f","e6f98d1666896c84279db4fb6af5c5e6d815bb75")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("1178e2b691fd266ccd29867acf134c855241b18b730b766da0ae69c53d4b9776","56a13812819c8426941c9bd8b63d3a9f","9aa9290d337d68136030fc8182f7d499951a207e","4368f30798a1caa0a7b30735111e143068678a0547dfd38c050926619869c73a","4b01f0d2de0b557cd13e42a36b78894f","b8a0d70e602684067b2dc5565a5f6a786fb298fa","bf8f74a05e4a10ab893c73bc95ed16c3b5c6ffe6e257c098b33c04c3a893acb9","cd513de769a9c385b218306e7affc131","1a22bc573674186f234dd541b9fccaf938195b33","86bd9cdfdb425266c477544a5cf951fdc56733d46f1a7b44f8188168b5e2fb15","cd4b9ae02fdddfdb555ee45591deca4f","e6f98d1666896c84279db4fb6af5c5e6d815bb75")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("1178e2b691fd266ccd29867acf134c855241b18b730b766da0ae69c53d4b9776","56a13812819c8426941c9bd8b63d3a9f","9aa9290d337d68136030fc8182f7d499951a207e","4368f30798a1caa0a7b30735111e143068678a0547dfd38c050926619869c73a","4b01f0d2de0b557cd13e42a36b78894f","b8a0d70e602684067b2dc5565a5f6a786fb298fa","bf8f74a05e4a10ab893c73bc95ed16c3b5c6ffe6e257c098b33c04c3a893acb9","cd513de769a9c385b218306e7affc131","1a22bc573674186f234dd541b9fccaf938195b33","86bd9cdfdb425266c477544a5cf951fdc56733d46f1a7b44f8188168b5e2fb15","cd4b9ae02fdddfdb555ee45591deca4f","e6f98d1666896c84279db4fb6af5c5e6d815bb75")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("1178e2b691fd266ccd29867acf134c855241b18b730b766da0ae69c53d4b9776","56a13812819c8426941c9bd8b63d3a9f","9aa9290d337d68136030fc8182f7d499951a207e","4368f30798a1caa0a7b30735111e143068678a0547dfd38c050926619869c73a","4b01f0d2de0b557cd13e42a36b78894f","b8a0d70e602684067b2dc5565a5f6a786fb298fa","bf8f74a05e4a10ab893c73bc95ed16c3b5c6ffe6e257c098b33c04c3a893acb9","cd513de769a9c385b218306e7affc131","1a22bc573674186f234dd541b9fccaf938195b33","86bd9cdfdb425266c477544a5cf951fdc56733d46f1a7b44f8188168b5e2fb15","cd4b9ae02fdddfdb555ee45591deca4f","e6f98d1666896c84279db4fb6af5c5e6d815bb75")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("1178e2b691fd266ccd29867acf134c855241b18b730b766da0ae69c53d4b9776","56a13812819c8426941c9bd8b63d3a9f","9aa9290d337d68136030fc8182f7d499951a207e","4368f30798a1caa0a7b30735111e143068678a0547dfd38c050926619869c73a","4b01f0d2de0b557cd13e42a36b78894f","b8a0d70e602684067b2dc5565a5f6a786fb298fa","bf8f74a05e4a10ab893c73bc95ed16c3b5c6ffe6e257c098b33c04c3a893acb9","cd513de769a9c385b218306e7affc131","1a22bc573674186f234dd541b9fccaf938195b33","86bd9cdfdb425266c477544a5cf951fdc56733d46f1a7b44f8188168b5e2fb15","cd4b9ae02fdddfdb555ee45591deca4f","e6f98d1666896c84279db4fb6af5c5e6d815bb75")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("1178e2b691fd266ccd29867acf134c855241b18b730b766da0ae69c53d4b9776","56a13812819c8426941c9bd8b63d3a9f","9aa9290d337d68136030fc8182f7d499951a207e","4368f30798a1caa0a7b30735111e143068678a0547dfd38c050926619869c73a","4b01f0d2de0b557cd13e42a36b78894f","b8a0d70e602684067b2dc5565a5f6a786fb298fa","bf8f74a05e4a10ab893c73bc95ed16c3b5c6ffe6e257c098b33c04c3a893acb9","cd513de769a9c385b218306e7affc131","1a22bc573674186f234dd541b9fccaf938195b33","86bd9cdfdb425266c477544a5cf951fdc56733d46f1a7b44f8188168b5e2fb15","cd4b9ae02fdddfdb555ee45591deca4f","e6f98d1666896c84279db4fb6af5c5e6d815bb75")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("1178e2b691fd266ccd29867acf134c855241b18b730b766da0ae69c53d4b9776","56a13812819c8426941c9bd8b63d3a9f","9aa9290d337d68136030fc8182f7d499951a207e","4368f30798a1caa0a7b30735111e143068678a0547dfd38c050926619869c73a","4b01f0d2de0b557cd13e42a36b78894f","b8a0d70e602684067b2dc5565a5f6a786fb298fa","bf8f74a05e4a10ab893c73bc95ed16c3b5c6ffe6e257c098b33c04c3a893acb9","cd513de769a9c385b218306e7affc131","1a22bc573674186f234dd541b9fccaf938195b33","86bd9cdfdb425266c477544a5cf951fdc56733d46f1a7b44f8188168b5e2fb15","cd4b9ae02fdddfdb555ee45591deca4f","e6f98d1666896c84279db4fb6af5c5e6d815bb75")
