index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("fbadfff7b61d820e3632a2f464079e8c","d5f241dee73cffe51897c15f36b713cc","1077ea936033ee9e9bf444dafb55867c","b1a5dc66f40a38d807ec8350ae89d1e4","dbf5afa377e3e761622e5f21af1f09e6","607f64b56bb3b94ee0009471f1fe9a3c","3ac65326f598ee9930031c17ce158d3d","91454a68ca3a6ce7cb30c9264a88c0dc")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("fbadfff7b61d820e3632a2f464079e8c","d5f241dee73cffe51897c15f36b713cc","1077ea936033ee9e9bf444dafb55867c","b1a5dc66f40a38d807ec8350ae89d1e4","dbf5afa377e3e761622e5f21af1f09e6","607f64b56bb3b94ee0009471f1fe9a3c","3ac65326f598ee9930031c17ce158d3d","91454a68ca3a6ce7cb30c9264a88c0dc")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("fbadfff7b61d820e3632a2f464079e8c","d5f241dee73cffe51897c15f36b713cc","1077ea936033ee9e9bf444dafb55867c","b1a5dc66f40a38d807ec8350ae89d1e4","dbf5afa377e3e761622e5f21af1f09e6","607f64b56bb3b94ee0009471f1fe9a3c","3ac65326f598ee9930031c17ce158d3d","91454a68ca3a6ce7cb30c9264a88c0dc")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring64 NOT NULL AND customstring64 IN ("fbadfff7b61d820e3632a2f464079e8c","d5f241dee73cffe51897c15f36b713cc","1077ea936033ee9e9bf444dafb55867c","b1a5dc66f40a38d807ec8350ae89d1e4","dbf5afa377e3e761622e5f21af1f09e6","607f64b56bb3b94ee0009471f1fe9a3c","3ac65326f598ee9930031c17ce158d3d","91454a68ca3a6ce7cb30c9264a88c0dc")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("fbadfff7b61d820e3632a2f464079e8c","d5f241dee73cffe51897c15f36b713cc","1077ea936033ee9e9bf444dafb55867c","b1a5dc66f40a38d807ec8350ae89d1e4","dbf5afa377e3e761622e5f21af1f09e6","607f64b56bb3b94ee0009471f1fe9a3c","3ac65326f598ee9930031c17ce158d3d","91454a68ca3a6ce7cb30c9264a88c0dc")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("fbadfff7b61d820e3632a2f464079e8c","d5f241dee73cffe51897c15f36b713cc","1077ea936033ee9e9bf444dafb55867c","b1a5dc66f40a38d807ec8350ae89d1e4","dbf5afa377e3e761622e5f21af1f09e6","607f64b56bb3b94ee0009471f1fe9a3c","3ac65326f598ee9930031c17ce158d3d","91454a68ca3a6ce7cb30c9264a88c0dc")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("fbadfff7b61d820e3632a2f464079e8c","d5f241dee73cffe51897c15f36b713cc","1077ea936033ee9e9bf444dafb55867c","b1a5dc66f40a38d807ec8350ae89d1e4","dbf5afa377e3e761622e5f21af1f09e6","607f64b56bb3b94ee0009471f1fe9a3c","3ac65326f598ee9930031c17ce158d3d","91454a68ca3a6ce7cb30c9264a88c0dc")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("fbadfff7b61d820e3632a2f464079e8c","d5f241dee73cffe51897c15f36b713cc","1077ea936033ee9e9bf444dafb55867c","b1a5dc66f40a38d807ec8350ae89d1e4","dbf5afa377e3e761622e5f21af1f09e6","607f64b56bb3b94ee0009471f1fe9a3c","3ac65326f598ee9930031c17ce158d3d","91454a68ca3a6ce7cb30c9264a88c0dc")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("fbadfff7b61d820e3632a2f464079e8c","d5f241dee73cffe51897c15f36b713cc","1077ea936033ee9e9bf444dafb55867c","b1a5dc66f40a38d807ec8350ae89d1e4","dbf5afa377e3e761622e5f21af1f09e6","607f64b56bb3b94ee0009471f1fe9a3c","3ac65326f598ee9930031c17ce158d3d","91454a68ca3a6ce7cb30c9264a88c0dc")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("fbadfff7b61d820e3632a2f464079e8c","d5f241dee73cffe51897c15f36b713cc","1077ea936033ee9e9bf444dafb55867c","b1a5dc66f40a38d807ec8350ae89d1e4","dbf5afa377e3e761622e5f21af1f09e6","607f64b56bb3b94ee0009471f1fe9a3c","3ac65326f598ee9930031c17ce158d3d","91454a68ca3a6ce7cb30c9264a88c0dc")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("fbadfff7b61d820e3632a2f464079e8c","d5f241dee73cffe51897c15f36b713cc","1077ea936033ee9e9bf444dafb55867c","b1a5dc66f40a38d807ec8350ae89d1e4","dbf5afa377e3e761622e5f21af1f09e6","607f64b56bb3b94ee0009471f1fe9a3c","3ac65326f598ee9930031c17ce158d3d","91454a68ca3a6ce7cb30c9264a88c0dc")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("fbadfff7b61d820e3632a2f464079e8c","d5f241dee73cffe51897c15f36b713cc","1077ea936033ee9e9bf444dafb55867c","b1a5dc66f40a38d807ec8350ae89d1e4","dbf5afa377e3e761622e5f21af1f09e6","607f64b56bb3b94ee0009471f1fe9a3c","3ac65326f598ee9930031c17ce158d3d","91454a68ca3a6ce7cb30c9264a88c0dc")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("fbadfff7b61d820e3632a2f464079e8c","d5f241dee73cffe51897c15f36b713cc","1077ea936033ee9e9bf444dafb55867c","b1a5dc66f40a38d807ec8350ae89d1e4","dbf5afa377e3e761622e5f21af1f09e6","607f64b56bb3b94ee0009471f1fe9a3c","3ac65326f598ee9930031c17ce158d3d","91454a68ca3a6ce7cb30c9264a88c0dc")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("fbadfff7b61d820e3632a2f464079e8c","d5f241dee73cffe51897c15f36b713cc","1077ea936033ee9e9bf444dafb55867c","b1a5dc66f40a38d807ec8350ae89d1e4","dbf5afa377e3e761622e5f21af1f09e6","607f64b56bb3b94ee0009471f1fe9a3c","3ac65326f598ee9930031c17ce158d3d","91454a68ca3a6ce7cb30c9264a88c0dc")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("fbadfff7b61d820e3632a2f464079e8c","d5f241dee73cffe51897c15f36b713cc","1077ea936033ee9e9bf444dafb55867c","b1a5dc66f40a38d807ec8350ae89d1e4","dbf5afa377e3e761622e5f21af1f09e6","607f64b56bb3b94ee0009471f1fe9a3c","3ac65326f598ee9930031c17ce158d3d","91454a68ca3a6ce7cb30c9264a88c0dc")
index=activity AND rg_functionality="Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("fbadfff7b61d820e3632a2f464079e8c","d5f241dee73cffe51897c15f36b713cc","1077ea936033ee9e9bf444dafb55867c","b1a5dc66f40a38d807ec8350ae89d1e4","dbf5afa377e3e761622e5f21af1f09e6","607f64b56bb3b94ee0009471f1fe9a3c","3ac65326f598ee9930031c17ce158d3d","91454a68ca3a6ce7cb30c9264a88c0dc")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("fbadfff7b61d820e3632a2f464079e8c","d5f241dee73cffe51897c15f36b713cc","1077ea936033ee9e9bf444dafb55867c","b1a5dc66f40a38d807ec8350ae89d1e4","dbf5afa377e3e761622e5f21af1f09e6","607f64b56bb3b94ee0009471f1fe9a3c","3ac65326f598ee9930031c17ce158d3d","91454a68ca3a6ce7cb30c9264a88c0dc")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("fbadfff7b61d820e3632a2f464079e8c","d5f241dee73cffe51897c15f36b713cc","1077ea936033ee9e9bf444dafb55867c","b1a5dc66f40a38d807ec8350ae89d1e4","dbf5afa377e3e761622e5f21af1f09e6","607f64b56bb3b94ee0009471f1fe9a3c","3ac65326f598ee9930031c17ce158d3d","91454a68ca3a6ce7cb30c9264a88c0dc")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("fbadfff7b61d820e3632a2f464079e8c","d5f241dee73cffe51897c15f36b713cc","1077ea936033ee9e9bf444dafb55867c","b1a5dc66f40a38d807ec8350ae89d1e4","dbf5afa377e3e761622e5f21af1f09e6","607f64b56bb3b94ee0009471f1fe9a3c","3ac65326f598ee9930031c17ce158d3d","91454a68ca3a6ce7cb30c9264a88c0dc")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("fbadfff7b61d820e3632a2f464079e8c","d5f241dee73cffe51897c15f36b713cc","1077ea936033ee9e9bf444dafb55867c","b1a5dc66f40a38d807ec8350ae89d1e4","dbf5afa377e3e761622e5f21af1f09e6","607f64b56bb3b94ee0009471f1fe9a3c","3ac65326f598ee9930031c17ce158d3d","91454a68ca3a6ce7cb30c9264a88c0dc")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("fbadfff7b61d820e3632a2f464079e8c","d5f241dee73cffe51897c15f36b713cc","1077ea936033ee9e9bf444dafb55867c","b1a5dc66f40a38d807ec8350ae89d1e4","dbf5afa377e3e761622e5f21af1f09e6","607f64b56bb3b94ee0009471f1fe9a3c","3ac65326f598ee9930031c17ce158d3d","91454a68ca3a6ce7cb30c9264a88c0dc")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("fbadfff7b61d820e3632a2f464079e8c","d5f241dee73cffe51897c15f36b713cc","1077ea936033ee9e9bf444dafb55867c","b1a5dc66f40a38d807ec8350ae89d1e4","dbf5afa377e3e761622e5f21af1f09e6","607f64b56bb3b94ee0009471f1fe9a3c","3ac65326f598ee9930031c17ce158d3d","91454a68ca3a6ce7cb30c9264a88c0dc")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("fbadfff7b61d820e3632a2f464079e8c","d5f241dee73cffe51897c15f36b713cc","1077ea936033ee9e9bf444dafb55867c","b1a5dc66f40a38d807ec8350ae89d1e4","dbf5afa377e3e761622e5f21af1f09e6","607f64b56bb3b94ee0009471f1fe9a3c","3ac65326f598ee9930031c17ce158d3d","91454a68ca3a6ce7cb30c9264a88c0dc")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring64 NOT NULL AND customstring64 IN ("fbadfff7b61d820e3632a2f464079e8c","d5f241dee73cffe51897c15f36b713cc","1077ea936033ee9e9bf444dafb55867c","b1a5dc66f40a38d807ec8350ae89d1e4","dbf5afa377e3e761622e5f21af1f09e6","607f64b56bb3b94ee0009471f1fe9a3c","3ac65326f598ee9930031c17ce158d3d","91454a68ca3a6ce7cb30c9264a88c0dc")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("fbadfff7b61d820e3632a2f464079e8c","d5f241dee73cffe51897c15f36b713cc","1077ea936033ee9e9bf444dafb55867c","b1a5dc66f40a38d807ec8350ae89d1e4","dbf5afa377e3e761622e5f21af1f09e6","607f64b56bb3b94ee0009471f1fe9a3c","3ac65326f598ee9930031c17ce158d3d","91454a68ca3a6ce7cb30c9264a88c0dc")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("fbadfff7b61d820e3632a2f464079e8c","d5f241dee73cffe51897c15f36b713cc","1077ea936033ee9e9bf444dafb55867c","b1a5dc66f40a38d807ec8350ae89d1e4","dbf5afa377e3e761622e5f21af1f09e6","607f64b56bb3b94ee0009471f1fe9a3c","3ac65326f598ee9930031c17ce158d3d","91454a68ca3a6ce7cb30c9264a88c0dc")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("fbadfff7b61d820e3632a2f464079e8c","d5f241dee73cffe51897c15f36b713cc","1077ea936033ee9e9bf444dafb55867c","b1a5dc66f40a38d807ec8350ae89d1e4","dbf5afa377e3e761622e5f21af1f09e6","607f64b56bb3b94ee0009471f1fe9a3c","3ac65326f598ee9930031c17ce158d3d","91454a68ca3a6ce7cb30c9264a88c0dc")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring64 NOT NULL AND customstring64 IN ("fbadfff7b61d820e3632a2f464079e8c","d5f241dee73cffe51897c15f36b713cc","1077ea936033ee9e9bf444dafb55867c","b1a5dc66f40a38d807ec8350ae89d1e4","dbf5afa377e3e761622e5f21af1f09e6","607f64b56bb3b94ee0009471f1fe9a3c","3ac65326f598ee9930031c17ce158d3d","91454a68ca3a6ce7cb30c9264a88c0dc")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("fbadfff7b61d820e3632a2f464079e8c","d5f241dee73cffe51897c15f36b713cc","1077ea936033ee9e9bf444dafb55867c","b1a5dc66f40a38d807ec8350ae89d1e4","dbf5afa377e3e761622e5f21af1f09e6","607f64b56bb3b94ee0009471f1fe9a3c","3ac65326f598ee9930031c17ce158d3d","91454a68ca3a6ce7cb30c9264a88c0dc")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("fbadfff7b61d820e3632a2f464079e8c","d5f241dee73cffe51897c15f36b713cc","1077ea936033ee9e9bf444dafb55867c","b1a5dc66f40a38d807ec8350ae89d1e4","dbf5afa377e3e761622e5f21af1f09e6","607f64b56bb3b94ee0009471f1fe9a3c","3ac65326f598ee9930031c17ce158d3d","91454a68ca3a6ce7cb30c9264a88c0dc")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("fbadfff7b61d820e3632a2f464079e8c","d5f241dee73cffe51897c15f36b713cc","1077ea936033ee9e9bf444dafb55867c","b1a5dc66f40a38d807ec8350ae89d1e4","dbf5afa377e3e761622e5f21af1f09e6","607f64b56bb3b94ee0009471f1fe9a3c","3ac65326f598ee9930031c17ce158d3d","91454a68ca3a6ce7cb30c9264a88c0dc")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring64 NOT NULL AND customstring64 IN ("fbadfff7b61d820e3632a2f464079e8c","d5f241dee73cffe51897c15f36b713cc","1077ea936033ee9e9bf444dafb55867c","b1a5dc66f40a38d807ec8350ae89d1e4","dbf5afa377e3e761622e5f21af1f09e6","607f64b56bb3b94ee0009471f1fe9a3c","3ac65326f598ee9930031c17ce158d3d","91454a68ca3a6ce7cb30c9264a88c0dc")
index=activity AND rg_functionality="O365 General" AND filehash NOT NULL AND filehash IN ("fbadfff7b61d820e3632a2f464079e8c","d5f241dee73cffe51897c15f36b713cc","1077ea936033ee9e9bf444dafb55867c","b1a5dc66f40a38d807ec8350ae89d1e4","dbf5afa377e3e761622e5f21af1f09e6","607f64b56bb3b94ee0009471f1fe9a3c","3ac65326f598ee9930031c17ce158d3d","91454a68ca3a6ce7cb30c9264a88c0dc")
index=activity AND rg_functionality="O365 General" AND oldfilehash NOT NULL AND oldfilehash IN ("fbadfff7b61d820e3632a2f464079e8c","d5f241dee73cffe51897c15f36b713cc","1077ea936033ee9e9bf444dafb55867c","b1a5dc66f40a38d807ec8350ae89d1e4","dbf5afa377e3e761622e5f21af1f09e6","607f64b56bb3b94ee0009471f1fe9a3c","3ac65326f598ee9930031c17ce158d3d","91454a68ca3a6ce7cb30c9264a88c0dc")
index=activity AND rg_functionality="O365 General" AND customstring3 NOT NULL AND customstring3 IN ("fbadfff7b61d820e3632a2f464079e8c","d5f241dee73cffe51897c15f36b713cc","1077ea936033ee9e9bf444dafb55867c","b1a5dc66f40a38d807ec8350ae89d1e4","dbf5afa377e3e761622e5f21af1f09e6","607f64b56bb3b94ee0009471f1fe9a3c","3ac65326f598ee9930031c17ce158d3d","91454a68ca3a6ce7cb30c9264a88c0dc")
index=activity AND rg_functionality="O365 General" AND customstring64 NOT NULL AND customstring64 IN ("fbadfff7b61d820e3632a2f464079e8c","d5f241dee73cffe51897c15f36b713cc","1077ea936033ee9e9bf444dafb55867c","b1a5dc66f40a38d807ec8350ae89d1e4","dbf5afa377e3e761622e5f21af1f09e6","607f64b56bb3b94ee0009471f1fe9a3c","3ac65326f598ee9930031c17ce158d3d","91454a68ca3a6ce7cb30c9264a88c0dc")
