index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("214436a0c7623e84e8078a3b141b7d9c","82c4739158099fe156aa1b23409c9bf5f96eb9d5","35c75ba64f1658bd9442afa255b671e3fe9cb93ffb4821270074a85fca966c3f","4711b96b395c7ced1e0c2f2d0b1786c6","dc203816c0bb91614d270a129ac968ee45f1b7d2","bbbd97e1c525f811fbd16e2a48989cfa3e3164aa3b21824108dd3f8f5394bd76")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("214436a0c7623e84e8078a3b141b7d9c","82c4739158099fe156aa1b23409c9bf5f96eb9d5","35c75ba64f1658bd9442afa255b671e3fe9cb93ffb4821270074a85fca966c3f","4711b96b395c7ced1e0c2f2d0b1786c6","dc203816c0bb91614d270a129ac968ee45f1b7d2","bbbd97e1c525f811fbd16e2a48989cfa3e3164aa3b21824108dd3f8f5394bd76")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("214436a0c7623e84e8078a3b141b7d9c","82c4739158099fe156aa1b23409c9bf5f96eb9d5","35c75ba64f1658bd9442afa255b671e3fe9cb93ffb4821270074a85fca966c3f","4711b96b395c7ced1e0c2f2d0b1786c6","dc203816c0bb91614d270a129ac968ee45f1b7d2","bbbd97e1c525f811fbd16e2a48989cfa3e3164aa3b21824108dd3f8f5394bd76")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring64 NOT NULL AND customstring64 IN ("214436a0c7623e84e8078a3b141b7d9c","82c4739158099fe156aa1b23409c9bf5f96eb9d5","35c75ba64f1658bd9442afa255b671e3fe9cb93ffb4821270074a85fca966c3f","4711b96b395c7ced1e0c2f2d0b1786c6","dc203816c0bb91614d270a129ac968ee45f1b7d2","bbbd97e1c525f811fbd16e2a48989cfa3e3164aa3b21824108dd3f8f5394bd76")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("214436a0c7623e84e8078a3b141b7d9c","82c4739158099fe156aa1b23409c9bf5f96eb9d5","35c75ba64f1658bd9442afa255b671e3fe9cb93ffb4821270074a85fca966c3f","4711b96b395c7ced1e0c2f2d0b1786c6","dc203816c0bb91614d270a129ac968ee45f1b7d2","bbbd97e1c525f811fbd16e2a48989cfa3e3164aa3b21824108dd3f8f5394bd76")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("214436a0c7623e84e8078a3b141b7d9c","82c4739158099fe156aa1b23409c9bf5f96eb9d5","35c75ba64f1658bd9442afa255b671e3fe9cb93ffb4821270074a85fca966c3f","4711b96b395c7ced1e0c2f2d0b1786c6","dc203816c0bb91614d270a129ac968ee45f1b7d2","bbbd97e1c525f811fbd16e2a48989cfa3e3164aa3b21824108dd3f8f5394bd76")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("214436a0c7623e84e8078a3b141b7d9c","82c4739158099fe156aa1b23409c9bf5f96eb9d5","35c75ba64f1658bd9442afa255b671e3fe9cb93ffb4821270074a85fca966c3f","4711b96b395c7ced1e0c2f2d0b1786c6","dc203816c0bb91614d270a129ac968ee45f1b7d2","bbbd97e1c525f811fbd16e2a48989cfa3e3164aa3b21824108dd3f8f5394bd76")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("214436a0c7623e84e8078a3b141b7d9c","82c4739158099fe156aa1b23409c9bf5f96eb9d5","35c75ba64f1658bd9442afa255b671e3fe9cb93ffb4821270074a85fca966c3f","4711b96b395c7ced1e0c2f2d0b1786c6","dc203816c0bb91614d270a129ac968ee45f1b7d2","bbbd97e1c525f811fbd16e2a48989cfa3e3164aa3b21824108dd3f8f5394bd76")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("214436a0c7623e84e8078a3b141b7d9c","82c4739158099fe156aa1b23409c9bf5f96eb9d5","35c75ba64f1658bd9442afa255b671e3fe9cb93ffb4821270074a85fca966c3f","4711b96b395c7ced1e0c2f2d0b1786c6","dc203816c0bb91614d270a129ac968ee45f1b7d2","bbbd97e1c525f811fbd16e2a48989cfa3e3164aa3b21824108dd3f8f5394bd76")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("214436a0c7623e84e8078a3b141b7d9c","82c4739158099fe156aa1b23409c9bf5f96eb9d5","35c75ba64f1658bd9442afa255b671e3fe9cb93ffb4821270074a85fca966c3f","4711b96b395c7ced1e0c2f2d0b1786c6","dc203816c0bb91614d270a129ac968ee45f1b7d2","bbbd97e1c525f811fbd16e2a48989cfa3e3164aa3b21824108dd3f8f5394bd76")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("214436a0c7623e84e8078a3b141b7d9c","82c4739158099fe156aa1b23409c9bf5f96eb9d5","35c75ba64f1658bd9442afa255b671e3fe9cb93ffb4821270074a85fca966c3f","4711b96b395c7ced1e0c2f2d0b1786c6","dc203816c0bb91614d270a129ac968ee45f1b7d2","bbbd97e1c525f811fbd16e2a48989cfa3e3164aa3b21824108dd3f8f5394bd76")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("214436a0c7623e84e8078a3b141b7d9c","82c4739158099fe156aa1b23409c9bf5f96eb9d5","35c75ba64f1658bd9442afa255b671e3fe9cb93ffb4821270074a85fca966c3f","4711b96b395c7ced1e0c2f2d0b1786c6","dc203816c0bb91614d270a129ac968ee45f1b7d2","bbbd97e1c525f811fbd16e2a48989cfa3e3164aa3b21824108dd3f8f5394bd76")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("214436a0c7623e84e8078a3b141b7d9c","82c4739158099fe156aa1b23409c9bf5f96eb9d5","35c75ba64f1658bd9442afa255b671e3fe9cb93ffb4821270074a85fca966c3f","4711b96b395c7ced1e0c2f2d0b1786c6","dc203816c0bb91614d270a129ac968ee45f1b7d2","bbbd97e1c525f811fbd16e2a48989cfa3e3164aa3b21824108dd3f8f5394bd76")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("214436a0c7623e84e8078a3b141b7d9c","82c4739158099fe156aa1b23409c9bf5f96eb9d5","35c75ba64f1658bd9442afa255b671e3fe9cb93ffb4821270074a85fca966c3f","4711b96b395c7ced1e0c2f2d0b1786c6","dc203816c0bb91614d270a129ac968ee45f1b7d2","bbbd97e1c525f811fbd16e2a48989cfa3e3164aa3b21824108dd3f8f5394bd76")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("214436a0c7623e84e8078a3b141b7d9c","82c4739158099fe156aa1b23409c9bf5f96eb9d5","35c75ba64f1658bd9442afa255b671e3fe9cb93ffb4821270074a85fca966c3f","4711b96b395c7ced1e0c2f2d0b1786c6","dc203816c0bb91614d270a129ac968ee45f1b7d2","bbbd97e1c525f811fbd16e2a48989cfa3e3164aa3b21824108dd3f8f5394bd76")
index=activity AND rg_functionality="Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("214436a0c7623e84e8078a3b141b7d9c","82c4739158099fe156aa1b23409c9bf5f96eb9d5","35c75ba64f1658bd9442afa255b671e3fe9cb93ffb4821270074a85fca966c3f","4711b96b395c7ced1e0c2f2d0b1786c6","dc203816c0bb91614d270a129ac968ee45f1b7d2","bbbd97e1c525f811fbd16e2a48989cfa3e3164aa3b21824108dd3f8f5394bd76")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("214436a0c7623e84e8078a3b141b7d9c","82c4739158099fe156aa1b23409c9bf5f96eb9d5","35c75ba64f1658bd9442afa255b671e3fe9cb93ffb4821270074a85fca966c3f","4711b96b395c7ced1e0c2f2d0b1786c6","dc203816c0bb91614d270a129ac968ee45f1b7d2","bbbd97e1c525f811fbd16e2a48989cfa3e3164aa3b21824108dd3f8f5394bd76")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("214436a0c7623e84e8078a3b141b7d9c","82c4739158099fe156aa1b23409c9bf5f96eb9d5","35c75ba64f1658bd9442afa255b671e3fe9cb93ffb4821270074a85fca966c3f","4711b96b395c7ced1e0c2f2d0b1786c6","dc203816c0bb91614d270a129ac968ee45f1b7d2","bbbd97e1c525f811fbd16e2a48989cfa3e3164aa3b21824108dd3f8f5394bd76")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("214436a0c7623e84e8078a3b141b7d9c","82c4739158099fe156aa1b23409c9bf5f96eb9d5","35c75ba64f1658bd9442afa255b671e3fe9cb93ffb4821270074a85fca966c3f","4711b96b395c7ced1e0c2f2d0b1786c6","dc203816c0bb91614d270a129ac968ee45f1b7d2","bbbd97e1c525f811fbd16e2a48989cfa3e3164aa3b21824108dd3f8f5394bd76")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("214436a0c7623e84e8078a3b141b7d9c","82c4739158099fe156aa1b23409c9bf5f96eb9d5","35c75ba64f1658bd9442afa255b671e3fe9cb93ffb4821270074a85fca966c3f","4711b96b395c7ced1e0c2f2d0b1786c6","dc203816c0bb91614d270a129ac968ee45f1b7d2","bbbd97e1c525f811fbd16e2a48989cfa3e3164aa3b21824108dd3f8f5394bd76")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("214436a0c7623e84e8078a3b141b7d9c","82c4739158099fe156aa1b23409c9bf5f96eb9d5","35c75ba64f1658bd9442afa255b671e3fe9cb93ffb4821270074a85fca966c3f","4711b96b395c7ced1e0c2f2d0b1786c6","dc203816c0bb91614d270a129ac968ee45f1b7d2","bbbd97e1c525f811fbd16e2a48989cfa3e3164aa3b21824108dd3f8f5394bd76")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("214436a0c7623e84e8078a3b141b7d9c","82c4739158099fe156aa1b23409c9bf5f96eb9d5","35c75ba64f1658bd9442afa255b671e3fe9cb93ffb4821270074a85fca966c3f","4711b96b395c7ced1e0c2f2d0b1786c6","dc203816c0bb91614d270a129ac968ee45f1b7d2","bbbd97e1c525f811fbd16e2a48989cfa3e3164aa3b21824108dd3f8f5394bd76")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("214436a0c7623e84e8078a3b141b7d9c","82c4739158099fe156aa1b23409c9bf5f96eb9d5","35c75ba64f1658bd9442afa255b671e3fe9cb93ffb4821270074a85fca966c3f","4711b96b395c7ced1e0c2f2d0b1786c6","dc203816c0bb91614d270a129ac968ee45f1b7d2","bbbd97e1c525f811fbd16e2a48989cfa3e3164aa3b21824108dd3f8f5394bd76")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring64 NOT NULL AND customstring64 IN ("214436a0c7623e84e8078a3b141b7d9c","82c4739158099fe156aa1b23409c9bf5f96eb9d5","35c75ba64f1658bd9442afa255b671e3fe9cb93ffb4821270074a85fca966c3f","4711b96b395c7ced1e0c2f2d0b1786c6","dc203816c0bb91614d270a129ac968ee45f1b7d2","bbbd97e1c525f811fbd16e2a48989cfa3e3164aa3b21824108dd3f8f5394bd76")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("214436a0c7623e84e8078a3b141b7d9c","82c4739158099fe156aa1b23409c9bf5f96eb9d5","35c75ba64f1658bd9442afa255b671e3fe9cb93ffb4821270074a85fca966c3f","4711b96b395c7ced1e0c2f2d0b1786c6","dc203816c0bb91614d270a129ac968ee45f1b7d2","bbbd97e1c525f811fbd16e2a48989cfa3e3164aa3b21824108dd3f8f5394bd76")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("214436a0c7623e84e8078a3b141b7d9c","82c4739158099fe156aa1b23409c9bf5f96eb9d5","35c75ba64f1658bd9442afa255b671e3fe9cb93ffb4821270074a85fca966c3f","4711b96b395c7ced1e0c2f2d0b1786c6","dc203816c0bb91614d270a129ac968ee45f1b7d2","bbbd97e1c525f811fbd16e2a48989cfa3e3164aa3b21824108dd3f8f5394bd76")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("214436a0c7623e84e8078a3b141b7d9c","82c4739158099fe156aa1b23409c9bf5f96eb9d5","35c75ba64f1658bd9442afa255b671e3fe9cb93ffb4821270074a85fca966c3f","4711b96b395c7ced1e0c2f2d0b1786c6","dc203816c0bb91614d270a129ac968ee45f1b7d2","bbbd97e1c525f811fbd16e2a48989cfa3e3164aa3b21824108dd3f8f5394bd76")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring64 NOT NULL AND customstring64 IN ("214436a0c7623e84e8078a3b141b7d9c","82c4739158099fe156aa1b23409c9bf5f96eb9d5","35c75ba64f1658bd9442afa255b671e3fe9cb93ffb4821270074a85fca966c3f","4711b96b395c7ced1e0c2f2d0b1786c6","dc203816c0bb91614d270a129ac968ee45f1b7d2","bbbd97e1c525f811fbd16e2a48989cfa3e3164aa3b21824108dd3f8f5394bd76")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("214436a0c7623e84e8078a3b141b7d9c","82c4739158099fe156aa1b23409c9bf5f96eb9d5","35c75ba64f1658bd9442afa255b671e3fe9cb93ffb4821270074a85fca966c3f","4711b96b395c7ced1e0c2f2d0b1786c6","dc203816c0bb91614d270a129ac968ee45f1b7d2","bbbd97e1c525f811fbd16e2a48989cfa3e3164aa3b21824108dd3f8f5394bd76")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("214436a0c7623e84e8078a3b141b7d9c","82c4739158099fe156aa1b23409c9bf5f96eb9d5","35c75ba64f1658bd9442afa255b671e3fe9cb93ffb4821270074a85fca966c3f","4711b96b395c7ced1e0c2f2d0b1786c6","dc203816c0bb91614d270a129ac968ee45f1b7d2","bbbd97e1c525f811fbd16e2a48989cfa3e3164aa3b21824108dd3f8f5394bd76")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("214436a0c7623e84e8078a3b141b7d9c","82c4739158099fe156aa1b23409c9bf5f96eb9d5","35c75ba64f1658bd9442afa255b671e3fe9cb93ffb4821270074a85fca966c3f","4711b96b395c7ced1e0c2f2d0b1786c6","dc203816c0bb91614d270a129ac968ee45f1b7d2","bbbd97e1c525f811fbd16e2a48989cfa3e3164aa3b21824108dd3f8f5394bd76")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring64 NOT NULL AND customstring64 IN ("214436a0c7623e84e8078a3b141b7d9c","82c4739158099fe156aa1b23409c9bf5f96eb9d5","35c75ba64f1658bd9442afa255b671e3fe9cb93ffb4821270074a85fca966c3f","4711b96b395c7ced1e0c2f2d0b1786c6","dc203816c0bb91614d270a129ac968ee45f1b7d2","bbbd97e1c525f811fbd16e2a48989cfa3e3164aa3b21824108dd3f8f5394bd76")
