index=activity AND rg_functionality="Endpoint Management Systems" AND baseeventid = "1" AND (destinationprocessname  ENDS WITH "rfusclient.exe" OR destinationprocessname  ENDS WITH "rutserv.exe")
index=activity AND rg_functionality="Endpoint Management Systems" AND baseeventid = "1" AND resourcecustomfield1 CONTAINS " -run_agent"
index=activity AND rg_functionality="Endpoint Management Systems" AND (deviceaction = "ProcessRollup2" or deviceaction = "Procstart" or deviceaction = "Childproc" or deviceaction = "Process" or deviceaction = "Process Create" or deviceaction = "Trace Executed Process") AND (destinationprocessname  ENDS WITH "rfusclient.exe" OR destinationprocessname  ENDS WITH "rutserv.exe")
index=activity AND rg_functionality="Endpoint Management Systems" AND (deviceaction = "ProcessRollup2" or deviceaction = "Procstart" or deviceaction = "Childproc" or deviceaction = "Process" or deviceaction = "Process Create" or deviceaction = "Trace Executed Process") AND resourcecustomfield1 CONTAINS " -run_agent"
