index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("3bf0f489250eaaa99100af4fd9cce3a23acf2b633c25f4571fb8078d4cb7c64d","e9f6edb73eb7cf8dcc40458f59d13ca2e236efc043d4bc913e113bd3a6af19a2","3450abaf86f0a535caeffb25f2a05576d60f871e9226b1bd425c425528c65670","091ffdfef9722804f33a2b1d0fe765d2c2b0c52ada6d8834fdf72d8cb67acc4b","96a88531d207bd33b579c8631000421b2063536764ebaf069d0e2ca3b97d4f84","de85a021c6a01a8601dbc8d78b81993072b7b9835f2109fe1cc1bad971bd1d89")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("3bf0f489250eaaa99100af4fd9cce3a23acf2b633c25f4571fb8078d4cb7c64d","e9f6edb73eb7cf8dcc40458f59d13ca2e236efc043d4bc913e113bd3a6af19a2","3450abaf86f0a535caeffb25f2a05576d60f871e9226b1bd425c425528c65670","091ffdfef9722804f33a2b1d0fe765d2c2b0c52ada6d8834fdf72d8cb67acc4b","96a88531d207bd33b579c8631000421b2063536764ebaf069d0e2ca3b97d4f84","de85a021c6a01a8601dbc8d78b81993072b7b9835f2109fe1cc1bad971bd1d89")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("3bf0f489250eaaa99100af4fd9cce3a23acf2b633c25f4571fb8078d4cb7c64d","e9f6edb73eb7cf8dcc40458f59d13ca2e236efc043d4bc913e113bd3a6af19a2","3450abaf86f0a535caeffb25f2a05576d60f871e9226b1bd425c425528c65670","091ffdfef9722804f33a2b1d0fe765d2c2b0c52ada6d8834fdf72d8cb67acc4b","96a88531d207bd33b579c8631000421b2063536764ebaf069d0e2ca3b97d4f84","de85a021c6a01a8601dbc8d78b81993072b7b9835f2109fe1cc1bad971bd1d89")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring64 NOT NULL AND customstring64 IN ("3bf0f489250eaaa99100af4fd9cce3a23acf2b633c25f4571fb8078d4cb7c64d","e9f6edb73eb7cf8dcc40458f59d13ca2e236efc043d4bc913e113bd3a6af19a2","3450abaf86f0a535caeffb25f2a05576d60f871e9226b1bd425c425528c65670","091ffdfef9722804f33a2b1d0fe765d2c2b0c52ada6d8834fdf72d8cb67acc4b","96a88531d207bd33b579c8631000421b2063536764ebaf069d0e2ca3b97d4f84","de85a021c6a01a8601dbc8d78b81993072b7b9835f2109fe1cc1bad971bd1d89")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("3bf0f489250eaaa99100af4fd9cce3a23acf2b633c25f4571fb8078d4cb7c64d","e9f6edb73eb7cf8dcc40458f59d13ca2e236efc043d4bc913e113bd3a6af19a2","3450abaf86f0a535caeffb25f2a05576d60f871e9226b1bd425c425528c65670","091ffdfef9722804f33a2b1d0fe765d2c2b0c52ada6d8834fdf72d8cb67acc4b","96a88531d207bd33b579c8631000421b2063536764ebaf069d0e2ca3b97d4f84","de85a021c6a01a8601dbc8d78b81993072b7b9835f2109fe1cc1bad971bd1d89")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("3bf0f489250eaaa99100af4fd9cce3a23acf2b633c25f4571fb8078d4cb7c64d","e9f6edb73eb7cf8dcc40458f59d13ca2e236efc043d4bc913e113bd3a6af19a2","3450abaf86f0a535caeffb25f2a05576d60f871e9226b1bd425c425528c65670","091ffdfef9722804f33a2b1d0fe765d2c2b0c52ada6d8834fdf72d8cb67acc4b","96a88531d207bd33b579c8631000421b2063536764ebaf069d0e2ca3b97d4f84","de85a021c6a01a8601dbc8d78b81993072b7b9835f2109fe1cc1bad971bd1d89")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("3bf0f489250eaaa99100af4fd9cce3a23acf2b633c25f4571fb8078d4cb7c64d","e9f6edb73eb7cf8dcc40458f59d13ca2e236efc043d4bc913e113bd3a6af19a2","3450abaf86f0a535caeffb25f2a05576d60f871e9226b1bd425c425528c65670","091ffdfef9722804f33a2b1d0fe765d2c2b0c52ada6d8834fdf72d8cb67acc4b","96a88531d207bd33b579c8631000421b2063536764ebaf069d0e2ca3b97d4f84","de85a021c6a01a8601dbc8d78b81993072b7b9835f2109fe1cc1bad971bd1d89")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("3bf0f489250eaaa99100af4fd9cce3a23acf2b633c25f4571fb8078d4cb7c64d","e9f6edb73eb7cf8dcc40458f59d13ca2e236efc043d4bc913e113bd3a6af19a2","3450abaf86f0a535caeffb25f2a05576d60f871e9226b1bd425c425528c65670","091ffdfef9722804f33a2b1d0fe765d2c2b0c52ada6d8834fdf72d8cb67acc4b","96a88531d207bd33b579c8631000421b2063536764ebaf069d0e2ca3b97d4f84","de85a021c6a01a8601dbc8d78b81993072b7b9835f2109fe1cc1bad971bd1d89")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("3bf0f489250eaaa99100af4fd9cce3a23acf2b633c25f4571fb8078d4cb7c64d","e9f6edb73eb7cf8dcc40458f59d13ca2e236efc043d4bc913e113bd3a6af19a2","3450abaf86f0a535caeffb25f2a05576d60f871e9226b1bd425c425528c65670","091ffdfef9722804f33a2b1d0fe765d2c2b0c52ada6d8834fdf72d8cb67acc4b","96a88531d207bd33b579c8631000421b2063536764ebaf069d0e2ca3b97d4f84","de85a021c6a01a8601dbc8d78b81993072b7b9835f2109fe1cc1bad971bd1d89")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("3bf0f489250eaaa99100af4fd9cce3a23acf2b633c25f4571fb8078d4cb7c64d","e9f6edb73eb7cf8dcc40458f59d13ca2e236efc043d4bc913e113bd3a6af19a2","3450abaf86f0a535caeffb25f2a05576d60f871e9226b1bd425c425528c65670","091ffdfef9722804f33a2b1d0fe765d2c2b0c52ada6d8834fdf72d8cb67acc4b","96a88531d207bd33b579c8631000421b2063536764ebaf069d0e2ca3b97d4f84","de85a021c6a01a8601dbc8d78b81993072b7b9835f2109fe1cc1bad971bd1d89")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("3bf0f489250eaaa99100af4fd9cce3a23acf2b633c25f4571fb8078d4cb7c64d","e9f6edb73eb7cf8dcc40458f59d13ca2e236efc043d4bc913e113bd3a6af19a2","3450abaf86f0a535caeffb25f2a05576d60f871e9226b1bd425c425528c65670","091ffdfef9722804f33a2b1d0fe765d2c2b0c52ada6d8834fdf72d8cb67acc4b","96a88531d207bd33b579c8631000421b2063536764ebaf069d0e2ca3b97d4f84","de85a021c6a01a8601dbc8d78b81993072b7b9835f2109fe1cc1bad971bd1d89")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("3bf0f489250eaaa99100af4fd9cce3a23acf2b633c25f4571fb8078d4cb7c64d","e9f6edb73eb7cf8dcc40458f59d13ca2e236efc043d4bc913e113bd3a6af19a2","3450abaf86f0a535caeffb25f2a05576d60f871e9226b1bd425c425528c65670","091ffdfef9722804f33a2b1d0fe765d2c2b0c52ada6d8834fdf72d8cb67acc4b","96a88531d207bd33b579c8631000421b2063536764ebaf069d0e2ca3b97d4f84","de85a021c6a01a8601dbc8d78b81993072b7b9835f2109fe1cc1bad971bd1d89")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("3bf0f489250eaaa99100af4fd9cce3a23acf2b633c25f4571fb8078d4cb7c64d","e9f6edb73eb7cf8dcc40458f59d13ca2e236efc043d4bc913e113bd3a6af19a2","3450abaf86f0a535caeffb25f2a05576d60f871e9226b1bd425c425528c65670","091ffdfef9722804f33a2b1d0fe765d2c2b0c52ada6d8834fdf72d8cb67acc4b","96a88531d207bd33b579c8631000421b2063536764ebaf069d0e2ca3b97d4f84","de85a021c6a01a8601dbc8d78b81993072b7b9835f2109fe1cc1bad971bd1d89")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("3bf0f489250eaaa99100af4fd9cce3a23acf2b633c25f4571fb8078d4cb7c64d","e9f6edb73eb7cf8dcc40458f59d13ca2e236efc043d4bc913e113bd3a6af19a2","3450abaf86f0a535caeffb25f2a05576d60f871e9226b1bd425c425528c65670","091ffdfef9722804f33a2b1d0fe765d2c2b0c52ada6d8834fdf72d8cb67acc4b","96a88531d207bd33b579c8631000421b2063536764ebaf069d0e2ca3b97d4f84","de85a021c6a01a8601dbc8d78b81993072b7b9835f2109fe1cc1bad971bd1d89")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("3bf0f489250eaaa99100af4fd9cce3a23acf2b633c25f4571fb8078d4cb7c64d","e9f6edb73eb7cf8dcc40458f59d13ca2e236efc043d4bc913e113bd3a6af19a2","3450abaf86f0a535caeffb25f2a05576d60f871e9226b1bd425c425528c65670","091ffdfef9722804f33a2b1d0fe765d2c2b0c52ada6d8834fdf72d8cb67acc4b","96a88531d207bd33b579c8631000421b2063536764ebaf069d0e2ca3b97d4f84","de85a021c6a01a8601dbc8d78b81993072b7b9835f2109fe1cc1bad971bd1d89")
index=activity AND rg_functionality="Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("3bf0f489250eaaa99100af4fd9cce3a23acf2b633c25f4571fb8078d4cb7c64d","e9f6edb73eb7cf8dcc40458f59d13ca2e236efc043d4bc913e113bd3a6af19a2","3450abaf86f0a535caeffb25f2a05576d60f871e9226b1bd425c425528c65670","091ffdfef9722804f33a2b1d0fe765d2c2b0c52ada6d8834fdf72d8cb67acc4b","96a88531d207bd33b579c8631000421b2063536764ebaf069d0e2ca3b97d4f84","de85a021c6a01a8601dbc8d78b81993072b7b9835f2109fe1cc1bad971bd1d89")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("3bf0f489250eaaa99100af4fd9cce3a23acf2b633c25f4571fb8078d4cb7c64d","e9f6edb73eb7cf8dcc40458f59d13ca2e236efc043d4bc913e113bd3a6af19a2","3450abaf86f0a535caeffb25f2a05576d60f871e9226b1bd425c425528c65670","091ffdfef9722804f33a2b1d0fe765d2c2b0c52ada6d8834fdf72d8cb67acc4b","96a88531d207bd33b579c8631000421b2063536764ebaf069d0e2ca3b97d4f84","de85a021c6a01a8601dbc8d78b81993072b7b9835f2109fe1cc1bad971bd1d89")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("3bf0f489250eaaa99100af4fd9cce3a23acf2b633c25f4571fb8078d4cb7c64d","e9f6edb73eb7cf8dcc40458f59d13ca2e236efc043d4bc913e113bd3a6af19a2","3450abaf86f0a535caeffb25f2a05576d60f871e9226b1bd425c425528c65670","091ffdfef9722804f33a2b1d0fe765d2c2b0c52ada6d8834fdf72d8cb67acc4b","96a88531d207bd33b579c8631000421b2063536764ebaf069d0e2ca3b97d4f84","de85a021c6a01a8601dbc8d78b81993072b7b9835f2109fe1cc1bad971bd1d89")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("3bf0f489250eaaa99100af4fd9cce3a23acf2b633c25f4571fb8078d4cb7c64d","e9f6edb73eb7cf8dcc40458f59d13ca2e236efc043d4bc913e113bd3a6af19a2","3450abaf86f0a535caeffb25f2a05576d60f871e9226b1bd425c425528c65670","091ffdfef9722804f33a2b1d0fe765d2c2b0c52ada6d8834fdf72d8cb67acc4b","96a88531d207bd33b579c8631000421b2063536764ebaf069d0e2ca3b97d4f84","de85a021c6a01a8601dbc8d78b81993072b7b9835f2109fe1cc1bad971bd1d89")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("3bf0f489250eaaa99100af4fd9cce3a23acf2b633c25f4571fb8078d4cb7c64d","e9f6edb73eb7cf8dcc40458f59d13ca2e236efc043d4bc913e113bd3a6af19a2","3450abaf86f0a535caeffb25f2a05576d60f871e9226b1bd425c425528c65670","091ffdfef9722804f33a2b1d0fe765d2c2b0c52ada6d8834fdf72d8cb67acc4b","96a88531d207bd33b579c8631000421b2063536764ebaf069d0e2ca3b97d4f84","de85a021c6a01a8601dbc8d78b81993072b7b9835f2109fe1cc1bad971bd1d89")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("3bf0f489250eaaa99100af4fd9cce3a23acf2b633c25f4571fb8078d4cb7c64d","e9f6edb73eb7cf8dcc40458f59d13ca2e236efc043d4bc913e113bd3a6af19a2","3450abaf86f0a535caeffb25f2a05576d60f871e9226b1bd425c425528c65670","091ffdfef9722804f33a2b1d0fe765d2c2b0c52ada6d8834fdf72d8cb67acc4b","96a88531d207bd33b579c8631000421b2063536764ebaf069d0e2ca3b97d4f84","de85a021c6a01a8601dbc8d78b81993072b7b9835f2109fe1cc1bad971bd1d89")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("3bf0f489250eaaa99100af4fd9cce3a23acf2b633c25f4571fb8078d4cb7c64d","e9f6edb73eb7cf8dcc40458f59d13ca2e236efc043d4bc913e113bd3a6af19a2","3450abaf86f0a535caeffb25f2a05576d60f871e9226b1bd425c425528c65670","091ffdfef9722804f33a2b1d0fe765d2c2b0c52ada6d8834fdf72d8cb67acc4b","96a88531d207bd33b579c8631000421b2063536764ebaf069d0e2ca3b97d4f84","de85a021c6a01a8601dbc8d78b81993072b7b9835f2109fe1cc1bad971bd1d89")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("3bf0f489250eaaa99100af4fd9cce3a23acf2b633c25f4571fb8078d4cb7c64d","e9f6edb73eb7cf8dcc40458f59d13ca2e236efc043d4bc913e113bd3a6af19a2","3450abaf86f0a535caeffb25f2a05576d60f871e9226b1bd425c425528c65670","091ffdfef9722804f33a2b1d0fe765d2c2b0c52ada6d8834fdf72d8cb67acc4b","96a88531d207bd33b579c8631000421b2063536764ebaf069d0e2ca3b97d4f84","de85a021c6a01a8601dbc8d78b81993072b7b9835f2109fe1cc1bad971bd1d89")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring64 NOT NULL AND customstring64 IN ("3bf0f489250eaaa99100af4fd9cce3a23acf2b633c25f4571fb8078d4cb7c64d","e9f6edb73eb7cf8dcc40458f59d13ca2e236efc043d4bc913e113bd3a6af19a2","3450abaf86f0a535caeffb25f2a05576d60f871e9226b1bd425c425528c65670","091ffdfef9722804f33a2b1d0fe765d2c2b0c52ada6d8834fdf72d8cb67acc4b","96a88531d207bd33b579c8631000421b2063536764ebaf069d0e2ca3b97d4f84","de85a021c6a01a8601dbc8d78b81993072b7b9835f2109fe1cc1bad971bd1d89")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("3bf0f489250eaaa99100af4fd9cce3a23acf2b633c25f4571fb8078d4cb7c64d","e9f6edb73eb7cf8dcc40458f59d13ca2e236efc043d4bc913e113bd3a6af19a2","3450abaf86f0a535caeffb25f2a05576d60f871e9226b1bd425c425528c65670","091ffdfef9722804f33a2b1d0fe765d2c2b0c52ada6d8834fdf72d8cb67acc4b","96a88531d207bd33b579c8631000421b2063536764ebaf069d0e2ca3b97d4f84","de85a021c6a01a8601dbc8d78b81993072b7b9835f2109fe1cc1bad971bd1d89")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("3bf0f489250eaaa99100af4fd9cce3a23acf2b633c25f4571fb8078d4cb7c64d","e9f6edb73eb7cf8dcc40458f59d13ca2e236efc043d4bc913e113bd3a6af19a2","3450abaf86f0a535caeffb25f2a05576d60f871e9226b1bd425c425528c65670","091ffdfef9722804f33a2b1d0fe765d2c2b0c52ada6d8834fdf72d8cb67acc4b","96a88531d207bd33b579c8631000421b2063536764ebaf069d0e2ca3b97d4f84","de85a021c6a01a8601dbc8d78b81993072b7b9835f2109fe1cc1bad971bd1d89")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("3bf0f489250eaaa99100af4fd9cce3a23acf2b633c25f4571fb8078d4cb7c64d","e9f6edb73eb7cf8dcc40458f59d13ca2e236efc043d4bc913e113bd3a6af19a2","3450abaf86f0a535caeffb25f2a05576d60f871e9226b1bd425c425528c65670","091ffdfef9722804f33a2b1d0fe765d2c2b0c52ada6d8834fdf72d8cb67acc4b","96a88531d207bd33b579c8631000421b2063536764ebaf069d0e2ca3b97d4f84","de85a021c6a01a8601dbc8d78b81993072b7b9835f2109fe1cc1bad971bd1d89")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring64 NOT NULL AND customstring64 IN ("3bf0f489250eaaa99100af4fd9cce3a23acf2b633c25f4571fb8078d4cb7c64d","e9f6edb73eb7cf8dcc40458f59d13ca2e236efc043d4bc913e113bd3a6af19a2","3450abaf86f0a535caeffb25f2a05576d60f871e9226b1bd425c425528c65670","091ffdfef9722804f33a2b1d0fe765d2c2b0c52ada6d8834fdf72d8cb67acc4b","96a88531d207bd33b579c8631000421b2063536764ebaf069d0e2ca3b97d4f84","de85a021c6a01a8601dbc8d78b81993072b7b9835f2109fe1cc1bad971bd1d89")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("3bf0f489250eaaa99100af4fd9cce3a23acf2b633c25f4571fb8078d4cb7c64d","e9f6edb73eb7cf8dcc40458f59d13ca2e236efc043d4bc913e113bd3a6af19a2","3450abaf86f0a535caeffb25f2a05576d60f871e9226b1bd425c425528c65670","091ffdfef9722804f33a2b1d0fe765d2c2b0c52ada6d8834fdf72d8cb67acc4b","96a88531d207bd33b579c8631000421b2063536764ebaf069d0e2ca3b97d4f84","de85a021c6a01a8601dbc8d78b81993072b7b9835f2109fe1cc1bad971bd1d89")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("3bf0f489250eaaa99100af4fd9cce3a23acf2b633c25f4571fb8078d4cb7c64d","e9f6edb73eb7cf8dcc40458f59d13ca2e236efc043d4bc913e113bd3a6af19a2","3450abaf86f0a535caeffb25f2a05576d60f871e9226b1bd425c425528c65670","091ffdfef9722804f33a2b1d0fe765d2c2b0c52ada6d8834fdf72d8cb67acc4b","96a88531d207bd33b579c8631000421b2063536764ebaf069d0e2ca3b97d4f84","de85a021c6a01a8601dbc8d78b81993072b7b9835f2109fe1cc1bad971bd1d89")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("3bf0f489250eaaa99100af4fd9cce3a23acf2b633c25f4571fb8078d4cb7c64d","e9f6edb73eb7cf8dcc40458f59d13ca2e236efc043d4bc913e113bd3a6af19a2","3450abaf86f0a535caeffb25f2a05576d60f871e9226b1bd425c425528c65670","091ffdfef9722804f33a2b1d0fe765d2c2b0c52ada6d8834fdf72d8cb67acc4b","96a88531d207bd33b579c8631000421b2063536764ebaf069d0e2ca3b97d4f84","de85a021c6a01a8601dbc8d78b81993072b7b9835f2109fe1cc1bad971bd1d89")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring64 NOT NULL AND customstring64 IN ("3bf0f489250eaaa99100af4fd9cce3a23acf2b633c25f4571fb8078d4cb7c64d","e9f6edb73eb7cf8dcc40458f59d13ca2e236efc043d4bc913e113bd3a6af19a2","3450abaf86f0a535caeffb25f2a05576d60f871e9226b1bd425c425528c65670","091ffdfef9722804f33a2b1d0fe765d2c2b0c52ada6d8834fdf72d8cb67acc4b","96a88531d207bd33b579c8631000421b2063536764ebaf069d0e2ca3b97d4f84","de85a021c6a01a8601dbc8d78b81993072b7b9835f2109fe1cc1bad971bd1d89")
