index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("1a277cba1676478bf3d47bec97edaa14f83f50bdd11e2a15d9e0936ed243fd64","abbb76a7000de1df7f95eef806356030b6a8576526e0e938e36f71b238580704","5db376a328476e670aeefb93af8969206ca6ba8cf0877fd99319fa5d5db175ca","a8daf444c78f17b4a8e42896d6cb085e4faad12d1c1ae7d0e79757e6772bddb9","5c51de7c7a1ec4126344c66c70b71434f6c6710ce1e6d160a668154d461275ac","48540f12275f1ed277e768058907eb70cc88e3f98d055d9d73bf30aa15310ef3","99fd0c8746d5cce65650328219783c6c6e68e212bf1af6ea5975f4a99d885e59","ad8777161d4794281c2cc652ecb805d3e6a9887798877c6aa4babfd0ecb631d2","73e02706ba90357aeeb4fdcbdb3f1c616801ca1affed0a059728119bd11121a4","e04936b97ed30e4045d67917b331eb56a4b2111534648adcabc4475f98456727","66fef499efea41ac31ea93265c04f3b87041a6ae3cd14cd502b02da8cc77cca8","4edc178549442dae3ad95f1379b7433945e5499859fdbfd571820d7e5cf5033c","926a6a4ba8402c3dd9c33ceff50ac957910775b2969505d36ee1a6db7a9e0c87","9b017fb1446cdc76f040406803e639b97658b987601970125826960e94e9a1a6","f81f710f5968fea399551a1fb7a13fad48b005f3c9ba2ea419d14b597401838c")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("1a277cba1676478bf3d47bec97edaa14f83f50bdd11e2a15d9e0936ed243fd64","abbb76a7000de1df7f95eef806356030b6a8576526e0e938e36f71b238580704","5db376a328476e670aeefb93af8969206ca6ba8cf0877fd99319fa5d5db175ca","a8daf444c78f17b4a8e42896d6cb085e4faad12d1c1ae7d0e79757e6772bddb9","5c51de7c7a1ec4126344c66c70b71434f6c6710ce1e6d160a668154d461275ac","48540f12275f1ed277e768058907eb70cc88e3f98d055d9d73bf30aa15310ef3","99fd0c8746d5cce65650328219783c6c6e68e212bf1af6ea5975f4a99d885e59","ad8777161d4794281c2cc652ecb805d3e6a9887798877c6aa4babfd0ecb631d2","73e02706ba90357aeeb4fdcbdb3f1c616801ca1affed0a059728119bd11121a4","e04936b97ed30e4045d67917b331eb56a4b2111534648adcabc4475f98456727","66fef499efea41ac31ea93265c04f3b87041a6ae3cd14cd502b02da8cc77cca8","4edc178549442dae3ad95f1379b7433945e5499859fdbfd571820d7e5cf5033c","926a6a4ba8402c3dd9c33ceff50ac957910775b2969505d36ee1a6db7a9e0c87","9b017fb1446cdc76f040406803e639b97658b987601970125826960e94e9a1a6","f81f710f5968fea399551a1fb7a13fad48b005f3c9ba2ea419d14b597401838c")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("1a277cba1676478bf3d47bec97edaa14f83f50bdd11e2a15d9e0936ed243fd64","abbb76a7000de1df7f95eef806356030b6a8576526e0e938e36f71b238580704","5db376a328476e670aeefb93af8969206ca6ba8cf0877fd99319fa5d5db175ca","a8daf444c78f17b4a8e42896d6cb085e4faad12d1c1ae7d0e79757e6772bddb9","5c51de7c7a1ec4126344c66c70b71434f6c6710ce1e6d160a668154d461275ac","48540f12275f1ed277e768058907eb70cc88e3f98d055d9d73bf30aa15310ef3","99fd0c8746d5cce65650328219783c6c6e68e212bf1af6ea5975f4a99d885e59","ad8777161d4794281c2cc652ecb805d3e6a9887798877c6aa4babfd0ecb631d2","73e02706ba90357aeeb4fdcbdb3f1c616801ca1affed0a059728119bd11121a4","e04936b97ed30e4045d67917b331eb56a4b2111534648adcabc4475f98456727","66fef499efea41ac31ea93265c04f3b87041a6ae3cd14cd502b02da8cc77cca8","4edc178549442dae3ad95f1379b7433945e5499859fdbfd571820d7e5cf5033c","926a6a4ba8402c3dd9c33ceff50ac957910775b2969505d36ee1a6db7a9e0c87","9b017fb1446cdc76f040406803e639b97658b987601970125826960e94e9a1a6","f81f710f5968fea399551a1fb7a13fad48b005f3c9ba2ea419d14b597401838c")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring64 NOT NULL AND customstring64 IN ("1a277cba1676478bf3d47bec97edaa14f83f50bdd11e2a15d9e0936ed243fd64","abbb76a7000de1df7f95eef806356030b6a8576526e0e938e36f71b238580704","5db376a328476e670aeefb93af8969206ca6ba8cf0877fd99319fa5d5db175ca","a8daf444c78f17b4a8e42896d6cb085e4faad12d1c1ae7d0e79757e6772bddb9","5c51de7c7a1ec4126344c66c70b71434f6c6710ce1e6d160a668154d461275ac","48540f12275f1ed277e768058907eb70cc88e3f98d055d9d73bf30aa15310ef3","99fd0c8746d5cce65650328219783c6c6e68e212bf1af6ea5975f4a99d885e59","ad8777161d4794281c2cc652ecb805d3e6a9887798877c6aa4babfd0ecb631d2","73e02706ba90357aeeb4fdcbdb3f1c616801ca1affed0a059728119bd11121a4","e04936b97ed30e4045d67917b331eb56a4b2111534648adcabc4475f98456727","66fef499efea41ac31ea93265c04f3b87041a6ae3cd14cd502b02da8cc77cca8","4edc178549442dae3ad95f1379b7433945e5499859fdbfd571820d7e5cf5033c","926a6a4ba8402c3dd9c33ceff50ac957910775b2969505d36ee1a6db7a9e0c87","9b017fb1446cdc76f040406803e639b97658b987601970125826960e94e9a1a6","f81f710f5968fea399551a1fb7a13fad48b005f3c9ba2ea419d14b597401838c")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("1a277cba1676478bf3d47bec97edaa14f83f50bdd11e2a15d9e0936ed243fd64","abbb76a7000de1df7f95eef806356030b6a8576526e0e938e36f71b238580704","5db376a328476e670aeefb93af8969206ca6ba8cf0877fd99319fa5d5db175ca","a8daf444c78f17b4a8e42896d6cb085e4faad12d1c1ae7d0e79757e6772bddb9","5c51de7c7a1ec4126344c66c70b71434f6c6710ce1e6d160a668154d461275ac","48540f12275f1ed277e768058907eb70cc88e3f98d055d9d73bf30aa15310ef3","99fd0c8746d5cce65650328219783c6c6e68e212bf1af6ea5975f4a99d885e59","ad8777161d4794281c2cc652ecb805d3e6a9887798877c6aa4babfd0ecb631d2","73e02706ba90357aeeb4fdcbdb3f1c616801ca1affed0a059728119bd11121a4","e04936b97ed30e4045d67917b331eb56a4b2111534648adcabc4475f98456727","66fef499efea41ac31ea93265c04f3b87041a6ae3cd14cd502b02da8cc77cca8","4edc178549442dae3ad95f1379b7433945e5499859fdbfd571820d7e5cf5033c","926a6a4ba8402c3dd9c33ceff50ac957910775b2969505d36ee1a6db7a9e0c87","9b017fb1446cdc76f040406803e639b97658b987601970125826960e94e9a1a6","f81f710f5968fea399551a1fb7a13fad48b005f3c9ba2ea419d14b597401838c")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("1a277cba1676478bf3d47bec97edaa14f83f50bdd11e2a15d9e0936ed243fd64","abbb76a7000de1df7f95eef806356030b6a8576526e0e938e36f71b238580704","5db376a328476e670aeefb93af8969206ca6ba8cf0877fd99319fa5d5db175ca","a8daf444c78f17b4a8e42896d6cb085e4faad12d1c1ae7d0e79757e6772bddb9","5c51de7c7a1ec4126344c66c70b71434f6c6710ce1e6d160a668154d461275ac","48540f12275f1ed277e768058907eb70cc88e3f98d055d9d73bf30aa15310ef3","99fd0c8746d5cce65650328219783c6c6e68e212bf1af6ea5975f4a99d885e59","ad8777161d4794281c2cc652ecb805d3e6a9887798877c6aa4babfd0ecb631d2","73e02706ba90357aeeb4fdcbdb3f1c616801ca1affed0a059728119bd11121a4","e04936b97ed30e4045d67917b331eb56a4b2111534648adcabc4475f98456727","66fef499efea41ac31ea93265c04f3b87041a6ae3cd14cd502b02da8cc77cca8","4edc178549442dae3ad95f1379b7433945e5499859fdbfd571820d7e5cf5033c","926a6a4ba8402c3dd9c33ceff50ac957910775b2969505d36ee1a6db7a9e0c87","9b017fb1446cdc76f040406803e639b97658b987601970125826960e94e9a1a6","f81f710f5968fea399551a1fb7a13fad48b005f3c9ba2ea419d14b597401838c")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("1a277cba1676478bf3d47bec97edaa14f83f50bdd11e2a15d9e0936ed243fd64","abbb76a7000de1df7f95eef806356030b6a8576526e0e938e36f71b238580704","5db376a328476e670aeefb93af8969206ca6ba8cf0877fd99319fa5d5db175ca","a8daf444c78f17b4a8e42896d6cb085e4faad12d1c1ae7d0e79757e6772bddb9","5c51de7c7a1ec4126344c66c70b71434f6c6710ce1e6d160a668154d461275ac","48540f12275f1ed277e768058907eb70cc88e3f98d055d9d73bf30aa15310ef3","99fd0c8746d5cce65650328219783c6c6e68e212bf1af6ea5975f4a99d885e59","ad8777161d4794281c2cc652ecb805d3e6a9887798877c6aa4babfd0ecb631d2","73e02706ba90357aeeb4fdcbdb3f1c616801ca1affed0a059728119bd11121a4","e04936b97ed30e4045d67917b331eb56a4b2111534648adcabc4475f98456727","66fef499efea41ac31ea93265c04f3b87041a6ae3cd14cd502b02da8cc77cca8","4edc178549442dae3ad95f1379b7433945e5499859fdbfd571820d7e5cf5033c","926a6a4ba8402c3dd9c33ceff50ac957910775b2969505d36ee1a6db7a9e0c87","9b017fb1446cdc76f040406803e639b97658b987601970125826960e94e9a1a6","f81f710f5968fea399551a1fb7a13fad48b005f3c9ba2ea419d14b597401838c")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("1a277cba1676478bf3d47bec97edaa14f83f50bdd11e2a15d9e0936ed243fd64","abbb76a7000de1df7f95eef806356030b6a8576526e0e938e36f71b238580704","5db376a328476e670aeefb93af8969206ca6ba8cf0877fd99319fa5d5db175ca","a8daf444c78f17b4a8e42896d6cb085e4faad12d1c1ae7d0e79757e6772bddb9","5c51de7c7a1ec4126344c66c70b71434f6c6710ce1e6d160a668154d461275ac","48540f12275f1ed277e768058907eb70cc88e3f98d055d9d73bf30aa15310ef3","99fd0c8746d5cce65650328219783c6c6e68e212bf1af6ea5975f4a99d885e59","ad8777161d4794281c2cc652ecb805d3e6a9887798877c6aa4babfd0ecb631d2","73e02706ba90357aeeb4fdcbdb3f1c616801ca1affed0a059728119bd11121a4","e04936b97ed30e4045d67917b331eb56a4b2111534648adcabc4475f98456727","66fef499efea41ac31ea93265c04f3b87041a6ae3cd14cd502b02da8cc77cca8","4edc178549442dae3ad95f1379b7433945e5499859fdbfd571820d7e5cf5033c","926a6a4ba8402c3dd9c33ceff50ac957910775b2969505d36ee1a6db7a9e0c87","9b017fb1446cdc76f040406803e639b97658b987601970125826960e94e9a1a6","f81f710f5968fea399551a1fb7a13fad48b005f3c9ba2ea419d14b597401838c")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("1a277cba1676478bf3d47bec97edaa14f83f50bdd11e2a15d9e0936ed243fd64","abbb76a7000de1df7f95eef806356030b6a8576526e0e938e36f71b238580704","5db376a328476e670aeefb93af8969206ca6ba8cf0877fd99319fa5d5db175ca","a8daf444c78f17b4a8e42896d6cb085e4faad12d1c1ae7d0e79757e6772bddb9","5c51de7c7a1ec4126344c66c70b71434f6c6710ce1e6d160a668154d461275ac","48540f12275f1ed277e768058907eb70cc88e3f98d055d9d73bf30aa15310ef3","99fd0c8746d5cce65650328219783c6c6e68e212bf1af6ea5975f4a99d885e59","ad8777161d4794281c2cc652ecb805d3e6a9887798877c6aa4babfd0ecb631d2","73e02706ba90357aeeb4fdcbdb3f1c616801ca1affed0a059728119bd11121a4","e04936b97ed30e4045d67917b331eb56a4b2111534648adcabc4475f98456727","66fef499efea41ac31ea93265c04f3b87041a6ae3cd14cd502b02da8cc77cca8","4edc178549442dae3ad95f1379b7433945e5499859fdbfd571820d7e5cf5033c","926a6a4ba8402c3dd9c33ceff50ac957910775b2969505d36ee1a6db7a9e0c87","9b017fb1446cdc76f040406803e639b97658b987601970125826960e94e9a1a6","f81f710f5968fea399551a1fb7a13fad48b005f3c9ba2ea419d14b597401838c")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("1a277cba1676478bf3d47bec97edaa14f83f50bdd11e2a15d9e0936ed243fd64","abbb76a7000de1df7f95eef806356030b6a8576526e0e938e36f71b238580704","5db376a328476e670aeefb93af8969206ca6ba8cf0877fd99319fa5d5db175ca","a8daf444c78f17b4a8e42896d6cb085e4faad12d1c1ae7d0e79757e6772bddb9","5c51de7c7a1ec4126344c66c70b71434f6c6710ce1e6d160a668154d461275ac","48540f12275f1ed277e768058907eb70cc88e3f98d055d9d73bf30aa15310ef3","99fd0c8746d5cce65650328219783c6c6e68e212bf1af6ea5975f4a99d885e59","ad8777161d4794281c2cc652ecb805d3e6a9887798877c6aa4babfd0ecb631d2","73e02706ba90357aeeb4fdcbdb3f1c616801ca1affed0a059728119bd11121a4","e04936b97ed30e4045d67917b331eb56a4b2111534648adcabc4475f98456727","66fef499efea41ac31ea93265c04f3b87041a6ae3cd14cd502b02da8cc77cca8","4edc178549442dae3ad95f1379b7433945e5499859fdbfd571820d7e5cf5033c","926a6a4ba8402c3dd9c33ceff50ac957910775b2969505d36ee1a6db7a9e0c87","9b017fb1446cdc76f040406803e639b97658b987601970125826960e94e9a1a6","f81f710f5968fea399551a1fb7a13fad48b005f3c9ba2ea419d14b597401838c")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("1a277cba1676478bf3d47bec97edaa14f83f50bdd11e2a15d9e0936ed243fd64","abbb76a7000de1df7f95eef806356030b6a8576526e0e938e36f71b238580704","5db376a328476e670aeefb93af8969206ca6ba8cf0877fd99319fa5d5db175ca","a8daf444c78f17b4a8e42896d6cb085e4faad12d1c1ae7d0e79757e6772bddb9","5c51de7c7a1ec4126344c66c70b71434f6c6710ce1e6d160a668154d461275ac","48540f12275f1ed277e768058907eb70cc88e3f98d055d9d73bf30aa15310ef3","99fd0c8746d5cce65650328219783c6c6e68e212bf1af6ea5975f4a99d885e59","ad8777161d4794281c2cc652ecb805d3e6a9887798877c6aa4babfd0ecb631d2","73e02706ba90357aeeb4fdcbdb3f1c616801ca1affed0a059728119bd11121a4","e04936b97ed30e4045d67917b331eb56a4b2111534648adcabc4475f98456727","66fef499efea41ac31ea93265c04f3b87041a6ae3cd14cd502b02da8cc77cca8","4edc178549442dae3ad95f1379b7433945e5499859fdbfd571820d7e5cf5033c","926a6a4ba8402c3dd9c33ceff50ac957910775b2969505d36ee1a6db7a9e0c87","9b017fb1446cdc76f040406803e639b97658b987601970125826960e94e9a1a6","f81f710f5968fea399551a1fb7a13fad48b005f3c9ba2ea419d14b597401838c")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("1a277cba1676478bf3d47bec97edaa14f83f50bdd11e2a15d9e0936ed243fd64","abbb76a7000de1df7f95eef806356030b6a8576526e0e938e36f71b238580704","5db376a328476e670aeefb93af8969206ca6ba8cf0877fd99319fa5d5db175ca","a8daf444c78f17b4a8e42896d6cb085e4faad12d1c1ae7d0e79757e6772bddb9","5c51de7c7a1ec4126344c66c70b71434f6c6710ce1e6d160a668154d461275ac","48540f12275f1ed277e768058907eb70cc88e3f98d055d9d73bf30aa15310ef3","99fd0c8746d5cce65650328219783c6c6e68e212bf1af6ea5975f4a99d885e59","ad8777161d4794281c2cc652ecb805d3e6a9887798877c6aa4babfd0ecb631d2","73e02706ba90357aeeb4fdcbdb3f1c616801ca1affed0a059728119bd11121a4","e04936b97ed30e4045d67917b331eb56a4b2111534648adcabc4475f98456727","66fef499efea41ac31ea93265c04f3b87041a6ae3cd14cd502b02da8cc77cca8","4edc178549442dae3ad95f1379b7433945e5499859fdbfd571820d7e5cf5033c","926a6a4ba8402c3dd9c33ceff50ac957910775b2969505d36ee1a6db7a9e0c87","9b017fb1446cdc76f040406803e639b97658b987601970125826960e94e9a1a6","f81f710f5968fea399551a1fb7a13fad48b005f3c9ba2ea419d14b597401838c")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("1a277cba1676478bf3d47bec97edaa14f83f50bdd11e2a15d9e0936ed243fd64","abbb76a7000de1df7f95eef806356030b6a8576526e0e938e36f71b238580704","5db376a328476e670aeefb93af8969206ca6ba8cf0877fd99319fa5d5db175ca","a8daf444c78f17b4a8e42896d6cb085e4faad12d1c1ae7d0e79757e6772bddb9","5c51de7c7a1ec4126344c66c70b71434f6c6710ce1e6d160a668154d461275ac","48540f12275f1ed277e768058907eb70cc88e3f98d055d9d73bf30aa15310ef3","99fd0c8746d5cce65650328219783c6c6e68e212bf1af6ea5975f4a99d885e59","ad8777161d4794281c2cc652ecb805d3e6a9887798877c6aa4babfd0ecb631d2","73e02706ba90357aeeb4fdcbdb3f1c616801ca1affed0a059728119bd11121a4","e04936b97ed30e4045d67917b331eb56a4b2111534648adcabc4475f98456727","66fef499efea41ac31ea93265c04f3b87041a6ae3cd14cd502b02da8cc77cca8","4edc178549442dae3ad95f1379b7433945e5499859fdbfd571820d7e5cf5033c","926a6a4ba8402c3dd9c33ceff50ac957910775b2969505d36ee1a6db7a9e0c87","9b017fb1446cdc76f040406803e639b97658b987601970125826960e94e9a1a6","f81f710f5968fea399551a1fb7a13fad48b005f3c9ba2ea419d14b597401838c")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("1a277cba1676478bf3d47bec97edaa14f83f50bdd11e2a15d9e0936ed243fd64","abbb76a7000de1df7f95eef806356030b6a8576526e0e938e36f71b238580704","5db376a328476e670aeefb93af8969206ca6ba8cf0877fd99319fa5d5db175ca","a8daf444c78f17b4a8e42896d6cb085e4faad12d1c1ae7d0e79757e6772bddb9","5c51de7c7a1ec4126344c66c70b71434f6c6710ce1e6d160a668154d461275ac","48540f12275f1ed277e768058907eb70cc88e3f98d055d9d73bf30aa15310ef3","99fd0c8746d5cce65650328219783c6c6e68e212bf1af6ea5975f4a99d885e59","ad8777161d4794281c2cc652ecb805d3e6a9887798877c6aa4babfd0ecb631d2","73e02706ba90357aeeb4fdcbdb3f1c616801ca1affed0a059728119bd11121a4","e04936b97ed30e4045d67917b331eb56a4b2111534648adcabc4475f98456727","66fef499efea41ac31ea93265c04f3b87041a6ae3cd14cd502b02da8cc77cca8","4edc178549442dae3ad95f1379b7433945e5499859fdbfd571820d7e5cf5033c","926a6a4ba8402c3dd9c33ceff50ac957910775b2969505d36ee1a6db7a9e0c87","9b017fb1446cdc76f040406803e639b97658b987601970125826960e94e9a1a6","f81f710f5968fea399551a1fb7a13fad48b005f3c9ba2ea419d14b597401838c")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("1a277cba1676478bf3d47bec97edaa14f83f50bdd11e2a15d9e0936ed243fd64","abbb76a7000de1df7f95eef806356030b6a8576526e0e938e36f71b238580704","5db376a328476e670aeefb93af8969206ca6ba8cf0877fd99319fa5d5db175ca","a8daf444c78f17b4a8e42896d6cb085e4faad12d1c1ae7d0e79757e6772bddb9","5c51de7c7a1ec4126344c66c70b71434f6c6710ce1e6d160a668154d461275ac","48540f12275f1ed277e768058907eb70cc88e3f98d055d9d73bf30aa15310ef3","99fd0c8746d5cce65650328219783c6c6e68e212bf1af6ea5975f4a99d885e59","ad8777161d4794281c2cc652ecb805d3e6a9887798877c6aa4babfd0ecb631d2","73e02706ba90357aeeb4fdcbdb3f1c616801ca1affed0a059728119bd11121a4","e04936b97ed30e4045d67917b331eb56a4b2111534648adcabc4475f98456727","66fef499efea41ac31ea93265c04f3b87041a6ae3cd14cd502b02da8cc77cca8","4edc178549442dae3ad95f1379b7433945e5499859fdbfd571820d7e5cf5033c","926a6a4ba8402c3dd9c33ceff50ac957910775b2969505d36ee1a6db7a9e0c87","9b017fb1446cdc76f040406803e639b97658b987601970125826960e94e9a1a6","f81f710f5968fea399551a1fb7a13fad48b005f3c9ba2ea419d14b597401838c")
index=activity AND rg_functionality="Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("1a277cba1676478bf3d47bec97edaa14f83f50bdd11e2a15d9e0936ed243fd64","abbb76a7000de1df7f95eef806356030b6a8576526e0e938e36f71b238580704","5db376a328476e670aeefb93af8969206ca6ba8cf0877fd99319fa5d5db175ca","a8daf444c78f17b4a8e42896d6cb085e4faad12d1c1ae7d0e79757e6772bddb9","5c51de7c7a1ec4126344c66c70b71434f6c6710ce1e6d160a668154d461275ac","48540f12275f1ed277e768058907eb70cc88e3f98d055d9d73bf30aa15310ef3","99fd0c8746d5cce65650328219783c6c6e68e212bf1af6ea5975f4a99d885e59","ad8777161d4794281c2cc652ecb805d3e6a9887798877c6aa4babfd0ecb631d2","73e02706ba90357aeeb4fdcbdb3f1c616801ca1affed0a059728119bd11121a4","e04936b97ed30e4045d67917b331eb56a4b2111534648adcabc4475f98456727","66fef499efea41ac31ea93265c04f3b87041a6ae3cd14cd502b02da8cc77cca8","4edc178549442dae3ad95f1379b7433945e5499859fdbfd571820d7e5cf5033c","926a6a4ba8402c3dd9c33ceff50ac957910775b2969505d36ee1a6db7a9e0c87","9b017fb1446cdc76f040406803e639b97658b987601970125826960e94e9a1a6","f81f710f5968fea399551a1fb7a13fad48b005f3c9ba2ea419d14b597401838c")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("1a277cba1676478bf3d47bec97edaa14f83f50bdd11e2a15d9e0936ed243fd64","abbb76a7000de1df7f95eef806356030b6a8576526e0e938e36f71b238580704","5db376a328476e670aeefb93af8969206ca6ba8cf0877fd99319fa5d5db175ca","a8daf444c78f17b4a8e42896d6cb085e4faad12d1c1ae7d0e79757e6772bddb9","5c51de7c7a1ec4126344c66c70b71434f6c6710ce1e6d160a668154d461275ac","48540f12275f1ed277e768058907eb70cc88e3f98d055d9d73bf30aa15310ef3","99fd0c8746d5cce65650328219783c6c6e68e212bf1af6ea5975f4a99d885e59","ad8777161d4794281c2cc652ecb805d3e6a9887798877c6aa4babfd0ecb631d2","73e02706ba90357aeeb4fdcbdb3f1c616801ca1affed0a059728119bd11121a4","e04936b97ed30e4045d67917b331eb56a4b2111534648adcabc4475f98456727","66fef499efea41ac31ea93265c04f3b87041a6ae3cd14cd502b02da8cc77cca8","4edc178549442dae3ad95f1379b7433945e5499859fdbfd571820d7e5cf5033c","926a6a4ba8402c3dd9c33ceff50ac957910775b2969505d36ee1a6db7a9e0c87","9b017fb1446cdc76f040406803e639b97658b987601970125826960e94e9a1a6","f81f710f5968fea399551a1fb7a13fad48b005f3c9ba2ea419d14b597401838c")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("1a277cba1676478bf3d47bec97edaa14f83f50bdd11e2a15d9e0936ed243fd64","abbb76a7000de1df7f95eef806356030b6a8576526e0e938e36f71b238580704","5db376a328476e670aeefb93af8969206ca6ba8cf0877fd99319fa5d5db175ca","a8daf444c78f17b4a8e42896d6cb085e4faad12d1c1ae7d0e79757e6772bddb9","5c51de7c7a1ec4126344c66c70b71434f6c6710ce1e6d160a668154d461275ac","48540f12275f1ed277e768058907eb70cc88e3f98d055d9d73bf30aa15310ef3","99fd0c8746d5cce65650328219783c6c6e68e212bf1af6ea5975f4a99d885e59","ad8777161d4794281c2cc652ecb805d3e6a9887798877c6aa4babfd0ecb631d2","73e02706ba90357aeeb4fdcbdb3f1c616801ca1affed0a059728119bd11121a4","e04936b97ed30e4045d67917b331eb56a4b2111534648adcabc4475f98456727","66fef499efea41ac31ea93265c04f3b87041a6ae3cd14cd502b02da8cc77cca8","4edc178549442dae3ad95f1379b7433945e5499859fdbfd571820d7e5cf5033c","926a6a4ba8402c3dd9c33ceff50ac957910775b2969505d36ee1a6db7a9e0c87","9b017fb1446cdc76f040406803e639b97658b987601970125826960e94e9a1a6","f81f710f5968fea399551a1fb7a13fad48b005f3c9ba2ea419d14b597401838c")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("1a277cba1676478bf3d47bec97edaa14f83f50bdd11e2a15d9e0936ed243fd64","abbb76a7000de1df7f95eef806356030b6a8576526e0e938e36f71b238580704","5db376a328476e670aeefb93af8969206ca6ba8cf0877fd99319fa5d5db175ca","a8daf444c78f17b4a8e42896d6cb085e4faad12d1c1ae7d0e79757e6772bddb9","5c51de7c7a1ec4126344c66c70b71434f6c6710ce1e6d160a668154d461275ac","48540f12275f1ed277e768058907eb70cc88e3f98d055d9d73bf30aa15310ef3","99fd0c8746d5cce65650328219783c6c6e68e212bf1af6ea5975f4a99d885e59","ad8777161d4794281c2cc652ecb805d3e6a9887798877c6aa4babfd0ecb631d2","73e02706ba90357aeeb4fdcbdb3f1c616801ca1affed0a059728119bd11121a4","e04936b97ed30e4045d67917b331eb56a4b2111534648adcabc4475f98456727","66fef499efea41ac31ea93265c04f3b87041a6ae3cd14cd502b02da8cc77cca8","4edc178549442dae3ad95f1379b7433945e5499859fdbfd571820d7e5cf5033c","926a6a4ba8402c3dd9c33ceff50ac957910775b2969505d36ee1a6db7a9e0c87","9b017fb1446cdc76f040406803e639b97658b987601970125826960e94e9a1a6","f81f710f5968fea399551a1fb7a13fad48b005f3c9ba2ea419d14b597401838c")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("1a277cba1676478bf3d47bec97edaa14f83f50bdd11e2a15d9e0936ed243fd64","abbb76a7000de1df7f95eef806356030b6a8576526e0e938e36f71b238580704","5db376a328476e670aeefb93af8969206ca6ba8cf0877fd99319fa5d5db175ca","a8daf444c78f17b4a8e42896d6cb085e4faad12d1c1ae7d0e79757e6772bddb9","5c51de7c7a1ec4126344c66c70b71434f6c6710ce1e6d160a668154d461275ac","48540f12275f1ed277e768058907eb70cc88e3f98d055d9d73bf30aa15310ef3","99fd0c8746d5cce65650328219783c6c6e68e212bf1af6ea5975f4a99d885e59","ad8777161d4794281c2cc652ecb805d3e6a9887798877c6aa4babfd0ecb631d2","73e02706ba90357aeeb4fdcbdb3f1c616801ca1affed0a059728119bd11121a4","e04936b97ed30e4045d67917b331eb56a4b2111534648adcabc4475f98456727","66fef499efea41ac31ea93265c04f3b87041a6ae3cd14cd502b02da8cc77cca8","4edc178549442dae3ad95f1379b7433945e5499859fdbfd571820d7e5cf5033c","926a6a4ba8402c3dd9c33ceff50ac957910775b2969505d36ee1a6db7a9e0c87","9b017fb1446cdc76f040406803e639b97658b987601970125826960e94e9a1a6","f81f710f5968fea399551a1fb7a13fad48b005f3c9ba2ea419d14b597401838c")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("1a277cba1676478bf3d47bec97edaa14f83f50bdd11e2a15d9e0936ed243fd64","abbb76a7000de1df7f95eef806356030b6a8576526e0e938e36f71b238580704","5db376a328476e670aeefb93af8969206ca6ba8cf0877fd99319fa5d5db175ca","a8daf444c78f17b4a8e42896d6cb085e4faad12d1c1ae7d0e79757e6772bddb9","5c51de7c7a1ec4126344c66c70b71434f6c6710ce1e6d160a668154d461275ac","48540f12275f1ed277e768058907eb70cc88e3f98d055d9d73bf30aa15310ef3","99fd0c8746d5cce65650328219783c6c6e68e212bf1af6ea5975f4a99d885e59","ad8777161d4794281c2cc652ecb805d3e6a9887798877c6aa4babfd0ecb631d2","73e02706ba90357aeeb4fdcbdb3f1c616801ca1affed0a059728119bd11121a4","e04936b97ed30e4045d67917b331eb56a4b2111534648adcabc4475f98456727","66fef499efea41ac31ea93265c04f3b87041a6ae3cd14cd502b02da8cc77cca8","4edc178549442dae3ad95f1379b7433945e5499859fdbfd571820d7e5cf5033c","926a6a4ba8402c3dd9c33ceff50ac957910775b2969505d36ee1a6db7a9e0c87","9b017fb1446cdc76f040406803e639b97658b987601970125826960e94e9a1a6","f81f710f5968fea399551a1fb7a13fad48b005f3c9ba2ea419d14b597401838c")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("1a277cba1676478bf3d47bec97edaa14f83f50bdd11e2a15d9e0936ed243fd64","abbb76a7000de1df7f95eef806356030b6a8576526e0e938e36f71b238580704","5db376a328476e670aeefb93af8969206ca6ba8cf0877fd99319fa5d5db175ca","a8daf444c78f17b4a8e42896d6cb085e4faad12d1c1ae7d0e79757e6772bddb9","5c51de7c7a1ec4126344c66c70b71434f6c6710ce1e6d160a668154d461275ac","48540f12275f1ed277e768058907eb70cc88e3f98d055d9d73bf30aa15310ef3","99fd0c8746d5cce65650328219783c6c6e68e212bf1af6ea5975f4a99d885e59","ad8777161d4794281c2cc652ecb805d3e6a9887798877c6aa4babfd0ecb631d2","73e02706ba90357aeeb4fdcbdb3f1c616801ca1affed0a059728119bd11121a4","e04936b97ed30e4045d67917b331eb56a4b2111534648adcabc4475f98456727","66fef499efea41ac31ea93265c04f3b87041a6ae3cd14cd502b02da8cc77cca8","4edc178549442dae3ad95f1379b7433945e5499859fdbfd571820d7e5cf5033c","926a6a4ba8402c3dd9c33ceff50ac957910775b2969505d36ee1a6db7a9e0c87","9b017fb1446cdc76f040406803e639b97658b987601970125826960e94e9a1a6","f81f710f5968fea399551a1fb7a13fad48b005f3c9ba2ea419d14b597401838c")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("1a277cba1676478bf3d47bec97edaa14f83f50bdd11e2a15d9e0936ed243fd64","abbb76a7000de1df7f95eef806356030b6a8576526e0e938e36f71b238580704","5db376a328476e670aeefb93af8969206ca6ba8cf0877fd99319fa5d5db175ca","a8daf444c78f17b4a8e42896d6cb085e4faad12d1c1ae7d0e79757e6772bddb9","5c51de7c7a1ec4126344c66c70b71434f6c6710ce1e6d160a668154d461275ac","48540f12275f1ed277e768058907eb70cc88e3f98d055d9d73bf30aa15310ef3","99fd0c8746d5cce65650328219783c6c6e68e212bf1af6ea5975f4a99d885e59","ad8777161d4794281c2cc652ecb805d3e6a9887798877c6aa4babfd0ecb631d2","73e02706ba90357aeeb4fdcbdb3f1c616801ca1affed0a059728119bd11121a4","e04936b97ed30e4045d67917b331eb56a4b2111534648adcabc4475f98456727","66fef499efea41ac31ea93265c04f3b87041a6ae3cd14cd502b02da8cc77cca8","4edc178549442dae3ad95f1379b7433945e5499859fdbfd571820d7e5cf5033c","926a6a4ba8402c3dd9c33ceff50ac957910775b2969505d36ee1a6db7a9e0c87","9b017fb1446cdc76f040406803e639b97658b987601970125826960e94e9a1a6","f81f710f5968fea399551a1fb7a13fad48b005f3c9ba2ea419d14b597401838c")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring64 NOT NULL AND customstring64 IN ("1a277cba1676478bf3d47bec97edaa14f83f50bdd11e2a15d9e0936ed243fd64","abbb76a7000de1df7f95eef806356030b6a8576526e0e938e36f71b238580704","5db376a328476e670aeefb93af8969206ca6ba8cf0877fd99319fa5d5db175ca","a8daf444c78f17b4a8e42896d6cb085e4faad12d1c1ae7d0e79757e6772bddb9","5c51de7c7a1ec4126344c66c70b71434f6c6710ce1e6d160a668154d461275ac","48540f12275f1ed277e768058907eb70cc88e3f98d055d9d73bf30aa15310ef3","99fd0c8746d5cce65650328219783c6c6e68e212bf1af6ea5975f4a99d885e59","ad8777161d4794281c2cc652ecb805d3e6a9887798877c6aa4babfd0ecb631d2","73e02706ba90357aeeb4fdcbdb3f1c616801ca1affed0a059728119bd11121a4","e04936b97ed30e4045d67917b331eb56a4b2111534648adcabc4475f98456727","66fef499efea41ac31ea93265c04f3b87041a6ae3cd14cd502b02da8cc77cca8","4edc178549442dae3ad95f1379b7433945e5499859fdbfd571820d7e5cf5033c","926a6a4ba8402c3dd9c33ceff50ac957910775b2969505d36ee1a6db7a9e0c87","9b017fb1446cdc76f040406803e639b97658b987601970125826960e94e9a1a6","f81f710f5968fea399551a1fb7a13fad48b005f3c9ba2ea419d14b597401838c")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("1a277cba1676478bf3d47bec97edaa14f83f50bdd11e2a15d9e0936ed243fd64","abbb76a7000de1df7f95eef806356030b6a8576526e0e938e36f71b238580704","5db376a328476e670aeefb93af8969206ca6ba8cf0877fd99319fa5d5db175ca","a8daf444c78f17b4a8e42896d6cb085e4faad12d1c1ae7d0e79757e6772bddb9","5c51de7c7a1ec4126344c66c70b71434f6c6710ce1e6d160a668154d461275ac","48540f12275f1ed277e768058907eb70cc88e3f98d055d9d73bf30aa15310ef3","99fd0c8746d5cce65650328219783c6c6e68e212bf1af6ea5975f4a99d885e59","ad8777161d4794281c2cc652ecb805d3e6a9887798877c6aa4babfd0ecb631d2","73e02706ba90357aeeb4fdcbdb3f1c616801ca1affed0a059728119bd11121a4","e04936b97ed30e4045d67917b331eb56a4b2111534648adcabc4475f98456727","66fef499efea41ac31ea93265c04f3b87041a6ae3cd14cd502b02da8cc77cca8","4edc178549442dae3ad95f1379b7433945e5499859fdbfd571820d7e5cf5033c","926a6a4ba8402c3dd9c33ceff50ac957910775b2969505d36ee1a6db7a9e0c87","9b017fb1446cdc76f040406803e639b97658b987601970125826960e94e9a1a6","f81f710f5968fea399551a1fb7a13fad48b005f3c9ba2ea419d14b597401838c")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("1a277cba1676478bf3d47bec97edaa14f83f50bdd11e2a15d9e0936ed243fd64","abbb76a7000de1df7f95eef806356030b6a8576526e0e938e36f71b238580704","5db376a328476e670aeefb93af8969206ca6ba8cf0877fd99319fa5d5db175ca","a8daf444c78f17b4a8e42896d6cb085e4faad12d1c1ae7d0e79757e6772bddb9","5c51de7c7a1ec4126344c66c70b71434f6c6710ce1e6d160a668154d461275ac","48540f12275f1ed277e768058907eb70cc88e3f98d055d9d73bf30aa15310ef3","99fd0c8746d5cce65650328219783c6c6e68e212bf1af6ea5975f4a99d885e59","ad8777161d4794281c2cc652ecb805d3e6a9887798877c6aa4babfd0ecb631d2","73e02706ba90357aeeb4fdcbdb3f1c616801ca1affed0a059728119bd11121a4","e04936b97ed30e4045d67917b331eb56a4b2111534648adcabc4475f98456727","66fef499efea41ac31ea93265c04f3b87041a6ae3cd14cd502b02da8cc77cca8","4edc178549442dae3ad95f1379b7433945e5499859fdbfd571820d7e5cf5033c","926a6a4ba8402c3dd9c33ceff50ac957910775b2969505d36ee1a6db7a9e0c87","9b017fb1446cdc76f040406803e639b97658b987601970125826960e94e9a1a6","f81f710f5968fea399551a1fb7a13fad48b005f3c9ba2ea419d14b597401838c")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("1a277cba1676478bf3d47bec97edaa14f83f50bdd11e2a15d9e0936ed243fd64","abbb76a7000de1df7f95eef806356030b6a8576526e0e938e36f71b238580704","5db376a328476e670aeefb93af8969206ca6ba8cf0877fd99319fa5d5db175ca","a8daf444c78f17b4a8e42896d6cb085e4faad12d1c1ae7d0e79757e6772bddb9","5c51de7c7a1ec4126344c66c70b71434f6c6710ce1e6d160a668154d461275ac","48540f12275f1ed277e768058907eb70cc88e3f98d055d9d73bf30aa15310ef3","99fd0c8746d5cce65650328219783c6c6e68e212bf1af6ea5975f4a99d885e59","ad8777161d4794281c2cc652ecb805d3e6a9887798877c6aa4babfd0ecb631d2","73e02706ba90357aeeb4fdcbdb3f1c616801ca1affed0a059728119bd11121a4","e04936b97ed30e4045d67917b331eb56a4b2111534648adcabc4475f98456727","66fef499efea41ac31ea93265c04f3b87041a6ae3cd14cd502b02da8cc77cca8","4edc178549442dae3ad95f1379b7433945e5499859fdbfd571820d7e5cf5033c","926a6a4ba8402c3dd9c33ceff50ac957910775b2969505d36ee1a6db7a9e0c87","9b017fb1446cdc76f040406803e639b97658b987601970125826960e94e9a1a6","f81f710f5968fea399551a1fb7a13fad48b005f3c9ba2ea419d14b597401838c")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring64 NOT NULL AND customstring64 IN ("1a277cba1676478bf3d47bec97edaa14f83f50bdd11e2a15d9e0936ed243fd64","abbb76a7000de1df7f95eef806356030b6a8576526e0e938e36f71b238580704","5db376a328476e670aeefb93af8969206ca6ba8cf0877fd99319fa5d5db175ca","a8daf444c78f17b4a8e42896d6cb085e4faad12d1c1ae7d0e79757e6772bddb9","5c51de7c7a1ec4126344c66c70b71434f6c6710ce1e6d160a668154d461275ac","48540f12275f1ed277e768058907eb70cc88e3f98d055d9d73bf30aa15310ef3","99fd0c8746d5cce65650328219783c6c6e68e212bf1af6ea5975f4a99d885e59","ad8777161d4794281c2cc652ecb805d3e6a9887798877c6aa4babfd0ecb631d2","73e02706ba90357aeeb4fdcbdb3f1c616801ca1affed0a059728119bd11121a4","e04936b97ed30e4045d67917b331eb56a4b2111534648adcabc4475f98456727","66fef499efea41ac31ea93265c04f3b87041a6ae3cd14cd502b02da8cc77cca8","4edc178549442dae3ad95f1379b7433945e5499859fdbfd571820d7e5cf5033c","926a6a4ba8402c3dd9c33ceff50ac957910775b2969505d36ee1a6db7a9e0c87","9b017fb1446cdc76f040406803e639b97658b987601970125826960e94e9a1a6","f81f710f5968fea399551a1fb7a13fad48b005f3c9ba2ea419d14b597401838c")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("1a277cba1676478bf3d47bec97edaa14f83f50bdd11e2a15d9e0936ed243fd64","abbb76a7000de1df7f95eef806356030b6a8576526e0e938e36f71b238580704","5db376a328476e670aeefb93af8969206ca6ba8cf0877fd99319fa5d5db175ca","a8daf444c78f17b4a8e42896d6cb085e4faad12d1c1ae7d0e79757e6772bddb9","5c51de7c7a1ec4126344c66c70b71434f6c6710ce1e6d160a668154d461275ac","48540f12275f1ed277e768058907eb70cc88e3f98d055d9d73bf30aa15310ef3","99fd0c8746d5cce65650328219783c6c6e68e212bf1af6ea5975f4a99d885e59","ad8777161d4794281c2cc652ecb805d3e6a9887798877c6aa4babfd0ecb631d2","73e02706ba90357aeeb4fdcbdb3f1c616801ca1affed0a059728119bd11121a4","e04936b97ed30e4045d67917b331eb56a4b2111534648adcabc4475f98456727","66fef499efea41ac31ea93265c04f3b87041a6ae3cd14cd502b02da8cc77cca8","4edc178549442dae3ad95f1379b7433945e5499859fdbfd571820d7e5cf5033c","926a6a4ba8402c3dd9c33ceff50ac957910775b2969505d36ee1a6db7a9e0c87","9b017fb1446cdc76f040406803e639b97658b987601970125826960e94e9a1a6","f81f710f5968fea399551a1fb7a13fad48b005f3c9ba2ea419d14b597401838c")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("1a277cba1676478bf3d47bec97edaa14f83f50bdd11e2a15d9e0936ed243fd64","abbb76a7000de1df7f95eef806356030b6a8576526e0e938e36f71b238580704","5db376a328476e670aeefb93af8969206ca6ba8cf0877fd99319fa5d5db175ca","a8daf444c78f17b4a8e42896d6cb085e4faad12d1c1ae7d0e79757e6772bddb9","5c51de7c7a1ec4126344c66c70b71434f6c6710ce1e6d160a668154d461275ac","48540f12275f1ed277e768058907eb70cc88e3f98d055d9d73bf30aa15310ef3","99fd0c8746d5cce65650328219783c6c6e68e212bf1af6ea5975f4a99d885e59","ad8777161d4794281c2cc652ecb805d3e6a9887798877c6aa4babfd0ecb631d2","73e02706ba90357aeeb4fdcbdb3f1c616801ca1affed0a059728119bd11121a4","e04936b97ed30e4045d67917b331eb56a4b2111534648adcabc4475f98456727","66fef499efea41ac31ea93265c04f3b87041a6ae3cd14cd502b02da8cc77cca8","4edc178549442dae3ad95f1379b7433945e5499859fdbfd571820d7e5cf5033c","926a6a4ba8402c3dd9c33ceff50ac957910775b2969505d36ee1a6db7a9e0c87","9b017fb1446cdc76f040406803e639b97658b987601970125826960e94e9a1a6","f81f710f5968fea399551a1fb7a13fad48b005f3c9ba2ea419d14b597401838c")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("1a277cba1676478bf3d47bec97edaa14f83f50bdd11e2a15d9e0936ed243fd64","abbb76a7000de1df7f95eef806356030b6a8576526e0e938e36f71b238580704","5db376a328476e670aeefb93af8969206ca6ba8cf0877fd99319fa5d5db175ca","a8daf444c78f17b4a8e42896d6cb085e4faad12d1c1ae7d0e79757e6772bddb9","5c51de7c7a1ec4126344c66c70b71434f6c6710ce1e6d160a668154d461275ac","48540f12275f1ed277e768058907eb70cc88e3f98d055d9d73bf30aa15310ef3","99fd0c8746d5cce65650328219783c6c6e68e212bf1af6ea5975f4a99d885e59","ad8777161d4794281c2cc652ecb805d3e6a9887798877c6aa4babfd0ecb631d2","73e02706ba90357aeeb4fdcbdb3f1c616801ca1affed0a059728119bd11121a4","e04936b97ed30e4045d67917b331eb56a4b2111534648adcabc4475f98456727","66fef499efea41ac31ea93265c04f3b87041a6ae3cd14cd502b02da8cc77cca8","4edc178549442dae3ad95f1379b7433945e5499859fdbfd571820d7e5cf5033c","926a6a4ba8402c3dd9c33ceff50ac957910775b2969505d36ee1a6db7a9e0c87","9b017fb1446cdc76f040406803e639b97658b987601970125826960e94e9a1a6","f81f710f5968fea399551a1fb7a13fad48b005f3c9ba2ea419d14b597401838c")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring64 NOT NULL AND customstring64 IN ("1a277cba1676478bf3d47bec97edaa14f83f50bdd11e2a15d9e0936ed243fd64","abbb76a7000de1df7f95eef806356030b6a8576526e0e938e36f71b238580704","5db376a328476e670aeefb93af8969206ca6ba8cf0877fd99319fa5d5db175ca","a8daf444c78f17b4a8e42896d6cb085e4faad12d1c1ae7d0e79757e6772bddb9","5c51de7c7a1ec4126344c66c70b71434f6c6710ce1e6d160a668154d461275ac","48540f12275f1ed277e768058907eb70cc88e3f98d055d9d73bf30aa15310ef3","99fd0c8746d5cce65650328219783c6c6e68e212bf1af6ea5975f4a99d885e59","ad8777161d4794281c2cc652ecb805d3e6a9887798877c6aa4babfd0ecb631d2","73e02706ba90357aeeb4fdcbdb3f1c616801ca1affed0a059728119bd11121a4","e04936b97ed30e4045d67917b331eb56a4b2111534648adcabc4475f98456727","66fef499efea41ac31ea93265c04f3b87041a6ae3cd14cd502b02da8cc77cca8","4edc178549442dae3ad95f1379b7433945e5499859fdbfd571820d7e5cf5033c","926a6a4ba8402c3dd9c33ceff50ac957910775b2969505d36ee1a6db7a9e0c87","9b017fb1446cdc76f040406803e639b97658b987601970125826960e94e9a1a6","f81f710f5968fea399551a1fb7a13fad48b005f3c9ba2ea419d14b597401838c")
index=activity AND rg_functionality="O365 General" AND filehash NOT NULL AND filehash IN ("1a277cba1676478bf3d47bec97edaa14f83f50bdd11e2a15d9e0936ed243fd64","abbb76a7000de1df7f95eef806356030b6a8576526e0e938e36f71b238580704","5db376a328476e670aeefb93af8969206ca6ba8cf0877fd99319fa5d5db175ca","a8daf444c78f17b4a8e42896d6cb085e4faad12d1c1ae7d0e79757e6772bddb9","5c51de7c7a1ec4126344c66c70b71434f6c6710ce1e6d160a668154d461275ac","48540f12275f1ed277e768058907eb70cc88e3f98d055d9d73bf30aa15310ef3","99fd0c8746d5cce65650328219783c6c6e68e212bf1af6ea5975f4a99d885e59","ad8777161d4794281c2cc652ecb805d3e6a9887798877c6aa4babfd0ecb631d2","73e02706ba90357aeeb4fdcbdb3f1c616801ca1affed0a059728119bd11121a4","e04936b97ed30e4045d67917b331eb56a4b2111534648adcabc4475f98456727","66fef499efea41ac31ea93265c04f3b87041a6ae3cd14cd502b02da8cc77cca8","4edc178549442dae3ad95f1379b7433945e5499859fdbfd571820d7e5cf5033c","926a6a4ba8402c3dd9c33ceff50ac957910775b2969505d36ee1a6db7a9e0c87","9b017fb1446cdc76f040406803e639b97658b987601970125826960e94e9a1a6","f81f710f5968fea399551a1fb7a13fad48b005f3c9ba2ea419d14b597401838c")
index=activity AND rg_functionality="O365 General" AND oldfilehash NOT NULL AND oldfilehash IN ("1a277cba1676478bf3d47bec97edaa14f83f50bdd11e2a15d9e0936ed243fd64","abbb76a7000de1df7f95eef806356030b6a8576526e0e938e36f71b238580704","5db376a328476e670aeefb93af8969206ca6ba8cf0877fd99319fa5d5db175ca","a8daf444c78f17b4a8e42896d6cb085e4faad12d1c1ae7d0e79757e6772bddb9","5c51de7c7a1ec4126344c66c70b71434f6c6710ce1e6d160a668154d461275ac","48540f12275f1ed277e768058907eb70cc88e3f98d055d9d73bf30aa15310ef3","99fd0c8746d5cce65650328219783c6c6e68e212bf1af6ea5975f4a99d885e59","ad8777161d4794281c2cc652ecb805d3e6a9887798877c6aa4babfd0ecb631d2","73e02706ba90357aeeb4fdcbdb3f1c616801ca1affed0a059728119bd11121a4","e04936b97ed30e4045d67917b331eb56a4b2111534648adcabc4475f98456727","66fef499efea41ac31ea93265c04f3b87041a6ae3cd14cd502b02da8cc77cca8","4edc178549442dae3ad95f1379b7433945e5499859fdbfd571820d7e5cf5033c","926a6a4ba8402c3dd9c33ceff50ac957910775b2969505d36ee1a6db7a9e0c87","9b017fb1446cdc76f040406803e639b97658b987601970125826960e94e9a1a6","f81f710f5968fea399551a1fb7a13fad48b005f3c9ba2ea419d14b597401838c")
index=activity AND rg_functionality="O365 General" AND customstring3 NOT NULL AND customstring3 IN ("1a277cba1676478bf3d47bec97edaa14f83f50bdd11e2a15d9e0936ed243fd64","abbb76a7000de1df7f95eef806356030b6a8576526e0e938e36f71b238580704","5db376a328476e670aeefb93af8969206ca6ba8cf0877fd99319fa5d5db175ca","a8daf444c78f17b4a8e42896d6cb085e4faad12d1c1ae7d0e79757e6772bddb9","5c51de7c7a1ec4126344c66c70b71434f6c6710ce1e6d160a668154d461275ac","48540f12275f1ed277e768058907eb70cc88e3f98d055d9d73bf30aa15310ef3","99fd0c8746d5cce65650328219783c6c6e68e212bf1af6ea5975f4a99d885e59","ad8777161d4794281c2cc652ecb805d3e6a9887798877c6aa4babfd0ecb631d2","73e02706ba90357aeeb4fdcbdb3f1c616801ca1affed0a059728119bd11121a4","e04936b97ed30e4045d67917b331eb56a4b2111534648adcabc4475f98456727","66fef499efea41ac31ea93265c04f3b87041a6ae3cd14cd502b02da8cc77cca8","4edc178549442dae3ad95f1379b7433945e5499859fdbfd571820d7e5cf5033c","926a6a4ba8402c3dd9c33ceff50ac957910775b2969505d36ee1a6db7a9e0c87","9b017fb1446cdc76f040406803e639b97658b987601970125826960e94e9a1a6","f81f710f5968fea399551a1fb7a13fad48b005f3c9ba2ea419d14b597401838c")
index=activity AND rg_functionality="O365 General" AND customstring64 NOT NULL AND customstring64 IN ("1a277cba1676478bf3d47bec97edaa14f83f50bdd11e2a15d9e0936ed243fd64","abbb76a7000de1df7f95eef806356030b6a8576526e0e938e36f71b238580704","5db376a328476e670aeefb93af8969206ca6ba8cf0877fd99319fa5d5db175ca","a8daf444c78f17b4a8e42896d6cb085e4faad12d1c1ae7d0e79757e6772bddb9","5c51de7c7a1ec4126344c66c70b71434f6c6710ce1e6d160a668154d461275ac","48540f12275f1ed277e768058907eb70cc88e3f98d055d9d73bf30aa15310ef3","99fd0c8746d5cce65650328219783c6c6e68e212bf1af6ea5975f4a99d885e59","ad8777161d4794281c2cc652ecb805d3e6a9887798877c6aa4babfd0ecb631d2","73e02706ba90357aeeb4fdcbdb3f1c616801ca1affed0a059728119bd11121a4","e04936b97ed30e4045d67917b331eb56a4b2111534648adcabc4475f98456727","66fef499efea41ac31ea93265c04f3b87041a6ae3cd14cd502b02da8cc77cca8","4edc178549442dae3ad95f1379b7433945e5499859fdbfd571820d7e5cf5033c","926a6a4ba8402c3dd9c33ceff50ac957910775b2969505d36ee1a6db7a9e0c87","9b017fb1446cdc76f040406803e639b97658b987601970125826960e94e9a1a6","f81f710f5968fea399551a1fb7a13fad48b005f3c9ba2ea419d14b597401838c")
index=activity AND rg_functionality="Endpoint Management Systems" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="31.57.38.244" AND destinationport=6767 OR destinationaddress="80.76.49.114" AND destinationport=6767)
index=activity AND rg_functionality="Endpoint Management Systems" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="31.57.38.244" AND sourceport=6767 OR sourceaddress="80.76.49.114" AND sourceport=6767)
index=activity AND rg_functionality="Endpoint Management Systems" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="31.57.38.244" AND sourceport=6767 OR translatedipaddress="80.76.49.114" AND sourceport=6767)
index=activity AND rg_functionality="Endpoint Management Systems" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="31.57.38.244" AND destinationport=6767 OR destinationtranslatedaddress="80.76.49.114" AND destinationport=6767)
index=activity AND rg_functionality="Endpoint Management Systems" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="31.57.38.244" AND destinationtranslatedport=6767 OR destinationtranslatedaddress="80.76.49.114" AND destinationtranslatedport=6767)
index=activity AND rg_functionality="Endpoint Management Systems" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="31.57.38.244" AND translatedport=6767 OR destinationtranslatedaddress="80.76.49.114" AND translatedport=6767)
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="31.57.38.244" AND destinationport=6767 OR destinationaddress="80.76.49.114" AND destinationport=6767)
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="31.57.38.244" AND sourceport=6767 OR sourceaddress="80.76.49.114" AND sourceport=6767)
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="31.57.38.244" AND sourceport=6767 OR translatedipaddress="80.76.49.114" AND sourceport=6767)
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="31.57.38.244" AND destinationport=6767 OR destinationtranslatedaddress="80.76.49.114" AND destinationport=6767)
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="31.57.38.244" AND destinationtranslatedport=6767 OR destinationtranslatedaddress="80.76.49.114" AND destinationtranslatedport=6767)
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="31.57.38.244" AND translatedport=6767 OR destinationtranslatedaddress="80.76.49.114" AND translatedport=6767)
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="31.57.38.244" AND destinationport=6767 OR destinationaddress="80.76.49.114" AND destinationport=6767)
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="31.57.38.244" AND sourceport=6767 OR sourceaddress="80.76.49.114" AND sourceport=6767)
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="31.57.38.244" AND sourceport=6767 OR translatedipaddress="80.76.49.114" AND sourceport=6767)
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="31.57.38.244" AND destinationport=6767 OR destinationtranslatedaddress="80.76.49.114" AND destinationport=6767)
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="31.57.38.244" AND destinationtranslatedport=6767 OR destinationtranslatedaddress="80.76.49.114" AND destinationtranslatedport=6767)
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="31.57.38.244" AND translatedport=6767 OR destinationtranslatedaddress="80.76.49.114" AND translatedport=6767)
index=activity AND rg_functionality="Email / Email Security" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="31.57.38.244" AND destinationport=6767 OR destinationaddress="80.76.49.114" AND destinationport=6767)
index=activity AND rg_functionality="Email / Email Security" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="31.57.38.244" AND sourceport=6767 OR sourceaddress="80.76.49.114" AND sourceport=6767)
index=activity AND rg_functionality="Email / Email Security" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="31.57.38.244" AND sourceport=6767 OR translatedipaddress="80.76.49.114" AND sourceport=6767)
index=activity AND rg_functionality="Email / Email Security" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="31.57.38.244" AND destinationport=6767 OR destinationtranslatedaddress="80.76.49.114" AND destinationport=6767)
index=activity AND rg_functionality="Email / Email Security" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="31.57.38.244" AND destinationtranslatedport=6767 OR destinationtranslatedaddress="80.76.49.114" AND destinationtranslatedport=6767)
index=activity AND rg_functionality="Email / Email Security" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="31.57.38.244" AND translatedport=6767 OR destinationtranslatedaddress="80.76.49.114" AND translatedport=6767)
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="31.57.38.244" AND destinationport=6767 OR destinationaddress="80.76.49.114" AND destinationport=6767)
index=activity AND rg_functionality="Cloud Email / Email Security" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="31.57.38.244" AND sourceport=6767 OR sourceaddress="80.76.49.114" AND sourceport=6767)
index=activity AND rg_functionality="Cloud Email / Email Security" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="31.57.38.244" AND sourceport=6767 OR translatedipaddress="80.76.49.114" AND sourceport=6767)
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="31.57.38.244" AND destinationport=6767 OR destinationtranslatedaddress="80.76.49.114" AND destinationport=6767)
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="31.57.38.244" AND destinationtranslatedport=6767 OR destinationtranslatedaddress="80.76.49.114" AND destinationtranslatedport=6767)
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="31.57.38.244" AND translatedport=6767 OR destinationtranslatedaddress="80.76.49.114" AND translatedport=6767)
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="31.57.38.244" AND destinationport=6767 OR destinationaddress="80.76.49.114" AND destinationport=6767)
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="31.57.38.244" AND sourceport=6767 OR sourceaddress="80.76.49.114" AND sourceport=6767)
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="31.57.38.244" AND sourceport=6767 OR translatedipaddress="80.76.49.114" AND sourceport=6767)
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="31.57.38.244" AND destinationport=6767 OR destinationtranslatedaddress="80.76.49.114" AND destinationport=6767)
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="31.57.38.244" AND destinationtranslatedport=6767 OR destinationtranslatedaddress="80.76.49.114" AND destinationtranslatedport=6767)
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="31.57.38.244" AND translatedport=6767 OR destinationtranslatedaddress="80.76.49.114" AND translatedport=6767)
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="31.57.38.244" AND destinationport=6767 OR destinationaddress="80.76.49.114" AND destinationport=6767)
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="31.57.38.244" AND sourceport=6767 OR sourceaddress="80.76.49.114" AND sourceport=6767)
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="31.57.38.244" AND sourceport=6767 OR translatedipaddress="80.76.49.114" AND sourceport=6767)
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="31.57.38.244" AND destinationport=6767 OR destinationtranslatedaddress="80.76.49.114" AND destinationport=6767)
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="31.57.38.244" AND destinationtranslatedport=6767 OR destinationtranslatedaddress="80.76.49.114" AND destinationtranslatedport=6767)
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="31.57.38.244" AND translatedport=6767 OR destinationtranslatedaddress="80.76.49.114" AND translatedport=6767)
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="31.57.38.244" AND destinationport=6767 OR destinationaddress="80.76.49.114" AND destinationport=6767)
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="31.57.38.244" AND sourceport=6767 OR sourceaddress="80.76.49.114" AND sourceport=6767)
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="31.57.38.244" AND sourceport=6767 OR translatedipaddress="80.76.49.114" AND sourceport=6767)
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="31.57.38.244" AND destinationport=6767 OR destinationtranslatedaddress="80.76.49.114" AND destinationport=6767)
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="31.57.38.244" AND destinationtranslatedport=6767 OR destinationtranslatedaddress="80.76.49.114" AND destinationtranslatedport=6767)
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="31.57.38.244" AND translatedport=6767 OR destinationtranslatedaddress="80.76.49.114" AND translatedport=6767)
index=activity AND rg_functionality="O365 General" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="31.57.38.244" AND destinationport=6767 OR destinationaddress="80.76.49.114" AND destinationport=6767)
index=activity AND rg_functionality="O365 General" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="31.57.38.244" AND sourceport=6767 OR sourceaddress="80.76.49.114" AND sourceport=6767)
index=activity AND rg_functionality="O365 General" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="31.57.38.244" AND sourceport=6767 OR translatedipaddress="80.76.49.114" AND sourceport=6767)
index=activity AND rg_functionality="O365 General" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="31.57.38.244" AND destinationport=6767 OR destinationtranslatedaddress="80.76.49.114" AND destinationport=6767)
index=activity AND rg_functionality="O365 General" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="31.57.38.244" AND destinationtranslatedport=6767 OR destinationtranslatedaddress="80.76.49.114" AND destinationtranslatedport=6767)
index=activity AND rg_functionality="O365 General" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="31.57.38.244" AND translatedport=6767 OR destinationtranslatedaddress="80.76.49.114" AND translatedport=6767)
index=activity AND rg_functionality="Next Generation Firewall" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="31.57.38.244" AND destinationport=6767 OR destinationaddress="80.76.49.114" AND destinationport=6767)
index=activity AND rg_functionality="Next Generation Firewall" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="31.57.38.244" AND sourceport=6767 OR sourceaddress="80.76.49.114" AND sourceport=6767)
index=activity AND rg_functionality="Next Generation Firewall" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="31.57.38.244" AND sourceport=6767 OR translatedipaddress="80.76.49.114" AND sourceport=6767)
index=activity AND rg_functionality="Next Generation Firewall" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="31.57.38.244" AND destinationport=6767 OR destinationtranslatedaddress="80.76.49.114" AND destinationport=6767)
index=activity AND rg_functionality="Next Generation Firewall" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="31.57.38.244" AND destinationtranslatedport=6767 OR destinationtranslatedaddress="80.76.49.114" AND destinationtranslatedport=6767)
index=activity AND rg_functionality="Next Generation Firewall" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="31.57.38.244" AND translatedport=6767 OR destinationtranslatedaddress="80.76.49.114" AND translatedport=6767)
index=activity AND rg_functionality="Firewall" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="31.57.38.244" AND destinationport=6767 OR destinationaddress="80.76.49.114" AND destinationport=6767)
index=activity AND rg_functionality="Firewall" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="31.57.38.244" AND sourceport=6767 OR sourceaddress="80.76.49.114" AND sourceport=6767)
index=activity AND rg_functionality="Firewall" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="31.57.38.244" AND sourceport=6767 OR translatedipaddress="80.76.49.114" AND sourceport=6767)
index=activity AND rg_functionality="Firewall" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="31.57.38.244" AND destinationport=6767 OR destinationtranslatedaddress="80.76.49.114" AND destinationport=6767)
index=activity AND rg_functionality="Firewall" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="31.57.38.244" AND destinationtranslatedport=6767 OR destinationtranslatedaddress="80.76.49.114" AND destinationtranslatedport=6767)
index=activity AND rg_functionality="Firewall" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="31.57.38.244" AND translatedport=6767 OR destinationtranslatedaddress="80.76.49.114" AND translatedport=6767)
index=activity AND rg_functionality="Web Proxy" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="31.57.38.244" AND destinationport=6767 OR destinationaddress="80.76.49.114" AND destinationport=6767)
index=activity AND rg_functionality="Web Proxy" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="31.57.38.244" AND sourceport=6767 OR sourceaddress="80.76.49.114" AND sourceport=6767)
index=activity AND rg_functionality="Web Proxy" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="31.57.38.244" AND sourceport=6767 OR translatedipaddress="80.76.49.114" AND sourceport=6767)
index=activity AND rg_functionality="Web Proxy" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="31.57.38.244" AND destinationport=6767 OR destinationtranslatedaddress="80.76.49.114" AND destinationport=6767)
index=activity AND rg_functionality="Web Proxy" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="31.57.38.244" AND destinationtranslatedport=6767 OR destinationtranslatedaddress="80.76.49.114" AND destinationtranslatedport=6767)
index=activity AND rg_functionality="Web Proxy" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="31.57.38.244" AND translatedport=6767 OR destinationtranslatedaddress="80.76.49.114" AND translatedport=6767)
index=activity AND rg_functionality="Flow" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="31.57.38.244" AND destinationport=6767 OR destinationaddress="80.76.49.114" AND destinationport=6767)
index=activity AND rg_functionality="Flow" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="31.57.38.244" AND sourceport=6767 OR sourceaddress="80.76.49.114" AND sourceport=6767)
index=activity AND rg_functionality="Flow" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="31.57.38.244" AND sourceport=6767 OR translatedipaddress="80.76.49.114" AND sourceport=6767)
index=activity AND rg_functionality="Flow" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="31.57.38.244" AND destinationport=6767 OR destinationtranslatedaddress="80.76.49.114" AND destinationport=6767)
index=activity AND rg_functionality="Flow" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="31.57.38.244" AND destinationtranslatedport=6767 OR destinationtranslatedaddress="80.76.49.114" AND destinationtranslatedport=6767)
index=activity AND rg_functionality="Flow" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="31.57.38.244" AND translatedport=6767 OR destinationtranslatedaddress="80.76.49.114" AND translatedport=6767)
index=activity AND rg_functionality="Web Server" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="31.57.38.244" AND destinationport=6767 OR destinationaddress="80.76.49.114" AND destinationport=6767)
index=activity AND rg_functionality="Web Server" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="31.57.38.244" AND sourceport=6767 OR sourceaddress="80.76.49.114" AND sourceport=6767)
index=activity AND rg_functionality="Web Server" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="31.57.38.244" AND sourceport=6767 OR translatedipaddress="80.76.49.114" AND sourceport=6767)
index=activity AND rg_functionality="Web Server" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="31.57.38.244" AND destinationport=6767 OR destinationtranslatedaddress="80.76.49.114" AND destinationport=6767)
index=activity AND rg_functionality="Web Server" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="31.57.38.244" AND destinationtranslatedport=6767 OR destinationtranslatedaddress="80.76.49.114" AND destinationtranslatedport=6767)
index=activity AND rg_functionality="Web Server" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="31.57.38.244" AND translatedport=6767 OR destinationtranslatedaddress="80.76.49.114" AND translatedport=6767)
index=activity AND rg_functionality="Web Application Firewall" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="31.57.38.244" AND destinationport=6767 OR destinationaddress="80.76.49.114" AND destinationport=6767)
index=activity AND rg_functionality="Web Application Firewall" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="31.57.38.244" AND sourceport=6767 OR sourceaddress="80.76.49.114" AND sourceport=6767)
index=activity AND rg_functionality="Web Application Firewall" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="31.57.38.244" AND sourceport=6767 OR translatedipaddress="80.76.49.114" AND sourceport=6767)
index=activity AND rg_functionality="Web Application Firewall" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="31.57.38.244" AND destinationport=6767 OR destinationtranslatedaddress="80.76.49.114" AND destinationport=6767)
index=activity AND rg_functionality="Web Application Firewall" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="31.57.38.244" AND destinationtranslatedport=6767 OR destinationtranslatedaddress="80.76.49.114" AND destinationtranslatedport=6767)
index=activity AND rg_functionality="Web Application Firewall" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="31.57.38.244" AND translatedport=6767 OR destinationtranslatedaddress="80.76.49.114" AND translatedport=6767)
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="31.57.38.244" AND destinationport=6767 OR destinationaddress="80.76.49.114" AND destinationport=6767)
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="31.57.38.244" AND sourceport=6767 OR sourceaddress="80.76.49.114" AND sourceport=6767)
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="31.57.38.244" AND sourceport=6767 OR translatedipaddress="80.76.49.114" AND sourceport=6767)
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="31.57.38.244" AND destinationport=6767 OR destinationtranslatedaddress="80.76.49.114" AND destinationport=6767)
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="31.57.38.244" AND destinationtranslatedport=6767 OR destinationtranslatedaddress="80.76.49.114" AND destinationtranslatedport=6767)
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="31.57.38.244" AND translatedport=6767 OR destinationtranslatedaddress="80.76.49.114" AND translatedport=6767)
index=activity AND rg_functionality="Cloud Services / Applications" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="31.57.38.244" AND destinationport=6767 OR destinationaddress="80.76.49.114" AND destinationport=6767)
index=activity AND rg_functionality="Cloud Services / Applications" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="31.57.38.244" AND sourceport=6767 OR sourceaddress="80.76.49.114" AND sourceport=6767)
index=activity AND rg_functionality="Cloud Services / Applications" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="31.57.38.244" AND sourceport=6767 OR translatedipaddress="80.76.49.114" AND sourceport=6767)
index=activity AND rg_functionality="Cloud Services / Applications" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="31.57.38.244" AND destinationport=6767 OR destinationtranslatedaddress="80.76.49.114" AND destinationport=6767)
index=activity AND rg_functionality="Cloud Services / Applications" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="31.57.38.244" AND destinationtranslatedport=6767 OR destinationtranslatedaddress="80.76.49.114" AND destinationtranslatedport=6767)
index=activity AND rg_functionality="Cloud Services / Applications" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="31.57.38.244" AND translatedport=6767 OR destinationtranslatedaddress="80.76.49.114" AND translatedport=6767)
index=activity AND rg_functionality="Cloud Application Audit" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="31.57.38.244" AND destinationport=6767 OR destinationaddress="80.76.49.114" AND destinationport=6767)
index=activity AND rg_functionality="Cloud Application Audit" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="31.57.38.244" AND sourceport=6767 OR sourceaddress="80.76.49.114" AND sourceport=6767)
index=activity AND rg_functionality="Cloud Application Audit" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="31.57.38.244" AND sourceport=6767 OR translatedipaddress="80.76.49.114" AND sourceport=6767)
index=activity AND rg_functionality="Cloud Application Audit" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="31.57.38.244" AND destinationport=6767 OR destinationtranslatedaddress="80.76.49.114" AND destinationport=6767)
index=activity AND rg_functionality="Cloud Application Audit" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="31.57.38.244" AND destinationtranslatedport=6767 OR destinationtranslatedaddress="80.76.49.114" AND destinationtranslatedport=6767)
index=activity AND rg_functionality="Cloud Application Audit" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="31.57.38.244" AND translatedport=6767 OR destinationtranslatedaddress="80.76.49.114" AND translatedport=6767)
index=activity AND rg_functionality="Authentication / VPN" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="31.57.38.244" AND destinationport=6767 OR destinationaddress="80.76.49.114" AND destinationport=6767)
index=activity AND rg_functionality="Authentication / VPN" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="31.57.38.244" AND sourceport=6767 OR sourceaddress="80.76.49.114" AND sourceport=6767)
index=activity AND rg_functionality="Authentication / VPN" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="31.57.38.244" AND sourceport=6767 OR translatedipaddress="80.76.49.114" AND sourceport=6767)
index=activity AND rg_functionality="Authentication / VPN" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="31.57.38.244" AND destinationport=6767 OR destinationtranslatedaddress="80.76.49.114" AND destinationport=6767)
index=activity AND rg_functionality="Authentication / VPN" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="31.57.38.244" AND destinationtranslatedport=6767 OR destinationtranslatedaddress="80.76.49.114" AND destinationtranslatedport=6767)
index=activity AND rg_functionality="Authentication / VPN" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="31.57.38.244" AND translatedport=6767 OR destinationtranslatedaddress="80.76.49.114" AND translatedport=6767)
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="31.57.38.244" AND destinationport=6767 OR destinationaddress="80.76.49.114" AND destinationport=6767)
index=activity AND rg_functionality="Unix / Linux / AIX" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="31.57.38.244" AND sourceport=6767 OR sourceaddress="80.76.49.114" AND sourceport=6767)
index=activity AND rg_functionality="Unix / Linux / AIX" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="31.57.38.244" AND sourceport=6767 OR translatedipaddress="80.76.49.114" AND sourceport=6767)
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="31.57.38.244" AND destinationport=6767 OR destinationtranslatedaddress="80.76.49.114" AND destinationport=6767)
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="31.57.38.244" AND destinationtranslatedport=6767 OR destinationtranslatedaddress="80.76.49.114" AND destinationtranslatedport=6767)
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="31.57.38.244" AND translatedport=6767 OR destinationtranslatedaddress="80.76.49.114" AND translatedport=6767)
index=activity AND rg_functionality="Authentication / WiFi" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="31.57.38.244" AND destinationport=6767 OR destinationaddress="80.76.49.114" AND destinationport=6767)
index=activity AND rg_functionality="Authentication / WiFi" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="31.57.38.244" AND sourceport=6767 OR sourceaddress="80.76.49.114" AND sourceport=6767)
index=activity AND rg_functionality="Authentication / WiFi" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="31.57.38.244" AND sourceport=6767 OR translatedipaddress="80.76.49.114" AND sourceport=6767)
index=activity AND rg_functionality="Authentication / WiFi" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="31.57.38.244" AND destinationport=6767 OR destinationtranslatedaddress="80.76.49.114" AND destinationport=6767)
index=activity AND rg_functionality="Authentication / WiFi" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="31.57.38.244" AND destinationtranslatedport=6767 OR destinationtranslatedaddress="80.76.49.114" AND destinationtranslatedport=6767)
index=activity AND rg_functionality="Authentication / WiFi" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="31.57.38.244" AND translatedport=6767 OR destinationtranslatedaddress="80.76.49.114" AND translatedport=6767)
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="31.57.38.244" AND destinationport=6767 OR destinationaddress="80.76.49.114" AND destinationport=6767)
index=activity AND rg_functionality="Cloud Application Security Broker" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="31.57.38.244" AND sourceport=6767 OR sourceaddress="80.76.49.114" AND sourceport=6767)
index=activity AND rg_functionality="Cloud Application Security Broker" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="31.57.38.244" AND sourceport=6767 OR translatedipaddress="80.76.49.114" AND sourceport=6767)
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="31.57.38.244" AND destinationport=6767 OR destinationtranslatedaddress="80.76.49.114" AND destinationport=6767)
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="31.57.38.244" AND destinationtranslatedport=6767 OR destinationtranslatedaddress="80.76.49.114" AND destinationtranslatedport=6767)
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="31.57.38.244" AND translatedport=6767 OR destinationtranslatedaddress="80.76.49.114" AND translatedport=6767)
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="31.57.38.244" AND destinationport=6767 OR destinationaddress="80.76.49.114" AND destinationport=6767)
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="31.57.38.244" AND sourceport=6767 OR sourceaddress="80.76.49.114" AND sourceport=6767)
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="31.57.38.244" AND sourceport=6767 OR translatedipaddress="80.76.49.114" AND sourceport=6767)
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="31.57.38.244" AND destinationport=6767 OR destinationtranslatedaddress="80.76.49.114" AND destinationport=6767)
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND destinationtranslatedaddress NOT NULL AND destinationtranslatedport NOT NULL AND (destinationtranslatedaddress="31.57.38.244" AND destinationtranslatedport=6767 OR destinationtranslatedaddress="80.76.49.114" AND destinationtranslatedport=6767)
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND destinationtranslatedaddress NOT NULL AND translatedport NOT NULL AND (destinationtranslatedaddress="31.57.38.244" AND translatedport=6767 OR destinationtranslatedaddress="80.76.49.114" AND translatedport=6767)
