index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("4dd2b61e0ccf633e008359ad989de2ed","1d70020ddf6f29638b22887947dd5b9c","8f154ca4a8ee50dc448181afbc95cfd7","3eff7826b6eea73b0206f11d08073a68","033acf3b0f699a39becdc71d3e2dddcc","0bbb9b0d573a9c6027ca7e0b1f5478bf","94a9da09da3151f306ab8a5b00f60a38b077d594","987ad5aa6aee86f474fb9313334e6c9718d68daf","4f5d4e9d1e3b6a46f450ad1fb90340dfd718608b","578b1b0f46491b9d39d21f2103cb437bc2d71cac","5949c404aee552fc8ce29e3bf77bd08e54d37c59","59e756e0da6a82a0f9046a3538d507c75eb95252","222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853","b5b105751a2bf965a6b78eeff100fe4c75282ad6f37f98b9adcd15d8c64283ec","fe311979cd099677b1fd7c5b2008aed000f0e38d58eb3bfd30d04444476416f9","7f624cfb74685effcb325206b428db2be8ac6cce7b72b3edebbe8e310a645099","5a936250411bf5709a888db54680c131e9c0f40ff4ff04db4aeda5443481922f","7f6421cdf6355edfdcbddadd26bcdfbf984def301df3c6c03d71af8e30bb781f")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("4dd2b61e0ccf633e008359ad989de2ed","1d70020ddf6f29638b22887947dd5b9c","8f154ca4a8ee50dc448181afbc95cfd7","3eff7826b6eea73b0206f11d08073a68","033acf3b0f699a39becdc71d3e2dddcc","0bbb9b0d573a9c6027ca7e0b1f5478bf","94a9da09da3151f306ab8a5b00f60a38b077d594","987ad5aa6aee86f474fb9313334e6c9718d68daf","4f5d4e9d1e3b6a46f450ad1fb90340dfd718608b","578b1b0f46491b9d39d21f2103cb437bc2d71cac","5949c404aee552fc8ce29e3bf77bd08e54d37c59","59e756e0da6a82a0f9046a3538d507c75eb95252","222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853","b5b105751a2bf965a6b78eeff100fe4c75282ad6f37f98b9adcd15d8c64283ec","fe311979cd099677b1fd7c5b2008aed000f0e38d58eb3bfd30d04444476416f9","7f624cfb74685effcb325206b428db2be8ac6cce7b72b3edebbe8e310a645099","5a936250411bf5709a888db54680c131e9c0f40ff4ff04db4aeda5443481922f","7f6421cdf6355edfdcbddadd26bcdfbf984def301df3c6c03d71af8e30bb781f")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("4dd2b61e0ccf633e008359ad989de2ed","1d70020ddf6f29638b22887947dd5b9c","8f154ca4a8ee50dc448181afbc95cfd7","3eff7826b6eea73b0206f11d08073a68","033acf3b0f699a39becdc71d3e2dddcc","0bbb9b0d573a9c6027ca7e0b1f5478bf","94a9da09da3151f306ab8a5b00f60a38b077d594","987ad5aa6aee86f474fb9313334e6c9718d68daf","4f5d4e9d1e3b6a46f450ad1fb90340dfd718608b","578b1b0f46491b9d39d21f2103cb437bc2d71cac","5949c404aee552fc8ce29e3bf77bd08e54d37c59","59e756e0da6a82a0f9046a3538d507c75eb95252","222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853","b5b105751a2bf965a6b78eeff100fe4c75282ad6f37f98b9adcd15d8c64283ec","fe311979cd099677b1fd7c5b2008aed000f0e38d58eb3bfd30d04444476416f9","7f624cfb74685effcb325206b428db2be8ac6cce7b72b3edebbe8e310a645099","5a936250411bf5709a888db54680c131e9c0f40ff4ff04db4aeda5443481922f","7f6421cdf6355edfdcbddadd26bcdfbf984def301df3c6c03d71af8e30bb781f")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring64 NOT NULL AND customstring64 IN ("4dd2b61e0ccf633e008359ad989de2ed","1d70020ddf6f29638b22887947dd5b9c","8f154ca4a8ee50dc448181afbc95cfd7","3eff7826b6eea73b0206f11d08073a68","033acf3b0f699a39becdc71d3e2dddcc","0bbb9b0d573a9c6027ca7e0b1f5478bf","94a9da09da3151f306ab8a5b00f60a38b077d594","987ad5aa6aee86f474fb9313334e6c9718d68daf","4f5d4e9d1e3b6a46f450ad1fb90340dfd718608b","578b1b0f46491b9d39d21f2103cb437bc2d71cac","5949c404aee552fc8ce29e3bf77bd08e54d37c59","59e756e0da6a82a0f9046a3538d507c75eb95252","222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853","b5b105751a2bf965a6b78eeff100fe4c75282ad6f37f98b9adcd15d8c64283ec","fe311979cd099677b1fd7c5b2008aed000f0e38d58eb3bfd30d04444476416f9","7f624cfb74685effcb325206b428db2be8ac6cce7b72b3edebbe8e310a645099","5a936250411bf5709a888db54680c131e9c0f40ff4ff04db4aeda5443481922f","7f6421cdf6355edfdcbddadd26bcdfbf984def301df3c6c03d71af8e30bb781f")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("4dd2b61e0ccf633e008359ad989de2ed","1d70020ddf6f29638b22887947dd5b9c","8f154ca4a8ee50dc448181afbc95cfd7","3eff7826b6eea73b0206f11d08073a68","033acf3b0f699a39becdc71d3e2dddcc","0bbb9b0d573a9c6027ca7e0b1f5478bf","94a9da09da3151f306ab8a5b00f60a38b077d594","987ad5aa6aee86f474fb9313334e6c9718d68daf","4f5d4e9d1e3b6a46f450ad1fb90340dfd718608b","578b1b0f46491b9d39d21f2103cb437bc2d71cac","5949c404aee552fc8ce29e3bf77bd08e54d37c59","59e756e0da6a82a0f9046a3538d507c75eb95252","222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853","b5b105751a2bf965a6b78eeff100fe4c75282ad6f37f98b9adcd15d8c64283ec","fe311979cd099677b1fd7c5b2008aed000f0e38d58eb3bfd30d04444476416f9","7f624cfb74685effcb325206b428db2be8ac6cce7b72b3edebbe8e310a645099","5a936250411bf5709a888db54680c131e9c0f40ff4ff04db4aeda5443481922f","7f6421cdf6355edfdcbddadd26bcdfbf984def301df3c6c03d71af8e30bb781f")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("4dd2b61e0ccf633e008359ad989de2ed","1d70020ddf6f29638b22887947dd5b9c","8f154ca4a8ee50dc448181afbc95cfd7","3eff7826b6eea73b0206f11d08073a68","033acf3b0f699a39becdc71d3e2dddcc","0bbb9b0d573a9c6027ca7e0b1f5478bf","94a9da09da3151f306ab8a5b00f60a38b077d594","987ad5aa6aee86f474fb9313334e6c9718d68daf","4f5d4e9d1e3b6a46f450ad1fb90340dfd718608b","578b1b0f46491b9d39d21f2103cb437bc2d71cac","5949c404aee552fc8ce29e3bf77bd08e54d37c59","59e756e0da6a82a0f9046a3538d507c75eb95252","222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853","b5b105751a2bf965a6b78eeff100fe4c75282ad6f37f98b9adcd15d8c64283ec","fe311979cd099677b1fd7c5b2008aed000f0e38d58eb3bfd30d04444476416f9","7f624cfb74685effcb325206b428db2be8ac6cce7b72b3edebbe8e310a645099","5a936250411bf5709a888db54680c131e9c0f40ff4ff04db4aeda5443481922f","7f6421cdf6355edfdcbddadd26bcdfbf984def301df3c6c03d71af8e30bb781f")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("4dd2b61e0ccf633e008359ad989de2ed","1d70020ddf6f29638b22887947dd5b9c","8f154ca4a8ee50dc448181afbc95cfd7","3eff7826b6eea73b0206f11d08073a68","033acf3b0f699a39becdc71d3e2dddcc","0bbb9b0d573a9c6027ca7e0b1f5478bf","94a9da09da3151f306ab8a5b00f60a38b077d594","987ad5aa6aee86f474fb9313334e6c9718d68daf","4f5d4e9d1e3b6a46f450ad1fb90340dfd718608b","578b1b0f46491b9d39d21f2103cb437bc2d71cac","5949c404aee552fc8ce29e3bf77bd08e54d37c59","59e756e0da6a82a0f9046a3538d507c75eb95252","222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853","b5b105751a2bf965a6b78eeff100fe4c75282ad6f37f98b9adcd15d8c64283ec","fe311979cd099677b1fd7c5b2008aed000f0e38d58eb3bfd30d04444476416f9","7f624cfb74685effcb325206b428db2be8ac6cce7b72b3edebbe8e310a645099","5a936250411bf5709a888db54680c131e9c0f40ff4ff04db4aeda5443481922f","7f6421cdf6355edfdcbddadd26bcdfbf984def301df3c6c03d71af8e30bb781f")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("4dd2b61e0ccf633e008359ad989de2ed","1d70020ddf6f29638b22887947dd5b9c","8f154ca4a8ee50dc448181afbc95cfd7","3eff7826b6eea73b0206f11d08073a68","033acf3b0f699a39becdc71d3e2dddcc","0bbb9b0d573a9c6027ca7e0b1f5478bf","94a9da09da3151f306ab8a5b00f60a38b077d594","987ad5aa6aee86f474fb9313334e6c9718d68daf","4f5d4e9d1e3b6a46f450ad1fb90340dfd718608b","578b1b0f46491b9d39d21f2103cb437bc2d71cac","5949c404aee552fc8ce29e3bf77bd08e54d37c59","59e756e0da6a82a0f9046a3538d507c75eb95252","222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853","b5b105751a2bf965a6b78eeff100fe4c75282ad6f37f98b9adcd15d8c64283ec","fe311979cd099677b1fd7c5b2008aed000f0e38d58eb3bfd30d04444476416f9","7f624cfb74685effcb325206b428db2be8ac6cce7b72b3edebbe8e310a645099","5a936250411bf5709a888db54680c131e9c0f40ff4ff04db4aeda5443481922f","7f6421cdf6355edfdcbddadd26bcdfbf984def301df3c6c03d71af8e30bb781f")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("4dd2b61e0ccf633e008359ad989de2ed","1d70020ddf6f29638b22887947dd5b9c","8f154ca4a8ee50dc448181afbc95cfd7","3eff7826b6eea73b0206f11d08073a68","033acf3b0f699a39becdc71d3e2dddcc","0bbb9b0d573a9c6027ca7e0b1f5478bf","94a9da09da3151f306ab8a5b00f60a38b077d594","987ad5aa6aee86f474fb9313334e6c9718d68daf","4f5d4e9d1e3b6a46f450ad1fb90340dfd718608b","578b1b0f46491b9d39d21f2103cb437bc2d71cac","5949c404aee552fc8ce29e3bf77bd08e54d37c59","59e756e0da6a82a0f9046a3538d507c75eb95252","222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853","b5b105751a2bf965a6b78eeff100fe4c75282ad6f37f98b9adcd15d8c64283ec","fe311979cd099677b1fd7c5b2008aed000f0e38d58eb3bfd30d04444476416f9","7f624cfb74685effcb325206b428db2be8ac6cce7b72b3edebbe8e310a645099","5a936250411bf5709a888db54680c131e9c0f40ff4ff04db4aeda5443481922f","7f6421cdf6355edfdcbddadd26bcdfbf984def301df3c6c03d71af8e30bb781f")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("4dd2b61e0ccf633e008359ad989de2ed","1d70020ddf6f29638b22887947dd5b9c","8f154ca4a8ee50dc448181afbc95cfd7","3eff7826b6eea73b0206f11d08073a68","033acf3b0f699a39becdc71d3e2dddcc","0bbb9b0d573a9c6027ca7e0b1f5478bf","94a9da09da3151f306ab8a5b00f60a38b077d594","987ad5aa6aee86f474fb9313334e6c9718d68daf","4f5d4e9d1e3b6a46f450ad1fb90340dfd718608b","578b1b0f46491b9d39d21f2103cb437bc2d71cac","5949c404aee552fc8ce29e3bf77bd08e54d37c59","59e756e0da6a82a0f9046a3538d507c75eb95252","222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853","b5b105751a2bf965a6b78eeff100fe4c75282ad6f37f98b9adcd15d8c64283ec","fe311979cd099677b1fd7c5b2008aed000f0e38d58eb3bfd30d04444476416f9","7f624cfb74685effcb325206b428db2be8ac6cce7b72b3edebbe8e310a645099","5a936250411bf5709a888db54680c131e9c0f40ff4ff04db4aeda5443481922f","7f6421cdf6355edfdcbddadd26bcdfbf984def301df3c6c03d71af8e30bb781f")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("4dd2b61e0ccf633e008359ad989de2ed","1d70020ddf6f29638b22887947dd5b9c","8f154ca4a8ee50dc448181afbc95cfd7","3eff7826b6eea73b0206f11d08073a68","033acf3b0f699a39becdc71d3e2dddcc","0bbb9b0d573a9c6027ca7e0b1f5478bf","94a9da09da3151f306ab8a5b00f60a38b077d594","987ad5aa6aee86f474fb9313334e6c9718d68daf","4f5d4e9d1e3b6a46f450ad1fb90340dfd718608b","578b1b0f46491b9d39d21f2103cb437bc2d71cac","5949c404aee552fc8ce29e3bf77bd08e54d37c59","59e756e0da6a82a0f9046a3538d507c75eb95252","222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853","b5b105751a2bf965a6b78eeff100fe4c75282ad6f37f98b9adcd15d8c64283ec","fe311979cd099677b1fd7c5b2008aed000f0e38d58eb3bfd30d04444476416f9","7f624cfb74685effcb325206b428db2be8ac6cce7b72b3edebbe8e310a645099","5a936250411bf5709a888db54680c131e9c0f40ff4ff04db4aeda5443481922f","7f6421cdf6355edfdcbddadd26bcdfbf984def301df3c6c03d71af8e30bb781f")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("4dd2b61e0ccf633e008359ad989de2ed","1d70020ddf6f29638b22887947dd5b9c","8f154ca4a8ee50dc448181afbc95cfd7","3eff7826b6eea73b0206f11d08073a68","033acf3b0f699a39becdc71d3e2dddcc","0bbb9b0d573a9c6027ca7e0b1f5478bf","94a9da09da3151f306ab8a5b00f60a38b077d594","987ad5aa6aee86f474fb9313334e6c9718d68daf","4f5d4e9d1e3b6a46f450ad1fb90340dfd718608b","578b1b0f46491b9d39d21f2103cb437bc2d71cac","5949c404aee552fc8ce29e3bf77bd08e54d37c59","59e756e0da6a82a0f9046a3538d507c75eb95252","222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853","b5b105751a2bf965a6b78eeff100fe4c75282ad6f37f98b9adcd15d8c64283ec","fe311979cd099677b1fd7c5b2008aed000f0e38d58eb3bfd30d04444476416f9","7f624cfb74685effcb325206b428db2be8ac6cce7b72b3edebbe8e310a645099","5a936250411bf5709a888db54680c131e9c0f40ff4ff04db4aeda5443481922f","7f6421cdf6355edfdcbddadd26bcdfbf984def301df3c6c03d71af8e30bb781f")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("4dd2b61e0ccf633e008359ad989de2ed","1d70020ddf6f29638b22887947dd5b9c","8f154ca4a8ee50dc448181afbc95cfd7","3eff7826b6eea73b0206f11d08073a68","033acf3b0f699a39becdc71d3e2dddcc","0bbb9b0d573a9c6027ca7e0b1f5478bf","94a9da09da3151f306ab8a5b00f60a38b077d594","987ad5aa6aee86f474fb9313334e6c9718d68daf","4f5d4e9d1e3b6a46f450ad1fb90340dfd718608b","578b1b0f46491b9d39d21f2103cb437bc2d71cac","5949c404aee552fc8ce29e3bf77bd08e54d37c59","59e756e0da6a82a0f9046a3538d507c75eb95252","222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853","b5b105751a2bf965a6b78eeff100fe4c75282ad6f37f98b9adcd15d8c64283ec","fe311979cd099677b1fd7c5b2008aed000f0e38d58eb3bfd30d04444476416f9","7f624cfb74685effcb325206b428db2be8ac6cce7b72b3edebbe8e310a645099","5a936250411bf5709a888db54680c131e9c0f40ff4ff04db4aeda5443481922f","7f6421cdf6355edfdcbddadd26bcdfbf984def301df3c6c03d71af8e30bb781f")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("4dd2b61e0ccf633e008359ad989de2ed","1d70020ddf6f29638b22887947dd5b9c","8f154ca4a8ee50dc448181afbc95cfd7","3eff7826b6eea73b0206f11d08073a68","033acf3b0f699a39becdc71d3e2dddcc","0bbb9b0d573a9c6027ca7e0b1f5478bf","94a9da09da3151f306ab8a5b00f60a38b077d594","987ad5aa6aee86f474fb9313334e6c9718d68daf","4f5d4e9d1e3b6a46f450ad1fb90340dfd718608b","578b1b0f46491b9d39d21f2103cb437bc2d71cac","5949c404aee552fc8ce29e3bf77bd08e54d37c59","59e756e0da6a82a0f9046a3538d507c75eb95252","222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853","b5b105751a2bf965a6b78eeff100fe4c75282ad6f37f98b9adcd15d8c64283ec","fe311979cd099677b1fd7c5b2008aed000f0e38d58eb3bfd30d04444476416f9","7f624cfb74685effcb325206b428db2be8ac6cce7b72b3edebbe8e310a645099","5a936250411bf5709a888db54680c131e9c0f40ff4ff04db4aeda5443481922f","7f6421cdf6355edfdcbddadd26bcdfbf984def301df3c6c03d71af8e30bb781f")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("4dd2b61e0ccf633e008359ad989de2ed","1d70020ddf6f29638b22887947dd5b9c","8f154ca4a8ee50dc448181afbc95cfd7","3eff7826b6eea73b0206f11d08073a68","033acf3b0f699a39becdc71d3e2dddcc","0bbb9b0d573a9c6027ca7e0b1f5478bf","94a9da09da3151f306ab8a5b00f60a38b077d594","987ad5aa6aee86f474fb9313334e6c9718d68daf","4f5d4e9d1e3b6a46f450ad1fb90340dfd718608b","578b1b0f46491b9d39d21f2103cb437bc2d71cac","5949c404aee552fc8ce29e3bf77bd08e54d37c59","59e756e0da6a82a0f9046a3538d507c75eb95252","222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853","b5b105751a2bf965a6b78eeff100fe4c75282ad6f37f98b9adcd15d8c64283ec","fe311979cd099677b1fd7c5b2008aed000f0e38d58eb3bfd30d04444476416f9","7f624cfb74685effcb325206b428db2be8ac6cce7b72b3edebbe8e310a645099","5a936250411bf5709a888db54680c131e9c0f40ff4ff04db4aeda5443481922f","7f6421cdf6355edfdcbddadd26bcdfbf984def301df3c6c03d71af8e30bb781f")
index=activity AND rg_functionality="Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("4dd2b61e0ccf633e008359ad989de2ed","1d70020ddf6f29638b22887947dd5b9c","8f154ca4a8ee50dc448181afbc95cfd7","3eff7826b6eea73b0206f11d08073a68","033acf3b0f699a39becdc71d3e2dddcc","0bbb9b0d573a9c6027ca7e0b1f5478bf","94a9da09da3151f306ab8a5b00f60a38b077d594","987ad5aa6aee86f474fb9313334e6c9718d68daf","4f5d4e9d1e3b6a46f450ad1fb90340dfd718608b","578b1b0f46491b9d39d21f2103cb437bc2d71cac","5949c404aee552fc8ce29e3bf77bd08e54d37c59","59e756e0da6a82a0f9046a3538d507c75eb95252","222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853","b5b105751a2bf965a6b78eeff100fe4c75282ad6f37f98b9adcd15d8c64283ec","fe311979cd099677b1fd7c5b2008aed000f0e38d58eb3bfd30d04444476416f9","7f624cfb74685effcb325206b428db2be8ac6cce7b72b3edebbe8e310a645099","5a936250411bf5709a888db54680c131e9c0f40ff4ff04db4aeda5443481922f","7f6421cdf6355edfdcbddadd26bcdfbf984def301df3c6c03d71af8e30bb781f")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("4dd2b61e0ccf633e008359ad989de2ed","1d70020ddf6f29638b22887947dd5b9c","8f154ca4a8ee50dc448181afbc95cfd7","3eff7826b6eea73b0206f11d08073a68","033acf3b0f699a39becdc71d3e2dddcc","0bbb9b0d573a9c6027ca7e0b1f5478bf","94a9da09da3151f306ab8a5b00f60a38b077d594","987ad5aa6aee86f474fb9313334e6c9718d68daf","4f5d4e9d1e3b6a46f450ad1fb90340dfd718608b","578b1b0f46491b9d39d21f2103cb437bc2d71cac","5949c404aee552fc8ce29e3bf77bd08e54d37c59","59e756e0da6a82a0f9046a3538d507c75eb95252","222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853","b5b105751a2bf965a6b78eeff100fe4c75282ad6f37f98b9adcd15d8c64283ec","fe311979cd099677b1fd7c5b2008aed000f0e38d58eb3bfd30d04444476416f9","7f624cfb74685effcb325206b428db2be8ac6cce7b72b3edebbe8e310a645099","5a936250411bf5709a888db54680c131e9c0f40ff4ff04db4aeda5443481922f","7f6421cdf6355edfdcbddadd26bcdfbf984def301df3c6c03d71af8e30bb781f")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("4dd2b61e0ccf633e008359ad989de2ed","1d70020ddf6f29638b22887947dd5b9c","8f154ca4a8ee50dc448181afbc95cfd7","3eff7826b6eea73b0206f11d08073a68","033acf3b0f699a39becdc71d3e2dddcc","0bbb9b0d573a9c6027ca7e0b1f5478bf","94a9da09da3151f306ab8a5b00f60a38b077d594","987ad5aa6aee86f474fb9313334e6c9718d68daf","4f5d4e9d1e3b6a46f450ad1fb90340dfd718608b","578b1b0f46491b9d39d21f2103cb437bc2d71cac","5949c404aee552fc8ce29e3bf77bd08e54d37c59","59e756e0da6a82a0f9046a3538d507c75eb95252","222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853","b5b105751a2bf965a6b78eeff100fe4c75282ad6f37f98b9adcd15d8c64283ec","fe311979cd099677b1fd7c5b2008aed000f0e38d58eb3bfd30d04444476416f9","7f624cfb74685effcb325206b428db2be8ac6cce7b72b3edebbe8e310a645099","5a936250411bf5709a888db54680c131e9c0f40ff4ff04db4aeda5443481922f","7f6421cdf6355edfdcbddadd26bcdfbf984def301df3c6c03d71af8e30bb781f")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("4dd2b61e0ccf633e008359ad989de2ed","1d70020ddf6f29638b22887947dd5b9c","8f154ca4a8ee50dc448181afbc95cfd7","3eff7826b6eea73b0206f11d08073a68","033acf3b0f699a39becdc71d3e2dddcc","0bbb9b0d573a9c6027ca7e0b1f5478bf","94a9da09da3151f306ab8a5b00f60a38b077d594","987ad5aa6aee86f474fb9313334e6c9718d68daf","4f5d4e9d1e3b6a46f450ad1fb90340dfd718608b","578b1b0f46491b9d39d21f2103cb437bc2d71cac","5949c404aee552fc8ce29e3bf77bd08e54d37c59","59e756e0da6a82a0f9046a3538d507c75eb95252","222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853","b5b105751a2bf965a6b78eeff100fe4c75282ad6f37f98b9adcd15d8c64283ec","fe311979cd099677b1fd7c5b2008aed000f0e38d58eb3bfd30d04444476416f9","7f624cfb74685effcb325206b428db2be8ac6cce7b72b3edebbe8e310a645099","5a936250411bf5709a888db54680c131e9c0f40ff4ff04db4aeda5443481922f","7f6421cdf6355edfdcbddadd26bcdfbf984def301df3c6c03d71af8e30bb781f")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("4dd2b61e0ccf633e008359ad989de2ed","1d70020ddf6f29638b22887947dd5b9c","8f154ca4a8ee50dc448181afbc95cfd7","3eff7826b6eea73b0206f11d08073a68","033acf3b0f699a39becdc71d3e2dddcc","0bbb9b0d573a9c6027ca7e0b1f5478bf","94a9da09da3151f306ab8a5b00f60a38b077d594","987ad5aa6aee86f474fb9313334e6c9718d68daf","4f5d4e9d1e3b6a46f450ad1fb90340dfd718608b","578b1b0f46491b9d39d21f2103cb437bc2d71cac","5949c404aee552fc8ce29e3bf77bd08e54d37c59","59e756e0da6a82a0f9046a3538d507c75eb95252","222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853","b5b105751a2bf965a6b78eeff100fe4c75282ad6f37f98b9adcd15d8c64283ec","fe311979cd099677b1fd7c5b2008aed000f0e38d58eb3bfd30d04444476416f9","7f624cfb74685effcb325206b428db2be8ac6cce7b72b3edebbe8e310a645099","5a936250411bf5709a888db54680c131e9c0f40ff4ff04db4aeda5443481922f","7f6421cdf6355edfdcbddadd26bcdfbf984def301df3c6c03d71af8e30bb781f")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("4dd2b61e0ccf633e008359ad989de2ed","1d70020ddf6f29638b22887947dd5b9c","8f154ca4a8ee50dc448181afbc95cfd7","3eff7826b6eea73b0206f11d08073a68","033acf3b0f699a39becdc71d3e2dddcc","0bbb9b0d573a9c6027ca7e0b1f5478bf","94a9da09da3151f306ab8a5b00f60a38b077d594","987ad5aa6aee86f474fb9313334e6c9718d68daf","4f5d4e9d1e3b6a46f450ad1fb90340dfd718608b","578b1b0f46491b9d39d21f2103cb437bc2d71cac","5949c404aee552fc8ce29e3bf77bd08e54d37c59","59e756e0da6a82a0f9046a3538d507c75eb95252","222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853","b5b105751a2bf965a6b78eeff100fe4c75282ad6f37f98b9adcd15d8c64283ec","fe311979cd099677b1fd7c5b2008aed000f0e38d58eb3bfd30d04444476416f9","7f624cfb74685effcb325206b428db2be8ac6cce7b72b3edebbe8e310a645099","5a936250411bf5709a888db54680c131e9c0f40ff4ff04db4aeda5443481922f","7f6421cdf6355edfdcbddadd26bcdfbf984def301df3c6c03d71af8e30bb781f")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("4dd2b61e0ccf633e008359ad989de2ed","1d70020ddf6f29638b22887947dd5b9c","8f154ca4a8ee50dc448181afbc95cfd7","3eff7826b6eea73b0206f11d08073a68","033acf3b0f699a39becdc71d3e2dddcc","0bbb9b0d573a9c6027ca7e0b1f5478bf","94a9da09da3151f306ab8a5b00f60a38b077d594","987ad5aa6aee86f474fb9313334e6c9718d68daf","4f5d4e9d1e3b6a46f450ad1fb90340dfd718608b","578b1b0f46491b9d39d21f2103cb437bc2d71cac","5949c404aee552fc8ce29e3bf77bd08e54d37c59","59e756e0da6a82a0f9046a3538d507c75eb95252","222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853","b5b105751a2bf965a6b78eeff100fe4c75282ad6f37f98b9adcd15d8c64283ec","fe311979cd099677b1fd7c5b2008aed000f0e38d58eb3bfd30d04444476416f9","7f624cfb74685effcb325206b428db2be8ac6cce7b72b3edebbe8e310a645099","5a936250411bf5709a888db54680c131e9c0f40ff4ff04db4aeda5443481922f","7f6421cdf6355edfdcbddadd26bcdfbf984def301df3c6c03d71af8e30bb781f")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("4dd2b61e0ccf633e008359ad989de2ed","1d70020ddf6f29638b22887947dd5b9c","8f154ca4a8ee50dc448181afbc95cfd7","3eff7826b6eea73b0206f11d08073a68","033acf3b0f699a39becdc71d3e2dddcc","0bbb9b0d573a9c6027ca7e0b1f5478bf","94a9da09da3151f306ab8a5b00f60a38b077d594","987ad5aa6aee86f474fb9313334e6c9718d68daf","4f5d4e9d1e3b6a46f450ad1fb90340dfd718608b","578b1b0f46491b9d39d21f2103cb437bc2d71cac","5949c404aee552fc8ce29e3bf77bd08e54d37c59","59e756e0da6a82a0f9046a3538d507c75eb95252","222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853","b5b105751a2bf965a6b78eeff100fe4c75282ad6f37f98b9adcd15d8c64283ec","fe311979cd099677b1fd7c5b2008aed000f0e38d58eb3bfd30d04444476416f9","7f624cfb74685effcb325206b428db2be8ac6cce7b72b3edebbe8e310a645099","5a936250411bf5709a888db54680c131e9c0f40ff4ff04db4aeda5443481922f","7f6421cdf6355edfdcbddadd26bcdfbf984def301df3c6c03d71af8e30bb781f")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring64 NOT NULL AND customstring64 IN ("4dd2b61e0ccf633e008359ad989de2ed","1d70020ddf6f29638b22887947dd5b9c","8f154ca4a8ee50dc448181afbc95cfd7","3eff7826b6eea73b0206f11d08073a68","033acf3b0f699a39becdc71d3e2dddcc","0bbb9b0d573a9c6027ca7e0b1f5478bf","94a9da09da3151f306ab8a5b00f60a38b077d594","987ad5aa6aee86f474fb9313334e6c9718d68daf","4f5d4e9d1e3b6a46f450ad1fb90340dfd718608b","578b1b0f46491b9d39d21f2103cb437bc2d71cac","5949c404aee552fc8ce29e3bf77bd08e54d37c59","59e756e0da6a82a0f9046a3538d507c75eb95252","222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853","b5b105751a2bf965a6b78eeff100fe4c75282ad6f37f98b9adcd15d8c64283ec","fe311979cd099677b1fd7c5b2008aed000f0e38d58eb3bfd30d04444476416f9","7f624cfb74685effcb325206b428db2be8ac6cce7b72b3edebbe8e310a645099","5a936250411bf5709a888db54680c131e9c0f40ff4ff04db4aeda5443481922f","7f6421cdf6355edfdcbddadd26bcdfbf984def301df3c6c03d71af8e30bb781f")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("4dd2b61e0ccf633e008359ad989de2ed","1d70020ddf6f29638b22887947dd5b9c","8f154ca4a8ee50dc448181afbc95cfd7","3eff7826b6eea73b0206f11d08073a68","033acf3b0f699a39becdc71d3e2dddcc","0bbb9b0d573a9c6027ca7e0b1f5478bf","94a9da09da3151f306ab8a5b00f60a38b077d594","987ad5aa6aee86f474fb9313334e6c9718d68daf","4f5d4e9d1e3b6a46f450ad1fb90340dfd718608b","578b1b0f46491b9d39d21f2103cb437bc2d71cac","5949c404aee552fc8ce29e3bf77bd08e54d37c59","59e756e0da6a82a0f9046a3538d507c75eb95252","222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853","b5b105751a2bf965a6b78eeff100fe4c75282ad6f37f98b9adcd15d8c64283ec","fe311979cd099677b1fd7c5b2008aed000f0e38d58eb3bfd30d04444476416f9","7f624cfb74685effcb325206b428db2be8ac6cce7b72b3edebbe8e310a645099","5a936250411bf5709a888db54680c131e9c0f40ff4ff04db4aeda5443481922f","7f6421cdf6355edfdcbddadd26bcdfbf984def301df3c6c03d71af8e30bb781f")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("4dd2b61e0ccf633e008359ad989de2ed","1d70020ddf6f29638b22887947dd5b9c","8f154ca4a8ee50dc448181afbc95cfd7","3eff7826b6eea73b0206f11d08073a68","033acf3b0f699a39becdc71d3e2dddcc","0bbb9b0d573a9c6027ca7e0b1f5478bf","94a9da09da3151f306ab8a5b00f60a38b077d594","987ad5aa6aee86f474fb9313334e6c9718d68daf","4f5d4e9d1e3b6a46f450ad1fb90340dfd718608b","578b1b0f46491b9d39d21f2103cb437bc2d71cac","5949c404aee552fc8ce29e3bf77bd08e54d37c59","59e756e0da6a82a0f9046a3538d507c75eb95252","222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853","b5b105751a2bf965a6b78eeff100fe4c75282ad6f37f98b9adcd15d8c64283ec","fe311979cd099677b1fd7c5b2008aed000f0e38d58eb3bfd30d04444476416f9","7f624cfb74685effcb325206b428db2be8ac6cce7b72b3edebbe8e310a645099","5a936250411bf5709a888db54680c131e9c0f40ff4ff04db4aeda5443481922f","7f6421cdf6355edfdcbddadd26bcdfbf984def301df3c6c03d71af8e30bb781f")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("4dd2b61e0ccf633e008359ad989de2ed","1d70020ddf6f29638b22887947dd5b9c","8f154ca4a8ee50dc448181afbc95cfd7","3eff7826b6eea73b0206f11d08073a68","033acf3b0f699a39becdc71d3e2dddcc","0bbb9b0d573a9c6027ca7e0b1f5478bf","94a9da09da3151f306ab8a5b00f60a38b077d594","987ad5aa6aee86f474fb9313334e6c9718d68daf","4f5d4e9d1e3b6a46f450ad1fb90340dfd718608b","578b1b0f46491b9d39d21f2103cb437bc2d71cac","5949c404aee552fc8ce29e3bf77bd08e54d37c59","59e756e0da6a82a0f9046a3538d507c75eb95252","222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853","b5b105751a2bf965a6b78eeff100fe4c75282ad6f37f98b9adcd15d8c64283ec","fe311979cd099677b1fd7c5b2008aed000f0e38d58eb3bfd30d04444476416f9","7f624cfb74685effcb325206b428db2be8ac6cce7b72b3edebbe8e310a645099","5a936250411bf5709a888db54680c131e9c0f40ff4ff04db4aeda5443481922f","7f6421cdf6355edfdcbddadd26bcdfbf984def301df3c6c03d71af8e30bb781f")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring64 NOT NULL AND customstring64 IN ("4dd2b61e0ccf633e008359ad989de2ed","1d70020ddf6f29638b22887947dd5b9c","8f154ca4a8ee50dc448181afbc95cfd7","3eff7826b6eea73b0206f11d08073a68","033acf3b0f699a39becdc71d3e2dddcc","0bbb9b0d573a9c6027ca7e0b1f5478bf","94a9da09da3151f306ab8a5b00f60a38b077d594","987ad5aa6aee86f474fb9313334e6c9718d68daf","4f5d4e9d1e3b6a46f450ad1fb90340dfd718608b","578b1b0f46491b9d39d21f2103cb437bc2d71cac","5949c404aee552fc8ce29e3bf77bd08e54d37c59","59e756e0da6a82a0f9046a3538d507c75eb95252","222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853","b5b105751a2bf965a6b78eeff100fe4c75282ad6f37f98b9adcd15d8c64283ec","fe311979cd099677b1fd7c5b2008aed000f0e38d58eb3bfd30d04444476416f9","7f624cfb74685effcb325206b428db2be8ac6cce7b72b3edebbe8e310a645099","5a936250411bf5709a888db54680c131e9c0f40ff4ff04db4aeda5443481922f","7f6421cdf6355edfdcbddadd26bcdfbf984def301df3c6c03d71af8e30bb781f")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("4dd2b61e0ccf633e008359ad989de2ed","1d70020ddf6f29638b22887947dd5b9c","8f154ca4a8ee50dc448181afbc95cfd7","3eff7826b6eea73b0206f11d08073a68","033acf3b0f699a39becdc71d3e2dddcc","0bbb9b0d573a9c6027ca7e0b1f5478bf","94a9da09da3151f306ab8a5b00f60a38b077d594","987ad5aa6aee86f474fb9313334e6c9718d68daf","4f5d4e9d1e3b6a46f450ad1fb90340dfd718608b","578b1b0f46491b9d39d21f2103cb437bc2d71cac","5949c404aee552fc8ce29e3bf77bd08e54d37c59","59e756e0da6a82a0f9046a3538d507c75eb95252","222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853","b5b105751a2bf965a6b78eeff100fe4c75282ad6f37f98b9adcd15d8c64283ec","fe311979cd099677b1fd7c5b2008aed000f0e38d58eb3bfd30d04444476416f9","7f624cfb74685effcb325206b428db2be8ac6cce7b72b3edebbe8e310a645099","5a936250411bf5709a888db54680c131e9c0f40ff4ff04db4aeda5443481922f","7f6421cdf6355edfdcbddadd26bcdfbf984def301df3c6c03d71af8e30bb781f")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("4dd2b61e0ccf633e008359ad989de2ed","1d70020ddf6f29638b22887947dd5b9c","8f154ca4a8ee50dc448181afbc95cfd7","3eff7826b6eea73b0206f11d08073a68","033acf3b0f699a39becdc71d3e2dddcc","0bbb9b0d573a9c6027ca7e0b1f5478bf","94a9da09da3151f306ab8a5b00f60a38b077d594","987ad5aa6aee86f474fb9313334e6c9718d68daf","4f5d4e9d1e3b6a46f450ad1fb90340dfd718608b","578b1b0f46491b9d39d21f2103cb437bc2d71cac","5949c404aee552fc8ce29e3bf77bd08e54d37c59","59e756e0da6a82a0f9046a3538d507c75eb95252","222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853","b5b105751a2bf965a6b78eeff100fe4c75282ad6f37f98b9adcd15d8c64283ec","fe311979cd099677b1fd7c5b2008aed000f0e38d58eb3bfd30d04444476416f9","7f624cfb74685effcb325206b428db2be8ac6cce7b72b3edebbe8e310a645099","5a936250411bf5709a888db54680c131e9c0f40ff4ff04db4aeda5443481922f","7f6421cdf6355edfdcbddadd26bcdfbf984def301df3c6c03d71af8e30bb781f")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("4dd2b61e0ccf633e008359ad989de2ed","1d70020ddf6f29638b22887947dd5b9c","8f154ca4a8ee50dc448181afbc95cfd7","3eff7826b6eea73b0206f11d08073a68","033acf3b0f699a39becdc71d3e2dddcc","0bbb9b0d573a9c6027ca7e0b1f5478bf","94a9da09da3151f306ab8a5b00f60a38b077d594","987ad5aa6aee86f474fb9313334e6c9718d68daf","4f5d4e9d1e3b6a46f450ad1fb90340dfd718608b","578b1b0f46491b9d39d21f2103cb437bc2d71cac","5949c404aee552fc8ce29e3bf77bd08e54d37c59","59e756e0da6a82a0f9046a3538d507c75eb95252","222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853","b5b105751a2bf965a6b78eeff100fe4c75282ad6f37f98b9adcd15d8c64283ec","fe311979cd099677b1fd7c5b2008aed000f0e38d58eb3bfd30d04444476416f9","7f624cfb74685effcb325206b428db2be8ac6cce7b72b3edebbe8e310a645099","5a936250411bf5709a888db54680c131e9c0f40ff4ff04db4aeda5443481922f","7f6421cdf6355edfdcbddadd26bcdfbf984def301df3c6c03d71af8e30bb781f")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring64 NOT NULL AND customstring64 IN ("4dd2b61e0ccf633e008359ad989de2ed","1d70020ddf6f29638b22887947dd5b9c","8f154ca4a8ee50dc448181afbc95cfd7","3eff7826b6eea73b0206f11d08073a68","033acf3b0f699a39becdc71d3e2dddcc","0bbb9b0d573a9c6027ca7e0b1f5478bf","94a9da09da3151f306ab8a5b00f60a38b077d594","987ad5aa6aee86f474fb9313334e6c9718d68daf","4f5d4e9d1e3b6a46f450ad1fb90340dfd718608b","578b1b0f46491b9d39d21f2103cb437bc2d71cac","5949c404aee552fc8ce29e3bf77bd08e54d37c59","59e756e0da6a82a0f9046a3538d507c75eb95252","222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853","b5b105751a2bf965a6b78eeff100fe4c75282ad6f37f98b9adcd15d8c64283ec","fe311979cd099677b1fd7c5b2008aed000f0e38d58eb3bfd30d04444476416f9","7f624cfb74685effcb325206b428db2be8ac6cce7b72b3edebbe8e310a645099","5a936250411bf5709a888db54680c131e9c0f40ff4ff04db4aeda5443481922f","7f6421cdf6355edfdcbddadd26bcdfbf984def301df3c6c03d71af8e30bb781f")
