index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("8710683d2ec2d04449b821a85b6ccd6b5cb874414fd4684702f88972a9d4cfdd","8710683d2ec2d04449b821a85b6ccd6b5cb874414fd4684702f88972a9d4cfdd","c7b9ae61046eed01651a72afe7a31de088056f1c1430b368b1acda0b58299e28","9df9bb3c13e4d20a83b0ac453e6a2908b77fc2bf841761b798b903efb2d0f4f7","a9b33572237b100edf1d4c7b0a2071d68406e5931ab3957a962fcce4bfc2cc49","e1b2d0396914f84d27ef780dd6fdd8bae653d721eea523f0ade8f45ac9a10faf","de839d6c361c7527eeaa4979b301ac408352b5b7edeb354536bd50225f19cfa5","9c83faae850406df7dc991f335c049b0b6a64e12af4bf61d5fb7281ba889ca82","9fb57a4c6576a98003de6bf441e4306f72c83f783630286758f5b468abaa105d","0f303988e5905dffc3202ad371c3d1a49bd3ea5e22da697031751a80e21a13a7","c8ed52278ec00a6fbc9697661db5ffbcbe19c5ab331b182f7fd0f9f7249b5896","e86feaa258df14e3023c7a74b7733f0b568cc75092248bec77de723dba52dd12")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("8710683d2ec2d04449b821a85b6ccd6b5cb874414fd4684702f88972a9d4cfdd","8710683d2ec2d04449b821a85b6ccd6b5cb874414fd4684702f88972a9d4cfdd","c7b9ae61046eed01651a72afe7a31de088056f1c1430b368b1acda0b58299e28","9df9bb3c13e4d20a83b0ac453e6a2908b77fc2bf841761b798b903efb2d0f4f7","a9b33572237b100edf1d4c7b0a2071d68406e5931ab3957a962fcce4bfc2cc49","e1b2d0396914f84d27ef780dd6fdd8bae653d721eea523f0ade8f45ac9a10faf","de839d6c361c7527eeaa4979b301ac408352b5b7edeb354536bd50225f19cfa5","9c83faae850406df7dc991f335c049b0b6a64e12af4bf61d5fb7281ba889ca82","9fb57a4c6576a98003de6bf441e4306f72c83f783630286758f5b468abaa105d","0f303988e5905dffc3202ad371c3d1a49bd3ea5e22da697031751a80e21a13a7","c8ed52278ec00a6fbc9697661db5ffbcbe19c5ab331b182f7fd0f9f7249b5896","e86feaa258df14e3023c7a74b7733f0b568cc75092248bec77de723dba52dd12")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("8710683d2ec2d04449b821a85b6ccd6b5cb874414fd4684702f88972a9d4cfdd","8710683d2ec2d04449b821a85b6ccd6b5cb874414fd4684702f88972a9d4cfdd","c7b9ae61046eed01651a72afe7a31de088056f1c1430b368b1acda0b58299e28","9df9bb3c13e4d20a83b0ac453e6a2908b77fc2bf841761b798b903efb2d0f4f7","a9b33572237b100edf1d4c7b0a2071d68406e5931ab3957a962fcce4bfc2cc49","e1b2d0396914f84d27ef780dd6fdd8bae653d721eea523f0ade8f45ac9a10faf","de839d6c361c7527eeaa4979b301ac408352b5b7edeb354536bd50225f19cfa5","9c83faae850406df7dc991f335c049b0b6a64e12af4bf61d5fb7281ba889ca82","9fb57a4c6576a98003de6bf441e4306f72c83f783630286758f5b468abaa105d","0f303988e5905dffc3202ad371c3d1a49bd3ea5e22da697031751a80e21a13a7","c8ed52278ec00a6fbc9697661db5ffbcbe19c5ab331b182f7fd0f9f7249b5896","e86feaa258df14e3023c7a74b7733f0b568cc75092248bec77de723dba52dd12")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring64 NOT NULL AND customstring64 IN ("8710683d2ec2d04449b821a85b6ccd6b5cb874414fd4684702f88972a9d4cfdd","8710683d2ec2d04449b821a85b6ccd6b5cb874414fd4684702f88972a9d4cfdd","c7b9ae61046eed01651a72afe7a31de088056f1c1430b368b1acda0b58299e28","9df9bb3c13e4d20a83b0ac453e6a2908b77fc2bf841761b798b903efb2d0f4f7","a9b33572237b100edf1d4c7b0a2071d68406e5931ab3957a962fcce4bfc2cc49","e1b2d0396914f84d27ef780dd6fdd8bae653d721eea523f0ade8f45ac9a10faf","de839d6c361c7527eeaa4979b301ac408352b5b7edeb354536bd50225f19cfa5","9c83faae850406df7dc991f335c049b0b6a64e12af4bf61d5fb7281ba889ca82","9fb57a4c6576a98003de6bf441e4306f72c83f783630286758f5b468abaa105d","0f303988e5905dffc3202ad371c3d1a49bd3ea5e22da697031751a80e21a13a7","c8ed52278ec00a6fbc9697661db5ffbcbe19c5ab331b182f7fd0f9f7249b5896","e86feaa258df14e3023c7a74b7733f0b568cc75092248bec77de723dba52dd12")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("8710683d2ec2d04449b821a85b6ccd6b5cb874414fd4684702f88972a9d4cfdd","8710683d2ec2d04449b821a85b6ccd6b5cb874414fd4684702f88972a9d4cfdd","c7b9ae61046eed01651a72afe7a31de088056f1c1430b368b1acda0b58299e28","9df9bb3c13e4d20a83b0ac453e6a2908b77fc2bf841761b798b903efb2d0f4f7","a9b33572237b100edf1d4c7b0a2071d68406e5931ab3957a962fcce4bfc2cc49","e1b2d0396914f84d27ef780dd6fdd8bae653d721eea523f0ade8f45ac9a10faf","de839d6c361c7527eeaa4979b301ac408352b5b7edeb354536bd50225f19cfa5","9c83faae850406df7dc991f335c049b0b6a64e12af4bf61d5fb7281ba889ca82","9fb57a4c6576a98003de6bf441e4306f72c83f783630286758f5b468abaa105d","0f303988e5905dffc3202ad371c3d1a49bd3ea5e22da697031751a80e21a13a7","c8ed52278ec00a6fbc9697661db5ffbcbe19c5ab331b182f7fd0f9f7249b5896","e86feaa258df14e3023c7a74b7733f0b568cc75092248bec77de723dba52dd12")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("8710683d2ec2d04449b821a85b6ccd6b5cb874414fd4684702f88972a9d4cfdd","8710683d2ec2d04449b821a85b6ccd6b5cb874414fd4684702f88972a9d4cfdd","c7b9ae61046eed01651a72afe7a31de088056f1c1430b368b1acda0b58299e28","9df9bb3c13e4d20a83b0ac453e6a2908b77fc2bf841761b798b903efb2d0f4f7","a9b33572237b100edf1d4c7b0a2071d68406e5931ab3957a962fcce4bfc2cc49","e1b2d0396914f84d27ef780dd6fdd8bae653d721eea523f0ade8f45ac9a10faf","de839d6c361c7527eeaa4979b301ac408352b5b7edeb354536bd50225f19cfa5","9c83faae850406df7dc991f335c049b0b6a64e12af4bf61d5fb7281ba889ca82","9fb57a4c6576a98003de6bf441e4306f72c83f783630286758f5b468abaa105d","0f303988e5905dffc3202ad371c3d1a49bd3ea5e22da697031751a80e21a13a7","c8ed52278ec00a6fbc9697661db5ffbcbe19c5ab331b182f7fd0f9f7249b5896","e86feaa258df14e3023c7a74b7733f0b568cc75092248bec77de723dba52dd12")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("8710683d2ec2d04449b821a85b6ccd6b5cb874414fd4684702f88972a9d4cfdd","8710683d2ec2d04449b821a85b6ccd6b5cb874414fd4684702f88972a9d4cfdd","c7b9ae61046eed01651a72afe7a31de088056f1c1430b368b1acda0b58299e28","9df9bb3c13e4d20a83b0ac453e6a2908b77fc2bf841761b798b903efb2d0f4f7","a9b33572237b100edf1d4c7b0a2071d68406e5931ab3957a962fcce4bfc2cc49","e1b2d0396914f84d27ef780dd6fdd8bae653d721eea523f0ade8f45ac9a10faf","de839d6c361c7527eeaa4979b301ac408352b5b7edeb354536bd50225f19cfa5","9c83faae850406df7dc991f335c049b0b6a64e12af4bf61d5fb7281ba889ca82","9fb57a4c6576a98003de6bf441e4306f72c83f783630286758f5b468abaa105d","0f303988e5905dffc3202ad371c3d1a49bd3ea5e22da697031751a80e21a13a7","c8ed52278ec00a6fbc9697661db5ffbcbe19c5ab331b182f7fd0f9f7249b5896","e86feaa258df14e3023c7a74b7733f0b568cc75092248bec77de723dba52dd12")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("8710683d2ec2d04449b821a85b6ccd6b5cb874414fd4684702f88972a9d4cfdd","8710683d2ec2d04449b821a85b6ccd6b5cb874414fd4684702f88972a9d4cfdd","c7b9ae61046eed01651a72afe7a31de088056f1c1430b368b1acda0b58299e28","9df9bb3c13e4d20a83b0ac453e6a2908b77fc2bf841761b798b903efb2d0f4f7","a9b33572237b100edf1d4c7b0a2071d68406e5931ab3957a962fcce4bfc2cc49","e1b2d0396914f84d27ef780dd6fdd8bae653d721eea523f0ade8f45ac9a10faf","de839d6c361c7527eeaa4979b301ac408352b5b7edeb354536bd50225f19cfa5","9c83faae850406df7dc991f335c049b0b6a64e12af4bf61d5fb7281ba889ca82","9fb57a4c6576a98003de6bf441e4306f72c83f783630286758f5b468abaa105d","0f303988e5905dffc3202ad371c3d1a49bd3ea5e22da697031751a80e21a13a7","c8ed52278ec00a6fbc9697661db5ffbcbe19c5ab331b182f7fd0f9f7249b5896","e86feaa258df14e3023c7a74b7733f0b568cc75092248bec77de723dba52dd12")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("8710683d2ec2d04449b821a85b6ccd6b5cb874414fd4684702f88972a9d4cfdd","8710683d2ec2d04449b821a85b6ccd6b5cb874414fd4684702f88972a9d4cfdd","c7b9ae61046eed01651a72afe7a31de088056f1c1430b368b1acda0b58299e28","9df9bb3c13e4d20a83b0ac453e6a2908b77fc2bf841761b798b903efb2d0f4f7","a9b33572237b100edf1d4c7b0a2071d68406e5931ab3957a962fcce4bfc2cc49","e1b2d0396914f84d27ef780dd6fdd8bae653d721eea523f0ade8f45ac9a10faf","de839d6c361c7527eeaa4979b301ac408352b5b7edeb354536bd50225f19cfa5","9c83faae850406df7dc991f335c049b0b6a64e12af4bf61d5fb7281ba889ca82","9fb57a4c6576a98003de6bf441e4306f72c83f783630286758f5b468abaa105d","0f303988e5905dffc3202ad371c3d1a49bd3ea5e22da697031751a80e21a13a7","c8ed52278ec00a6fbc9697661db5ffbcbe19c5ab331b182f7fd0f9f7249b5896","e86feaa258df14e3023c7a74b7733f0b568cc75092248bec77de723dba52dd12")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("8710683d2ec2d04449b821a85b6ccd6b5cb874414fd4684702f88972a9d4cfdd","8710683d2ec2d04449b821a85b6ccd6b5cb874414fd4684702f88972a9d4cfdd","c7b9ae61046eed01651a72afe7a31de088056f1c1430b368b1acda0b58299e28","9df9bb3c13e4d20a83b0ac453e6a2908b77fc2bf841761b798b903efb2d0f4f7","a9b33572237b100edf1d4c7b0a2071d68406e5931ab3957a962fcce4bfc2cc49","e1b2d0396914f84d27ef780dd6fdd8bae653d721eea523f0ade8f45ac9a10faf","de839d6c361c7527eeaa4979b301ac408352b5b7edeb354536bd50225f19cfa5","9c83faae850406df7dc991f335c049b0b6a64e12af4bf61d5fb7281ba889ca82","9fb57a4c6576a98003de6bf441e4306f72c83f783630286758f5b468abaa105d","0f303988e5905dffc3202ad371c3d1a49bd3ea5e22da697031751a80e21a13a7","c8ed52278ec00a6fbc9697661db5ffbcbe19c5ab331b182f7fd0f9f7249b5896","e86feaa258df14e3023c7a74b7733f0b568cc75092248bec77de723dba52dd12")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("8710683d2ec2d04449b821a85b6ccd6b5cb874414fd4684702f88972a9d4cfdd","8710683d2ec2d04449b821a85b6ccd6b5cb874414fd4684702f88972a9d4cfdd","c7b9ae61046eed01651a72afe7a31de088056f1c1430b368b1acda0b58299e28","9df9bb3c13e4d20a83b0ac453e6a2908b77fc2bf841761b798b903efb2d0f4f7","a9b33572237b100edf1d4c7b0a2071d68406e5931ab3957a962fcce4bfc2cc49","e1b2d0396914f84d27ef780dd6fdd8bae653d721eea523f0ade8f45ac9a10faf","de839d6c361c7527eeaa4979b301ac408352b5b7edeb354536bd50225f19cfa5","9c83faae850406df7dc991f335c049b0b6a64e12af4bf61d5fb7281ba889ca82","9fb57a4c6576a98003de6bf441e4306f72c83f783630286758f5b468abaa105d","0f303988e5905dffc3202ad371c3d1a49bd3ea5e22da697031751a80e21a13a7","c8ed52278ec00a6fbc9697661db5ffbcbe19c5ab331b182f7fd0f9f7249b5896","e86feaa258df14e3023c7a74b7733f0b568cc75092248bec77de723dba52dd12")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("8710683d2ec2d04449b821a85b6ccd6b5cb874414fd4684702f88972a9d4cfdd","8710683d2ec2d04449b821a85b6ccd6b5cb874414fd4684702f88972a9d4cfdd","c7b9ae61046eed01651a72afe7a31de088056f1c1430b368b1acda0b58299e28","9df9bb3c13e4d20a83b0ac453e6a2908b77fc2bf841761b798b903efb2d0f4f7","a9b33572237b100edf1d4c7b0a2071d68406e5931ab3957a962fcce4bfc2cc49","e1b2d0396914f84d27ef780dd6fdd8bae653d721eea523f0ade8f45ac9a10faf","de839d6c361c7527eeaa4979b301ac408352b5b7edeb354536bd50225f19cfa5","9c83faae850406df7dc991f335c049b0b6a64e12af4bf61d5fb7281ba889ca82","9fb57a4c6576a98003de6bf441e4306f72c83f783630286758f5b468abaa105d","0f303988e5905dffc3202ad371c3d1a49bd3ea5e22da697031751a80e21a13a7","c8ed52278ec00a6fbc9697661db5ffbcbe19c5ab331b182f7fd0f9f7249b5896","e86feaa258df14e3023c7a74b7733f0b568cc75092248bec77de723dba52dd12")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("8710683d2ec2d04449b821a85b6ccd6b5cb874414fd4684702f88972a9d4cfdd","8710683d2ec2d04449b821a85b6ccd6b5cb874414fd4684702f88972a9d4cfdd","c7b9ae61046eed01651a72afe7a31de088056f1c1430b368b1acda0b58299e28","9df9bb3c13e4d20a83b0ac453e6a2908b77fc2bf841761b798b903efb2d0f4f7","a9b33572237b100edf1d4c7b0a2071d68406e5931ab3957a962fcce4bfc2cc49","e1b2d0396914f84d27ef780dd6fdd8bae653d721eea523f0ade8f45ac9a10faf","de839d6c361c7527eeaa4979b301ac408352b5b7edeb354536bd50225f19cfa5","9c83faae850406df7dc991f335c049b0b6a64e12af4bf61d5fb7281ba889ca82","9fb57a4c6576a98003de6bf441e4306f72c83f783630286758f5b468abaa105d","0f303988e5905dffc3202ad371c3d1a49bd3ea5e22da697031751a80e21a13a7","c8ed52278ec00a6fbc9697661db5ffbcbe19c5ab331b182f7fd0f9f7249b5896","e86feaa258df14e3023c7a74b7733f0b568cc75092248bec77de723dba52dd12")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("8710683d2ec2d04449b821a85b6ccd6b5cb874414fd4684702f88972a9d4cfdd","8710683d2ec2d04449b821a85b6ccd6b5cb874414fd4684702f88972a9d4cfdd","c7b9ae61046eed01651a72afe7a31de088056f1c1430b368b1acda0b58299e28","9df9bb3c13e4d20a83b0ac453e6a2908b77fc2bf841761b798b903efb2d0f4f7","a9b33572237b100edf1d4c7b0a2071d68406e5931ab3957a962fcce4bfc2cc49","e1b2d0396914f84d27ef780dd6fdd8bae653d721eea523f0ade8f45ac9a10faf","de839d6c361c7527eeaa4979b301ac408352b5b7edeb354536bd50225f19cfa5","9c83faae850406df7dc991f335c049b0b6a64e12af4bf61d5fb7281ba889ca82","9fb57a4c6576a98003de6bf441e4306f72c83f783630286758f5b468abaa105d","0f303988e5905dffc3202ad371c3d1a49bd3ea5e22da697031751a80e21a13a7","c8ed52278ec00a6fbc9697661db5ffbcbe19c5ab331b182f7fd0f9f7249b5896","e86feaa258df14e3023c7a74b7733f0b568cc75092248bec77de723dba52dd12")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("8710683d2ec2d04449b821a85b6ccd6b5cb874414fd4684702f88972a9d4cfdd","8710683d2ec2d04449b821a85b6ccd6b5cb874414fd4684702f88972a9d4cfdd","c7b9ae61046eed01651a72afe7a31de088056f1c1430b368b1acda0b58299e28","9df9bb3c13e4d20a83b0ac453e6a2908b77fc2bf841761b798b903efb2d0f4f7","a9b33572237b100edf1d4c7b0a2071d68406e5931ab3957a962fcce4bfc2cc49","e1b2d0396914f84d27ef780dd6fdd8bae653d721eea523f0ade8f45ac9a10faf","de839d6c361c7527eeaa4979b301ac408352b5b7edeb354536bd50225f19cfa5","9c83faae850406df7dc991f335c049b0b6a64e12af4bf61d5fb7281ba889ca82","9fb57a4c6576a98003de6bf441e4306f72c83f783630286758f5b468abaa105d","0f303988e5905dffc3202ad371c3d1a49bd3ea5e22da697031751a80e21a13a7","c8ed52278ec00a6fbc9697661db5ffbcbe19c5ab331b182f7fd0f9f7249b5896","e86feaa258df14e3023c7a74b7733f0b568cc75092248bec77de723dba52dd12")
index=activity AND rg_functionality="Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("8710683d2ec2d04449b821a85b6ccd6b5cb874414fd4684702f88972a9d4cfdd","8710683d2ec2d04449b821a85b6ccd6b5cb874414fd4684702f88972a9d4cfdd","c7b9ae61046eed01651a72afe7a31de088056f1c1430b368b1acda0b58299e28","9df9bb3c13e4d20a83b0ac453e6a2908b77fc2bf841761b798b903efb2d0f4f7","a9b33572237b100edf1d4c7b0a2071d68406e5931ab3957a962fcce4bfc2cc49","e1b2d0396914f84d27ef780dd6fdd8bae653d721eea523f0ade8f45ac9a10faf","de839d6c361c7527eeaa4979b301ac408352b5b7edeb354536bd50225f19cfa5","9c83faae850406df7dc991f335c049b0b6a64e12af4bf61d5fb7281ba889ca82","9fb57a4c6576a98003de6bf441e4306f72c83f783630286758f5b468abaa105d","0f303988e5905dffc3202ad371c3d1a49bd3ea5e22da697031751a80e21a13a7","c8ed52278ec00a6fbc9697661db5ffbcbe19c5ab331b182f7fd0f9f7249b5896","e86feaa258df14e3023c7a74b7733f0b568cc75092248bec77de723dba52dd12")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("8710683d2ec2d04449b821a85b6ccd6b5cb874414fd4684702f88972a9d4cfdd","8710683d2ec2d04449b821a85b6ccd6b5cb874414fd4684702f88972a9d4cfdd","c7b9ae61046eed01651a72afe7a31de088056f1c1430b368b1acda0b58299e28","9df9bb3c13e4d20a83b0ac453e6a2908b77fc2bf841761b798b903efb2d0f4f7","a9b33572237b100edf1d4c7b0a2071d68406e5931ab3957a962fcce4bfc2cc49","e1b2d0396914f84d27ef780dd6fdd8bae653d721eea523f0ade8f45ac9a10faf","de839d6c361c7527eeaa4979b301ac408352b5b7edeb354536bd50225f19cfa5","9c83faae850406df7dc991f335c049b0b6a64e12af4bf61d5fb7281ba889ca82","9fb57a4c6576a98003de6bf441e4306f72c83f783630286758f5b468abaa105d","0f303988e5905dffc3202ad371c3d1a49bd3ea5e22da697031751a80e21a13a7","c8ed52278ec00a6fbc9697661db5ffbcbe19c5ab331b182f7fd0f9f7249b5896","e86feaa258df14e3023c7a74b7733f0b568cc75092248bec77de723dba52dd12")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("8710683d2ec2d04449b821a85b6ccd6b5cb874414fd4684702f88972a9d4cfdd","8710683d2ec2d04449b821a85b6ccd6b5cb874414fd4684702f88972a9d4cfdd","c7b9ae61046eed01651a72afe7a31de088056f1c1430b368b1acda0b58299e28","9df9bb3c13e4d20a83b0ac453e6a2908b77fc2bf841761b798b903efb2d0f4f7","a9b33572237b100edf1d4c7b0a2071d68406e5931ab3957a962fcce4bfc2cc49","e1b2d0396914f84d27ef780dd6fdd8bae653d721eea523f0ade8f45ac9a10faf","de839d6c361c7527eeaa4979b301ac408352b5b7edeb354536bd50225f19cfa5","9c83faae850406df7dc991f335c049b0b6a64e12af4bf61d5fb7281ba889ca82","9fb57a4c6576a98003de6bf441e4306f72c83f783630286758f5b468abaa105d","0f303988e5905dffc3202ad371c3d1a49bd3ea5e22da697031751a80e21a13a7","c8ed52278ec00a6fbc9697661db5ffbcbe19c5ab331b182f7fd0f9f7249b5896","e86feaa258df14e3023c7a74b7733f0b568cc75092248bec77de723dba52dd12")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("8710683d2ec2d04449b821a85b6ccd6b5cb874414fd4684702f88972a9d4cfdd","8710683d2ec2d04449b821a85b6ccd6b5cb874414fd4684702f88972a9d4cfdd","c7b9ae61046eed01651a72afe7a31de088056f1c1430b368b1acda0b58299e28","9df9bb3c13e4d20a83b0ac453e6a2908b77fc2bf841761b798b903efb2d0f4f7","a9b33572237b100edf1d4c7b0a2071d68406e5931ab3957a962fcce4bfc2cc49","e1b2d0396914f84d27ef780dd6fdd8bae653d721eea523f0ade8f45ac9a10faf","de839d6c361c7527eeaa4979b301ac408352b5b7edeb354536bd50225f19cfa5","9c83faae850406df7dc991f335c049b0b6a64e12af4bf61d5fb7281ba889ca82","9fb57a4c6576a98003de6bf441e4306f72c83f783630286758f5b468abaa105d","0f303988e5905dffc3202ad371c3d1a49bd3ea5e22da697031751a80e21a13a7","c8ed52278ec00a6fbc9697661db5ffbcbe19c5ab331b182f7fd0f9f7249b5896","e86feaa258df14e3023c7a74b7733f0b568cc75092248bec77de723dba52dd12")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("8710683d2ec2d04449b821a85b6ccd6b5cb874414fd4684702f88972a9d4cfdd","8710683d2ec2d04449b821a85b6ccd6b5cb874414fd4684702f88972a9d4cfdd","c7b9ae61046eed01651a72afe7a31de088056f1c1430b368b1acda0b58299e28","9df9bb3c13e4d20a83b0ac453e6a2908b77fc2bf841761b798b903efb2d0f4f7","a9b33572237b100edf1d4c7b0a2071d68406e5931ab3957a962fcce4bfc2cc49","e1b2d0396914f84d27ef780dd6fdd8bae653d721eea523f0ade8f45ac9a10faf","de839d6c361c7527eeaa4979b301ac408352b5b7edeb354536bd50225f19cfa5","9c83faae850406df7dc991f335c049b0b6a64e12af4bf61d5fb7281ba889ca82","9fb57a4c6576a98003de6bf441e4306f72c83f783630286758f5b468abaa105d","0f303988e5905dffc3202ad371c3d1a49bd3ea5e22da697031751a80e21a13a7","c8ed52278ec00a6fbc9697661db5ffbcbe19c5ab331b182f7fd0f9f7249b5896","e86feaa258df14e3023c7a74b7733f0b568cc75092248bec77de723dba52dd12")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("8710683d2ec2d04449b821a85b6ccd6b5cb874414fd4684702f88972a9d4cfdd","8710683d2ec2d04449b821a85b6ccd6b5cb874414fd4684702f88972a9d4cfdd","c7b9ae61046eed01651a72afe7a31de088056f1c1430b368b1acda0b58299e28","9df9bb3c13e4d20a83b0ac453e6a2908b77fc2bf841761b798b903efb2d0f4f7","a9b33572237b100edf1d4c7b0a2071d68406e5931ab3957a962fcce4bfc2cc49","e1b2d0396914f84d27ef780dd6fdd8bae653d721eea523f0ade8f45ac9a10faf","de839d6c361c7527eeaa4979b301ac408352b5b7edeb354536bd50225f19cfa5","9c83faae850406df7dc991f335c049b0b6a64e12af4bf61d5fb7281ba889ca82","9fb57a4c6576a98003de6bf441e4306f72c83f783630286758f5b468abaa105d","0f303988e5905dffc3202ad371c3d1a49bd3ea5e22da697031751a80e21a13a7","c8ed52278ec00a6fbc9697661db5ffbcbe19c5ab331b182f7fd0f9f7249b5896","e86feaa258df14e3023c7a74b7733f0b568cc75092248bec77de723dba52dd12")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("8710683d2ec2d04449b821a85b6ccd6b5cb874414fd4684702f88972a9d4cfdd","8710683d2ec2d04449b821a85b6ccd6b5cb874414fd4684702f88972a9d4cfdd","c7b9ae61046eed01651a72afe7a31de088056f1c1430b368b1acda0b58299e28","9df9bb3c13e4d20a83b0ac453e6a2908b77fc2bf841761b798b903efb2d0f4f7","a9b33572237b100edf1d4c7b0a2071d68406e5931ab3957a962fcce4bfc2cc49","e1b2d0396914f84d27ef780dd6fdd8bae653d721eea523f0ade8f45ac9a10faf","de839d6c361c7527eeaa4979b301ac408352b5b7edeb354536bd50225f19cfa5","9c83faae850406df7dc991f335c049b0b6a64e12af4bf61d5fb7281ba889ca82","9fb57a4c6576a98003de6bf441e4306f72c83f783630286758f5b468abaa105d","0f303988e5905dffc3202ad371c3d1a49bd3ea5e22da697031751a80e21a13a7","c8ed52278ec00a6fbc9697661db5ffbcbe19c5ab331b182f7fd0f9f7249b5896","e86feaa258df14e3023c7a74b7733f0b568cc75092248bec77de723dba52dd12")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("8710683d2ec2d04449b821a85b6ccd6b5cb874414fd4684702f88972a9d4cfdd","8710683d2ec2d04449b821a85b6ccd6b5cb874414fd4684702f88972a9d4cfdd","c7b9ae61046eed01651a72afe7a31de088056f1c1430b368b1acda0b58299e28","9df9bb3c13e4d20a83b0ac453e6a2908b77fc2bf841761b798b903efb2d0f4f7","a9b33572237b100edf1d4c7b0a2071d68406e5931ab3957a962fcce4bfc2cc49","e1b2d0396914f84d27ef780dd6fdd8bae653d721eea523f0ade8f45ac9a10faf","de839d6c361c7527eeaa4979b301ac408352b5b7edeb354536bd50225f19cfa5","9c83faae850406df7dc991f335c049b0b6a64e12af4bf61d5fb7281ba889ca82","9fb57a4c6576a98003de6bf441e4306f72c83f783630286758f5b468abaa105d","0f303988e5905dffc3202ad371c3d1a49bd3ea5e22da697031751a80e21a13a7","c8ed52278ec00a6fbc9697661db5ffbcbe19c5ab331b182f7fd0f9f7249b5896","e86feaa258df14e3023c7a74b7733f0b568cc75092248bec77de723dba52dd12")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring64 NOT NULL AND customstring64 IN ("8710683d2ec2d04449b821a85b6ccd6b5cb874414fd4684702f88972a9d4cfdd","8710683d2ec2d04449b821a85b6ccd6b5cb874414fd4684702f88972a9d4cfdd","c7b9ae61046eed01651a72afe7a31de088056f1c1430b368b1acda0b58299e28","9df9bb3c13e4d20a83b0ac453e6a2908b77fc2bf841761b798b903efb2d0f4f7","a9b33572237b100edf1d4c7b0a2071d68406e5931ab3957a962fcce4bfc2cc49","e1b2d0396914f84d27ef780dd6fdd8bae653d721eea523f0ade8f45ac9a10faf","de839d6c361c7527eeaa4979b301ac408352b5b7edeb354536bd50225f19cfa5","9c83faae850406df7dc991f335c049b0b6a64e12af4bf61d5fb7281ba889ca82","9fb57a4c6576a98003de6bf441e4306f72c83f783630286758f5b468abaa105d","0f303988e5905dffc3202ad371c3d1a49bd3ea5e22da697031751a80e21a13a7","c8ed52278ec00a6fbc9697661db5ffbcbe19c5ab331b182f7fd0f9f7249b5896","e86feaa258df14e3023c7a74b7733f0b568cc75092248bec77de723dba52dd12")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("8710683d2ec2d04449b821a85b6ccd6b5cb874414fd4684702f88972a9d4cfdd","8710683d2ec2d04449b821a85b6ccd6b5cb874414fd4684702f88972a9d4cfdd","c7b9ae61046eed01651a72afe7a31de088056f1c1430b368b1acda0b58299e28","9df9bb3c13e4d20a83b0ac453e6a2908b77fc2bf841761b798b903efb2d0f4f7","a9b33572237b100edf1d4c7b0a2071d68406e5931ab3957a962fcce4bfc2cc49","e1b2d0396914f84d27ef780dd6fdd8bae653d721eea523f0ade8f45ac9a10faf","de839d6c361c7527eeaa4979b301ac408352b5b7edeb354536bd50225f19cfa5","9c83faae850406df7dc991f335c049b0b6a64e12af4bf61d5fb7281ba889ca82","9fb57a4c6576a98003de6bf441e4306f72c83f783630286758f5b468abaa105d","0f303988e5905dffc3202ad371c3d1a49bd3ea5e22da697031751a80e21a13a7","c8ed52278ec00a6fbc9697661db5ffbcbe19c5ab331b182f7fd0f9f7249b5896","e86feaa258df14e3023c7a74b7733f0b568cc75092248bec77de723dba52dd12")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("8710683d2ec2d04449b821a85b6ccd6b5cb874414fd4684702f88972a9d4cfdd","8710683d2ec2d04449b821a85b6ccd6b5cb874414fd4684702f88972a9d4cfdd","c7b9ae61046eed01651a72afe7a31de088056f1c1430b368b1acda0b58299e28","9df9bb3c13e4d20a83b0ac453e6a2908b77fc2bf841761b798b903efb2d0f4f7","a9b33572237b100edf1d4c7b0a2071d68406e5931ab3957a962fcce4bfc2cc49","e1b2d0396914f84d27ef780dd6fdd8bae653d721eea523f0ade8f45ac9a10faf","de839d6c361c7527eeaa4979b301ac408352b5b7edeb354536bd50225f19cfa5","9c83faae850406df7dc991f335c049b0b6a64e12af4bf61d5fb7281ba889ca82","9fb57a4c6576a98003de6bf441e4306f72c83f783630286758f5b468abaa105d","0f303988e5905dffc3202ad371c3d1a49bd3ea5e22da697031751a80e21a13a7","c8ed52278ec00a6fbc9697661db5ffbcbe19c5ab331b182f7fd0f9f7249b5896","e86feaa258df14e3023c7a74b7733f0b568cc75092248bec77de723dba52dd12")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("8710683d2ec2d04449b821a85b6ccd6b5cb874414fd4684702f88972a9d4cfdd","8710683d2ec2d04449b821a85b6ccd6b5cb874414fd4684702f88972a9d4cfdd","c7b9ae61046eed01651a72afe7a31de088056f1c1430b368b1acda0b58299e28","9df9bb3c13e4d20a83b0ac453e6a2908b77fc2bf841761b798b903efb2d0f4f7","a9b33572237b100edf1d4c7b0a2071d68406e5931ab3957a962fcce4bfc2cc49","e1b2d0396914f84d27ef780dd6fdd8bae653d721eea523f0ade8f45ac9a10faf","de839d6c361c7527eeaa4979b301ac408352b5b7edeb354536bd50225f19cfa5","9c83faae850406df7dc991f335c049b0b6a64e12af4bf61d5fb7281ba889ca82","9fb57a4c6576a98003de6bf441e4306f72c83f783630286758f5b468abaa105d","0f303988e5905dffc3202ad371c3d1a49bd3ea5e22da697031751a80e21a13a7","c8ed52278ec00a6fbc9697661db5ffbcbe19c5ab331b182f7fd0f9f7249b5896","e86feaa258df14e3023c7a74b7733f0b568cc75092248bec77de723dba52dd12")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring64 NOT NULL AND customstring64 IN ("8710683d2ec2d04449b821a85b6ccd6b5cb874414fd4684702f88972a9d4cfdd","8710683d2ec2d04449b821a85b6ccd6b5cb874414fd4684702f88972a9d4cfdd","c7b9ae61046eed01651a72afe7a31de088056f1c1430b368b1acda0b58299e28","9df9bb3c13e4d20a83b0ac453e6a2908b77fc2bf841761b798b903efb2d0f4f7","a9b33572237b100edf1d4c7b0a2071d68406e5931ab3957a962fcce4bfc2cc49","e1b2d0396914f84d27ef780dd6fdd8bae653d721eea523f0ade8f45ac9a10faf","de839d6c361c7527eeaa4979b301ac408352b5b7edeb354536bd50225f19cfa5","9c83faae850406df7dc991f335c049b0b6a64e12af4bf61d5fb7281ba889ca82","9fb57a4c6576a98003de6bf441e4306f72c83f783630286758f5b468abaa105d","0f303988e5905dffc3202ad371c3d1a49bd3ea5e22da697031751a80e21a13a7","c8ed52278ec00a6fbc9697661db5ffbcbe19c5ab331b182f7fd0f9f7249b5896","e86feaa258df14e3023c7a74b7733f0b568cc75092248bec77de723dba52dd12")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("8710683d2ec2d04449b821a85b6ccd6b5cb874414fd4684702f88972a9d4cfdd","8710683d2ec2d04449b821a85b6ccd6b5cb874414fd4684702f88972a9d4cfdd","c7b9ae61046eed01651a72afe7a31de088056f1c1430b368b1acda0b58299e28","9df9bb3c13e4d20a83b0ac453e6a2908b77fc2bf841761b798b903efb2d0f4f7","a9b33572237b100edf1d4c7b0a2071d68406e5931ab3957a962fcce4bfc2cc49","e1b2d0396914f84d27ef780dd6fdd8bae653d721eea523f0ade8f45ac9a10faf","de839d6c361c7527eeaa4979b301ac408352b5b7edeb354536bd50225f19cfa5","9c83faae850406df7dc991f335c049b0b6a64e12af4bf61d5fb7281ba889ca82","9fb57a4c6576a98003de6bf441e4306f72c83f783630286758f5b468abaa105d","0f303988e5905dffc3202ad371c3d1a49bd3ea5e22da697031751a80e21a13a7","c8ed52278ec00a6fbc9697661db5ffbcbe19c5ab331b182f7fd0f9f7249b5896","e86feaa258df14e3023c7a74b7733f0b568cc75092248bec77de723dba52dd12")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("8710683d2ec2d04449b821a85b6ccd6b5cb874414fd4684702f88972a9d4cfdd","8710683d2ec2d04449b821a85b6ccd6b5cb874414fd4684702f88972a9d4cfdd","c7b9ae61046eed01651a72afe7a31de088056f1c1430b368b1acda0b58299e28","9df9bb3c13e4d20a83b0ac453e6a2908b77fc2bf841761b798b903efb2d0f4f7","a9b33572237b100edf1d4c7b0a2071d68406e5931ab3957a962fcce4bfc2cc49","e1b2d0396914f84d27ef780dd6fdd8bae653d721eea523f0ade8f45ac9a10faf","de839d6c361c7527eeaa4979b301ac408352b5b7edeb354536bd50225f19cfa5","9c83faae850406df7dc991f335c049b0b6a64e12af4bf61d5fb7281ba889ca82","9fb57a4c6576a98003de6bf441e4306f72c83f783630286758f5b468abaa105d","0f303988e5905dffc3202ad371c3d1a49bd3ea5e22da697031751a80e21a13a7","c8ed52278ec00a6fbc9697661db5ffbcbe19c5ab331b182f7fd0f9f7249b5896","e86feaa258df14e3023c7a74b7733f0b568cc75092248bec77de723dba52dd12")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("8710683d2ec2d04449b821a85b6ccd6b5cb874414fd4684702f88972a9d4cfdd","8710683d2ec2d04449b821a85b6ccd6b5cb874414fd4684702f88972a9d4cfdd","c7b9ae61046eed01651a72afe7a31de088056f1c1430b368b1acda0b58299e28","9df9bb3c13e4d20a83b0ac453e6a2908b77fc2bf841761b798b903efb2d0f4f7","a9b33572237b100edf1d4c7b0a2071d68406e5931ab3957a962fcce4bfc2cc49","e1b2d0396914f84d27ef780dd6fdd8bae653d721eea523f0ade8f45ac9a10faf","de839d6c361c7527eeaa4979b301ac408352b5b7edeb354536bd50225f19cfa5","9c83faae850406df7dc991f335c049b0b6a64e12af4bf61d5fb7281ba889ca82","9fb57a4c6576a98003de6bf441e4306f72c83f783630286758f5b468abaa105d","0f303988e5905dffc3202ad371c3d1a49bd3ea5e22da697031751a80e21a13a7","c8ed52278ec00a6fbc9697661db5ffbcbe19c5ab331b182f7fd0f9f7249b5896","e86feaa258df14e3023c7a74b7733f0b568cc75092248bec77de723dba52dd12")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring64 NOT NULL AND customstring64 IN ("8710683d2ec2d04449b821a85b6ccd6b5cb874414fd4684702f88972a9d4cfdd","8710683d2ec2d04449b821a85b6ccd6b5cb874414fd4684702f88972a9d4cfdd","c7b9ae61046eed01651a72afe7a31de088056f1c1430b368b1acda0b58299e28","9df9bb3c13e4d20a83b0ac453e6a2908b77fc2bf841761b798b903efb2d0f4f7","a9b33572237b100edf1d4c7b0a2071d68406e5931ab3957a962fcce4bfc2cc49","e1b2d0396914f84d27ef780dd6fdd8bae653d721eea523f0ade8f45ac9a10faf","de839d6c361c7527eeaa4979b301ac408352b5b7edeb354536bd50225f19cfa5","9c83faae850406df7dc991f335c049b0b6a64e12af4bf61d5fb7281ba889ca82","9fb57a4c6576a98003de6bf441e4306f72c83f783630286758f5b468abaa105d","0f303988e5905dffc3202ad371c3d1a49bd3ea5e22da697031751a80e21a13a7","c8ed52278ec00a6fbc9697661db5ffbcbe19c5ab331b182f7fd0f9f7249b5896","e86feaa258df14e3023c7a74b7733f0b568cc75092248bec77de723dba52dd12")
index=activity AND rg_functionality="O365 General" AND filehash NOT NULL AND filehash IN ("8710683d2ec2d04449b821a85b6ccd6b5cb874414fd4684702f88972a9d4cfdd","8710683d2ec2d04449b821a85b6ccd6b5cb874414fd4684702f88972a9d4cfdd","c7b9ae61046eed01651a72afe7a31de088056f1c1430b368b1acda0b58299e28","9df9bb3c13e4d20a83b0ac453e6a2908b77fc2bf841761b798b903efb2d0f4f7","a9b33572237b100edf1d4c7b0a2071d68406e5931ab3957a962fcce4bfc2cc49","e1b2d0396914f84d27ef780dd6fdd8bae653d721eea523f0ade8f45ac9a10faf","de839d6c361c7527eeaa4979b301ac408352b5b7edeb354536bd50225f19cfa5","9c83faae850406df7dc991f335c049b0b6a64e12af4bf61d5fb7281ba889ca82","9fb57a4c6576a98003de6bf441e4306f72c83f783630286758f5b468abaa105d","0f303988e5905dffc3202ad371c3d1a49bd3ea5e22da697031751a80e21a13a7","c8ed52278ec00a6fbc9697661db5ffbcbe19c5ab331b182f7fd0f9f7249b5896","e86feaa258df14e3023c7a74b7733f0b568cc75092248bec77de723dba52dd12")
index=activity AND rg_functionality="O365 General" AND oldfilehash NOT NULL AND oldfilehash IN ("8710683d2ec2d04449b821a85b6ccd6b5cb874414fd4684702f88972a9d4cfdd","8710683d2ec2d04449b821a85b6ccd6b5cb874414fd4684702f88972a9d4cfdd","c7b9ae61046eed01651a72afe7a31de088056f1c1430b368b1acda0b58299e28","9df9bb3c13e4d20a83b0ac453e6a2908b77fc2bf841761b798b903efb2d0f4f7","a9b33572237b100edf1d4c7b0a2071d68406e5931ab3957a962fcce4bfc2cc49","e1b2d0396914f84d27ef780dd6fdd8bae653d721eea523f0ade8f45ac9a10faf","de839d6c361c7527eeaa4979b301ac408352b5b7edeb354536bd50225f19cfa5","9c83faae850406df7dc991f335c049b0b6a64e12af4bf61d5fb7281ba889ca82","9fb57a4c6576a98003de6bf441e4306f72c83f783630286758f5b468abaa105d","0f303988e5905dffc3202ad371c3d1a49bd3ea5e22da697031751a80e21a13a7","c8ed52278ec00a6fbc9697661db5ffbcbe19c5ab331b182f7fd0f9f7249b5896","e86feaa258df14e3023c7a74b7733f0b568cc75092248bec77de723dba52dd12")
index=activity AND rg_functionality="O365 General" AND customstring3 NOT NULL AND customstring3 IN ("8710683d2ec2d04449b821a85b6ccd6b5cb874414fd4684702f88972a9d4cfdd","8710683d2ec2d04449b821a85b6ccd6b5cb874414fd4684702f88972a9d4cfdd","c7b9ae61046eed01651a72afe7a31de088056f1c1430b368b1acda0b58299e28","9df9bb3c13e4d20a83b0ac453e6a2908b77fc2bf841761b798b903efb2d0f4f7","a9b33572237b100edf1d4c7b0a2071d68406e5931ab3957a962fcce4bfc2cc49","e1b2d0396914f84d27ef780dd6fdd8bae653d721eea523f0ade8f45ac9a10faf","de839d6c361c7527eeaa4979b301ac408352b5b7edeb354536bd50225f19cfa5","9c83faae850406df7dc991f335c049b0b6a64e12af4bf61d5fb7281ba889ca82","9fb57a4c6576a98003de6bf441e4306f72c83f783630286758f5b468abaa105d","0f303988e5905dffc3202ad371c3d1a49bd3ea5e22da697031751a80e21a13a7","c8ed52278ec00a6fbc9697661db5ffbcbe19c5ab331b182f7fd0f9f7249b5896","e86feaa258df14e3023c7a74b7733f0b568cc75092248bec77de723dba52dd12")
index=activity AND rg_functionality="O365 General" AND customstring64 NOT NULL AND customstring64 IN ("8710683d2ec2d04449b821a85b6ccd6b5cb874414fd4684702f88972a9d4cfdd","8710683d2ec2d04449b821a85b6ccd6b5cb874414fd4684702f88972a9d4cfdd","c7b9ae61046eed01651a72afe7a31de088056f1c1430b368b1acda0b58299e28","9df9bb3c13e4d20a83b0ac453e6a2908b77fc2bf841761b798b903efb2d0f4f7","a9b33572237b100edf1d4c7b0a2071d68406e5931ab3957a962fcce4bfc2cc49","e1b2d0396914f84d27ef780dd6fdd8bae653d721eea523f0ade8f45ac9a10faf","de839d6c361c7527eeaa4979b301ac408352b5b7edeb354536bd50225f19cfa5","9c83faae850406df7dc991f335c049b0b6a64e12af4bf61d5fb7281ba889ca82","9fb57a4c6576a98003de6bf441e4306f72c83f783630286758f5b468abaa105d","0f303988e5905dffc3202ad371c3d1a49bd3ea5e22da697031751a80e21a13a7","c8ed52278ec00a6fbc9697661db5ffbcbe19c5ab331b182f7fd0f9f7249b5896","e86feaa258df14e3023c7a74b7733f0b568cc75092248bec77de723dba52dd12")
