index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("d60e54854f2b28c2ce197f8a3b37440dfa8dea18ce7939a356f5503ece9e5eb7","6c81d2af950e958f4872d3ced470d9f70b7d73bc0b92c20a34ce8bf75d551609","8508003c5aafdf89749d0abbfb9f5deb6d7b615f604bbb11b8702ddba2e365e7")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("d60e54854f2b28c2ce197f8a3b37440dfa8dea18ce7939a356f5503ece9e5eb7","6c81d2af950e958f4872d3ced470d9f70b7d73bc0b92c20a34ce8bf75d551609","8508003c5aafdf89749d0abbfb9f5deb6d7b615f604bbb11b8702ddba2e365e7")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("d60e54854f2b28c2ce197f8a3b37440dfa8dea18ce7939a356f5503ece9e5eb7","6c81d2af950e958f4872d3ced470d9f70b7d73bc0b92c20a34ce8bf75d551609","8508003c5aafdf89749d0abbfb9f5deb6d7b615f604bbb11b8702ddba2e365e7")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring64 NOT NULL AND customstring64 IN ("d60e54854f2b28c2ce197f8a3b37440dfa8dea18ce7939a356f5503ece9e5eb7","6c81d2af950e958f4872d3ced470d9f70b7d73bc0b92c20a34ce8bf75d551609","8508003c5aafdf89749d0abbfb9f5deb6d7b615f604bbb11b8702ddba2e365e7")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("d60e54854f2b28c2ce197f8a3b37440dfa8dea18ce7939a356f5503ece9e5eb7","6c81d2af950e958f4872d3ced470d9f70b7d73bc0b92c20a34ce8bf75d551609","8508003c5aafdf89749d0abbfb9f5deb6d7b615f604bbb11b8702ddba2e365e7")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("d60e54854f2b28c2ce197f8a3b37440dfa8dea18ce7939a356f5503ece9e5eb7","6c81d2af950e958f4872d3ced470d9f70b7d73bc0b92c20a34ce8bf75d551609","8508003c5aafdf89749d0abbfb9f5deb6d7b615f604bbb11b8702ddba2e365e7")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("d60e54854f2b28c2ce197f8a3b37440dfa8dea18ce7939a356f5503ece9e5eb7","6c81d2af950e958f4872d3ced470d9f70b7d73bc0b92c20a34ce8bf75d551609","8508003c5aafdf89749d0abbfb9f5deb6d7b615f604bbb11b8702ddba2e365e7")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("d60e54854f2b28c2ce197f8a3b37440dfa8dea18ce7939a356f5503ece9e5eb7","6c81d2af950e958f4872d3ced470d9f70b7d73bc0b92c20a34ce8bf75d551609","8508003c5aafdf89749d0abbfb9f5deb6d7b615f604bbb11b8702ddba2e365e7")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("d60e54854f2b28c2ce197f8a3b37440dfa8dea18ce7939a356f5503ece9e5eb7","6c81d2af950e958f4872d3ced470d9f70b7d73bc0b92c20a34ce8bf75d551609","8508003c5aafdf89749d0abbfb9f5deb6d7b615f604bbb11b8702ddba2e365e7")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("d60e54854f2b28c2ce197f8a3b37440dfa8dea18ce7939a356f5503ece9e5eb7","6c81d2af950e958f4872d3ced470d9f70b7d73bc0b92c20a34ce8bf75d551609","8508003c5aafdf89749d0abbfb9f5deb6d7b615f604bbb11b8702ddba2e365e7")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("d60e54854f2b28c2ce197f8a3b37440dfa8dea18ce7939a356f5503ece9e5eb7","6c81d2af950e958f4872d3ced470d9f70b7d73bc0b92c20a34ce8bf75d551609","8508003c5aafdf89749d0abbfb9f5deb6d7b615f604bbb11b8702ddba2e365e7")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("d60e54854f2b28c2ce197f8a3b37440dfa8dea18ce7939a356f5503ece9e5eb7","6c81d2af950e958f4872d3ced470d9f70b7d73bc0b92c20a34ce8bf75d551609","8508003c5aafdf89749d0abbfb9f5deb6d7b615f604bbb11b8702ddba2e365e7")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("d60e54854f2b28c2ce197f8a3b37440dfa8dea18ce7939a356f5503ece9e5eb7","6c81d2af950e958f4872d3ced470d9f70b7d73bc0b92c20a34ce8bf75d551609","8508003c5aafdf89749d0abbfb9f5deb6d7b615f604bbb11b8702ddba2e365e7")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("d60e54854f2b28c2ce197f8a3b37440dfa8dea18ce7939a356f5503ece9e5eb7","6c81d2af950e958f4872d3ced470d9f70b7d73bc0b92c20a34ce8bf75d551609","8508003c5aafdf89749d0abbfb9f5deb6d7b615f604bbb11b8702ddba2e365e7")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("d60e54854f2b28c2ce197f8a3b37440dfa8dea18ce7939a356f5503ece9e5eb7","6c81d2af950e958f4872d3ced470d9f70b7d73bc0b92c20a34ce8bf75d551609","8508003c5aafdf89749d0abbfb9f5deb6d7b615f604bbb11b8702ddba2e365e7")
index=activity AND rg_functionality="Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("d60e54854f2b28c2ce197f8a3b37440dfa8dea18ce7939a356f5503ece9e5eb7","6c81d2af950e958f4872d3ced470d9f70b7d73bc0b92c20a34ce8bf75d551609","8508003c5aafdf89749d0abbfb9f5deb6d7b615f604bbb11b8702ddba2e365e7")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("d60e54854f2b28c2ce197f8a3b37440dfa8dea18ce7939a356f5503ece9e5eb7","6c81d2af950e958f4872d3ced470d9f70b7d73bc0b92c20a34ce8bf75d551609","8508003c5aafdf89749d0abbfb9f5deb6d7b615f604bbb11b8702ddba2e365e7")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("d60e54854f2b28c2ce197f8a3b37440dfa8dea18ce7939a356f5503ece9e5eb7","6c81d2af950e958f4872d3ced470d9f70b7d73bc0b92c20a34ce8bf75d551609","8508003c5aafdf89749d0abbfb9f5deb6d7b615f604bbb11b8702ddba2e365e7")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("d60e54854f2b28c2ce197f8a3b37440dfa8dea18ce7939a356f5503ece9e5eb7","6c81d2af950e958f4872d3ced470d9f70b7d73bc0b92c20a34ce8bf75d551609","8508003c5aafdf89749d0abbfb9f5deb6d7b615f604bbb11b8702ddba2e365e7")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("d60e54854f2b28c2ce197f8a3b37440dfa8dea18ce7939a356f5503ece9e5eb7","6c81d2af950e958f4872d3ced470d9f70b7d73bc0b92c20a34ce8bf75d551609","8508003c5aafdf89749d0abbfb9f5deb6d7b615f604bbb11b8702ddba2e365e7")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("d60e54854f2b28c2ce197f8a3b37440dfa8dea18ce7939a356f5503ece9e5eb7","6c81d2af950e958f4872d3ced470d9f70b7d73bc0b92c20a34ce8bf75d551609","8508003c5aafdf89749d0abbfb9f5deb6d7b615f604bbb11b8702ddba2e365e7")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("d60e54854f2b28c2ce197f8a3b37440dfa8dea18ce7939a356f5503ece9e5eb7","6c81d2af950e958f4872d3ced470d9f70b7d73bc0b92c20a34ce8bf75d551609","8508003c5aafdf89749d0abbfb9f5deb6d7b615f604bbb11b8702ddba2e365e7")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("d60e54854f2b28c2ce197f8a3b37440dfa8dea18ce7939a356f5503ece9e5eb7","6c81d2af950e958f4872d3ced470d9f70b7d73bc0b92c20a34ce8bf75d551609","8508003c5aafdf89749d0abbfb9f5deb6d7b615f604bbb11b8702ddba2e365e7")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring64 NOT NULL AND customstring64 IN ("d60e54854f2b28c2ce197f8a3b37440dfa8dea18ce7939a356f5503ece9e5eb7","6c81d2af950e958f4872d3ced470d9f70b7d73bc0b92c20a34ce8bf75d551609","8508003c5aafdf89749d0abbfb9f5deb6d7b615f604bbb11b8702ddba2e365e7")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("d60e54854f2b28c2ce197f8a3b37440dfa8dea18ce7939a356f5503ece9e5eb7","6c81d2af950e958f4872d3ced470d9f70b7d73bc0b92c20a34ce8bf75d551609","8508003c5aafdf89749d0abbfb9f5deb6d7b615f604bbb11b8702ddba2e365e7")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("d60e54854f2b28c2ce197f8a3b37440dfa8dea18ce7939a356f5503ece9e5eb7","6c81d2af950e958f4872d3ced470d9f70b7d73bc0b92c20a34ce8bf75d551609","8508003c5aafdf89749d0abbfb9f5deb6d7b615f604bbb11b8702ddba2e365e7")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("d60e54854f2b28c2ce197f8a3b37440dfa8dea18ce7939a356f5503ece9e5eb7","6c81d2af950e958f4872d3ced470d9f70b7d73bc0b92c20a34ce8bf75d551609","8508003c5aafdf89749d0abbfb9f5deb6d7b615f604bbb11b8702ddba2e365e7")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring64 NOT NULL AND customstring64 IN ("d60e54854f2b28c2ce197f8a3b37440dfa8dea18ce7939a356f5503ece9e5eb7","6c81d2af950e958f4872d3ced470d9f70b7d73bc0b92c20a34ce8bf75d551609","8508003c5aafdf89749d0abbfb9f5deb6d7b615f604bbb11b8702ddba2e365e7")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("d60e54854f2b28c2ce197f8a3b37440dfa8dea18ce7939a356f5503ece9e5eb7","6c81d2af950e958f4872d3ced470d9f70b7d73bc0b92c20a34ce8bf75d551609","8508003c5aafdf89749d0abbfb9f5deb6d7b615f604bbb11b8702ddba2e365e7")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("d60e54854f2b28c2ce197f8a3b37440dfa8dea18ce7939a356f5503ece9e5eb7","6c81d2af950e958f4872d3ced470d9f70b7d73bc0b92c20a34ce8bf75d551609","8508003c5aafdf89749d0abbfb9f5deb6d7b615f604bbb11b8702ddba2e365e7")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("d60e54854f2b28c2ce197f8a3b37440dfa8dea18ce7939a356f5503ece9e5eb7","6c81d2af950e958f4872d3ced470d9f70b7d73bc0b92c20a34ce8bf75d551609","8508003c5aafdf89749d0abbfb9f5deb6d7b615f604bbb11b8702ddba2e365e7")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring64 NOT NULL AND customstring64 IN ("d60e54854f2b28c2ce197f8a3b37440dfa8dea18ce7939a356f5503ece9e5eb7","6c81d2af950e958f4872d3ced470d9f70b7d73bc0b92c20a34ce8bf75d551609","8508003c5aafdf89749d0abbfb9f5deb6d7b615f604bbb11b8702ddba2e365e7")
index=activity AND rg_functionality="O365 General" AND filehash NOT NULL AND filehash IN ("d60e54854f2b28c2ce197f8a3b37440dfa8dea18ce7939a356f5503ece9e5eb7","6c81d2af950e958f4872d3ced470d9f70b7d73bc0b92c20a34ce8bf75d551609","8508003c5aafdf89749d0abbfb9f5deb6d7b615f604bbb11b8702ddba2e365e7")
index=activity AND rg_functionality="O365 General" AND oldfilehash NOT NULL AND oldfilehash IN ("d60e54854f2b28c2ce197f8a3b37440dfa8dea18ce7939a356f5503ece9e5eb7","6c81d2af950e958f4872d3ced470d9f70b7d73bc0b92c20a34ce8bf75d551609","8508003c5aafdf89749d0abbfb9f5deb6d7b615f604bbb11b8702ddba2e365e7")
index=activity AND rg_functionality="O365 General" AND customstring3 NOT NULL AND customstring3 IN ("d60e54854f2b28c2ce197f8a3b37440dfa8dea18ce7939a356f5503ece9e5eb7","6c81d2af950e958f4872d3ced470d9f70b7d73bc0b92c20a34ce8bf75d551609","8508003c5aafdf89749d0abbfb9f5deb6d7b615f604bbb11b8702ddba2e365e7")
index=activity AND rg_functionality="O365 General" AND customstring64 NOT NULL AND customstring64 IN ("d60e54854f2b28c2ce197f8a3b37440dfa8dea18ce7939a356f5503ece9e5eb7","6c81d2af950e958f4872d3ced470d9f70b7d73bc0b92c20a34ce8bf75d551609","8508003c5aafdf89749d0abbfb9f5deb6d7b615f604bbb11b8702ddba2e365e7")
