index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("46cd508b7e77bb2c1d47f7fef0042a13c516f8163f9373ef9dfac180131c65ed","40b7b386c2c6944a6571c6dcfb23aaae026e8e82","f59d2a3c925f331aae7437dd7ac1a7c8sha256","e98c2fa10d77d345c960fc63436405a8b5024bd9b938a5962f70f66842e8b2cf","eaa8a81f8564b2da25b9d91797fda8e53fca93b8","a610664961870a1817df06f3eae1010bsha256","343cb2d5900f5fe4abd5442a4a18541753fbb6ca5ff4ee7f2c312ed96e413335","a074790705ecbede2e67cced4bcb62d833d828a5","1e98a8d79ed7afbd77f6536dd7b4398fsha256","4839c7e3dde1e707cb538ab301d792b3ad75b45b03c65a4a6095c2a65ce65c84","25109b11c5dd418ca98f7971b8cc4ded8b0cd446","bcf497379b84656ede89d562067d1cedsha256","09d6dab9b70a74f61c41eaa485b37de9a40c86b6d2eae7413db11b4e6a8256ef","46b02cc186b85e11c3d59790c3a0bfd2ae1f82a5","31e0439e6ef1dd29c0db6d96bac59446sha256")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("46cd508b7e77bb2c1d47f7fef0042a13c516f8163f9373ef9dfac180131c65ed","40b7b386c2c6944a6571c6dcfb23aaae026e8e82","f59d2a3c925f331aae7437dd7ac1a7c8sha256","e98c2fa10d77d345c960fc63436405a8b5024bd9b938a5962f70f66842e8b2cf","eaa8a81f8564b2da25b9d91797fda8e53fca93b8","a610664961870a1817df06f3eae1010bsha256","343cb2d5900f5fe4abd5442a4a18541753fbb6ca5ff4ee7f2c312ed96e413335","a074790705ecbede2e67cced4bcb62d833d828a5","1e98a8d79ed7afbd77f6536dd7b4398fsha256","4839c7e3dde1e707cb538ab301d792b3ad75b45b03c65a4a6095c2a65ce65c84","25109b11c5dd418ca98f7971b8cc4ded8b0cd446","bcf497379b84656ede89d562067d1cedsha256","09d6dab9b70a74f61c41eaa485b37de9a40c86b6d2eae7413db11b4e6a8256ef","46b02cc186b85e11c3d59790c3a0bfd2ae1f82a5","31e0439e6ef1dd29c0db6d96bac59446sha256")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("46cd508b7e77bb2c1d47f7fef0042a13c516f8163f9373ef9dfac180131c65ed","40b7b386c2c6944a6571c6dcfb23aaae026e8e82","f59d2a3c925f331aae7437dd7ac1a7c8sha256","e98c2fa10d77d345c960fc63436405a8b5024bd9b938a5962f70f66842e8b2cf","eaa8a81f8564b2da25b9d91797fda8e53fca93b8","a610664961870a1817df06f3eae1010bsha256","343cb2d5900f5fe4abd5442a4a18541753fbb6ca5ff4ee7f2c312ed96e413335","a074790705ecbede2e67cced4bcb62d833d828a5","1e98a8d79ed7afbd77f6536dd7b4398fsha256","4839c7e3dde1e707cb538ab301d792b3ad75b45b03c65a4a6095c2a65ce65c84","25109b11c5dd418ca98f7971b8cc4ded8b0cd446","bcf497379b84656ede89d562067d1cedsha256","09d6dab9b70a74f61c41eaa485b37de9a40c86b6d2eae7413db11b4e6a8256ef","46b02cc186b85e11c3d59790c3a0bfd2ae1f82a5","31e0439e6ef1dd29c0db6d96bac59446sha256")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring64 NOT NULL AND customstring64 IN ("46cd508b7e77bb2c1d47f7fef0042a13c516f8163f9373ef9dfac180131c65ed","40b7b386c2c6944a6571c6dcfb23aaae026e8e82","f59d2a3c925f331aae7437dd7ac1a7c8sha256","e98c2fa10d77d345c960fc63436405a8b5024bd9b938a5962f70f66842e8b2cf","eaa8a81f8564b2da25b9d91797fda8e53fca93b8","a610664961870a1817df06f3eae1010bsha256","343cb2d5900f5fe4abd5442a4a18541753fbb6ca5ff4ee7f2c312ed96e413335","a074790705ecbede2e67cced4bcb62d833d828a5","1e98a8d79ed7afbd77f6536dd7b4398fsha256","4839c7e3dde1e707cb538ab301d792b3ad75b45b03c65a4a6095c2a65ce65c84","25109b11c5dd418ca98f7971b8cc4ded8b0cd446","bcf497379b84656ede89d562067d1cedsha256","09d6dab9b70a74f61c41eaa485b37de9a40c86b6d2eae7413db11b4e6a8256ef","46b02cc186b85e11c3d59790c3a0bfd2ae1f82a5","31e0439e6ef1dd29c0db6d96bac59446sha256")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("46cd508b7e77bb2c1d47f7fef0042a13c516f8163f9373ef9dfac180131c65ed","40b7b386c2c6944a6571c6dcfb23aaae026e8e82","f59d2a3c925f331aae7437dd7ac1a7c8sha256","e98c2fa10d77d345c960fc63436405a8b5024bd9b938a5962f70f66842e8b2cf","eaa8a81f8564b2da25b9d91797fda8e53fca93b8","a610664961870a1817df06f3eae1010bsha256","343cb2d5900f5fe4abd5442a4a18541753fbb6ca5ff4ee7f2c312ed96e413335","a074790705ecbede2e67cced4bcb62d833d828a5","1e98a8d79ed7afbd77f6536dd7b4398fsha256","4839c7e3dde1e707cb538ab301d792b3ad75b45b03c65a4a6095c2a65ce65c84","25109b11c5dd418ca98f7971b8cc4ded8b0cd446","bcf497379b84656ede89d562067d1cedsha256","09d6dab9b70a74f61c41eaa485b37de9a40c86b6d2eae7413db11b4e6a8256ef","46b02cc186b85e11c3d59790c3a0bfd2ae1f82a5","31e0439e6ef1dd29c0db6d96bac59446sha256")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("46cd508b7e77bb2c1d47f7fef0042a13c516f8163f9373ef9dfac180131c65ed","40b7b386c2c6944a6571c6dcfb23aaae026e8e82","f59d2a3c925f331aae7437dd7ac1a7c8sha256","e98c2fa10d77d345c960fc63436405a8b5024bd9b938a5962f70f66842e8b2cf","eaa8a81f8564b2da25b9d91797fda8e53fca93b8","a610664961870a1817df06f3eae1010bsha256","343cb2d5900f5fe4abd5442a4a18541753fbb6ca5ff4ee7f2c312ed96e413335","a074790705ecbede2e67cced4bcb62d833d828a5","1e98a8d79ed7afbd77f6536dd7b4398fsha256","4839c7e3dde1e707cb538ab301d792b3ad75b45b03c65a4a6095c2a65ce65c84","25109b11c5dd418ca98f7971b8cc4ded8b0cd446","bcf497379b84656ede89d562067d1cedsha256","09d6dab9b70a74f61c41eaa485b37de9a40c86b6d2eae7413db11b4e6a8256ef","46b02cc186b85e11c3d59790c3a0bfd2ae1f82a5","31e0439e6ef1dd29c0db6d96bac59446sha256")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("46cd508b7e77bb2c1d47f7fef0042a13c516f8163f9373ef9dfac180131c65ed","40b7b386c2c6944a6571c6dcfb23aaae026e8e82","f59d2a3c925f331aae7437dd7ac1a7c8sha256","e98c2fa10d77d345c960fc63436405a8b5024bd9b938a5962f70f66842e8b2cf","eaa8a81f8564b2da25b9d91797fda8e53fca93b8","a610664961870a1817df06f3eae1010bsha256","343cb2d5900f5fe4abd5442a4a18541753fbb6ca5ff4ee7f2c312ed96e413335","a074790705ecbede2e67cced4bcb62d833d828a5","1e98a8d79ed7afbd77f6536dd7b4398fsha256","4839c7e3dde1e707cb538ab301d792b3ad75b45b03c65a4a6095c2a65ce65c84","25109b11c5dd418ca98f7971b8cc4ded8b0cd446","bcf497379b84656ede89d562067d1cedsha256","09d6dab9b70a74f61c41eaa485b37de9a40c86b6d2eae7413db11b4e6a8256ef","46b02cc186b85e11c3d59790c3a0bfd2ae1f82a5","31e0439e6ef1dd29c0db6d96bac59446sha256")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("46cd508b7e77bb2c1d47f7fef0042a13c516f8163f9373ef9dfac180131c65ed","40b7b386c2c6944a6571c6dcfb23aaae026e8e82","f59d2a3c925f331aae7437dd7ac1a7c8sha256","e98c2fa10d77d345c960fc63436405a8b5024bd9b938a5962f70f66842e8b2cf","eaa8a81f8564b2da25b9d91797fda8e53fca93b8","a610664961870a1817df06f3eae1010bsha256","343cb2d5900f5fe4abd5442a4a18541753fbb6ca5ff4ee7f2c312ed96e413335","a074790705ecbede2e67cced4bcb62d833d828a5","1e98a8d79ed7afbd77f6536dd7b4398fsha256","4839c7e3dde1e707cb538ab301d792b3ad75b45b03c65a4a6095c2a65ce65c84","25109b11c5dd418ca98f7971b8cc4ded8b0cd446","bcf497379b84656ede89d562067d1cedsha256","09d6dab9b70a74f61c41eaa485b37de9a40c86b6d2eae7413db11b4e6a8256ef","46b02cc186b85e11c3d59790c3a0bfd2ae1f82a5","31e0439e6ef1dd29c0db6d96bac59446sha256")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("46cd508b7e77bb2c1d47f7fef0042a13c516f8163f9373ef9dfac180131c65ed","40b7b386c2c6944a6571c6dcfb23aaae026e8e82","f59d2a3c925f331aae7437dd7ac1a7c8sha256","e98c2fa10d77d345c960fc63436405a8b5024bd9b938a5962f70f66842e8b2cf","eaa8a81f8564b2da25b9d91797fda8e53fca93b8","a610664961870a1817df06f3eae1010bsha256","343cb2d5900f5fe4abd5442a4a18541753fbb6ca5ff4ee7f2c312ed96e413335","a074790705ecbede2e67cced4bcb62d833d828a5","1e98a8d79ed7afbd77f6536dd7b4398fsha256","4839c7e3dde1e707cb538ab301d792b3ad75b45b03c65a4a6095c2a65ce65c84","25109b11c5dd418ca98f7971b8cc4ded8b0cd446","bcf497379b84656ede89d562067d1cedsha256","09d6dab9b70a74f61c41eaa485b37de9a40c86b6d2eae7413db11b4e6a8256ef","46b02cc186b85e11c3d59790c3a0bfd2ae1f82a5","31e0439e6ef1dd29c0db6d96bac59446sha256")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("46cd508b7e77bb2c1d47f7fef0042a13c516f8163f9373ef9dfac180131c65ed","40b7b386c2c6944a6571c6dcfb23aaae026e8e82","f59d2a3c925f331aae7437dd7ac1a7c8sha256","e98c2fa10d77d345c960fc63436405a8b5024bd9b938a5962f70f66842e8b2cf","eaa8a81f8564b2da25b9d91797fda8e53fca93b8","a610664961870a1817df06f3eae1010bsha256","343cb2d5900f5fe4abd5442a4a18541753fbb6ca5ff4ee7f2c312ed96e413335","a074790705ecbede2e67cced4bcb62d833d828a5","1e98a8d79ed7afbd77f6536dd7b4398fsha256","4839c7e3dde1e707cb538ab301d792b3ad75b45b03c65a4a6095c2a65ce65c84","25109b11c5dd418ca98f7971b8cc4ded8b0cd446","bcf497379b84656ede89d562067d1cedsha256","09d6dab9b70a74f61c41eaa485b37de9a40c86b6d2eae7413db11b4e6a8256ef","46b02cc186b85e11c3d59790c3a0bfd2ae1f82a5","31e0439e6ef1dd29c0db6d96bac59446sha256")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("46cd508b7e77bb2c1d47f7fef0042a13c516f8163f9373ef9dfac180131c65ed","40b7b386c2c6944a6571c6dcfb23aaae026e8e82","f59d2a3c925f331aae7437dd7ac1a7c8sha256","e98c2fa10d77d345c960fc63436405a8b5024bd9b938a5962f70f66842e8b2cf","eaa8a81f8564b2da25b9d91797fda8e53fca93b8","a610664961870a1817df06f3eae1010bsha256","343cb2d5900f5fe4abd5442a4a18541753fbb6ca5ff4ee7f2c312ed96e413335","a074790705ecbede2e67cced4bcb62d833d828a5","1e98a8d79ed7afbd77f6536dd7b4398fsha256","4839c7e3dde1e707cb538ab301d792b3ad75b45b03c65a4a6095c2a65ce65c84","25109b11c5dd418ca98f7971b8cc4ded8b0cd446","bcf497379b84656ede89d562067d1cedsha256","09d6dab9b70a74f61c41eaa485b37de9a40c86b6d2eae7413db11b4e6a8256ef","46b02cc186b85e11c3d59790c3a0bfd2ae1f82a5","31e0439e6ef1dd29c0db6d96bac59446sha256")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("46cd508b7e77bb2c1d47f7fef0042a13c516f8163f9373ef9dfac180131c65ed","40b7b386c2c6944a6571c6dcfb23aaae026e8e82","f59d2a3c925f331aae7437dd7ac1a7c8sha256","e98c2fa10d77d345c960fc63436405a8b5024bd9b938a5962f70f66842e8b2cf","eaa8a81f8564b2da25b9d91797fda8e53fca93b8","a610664961870a1817df06f3eae1010bsha256","343cb2d5900f5fe4abd5442a4a18541753fbb6ca5ff4ee7f2c312ed96e413335","a074790705ecbede2e67cced4bcb62d833d828a5","1e98a8d79ed7afbd77f6536dd7b4398fsha256","4839c7e3dde1e707cb538ab301d792b3ad75b45b03c65a4a6095c2a65ce65c84","25109b11c5dd418ca98f7971b8cc4ded8b0cd446","bcf497379b84656ede89d562067d1cedsha256","09d6dab9b70a74f61c41eaa485b37de9a40c86b6d2eae7413db11b4e6a8256ef","46b02cc186b85e11c3d59790c3a0bfd2ae1f82a5","31e0439e6ef1dd29c0db6d96bac59446sha256")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("46cd508b7e77bb2c1d47f7fef0042a13c516f8163f9373ef9dfac180131c65ed","40b7b386c2c6944a6571c6dcfb23aaae026e8e82","f59d2a3c925f331aae7437dd7ac1a7c8sha256","e98c2fa10d77d345c960fc63436405a8b5024bd9b938a5962f70f66842e8b2cf","eaa8a81f8564b2da25b9d91797fda8e53fca93b8","a610664961870a1817df06f3eae1010bsha256","343cb2d5900f5fe4abd5442a4a18541753fbb6ca5ff4ee7f2c312ed96e413335","a074790705ecbede2e67cced4bcb62d833d828a5","1e98a8d79ed7afbd77f6536dd7b4398fsha256","4839c7e3dde1e707cb538ab301d792b3ad75b45b03c65a4a6095c2a65ce65c84","25109b11c5dd418ca98f7971b8cc4ded8b0cd446","bcf497379b84656ede89d562067d1cedsha256","09d6dab9b70a74f61c41eaa485b37de9a40c86b6d2eae7413db11b4e6a8256ef","46b02cc186b85e11c3d59790c3a0bfd2ae1f82a5","31e0439e6ef1dd29c0db6d96bac59446sha256")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("46cd508b7e77bb2c1d47f7fef0042a13c516f8163f9373ef9dfac180131c65ed","40b7b386c2c6944a6571c6dcfb23aaae026e8e82","f59d2a3c925f331aae7437dd7ac1a7c8sha256","e98c2fa10d77d345c960fc63436405a8b5024bd9b938a5962f70f66842e8b2cf","eaa8a81f8564b2da25b9d91797fda8e53fca93b8","a610664961870a1817df06f3eae1010bsha256","343cb2d5900f5fe4abd5442a4a18541753fbb6ca5ff4ee7f2c312ed96e413335","a074790705ecbede2e67cced4bcb62d833d828a5","1e98a8d79ed7afbd77f6536dd7b4398fsha256","4839c7e3dde1e707cb538ab301d792b3ad75b45b03c65a4a6095c2a65ce65c84","25109b11c5dd418ca98f7971b8cc4ded8b0cd446","bcf497379b84656ede89d562067d1cedsha256","09d6dab9b70a74f61c41eaa485b37de9a40c86b6d2eae7413db11b4e6a8256ef","46b02cc186b85e11c3d59790c3a0bfd2ae1f82a5","31e0439e6ef1dd29c0db6d96bac59446sha256")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("46cd508b7e77bb2c1d47f7fef0042a13c516f8163f9373ef9dfac180131c65ed","40b7b386c2c6944a6571c6dcfb23aaae026e8e82","f59d2a3c925f331aae7437dd7ac1a7c8sha256","e98c2fa10d77d345c960fc63436405a8b5024bd9b938a5962f70f66842e8b2cf","eaa8a81f8564b2da25b9d91797fda8e53fca93b8","a610664961870a1817df06f3eae1010bsha256","343cb2d5900f5fe4abd5442a4a18541753fbb6ca5ff4ee7f2c312ed96e413335","a074790705ecbede2e67cced4bcb62d833d828a5","1e98a8d79ed7afbd77f6536dd7b4398fsha256","4839c7e3dde1e707cb538ab301d792b3ad75b45b03c65a4a6095c2a65ce65c84","25109b11c5dd418ca98f7971b8cc4ded8b0cd446","bcf497379b84656ede89d562067d1cedsha256","09d6dab9b70a74f61c41eaa485b37de9a40c86b6d2eae7413db11b4e6a8256ef","46b02cc186b85e11c3d59790c3a0bfd2ae1f82a5","31e0439e6ef1dd29c0db6d96bac59446sha256")
index=activity AND rg_functionality="Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("46cd508b7e77bb2c1d47f7fef0042a13c516f8163f9373ef9dfac180131c65ed","40b7b386c2c6944a6571c6dcfb23aaae026e8e82","f59d2a3c925f331aae7437dd7ac1a7c8sha256","e98c2fa10d77d345c960fc63436405a8b5024bd9b938a5962f70f66842e8b2cf","eaa8a81f8564b2da25b9d91797fda8e53fca93b8","a610664961870a1817df06f3eae1010bsha256","343cb2d5900f5fe4abd5442a4a18541753fbb6ca5ff4ee7f2c312ed96e413335","a074790705ecbede2e67cced4bcb62d833d828a5","1e98a8d79ed7afbd77f6536dd7b4398fsha256","4839c7e3dde1e707cb538ab301d792b3ad75b45b03c65a4a6095c2a65ce65c84","25109b11c5dd418ca98f7971b8cc4ded8b0cd446","bcf497379b84656ede89d562067d1cedsha256","09d6dab9b70a74f61c41eaa485b37de9a40c86b6d2eae7413db11b4e6a8256ef","46b02cc186b85e11c3d59790c3a0bfd2ae1f82a5","31e0439e6ef1dd29c0db6d96bac59446sha256")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("46cd508b7e77bb2c1d47f7fef0042a13c516f8163f9373ef9dfac180131c65ed","40b7b386c2c6944a6571c6dcfb23aaae026e8e82","f59d2a3c925f331aae7437dd7ac1a7c8sha256","e98c2fa10d77d345c960fc63436405a8b5024bd9b938a5962f70f66842e8b2cf","eaa8a81f8564b2da25b9d91797fda8e53fca93b8","a610664961870a1817df06f3eae1010bsha256","343cb2d5900f5fe4abd5442a4a18541753fbb6ca5ff4ee7f2c312ed96e413335","a074790705ecbede2e67cced4bcb62d833d828a5","1e98a8d79ed7afbd77f6536dd7b4398fsha256","4839c7e3dde1e707cb538ab301d792b3ad75b45b03c65a4a6095c2a65ce65c84","25109b11c5dd418ca98f7971b8cc4ded8b0cd446","bcf497379b84656ede89d562067d1cedsha256","09d6dab9b70a74f61c41eaa485b37de9a40c86b6d2eae7413db11b4e6a8256ef","46b02cc186b85e11c3d59790c3a0bfd2ae1f82a5","31e0439e6ef1dd29c0db6d96bac59446sha256")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("46cd508b7e77bb2c1d47f7fef0042a13c516f8163f9373ef9dfac180131c65ed","40b7b386c2c6944a6571c6dcfb23aaae026e8e82","f59d2a3c925f331aae7437dd7ac1a7c8sha256","e98c2fa10d77d345c960fc63436405a8b5024bd9b938a5962f70f66842e8b2cf","eaa8a81f8564b2da25b9d91797fda8e53fca93b8","a610664961870a1817df06f3eae1010bsha256","343cb2d5900f5fe4abd5442a4a18541753fbb6ca5ff4ee7f2c312ed96e413335","a074790705ecbede2e67cced4bcb62d833d828a5","1e98a8d79ed7afbd77f6536dd7b4398fsha256","4839c7e3dde1e707cb538ab301d792b3ad75b45b03c65a4a6095c2a65ce65c84","25109b11c5dd418ca98f7971b8cc4ded8b0cd446","bcf497379b84656ede89d562067d1cedsha256","09d6dab9b70a74f61c41eaa485b37de9a40c86b6d2eae7413db11b4e6a8256ef","46b02cc186b85e11c3d59790c3a0bfd2ae1f82a5","31e0439e6ef1dd29c0db6d96bac59446sha256")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("46cd508b7e77bb2c1d47f7fef0042a13c516f8163f9373ef9dfac180131c65ed","40b7b386c2c6944a6571c6dcfb23aaae026e8e82","f59d2a3c925f331aae7437dd7ac1a7c8sha256","e98c2fa10d77d345c960fc63436405a8b5024bd9b938a5962f70f66842e8b2cf","eaa8a81f8564b2da25b9d91797fda8e53fca93b8","a610664961870a1817df06f3eae1010bsha256","343cb2d5900f5fe4abd5442a4a18541753fbb6ca5ff4ee7f2c312ed96e413335","a074790705ecbede2e67cced4bcb62d833d828a5","1e98a8d79ed7afbd77f6536dd7b4398fsha256","4839c7e3dde1e707cb538ab301d792b3ad75b45b03c65a4a6095c2a65ce65c84","25109b11c5dd418ca98f7971b8cc4ded8b0cd446","bcf497379b84656ede89d562067d1cedsha256","09d6dab9b70a74f61c41eaa485b37de9a40c86b6d2eae7413db11b4e6a8256ef","46b02cc186b85e11c3d59790c3a0bfd2ae1f82a5","31e0439e6ef1dd29c0db6d96bac59446sha256")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("46cd508b7e77bb2c1d47f7fef0042a13c516f8163f9373ef9dfac180131c65ed","40b7b386c2c6944a6571c6dcfb23aaae026e8e82","f59d2a3c925f331aae7437dd7ac1a7c8sha256","e98c2fa10d77d345c960fc63436405a8b5024bd9b938a5962f70f66842e8b2cf","eaa8a81f8564b2da25b9d91797fda8e53fca93b8","a610664961870a1817df06f3eae1010bsha256","343cb2d5900f5fe4abd5442a4a18541753fbb6ca5ff4ee7f2c312ed96e413335","a074790705ecbede2e67cced4bcb62d833d828a5","1e98a8d79ed7afbd77f6536dd7b4398fsha256","4839c7e3dde1e707cb538ab301d792b3ad75b45b03c65a4a6095c2a65ce65c84","25109b11c5dd418ca98f7971b8cc4ded8b0cd446","bcf497379b84656ede89d562067d1cedsha256","09d6dab9b70a74f61c41eaa485b37de9a40c86b6d2eae7413db11b4e6a8256ef","46b02cc186b85e11c3d59790c3a0bfd2ae1f82a5","31e0439e6ef1dd29c0db6d96bac59446sha256")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("46cd508b7e77bb2c1d47f7fef0042a13c516f8163f9373ef9dfac180131c65ed","40b7b386c2c6944a6571c6dcfb23aaae026e8e82","f59d2a3c925f331aae7437dd7ac1a7c8sha256","e98c2fa10d77d345c960fc63436405a8b5024bd9b938a5962f70f66842e8b2cf","eaa8a81f8564b2da25b9d91797fda8e53fca93b8","a610664961870a1817df06f3eae1010bsha256","343cb2d5900f5fe4abd5442a4a18541753fbb6ca5ff4ee7f2c312ed96e413335","a074790705ecbede2e67cced4bcb62d833d828a5","1e98a8d79ed7afbd77f6536dd7b4398fsha256","4839c7e3dde1e707cb538ab301d792b3ad75b45b03c65a4a6095c2a65ce65c84","25109b11c5dd418ca98f7971b8cc4ded8b0cd446","bcf497379b84656ede89d562067d1cedsha256","09d6dab9b70a74f61c41eaa485b37de9a40c86b6d2eae7413db11b4e6a8256ef","46b02cc186b85e11c3d59790c3a0bfd2ae1f82a5","31e0439e6ef1dd29c0db6d96bac59446sha256")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("46cd508b7e77bb2c1d47f7fef0042a13c516f8163f9373ef9dfac180131c65ed","40b7b386c2c6944a6571c6dcfb23aaae026e8e82","f59d2a3c925f331aae7437dd7ac1a7c8sha256","e98c2fa10d77d345c960fc63436405a8b5024bd9b938a5962f70f66842e8b2cf","eaa8a81f8564b2da25b9d91797fda8e53fca93b8","a610664961870a1817df06f3eae1010bsha256","343cb2d5900f5fe4abd5442a4a18541753fbb6ca5ff4ee7f2c312ed96e413335","a074790705ecbede2e67cced4bcb62d833d828a5","1e98a8d79ed7afbd77f6536dd7b4398fsha256","4839c7e3dde1e707cb538ab301d792b3ad75b45b03c65a4a6095c2a65ce65c84","25109b11c5dd418ca98f7971b8cc4ded8b0cd446","bcf497379b84656ede89d562067d1cedsha256","09d6dab9b70a74f61c41eaa485b37de9a40c86b6d2eae7413db11b4e6a8256ef","46b02cc186b85e11c3d59790c3a0bfd2ae1f82a5","31e0439e6ef1dd29c0db6d96bac59446sha256")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("46cd508b7e77bb2c1d47f7fef0042a13c516f8163f9373ef9dfac180131c65ed","40b7b386c2c6944a6571c6dcfb23aaae026e8e82","f59d2a3c925f331aae7437dd7ac1a7c8sha256","e98c2fa10d77d345c960fc63436405a8b5024bd9b938a5962f70f66842e8b2cf","eaa8a81f8564b2da25b9d91797fda8e53fca93b8","a610664961870a1817df06f3eae1010bsha256","343cb2d5900f5fe4abd5442a4a18541753fbb6ca5ff4ee7f2c312ed96e413335","a074790705ecbede2e67cced4bcb62d833d828a5","1e98a8d79ed7afbd77f6536dd7b4398fsha256","4839c7e3dde1e707cb538ab301d792b3ad75b45b03c65a4a6095c2a65ce65c84","25109b11c5dd418ca98f7971b8cc4ded8b0cd446","bcf497379b84656ede89d562067d1cedsha256","09d6dab9b70a74f61c41eaa485b37de9a40c86b6d2eae7413db11b4e6a8256ef","46b02cc186b85e11c3d59790c3a0bfd2ae1f82a5","31e0439e6ef1dd29c0db6d96bac59446sha256")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring64 NOT NULL AND customstring64 IN ("46cd508b7e77bb2c1d47f7fef0042a13c516f8163f9373ef9dfac180131c65ed","40b7b386c2c6944a6571c6dcfb23aaae026e8e82","f59d2a3c925f331aae7437dd7ac1a7c8sha256","e98c2fa10d77d345c960fc63436405a8b5024bd9b938a5962f70f66842e8b2cf","eaa8a81f8564b2da25b9d91797fda8e53fca93b8","a610664961870a1817df06f3eae1010bsha256","343cb2d5900f5fe4abd5442a4a18541753fbb6ca5ff4ee7f2c312ed96e413335","a074790705ecbede2e67cced4bcb62d833d828a5","1e98a8d79ed7afbd77f6536dd7b4398fsha256","4839c7e3dde1e707cb538ab301d792b3ad75b45b03c65a4a6095c2a65ce65c84","25109b11c5dd418ca98f7971b8cc4ded8b0cd446","bcf497379b84656ede89d562067d1cedsha256","09d6dab9b70a74f61c41eaa485b37de9a40c86b6d2eae7413db11b4e6a8256ef","46b02cc186b85e11c3d59790c3a0bfd2ae1f82a5","31e0439e6ef1dd29c0db6d96bac59446sha256")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("46cd508b7e77bb2c1d47f7fef0042a13c516f8163f9373ef9dfac180131c65ed","40b7b386c2c6944a6571c6dcfb23aaae026e8e82","f59d2a3c925f331aae7437dd7ac1a7c8sha256","e98c2fa10d77d345c960fc63436405a8b5024bd9b938a5962f70f66842e8b2cf","eaa8a81f8564b2da25b9d91797fda8e53fca93b8","a610664961870a1817df06f3eae1010bsha256","343cb2d5900f5fe4abd5442a4a18541753fbb6ca5ff4ee7f2c312ed96e413335","a074790705ecbede2e67cced4bcb62d833d828a5","1e98a8d79ed7afbd77f6536dd7b4398fsha256","4839c7e3dde1e707cb538ab301d792b3ad75b45b03c65a4a6095c2a65ce65c84","25109b11c5dd418ca98f7971b8cc4ded8b0cd446","bcf497379b84656ede89d562067d1cedsha256","09d6dab9b70a74f61c41eaa485b37de9a40c86b6d2eae7413db11b4e6a8256ef","46b02cc186b85e11c3d59790c3a0bfd2ae1f82a5","31e0439e6ef1dd29c0db6d96bac59446sha256")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("46cd508b7e77bb2c1d47f7fef0042a13c516f8163f9373ef9dfac180131c65ed","40b7b386c2c6944a6571c6dcfb23aaae026e8e82","f59d2a3c925f331aae7437dd7ac1a7c8sha256","e98c2fa10d77d345c960fc63436405a8b5024bd9b938a5962f70f66842e8b2cf","eaa8a81f8564b2da25b9d91797fda8e53fca93b8","a610664961870a1817df06f3eae1010bsha256","343cb2d5900f5fe4abd5442a4a18541753fbb6ca5ff4ee7f2c312ed96e413335","a074790705ecbede2e67cced4bcb62d833d828a5","1e98a8d79ed7afbd77f6536dd7b4398fsha256","4839c7e3dde1e707cb538ab301d792b3ad75b45b03c65a4a6095c2a65ce65c84","25109b11c5dd418ca98f7971b8cc4ded8b0cd446","bcf497379b84656ede89d562067d1cedsha256","09d6dab9b70a74f61c41eaa485b37de9a40c86b6d2eae7413db11b4e6a8256ef","46b02cc186b85e11c3d59790c3a0bfd2ae1f82a5","31e0439e6ef1dd29c0db6d96bac59446sha256")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("46cd508b7e77bb2c1d47f7fef0042a13c516f8163f9373ef9dfac180131c65ed","40b7b386c2c6944a6571c6dcfb23aaae026e8e82","f59d2a3c925f331aae7437dd7ac1a7c8sha256","e98c2fa10d77d345c960fc63436405a8b5024bd9b938a5962f70f66842e8b2cf","eaa8a81f8564b2da25b9d91797fda8e53fca93b8","a610664961870a1817df06f3eae1010bsha256","343cb2d5900f5fe4abd5442a4a18541753fbb6ca5ff4ee7f2c312ed96e413335","a074790705ecbede2e67cced4bcb62d833d828a5","1e98a8d79ed7afbd77f6536dd7b4398fsha256","4839c7e3dde1e707cb538ab301d792b3ad75b45b03c65a4a6095c2a65ce65c84","25109b11c5dd418ca98f7971b8cc4ded8b0cd446","bcf497379b84656ede89d562067d1cedsha256","09d6dab9b70a74f61c41eaa485b37de9a40c86b6d2eae7413db11b4e6a8256ef","46b02cc186b85e11c3d59790c3a0bfd2ae1f82a5","31e0439e6ef1dd29c0db6d96bac59446sha256")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring64 NOT NULL AND customstring64 IN ("46cd508b7e77bb2c1d47f7fef0042a13c516f8163f9373ef9dfac180131c65ed","40b7b386c2c6944a6571c6dcfb23aaae026e8e82","f59d2a3c925f331aae7437dd7ac1a7c8sha256","e98c2fa10d77d345c960fc63436405a8b5024bd9b938a5962f70f66842e8b2cf","eaa8a81f8564b2da25b9d91797fda8e53fca93b8","a610664961870a1817df06f3eae1010bsha256","343cb2d5900f5fe4abd5442a4a18541753fbb6ca5ff4ee7f2c312ed96e413335","a074790705ecbede2e67cced4bcb62d833d828a5","1e98a8d79ed7afbd77f6536dd7b4398fsha256","4839c7e3dde1e707cb538ab301d792b3ad75b45b03c65a4a6095c2a65ce65c84","25109b11c5dd418ca98f7971b8cc4ded8b0cd446","bcf497379b84656ede89d562067d1cedsha256","09d6dab9b70a74f61c41eaa485b37de9a40c86b6d2eae7413db11b4e6a8256ef","46b02cc186b85e11c3d59790c3a0bfd2ae1f82a5","31e0439e6ef1dd29c0db6d96bac59446sha256")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("46cd508b7e77bb2c1d47f7fef0042a13c516f8163f9373ef9dfac180131c65ed","40b7b386c2c6944a6571c6dcfb23aaae026e8e82","f59d2a3c925f331aae7437dd7ac1a7c8sha256","e98c2fa10d77d345c960fc63436405a8b5024bd9b938a5962f70f66842e8b2cf","eaa8a81f8564b2da25b9d91797fda8e53fca93b8","a610664961870a1817df06f3eae1010bsha256","343cb2d5900f5fe4abd5442a4a18541753fbb6ca5ff4ee7f2c312ed96e413335","a074790705ecbede2e67cced4bcb62d833d828a5","1e98a8d79ed7afbd77f6536dd7b4398fsha256","4839c7e3dde1e707cb538ab301d792b3ad75b45b03c65a4a6095c2a65ce65c84","25109b11c5dd418ca98f7971b8cc4ded8b0cd446","bcf497379b84656ede89d562067d1cedsha256","09d6dab9b70a74f61c41eaa485b37de9a40c86b6d2eae7413db11b4e6a8256ef","46b02cc186b85e11c3d59790c3a0bfd2ae1f82a5","31e0439e6ef1dd29c0db6d96bac59446sha256")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("46cd508b7e77bb2c1d47f7fef0042a13c516f8163f9373ef9dfac180131c65ed","40b7b386c2c6944a6571c6dcfb23aaae026e8e82","f59d2a3c925f331aae7437dd7ac1a7c8sha256","e98c2fa10d77d345c960fc63436405a8b5024bd9b938a5962f70f66842e8b2cf","eaa8a81f8564b2da25b9d91797fda8e53fca93b8","a610664961870a1817df06f3eae1010bsha256","343cb2d5900f5fe4abd5442a4a18541753fbb6ca5ff4ee7f2c312ed96e413335","a074790705ecbede2e67cced4bcb62d833d828a5","1e98a8d79ed7afbd77f6536dd7b4398fsha256","4839c7e3dde1e707cb538ab301d792b3ad75b45b03c65a4a6095c2a65ce65c84","25109b11c5dd418ca98f7971b8cc4ded8b0cd446","bcf497379b84656ede89d562067d1cedsha256","09d6dab9b70a74f61c41eaa485b37de9a40c86b6d2eae7413db11b4e6a8256ef","46b02cc186b85e11c3d59790c3a0bfd2ae1f82a5","31e0439e6ef1dd29c0db6d96bac59446sha256")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("46cd508b7e77bb2c1d47f7fef0042a13c516f8163f9373ef9dfac180131c65ed","40b7b386c2c6944a6571c6dcfb23aaae026e8e82","f59d2a3c925f331aae7437dd7ac1a7c8sha256","e98c2fa10d77d345c960fc63436405a8b5024bd9b938a5962f70f66842e8b2cf","eaa8a81f8564b2da25b9d91797fda8e53fca93b8","a610664961870a1817df06f3eae1010bsha256","343cb2d5900f5fe4abd5442a4a18541753fbb6ca5ff4ee7f2c312ed96e413335","a074790705ecbede2e67cced4bcb62d833d828a5","1e98a8d79ed7afbd77f6536dd7b4398fsha256","4839c7e3dde1e707cb538ab301d792b3ad75b45b03c65a4a6095c2a65ce65c84","25109b11c5dd418ca98f7971b8cc4ded8b0cd446","bcf497379b84656ede89d562067d1cedsha256","09d6dab9b70a74f61c41eaa485b37de9a40c86b6d2eae7413db11b4e6a8256ef","46b02cc186b85e11c3d59790c3a0bfd2ae1f82a5","31e0439e6ef1dd29c0db6d96bac59446sha256")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring64 NOT NULL AND customstring64 IN ("46cd508b7e77bb2c1d47f7fef0042a13c516f8163f9373ef9dfac180131c65ed","40b7b386c2c6944a6571c6dcfb23aaae026e8e82","f59d2a3c925f331aae7437dd7ac1a7c8sha256","e98c2fa10d77d345c960fc63436405a8b5024bd9b938a5962f70f66842e8b2cf","eaa8a81f8564b2da25b9d91797fda8e53fca93b8","a610664961870a1817df06f3eae1010bsha256","343cb2d5900f5fe4abd5442a4a18541753fbb6ca5ff4ee7f2c312ed96e413335","a074790705ecbede2e67cced4bcb62d833d828a5","1e98a8d79ed7afbd77f6536dd7b4398fsha256","4839c7e3dde1e707cb538ab301d792b3ad75b45b03c65a4a6095c2a65ce65c84","25109b11c5dd418ca98f7971b8cc4ded8b0cd446","bcf497379b84656ede89d562067d1cedsha256","09d6dab9b70a74f61c41eaa485b37de9a40c86b6d2eae7413db11b4e6a8256ef","46b02cc186b85e11c3d59790c3a0bfd2ae1f82a5","31e0439e6ef1dd29c0db6d96bac59446sha256")
