index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("eefa1271d1a2a937d0baa3f0c7d904941151d6c8f915aed4dd51f10fa5d09b2a","d9a3f2ad7cfc6989cc4da117d5a4f8097362aad6b91391e89746d68d8d7aa29f","9092ef0beeef1b147c13da3f3259f4a075f3bfb2414c39f9108395435ac9887c")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("eefa1271d1a2a937d0baa3f0c7d904941151d6c8f915aed4dd51f10fa5d09b2a","d9a3f2ad7cfc6989cc4da117d5a4f8097362aad6b91391e89746d68d8d7aa29f","9092ef0beeef1b147c13da3f3259f4a075f3bfb2414c39f9108395435ac9887c")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("eefa1271d1a2a937d0baa3f0c7d904941151d6c8f915aed4dd51f10fa5d09b2a","d9a3f2ad7cfc6989cc4da117d5a4f8097362aad6b91391e89746d68d8d7aa29f","9092ef0beeef1b147c13da3f3259f4a075f3bfb2414c39f9108395435ac9887c")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring64 NOT NULL AND customstring64 IN ("eefa1271d1a2a937d0baa3f0c7d904941151d6c8f915aed4dd51f10fa5d09b2a","d9a3f2ad7cfc6989cc4da117d5a4f8097362aad6b91391e89746d68d8d7aa29f","9092ef0beeef1b147c13da3f3259f4a075f3bfb2414c39f9108395435ac9887c")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("eefa1271d1a2a937d0baa3f0c7d904941151d6c8f915aed4dd51f10fa5d09b2a","d9a3f2ad7cfc6989cc4da117d5a4f8097362aad6b91391e89746d68d8d7aa29f","9092ef0beeef1b147c13da3f3259f4a075f3bfb2414c39f9108395435ac9887c")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("eefa1271d1a2a937d0baa3f0c7d904941151d6c8f915aed4dd51f10fa5d09b2a","d9a3f2ad7cfc6989cc4da117d5a4f8097362aad6b91391e89746d68d8d7aa29f","9092ef0beeef1b147c13da3f3259f4a075f3bfb2414c39f9108395435ac9887c")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("eefa1271d1a2a937d0baa3f0c7d904941151d6c8f915aed4dd51f10fa5d09b2a","d9a3f2ad7cfc6989cc4da117d5a4f8097362aad6b91391e89746d68d8d7aa29f","9092ef0beeef1b147c13da3f3259f4a075f3bfb2414c39f9108395435ac9887c")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("eefa1271d1a2a937d0baa3f0c7d904941151d6c8f915aed4dd51f10fa5d09b2a","d9a3f2ad7cfc6989cc4da117d5a4f8097362aad6b91391e89746d68d8d7aa29f","9092ef0beeef1b147c13da3f3259f4a075f3bfb2414c39f9108395435ac9887c")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("eefa1271d1a2a937d0baa3f0c7d904941151d6c8f915aed4dd51f10fa5d09b2a","d9a3f2ad7cfc6989cc4da117d5a4f8097362aad6b91391e89746d68d8d7aa29f","9092ef0beeef1b147c13da3f3259f4a075f3bfb2414c39f9108395435ac9887c")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("eefa1271d1a2a937d0baa3f0c7d904941151d6c8f915aed4dd51f10fa5d09b2a","d9a3f2ad7cfc6989cc4da117d5a4f8097362aad6b91391e89746d68d8d7aa29f","9092ef0beeef1b147c13da3f3259f4a075f3bfb2414c39f9108395435ac9887c")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("eefa1271d1a2a937d0baa3f0c7d904941151d6c8f915aed4dd51f10fa5d09b2a","d9a3f2ad7cfc6989cc4da117d5a4f8097362aad6b91391e89746d68d8d7aa29f","9092ef0beeef1b147c13da3f3259f4a075f3bfb2414c39f9108395435ac9887c")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("eefa1271d1a2a937d0baa3f0c7d904941151d6c8f915aed4dd51f10fa5d09b2a","d9a3f2ad7cfc6989cc4da117d5a4f8097362aad6b91391e89746d68d8d7aa29f","9092ef0beeef1b147c13da3f3259f4a075f3bfb2414c39f9108395435ac9887c")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("eefa1271d1a2a937d0baa3f0c7d904941151d6c8f915aed4dd51f10fa5d09b2a","d9a3f2ad7cfc6989cc4da117d5a4f8097362aad6b91391e89746d68d8d7aa29f","9092ef0beeef1b147c13da3f3259f4a075f3bfb2414c39f9108395435ac9887c")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("eefa1271d1a2a937d0baa3f0c7d904941151d6c8f915aed4dd51f10fa5d09b2a","d9a3f2ad7cfc6989cc4da117d5a4f8097362aad6b91391e89746d68d8d7aa29f","9092ef0beeef1b147c13da3f3259f4a075f3bfb2414c39f9108395435ac9887c")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("eefa1271d1a2a937d0baa3f0c7d904941151d6c8f915aed4dd51f10fa5d09b2a","d9a3f2ad7cfc6989cc4da117d5a4f8097362aad6b91391e89746d68d8d7aa29f","9092ef0beeef1b147c13da3f3259f4a075f3bfb2414c39f9108395435ac9887c")
index=activity AND rg_functionality="Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("eefa1271d1a2a937d0baa3f0c7d904941151d6c8f915aed4dd51f10fa5d09b2a","d9a3f2ad7cfc6989cc4da117d5a4f8097362aad6b91391e89746d68d8d7aa29f","9092ef0beeef1b147c13da3f3259f4a075f3bfb2414c39f9108395435ac9887c")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("eefa1271d1a2a937d0baa3f0c7d904941151d6c8f915aed4dd51f10fa5d09b2a","d9a3f2ad7cfc6989cc4da117d5a4f8097362aad6b91391e89746d68d8d7aa29f","9092ef0beeef1b147c13da3f3259f4a075f3bfb2414c39f9108395435ac9887c")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("eefa1271d1a2a937d0baa3f0c7d904941151d6c8f915aed4dd51f10fa5d09b2a","d9a3f2ad7cfc6989cc4da117d5a4f8097362aad6b91391e89746d68d8d7aa29f","9092ef0beeef1b147c13da3f3259f4a075f3bfb2414c39f9108395435ac9887c")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("eefa1271d1a2a937d0baa3f0c7d904941151d6c8f915aed4dd51f10fa5d09b2a","d9a3f2ad7cfc6989cc4da117d5a4f8097362aad6b91391e89746d68d8d7aa29f","9092ef0beeef1b147c13da3f3259f4a075f3bfb2414c39f9108395435ac9887c")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("eefa1271d1a2a937d0baa3f0c7d904941151d6c8f915aed4dd51f10fa5d09b2a","d9a3f2ad7cfc6989cc4da117d5a4f8097362aad6b91391e89746d68d8d7aa29f","9092ef0beeef1b147c13da3f3259f4a075f3bfb2414c39f9108395435ac9887c")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("eefa1271d1a2a937d0baa3f0c7d904941151d6c8f915aed4dd51f10fa5d09b2a","d9a3f2ad7cfc6989cc4da117d5a4f8097362aad6b91391e89746d68d8d7aa29f","9092ef0beeef1b147c13da3f3259f4a075f3bfb2414c39f9108395435ac9887c")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("eefa1271d1a2a937d0baa3f0c7d904941151d6c8f915aed4dd51f10fa5d09b2a","d9a3f2ad7cfc6989cc4da117d5a4f8097362aad6b91391e89746d68d8d7aa29f","9092ef0beeef1b147c13da3f3259f4a075f3bfb2414c39f9108395435ac9887c")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("eefa1271d1a2a937d0baa3f0c7d904941151d6c8f915aed4dd51f10fa5d09b2a","d9a3f2ad7cfc6989cc4da117d5a4f8097362aad6b91391e89746d68d8d7aa29f","9092ef0beeef1b147c13da3f3259f4a075f3bfb2414c39f9108395435ac9887c")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring64 NOT NULL AND customstring64 IN ("eefa1271d1a2a937d0baa3f0c7d904941151d6c8f915aed4dd51f10fa5d09b2a","d9a3f2ad7cfc6989cc4da117d5a4f8097362aad6b91391e89746d68d8d7aa29f","9092ef0beeef1b147c13da3f3259f4a075f3bfb2414c39f9108395435ac9887c")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("eefa1271d1a2a937d0baa3f0c7d904941151d6c8f915aed4dd51f10fa5d09b2a","d9a3f2ad7cfc6989cc4da117d5a4f8097362aad6b91391e89746d68d8d7aa29f","9092ef0beeef1b147c13da3f3259f4a075f3bfb2414c39f9108395435ac9887c")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("eefa1271d1a2a937d0baa3f0c7d904941151d6c8f915aed4dd51f10fa5d09b2a","d9a3f2ad7cfc6989cc4da117d5a4f8097362aad6b91391e89746d68d8d7aa29f","9092ef0beeef1b147c13da3f3259f4a075f3bfb2414c39f9108395435ac9887c")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("eefa1271d1a2a937d0baa3f0c7d904941151d6c8f915aed4dd51f10fa5d09b2a","d9a3f2ad7cfc6989cc4da117d5a4f8097362aad6b91391e89746d68d8d7aa29f","9092ef0beeef1b147c13da3f3259f4a075f3bfb2414c39f9108395435ac9887c")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring64 NOT NULL AND customstring64 IN ("eefa1271d1a2a937d0baa3f0c7d904941151d6c8f915aed4dd51f10fa5d09b2a","d9a3f2ad7cfc6989cc4da117d5a4f8097362aad6b91391e89746d68d8d7aa29f","9092ef0beeef1b147c13da3f3259f4a075f3bfb2414c39f9108395435ac9887c")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("eefa1271d1a2a937d0baa3f0c7d904941151d6c8f915aed4dd51f10fa5d09b2a","d9a3f2ad7cfc6989cc4da117d5a4f8097362aad6b91391e89746d68d8d7aa29f","9092ef0beeef1b147c13da3f3259f4a075f3bfb2414c39f9108395435ac9887c")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("eefa1271d1a2a937d0baa3f0c7d904941151d6c8f915aed4dd51f10fa5d09b2a","d9a3f2ad7cfc6989cc4da117d5a4f8097362aad6b91391e89746d68d8d7aa29f","9092ef0beeef1b147c13da3f3259f4a075f3bfb2414c39f9108395435ac9887c")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("eefa1271d1a2a937d0baa3f0c7d904941151d6c8f915aed4dd51f10fa5d09b2a","d9a3f2ad7cfc6989cc4da117d5a4f8097362aad6b91391e89746d68d8d7aa29f","9092ef0beeef1b147c13da3f3259f4a075f3bfb2414c39f9108395435ac9887c")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring64 NOT NULL AND customstring64 IN ("eefa1271d1a2a937d0baa3f0c7d904941151d6c8f915aed4dd51f10fa5d09b2a","d9a3f2ad7cfc6989cc4da117d5a4f8097362aad6b91391e89746d68d8d7aa29f","9092ef0beeef1b147c13da3f3259f4a075f3bfb2414c39f9108395435ac9887c")
