index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("3b55904d3b37c810fc230b991a257939","2e4c626e67df46b2a7258e73c04c4f73","b1095d0837dd11b5280fcb29b5a1bb84","18baedf43f4a68455e8d36b657aff03c","d75e1c01c59b63d73f22e84a8a8819bf","6ff538dfd4b6a6fa796ea74eed50c80e","e93eda81803040e70d64168c8a83228f","2442ff56720d1887cb46dd37ed732407","4704cd96029606d6f501826d41805486","0b53120151a20a46edf3ef85b8ac450f")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("3b55904d3b37c810fc230b991a257939","2e4c626e67df46b2a7258e73c04c4f73","b1095d0837dd11b5280fcb29b5a1bb84","18baedf43f4a68455e8d36b657aff03c","d75e1c01c59b63d73f22e84a8a8819bf","6ff538dfd4b6a6fa796ea74eed50c80e","e93eda81803040e70d64168c8a83228f","2442ff56720d1887cb46dd37ed732407","4704cd96029606d6f501826d41805486","0b53120151a20a46edf3ef85b8ac450f")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("3b55904d3b37c810fc230b991a257939","2e4c626e67df46b2a7258e73c04c4f73","b1095d0837dd11b5280fcb29b5a1bb84","18baedf43f4a68455e8d36b657aff03c","d75e1c01c59b63d73f22e84a8a8819bf","6ff538dfd4b6a6fa796ea74eed50c80e","e93eda81803040e70d64168c8a83228f","2442ff56720d1887cb46dd37ed732407","4704cd96029606d6f501826d41805486","0b53120151a20a46edf3ef85b8ac450f")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring64 NOT NULL AND customstring64 IN ("3b55904d3b37c810fc230b991a257939","2e4c626e67df46b2a7258e73c04c4f73","b1095d0837dd11b5280fcb29b5a1bb84","18baedf43f4a68455e8d36b657aff03c","d75e1c01c59b63d73f22e84a8a8819bf","6ff538dfd4b6a6fa796ea74eed50c80e","e93eda81803040e70d64168c8a83228f","2442ff56720d1887cb46dd37ed732407","4704cd96029606d6f501826d41805486","0b53120151a20a46edf3ef85b8ac450f")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("3b55904d3b37c810fc230b991a257939","2e4c626e67df46b2a7258e73c04c4f73","b1095d0837dd11b5280fcb29b5a1bb84","18baedf43f4a68455e8d36b657aff03c","d75e1c01c59b63d73f22e84a8a8819bf","6ff538dfd4b6a6fa796ea74eed50c80e","e93eda81803040e70d64168c8a83228f","2442ff56720d1887cb46dd37ed732407","4704cd96029606d6f501826d41805486","0b53120151a20a46edf3ef85b8ac450f")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("3b55904d3b37c810fc230b991a257939","2e4c626e67df46b2a7258e73c04c4f73","b1095d0837dd11b5280fcb29b5a1bb84","18baedf43f4a68455e8d36b657aff03c","d75e1c01c59b63d73f22e84a8a8819bf","6ff538dfd4b6a6fa796ea74eed50c80e","e93eda81803040e70d64168c8a83228f","2442ff56720d1887cb46dd37ed732407","4704cd96029606d6f501826d41805486","0b53120151a20a46edf3ef85b8ac450f")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("3b55904d3b37c810fc230b991a257939","2e4c626e67df46b2a7258e73c04c4f73","b1095d0837dd11b5280fcb29b5a1bb84","18baedf43f4a68455e8d36b657aff03c","d75e1c01c59b63d73f22e84a8a8819bf","6ff538dfd4b6a6fa796ea74eed50c80e","e93eda81803040e70d64168c8a83228f","2442ff56720d1887cb46dd37ed732407","4704cd96029606d6f501826d41805486","0b53120151a20a46edf3ef85b8ac450f")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("3b55904d3b37c810fc230b991a257939","2e4c626e67df46b2a7258e73c04c4f73","b1095d0837dd11b5280fcb29b5a1bb84","18baedf43f4a68455e8d36b657aff03c","d75e1c01c59b63d73f22e84a8a8819bf","6ff538dfd4b6a6fa796ea74eed50c80e","e93eda81803040e70d64168c8a83228f","2442ff56720d1887cb46dd37ed732407","4704cd96029606d6f501826d41805486","0b53120151a20a46edf3ef85b8ac450f")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("3b55904d3b37c810fc230b991a257939","2e4c626e67df46b2a7258e73c04c4f73","b1095d0837dd11b5280fcb29b5a1bb84","18baedf43f4a68455e8d36b657aff03c","d75e1c01c59b63d73f22e84a8a8819bf","6ff538dfd4b6a6fa796ea74eed50c80e","e93eda81803040e70d64168c8a83228f","2442ff56720d1887cb46dd37ed732407","4704cd96029606d6f501826d41805486","0b53120151a20a46edf3ef85b8ac450f")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("3b55904d3b37c810fc230b991a257939","2e4c626e67df46b2a7258e73c04c4f73","b1095d0837dd11b5280fcb29b5a1bb84","18baedf43f4a68455e8d36b657aff03c","d75e1c01c59b63d73f22e84a8a8819bf","6ff538dfd4b6a6fa796ea74eed50c80e","e93eda81803040e70d64168c8a83228f","2442ff56720d1887cb46dd37ed732407","4704cd96029606d6f501826d41805486","0b53120151a20a46edf3ef85b8ac450f")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("3b55904d3b37c810fc230b991a257939","2e4c626e67df46b2a7258e73c04c4f73","b1095d0837dd11b5280fcb29b5a1bb84","18baedf43f4a68455e8d36b657aff03c","d75e1c01c59b63d73f22e84a8a8819bf","6ff538dfd4b6a6fa796ea74eed50c80e","e93eda81803040e70d64168c8a83228f","2442ff56720d1887cb46dd37ed732407","4704cd96029606d6f501826d41805486","0b53120151a20a46edf3ef85b8ac450f")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("3b55904d3b37c810fc230b991a257939","2e4c626e67df46b2a7258e73c04c4f73","b1095d0837dd11b5280fcb29b5a1bb84","18baedf43f4a68455e8d36b657aff03c","d75e1c01c59b63d73f22e84a8a8819bf","6ff538dfd4b6a6fa796ea74eed50c80e","e93eda81803040e70d64168c8a83228f","2442ff56720d1887cb46dd37ed732407","4704cd96029606d6f501826d41805486","0b53120151a20a46edf3ef85b8ac450f")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("3b55904d3b37c810fc230b991a257939","2e4c626e67df46b2a7258e73c04c4f73","b1095d0837dd11b5280fcb29b5a1bb84","18baedf43f4a68455e8d36b657aff03c","d75e1c01c59b63d73f22e84a8a8819bf","6ff538dfd4b6a6fa796ea74eed50c80e","e93eda81803040e70d64168c8a83228f","2442ff56720d1887cb46dd37ed732407","4704cd96029606d6f501826d41805486","0b53120151a20a46edf3ef85b8ac450f")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("3b55904d3b37c810fc230b991a257939","2e4c626e67df46b2a7258e73c04c4f73","b1095d0837dd11b5280fcb29b5a1bb84","18baedf43f4a68455e8d36b657aff03c","d75e1c01c59b63d73f22e84a8a8819bf","6ff538dfd4b6a6fa796ea74eed50c80e","e93eda81803040e70d64168c8a83228f","2442ff56720d1887cb46dd37ed732407","4704cd96029606d6f501826d41805486","0b53120151a20a46edf3ef85b8ac450f")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("3b55904d3b37c810fc230b991a257939","2e4c626e67df46b2a7258e73c04c4f73","b1095d0837dd11b5280fcb29b5a1bb84","18baedf43f4a68455e8d36b657aff03c","d75e1c01c59b63d73f22e84a8a8819bf","6ff538dfd4b6a6fa796ea74eed50c80e","e93eda81803040e70d64168c8a83228f","2442ff56720d1887cb46dd37ed732407","4704cd96029606d6f501826d41805486","0b53120151a20a46edf3ef85b8ac450f")
index=activity AND rg_functionality="Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("3b55904d3b37c810fc230b991a257939","2e4c626e67df46b2a7258e73c04c4f73","b1095d0837dd11b5280fcb29b5a1bb84","18baedf43f4a68455e8d36b657aff03c","d75e1c01c59b63d73f22e84a8a8819bf","6ff538dfd4b6a6fa796ea74eed50c80e","e93eda81803040e70d64168c8a83228f","2442ff56720d1887cb46dd37ed732407","4704cd96029606d6f501826d41805486","0b53120151a20a46edf3ef85b8ac450f")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("3b55904d3b37c810fc230b991a257939","2e4c626e67df46b2a7258e73c04c4f73","b1095d0837dd11b5280fcb29b5a1bb84","18baedf43f4a68455e8d36b657aff03c","d75e1c01c59b63d73f22e84a8a8819bf","6ff538dfd4b6a6fa796ea74eed50c80e","e93eda81803040e70d64168c8a83228f","2442ff56720d1887cb46dd37ed732407","4704cd96029606d6f501826d41805486","0b53120151a20a46edf3ef85b8ac450f")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("3b55904d3b37c810fc230b991a257939","2e4c626e67df46b2a7258e73c04c4f73","b1095d0837dd11b5280fcb29b5a1bb84","18baedf43f4a68455e8d36b657aff03c","d75e1c01c59b63d73f22e84a8a8819bf","6ff538dfd4b6a6fa796ea74eed50c80e","e93eda81803040e70d64168c8a83228f","2442ff56720d1887cb46dd37ed732407","4704cd96029606d6f501826d41805486","0b53120151a20a46edf3ef85b8ac450f")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("3b55904d3b37c810fc230b991a257939","2e4c626e67df46b2a7258e73c04c4f73","b1095d0837dd11b5280fcb29b5a1bb84","18baedf43f4a68455e8d36b657aff03c","d75e1c01c59b63d73f22e84a8a8819bf","6ff538dfd4b6a6fa796ea74eed50c80e","e93eda81803040e70d64168c8a83228f","2442ff56720d1887cb46dd37ed732407","4704cd96029606d6f501826d41805486","0b53120151a20a46edf3ef85b8ac450f")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("3b55904d3b37c810fc230b991a257939","2e4c626e67df46b2a7258e73c04c4f73","b1095d0837dd11b5280fcb29b5a1bb84","18baedf43f4a68455e8d36b657aff03c","d75e1c01c59b63d73f22e84a8a8819bf","6ff538dfd4b6a6fa796ea74eed50c80e","e93eda81803040e70d64168c8a83228f","2442ff56720d1887cb46dd37ed732407","4704cd96029606d6f501826d41805486","0b53120151a20a46edf3ef85b8ac450f")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("3b55904d3b37c810fc230b991a257939","2e4c626e67df46b2a7258e73c04c4f73","b1095d0837dd11b5280fcb29b5a1bb84","18baedf43f4a68455e8d36b657aff03c","d75e1c01c59b63d73f22e84a8a8819bf","6ff538dfd4b6a6fa796ea74eed50c80e","e93eda81803040e70d64168c8a83228f","2442ff56720d1887cb46dd37ed732407","4704cd96029606d6f501826d41805486","0b53120151a20a46edf3ef85b8ac450f")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("3b55904d3b37c810fc230b991a257939","2e4c626e67df46b2a7258e73c04c4f73","b1095d0837dd11b5280fcb29b5a1bb84","18baedf43f4a68455e8d36b657aff03c","d75e1c01c59b63d73f22e84a8a8819bf","6ff538dfd4b6a6fa796ea74eed50c80e","e93eda81803040e70d64168c8a83228f","2442ff56720d1887cb46dd37ed732407","4704cd96029606d6f501826d41805486","0b53120151a20a46edf3ef85b8ac450f")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("3b55904d3b37c810fc230b991a257939","2e4c626e67df46b2a7258e73c04c4f73","b1095d0837dd11b5280fcb29b5a1bb84","18baedf43f4a68455e8d36b657aff03c","d75e1c01c59b63d73f22e84a8a8819bf","6ff538dfd4b6a6fa796ea74eed50c80e","e93eda81803040e70d64168c8a83228f","2442ff56720d1887cb46dd37ed732407","4704cd96029606d6f501826d41805486","0b53120151a20a46edf3ef85b8ac450f")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring64 NOT NULL AND customstring64 IN ("3b55904d3b37c810fc230b991a257939","2e4c626e67df46b2a7258e73c04c4f73","b1095d0837dd11b5280fcb29b5a1bb84","18baedf43f4a68455e8d36b657aff03c","d75e1c01c59b63d73f22e84a8a8819bf","6ff538dfd4b6a6fa796ea74eed50c80e","e93eda81803040e70d64168c8a83228f","2442ff56720d1887cb46dd37ed732407","4704cd96029606d6f501826d41805486","0b53120151a20a46edf3ef85b8ac450f")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("3b55904d3b37c810fc230b991a257939","2e4c626e67df46b2a7258e73c04c4f73","b1095d0837dd11b5280fcb29b5a1bb84","18baedf43f4a68455e8d36b657aff03c","d75e1c01c59b63d73f22e84a8a8819bf","6ff538dfd4b6a6fa796ea74eed50c80e","e93eda81803040e70d64168c8a83228f","2442ff56720d1887cb46dd37ed732407","4704cd96029606d6f501826d41805486","0b53120151a20a46edf3ef85b8ac450f")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("3b55904d3b37c810fc230b991a257939","2e4c626e67df46b2a7258e73c04c4f73","b1095d0837dd11b5280fcb29b5a1bb84","18baedf43f4a68455e8d36b657aff03c","d75e1c01c59b63d73f22e84a8a8819bf","6ff538dfd4b6a6fa796ea74eed50c80e","e93eda81803040e70d64168c8a83228f","2442ff56720d1887cb46dd37ed732407","4704cd96029606d6f501826d41805486","0b53120151a20a46edf3ef85b8ac450f")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("3b55904d3b37c810fc230b991a257939","2e4c626e67df46b2a7258e73c04c4f73","b1095d0837dd11b5280fcb29b5a1bb84","18baedf43f4a68455e8d36b657aff03c","d75e1c01c59b63d73f22e84a8a8819bf","6ff538dfd4b6a6fa796ea74eed50c80e","e93eda81803040e70d64168c8a83228f","2442ff56720d1887cb46dd37ed732407","4704cd96029606d6f501826d41805486","0b53120151a20a46edf3ef85b8ac450f")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring64 NOT NULL AND customstring64 IN ("3b55904d3b37c810fc230b991a257939","2e4c626e67df46b2a7258e73c04c4f73","b1095d0837dd11b5280fcb29b5a1bb84","18baedf43f4a68455e8d36b657aff03c","d75e1c01c59b63d73f22e84a8a8819bf","6ff538dfd4b6a6fa796ea74eed50c80e","e93eda81803040e70d64168c8a83228f","2442ff56720d1887cb46dd37ed732407","4704cd96029606d6f501826d41805486","0b53120151a20a46edf3ef85b8ac450f")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("3b55904d3b37c810fc230b991a257939","2e4c626e67df46b2a7258e73c04c4f73","b1095d0837dd11b5280fcb29b5a1bb84","18baedf43f4a68455e8d36b657aff03c","d75e1c01c59b63d73f22e84a8a8819bf","6ff538dfd4b6a6fa796ea74eed50c80e","e93eda81803040e70d64168c8a83228f","2442ff56720d1887cb46dd37ed732407","4704cd96029606d6f501826d41805486","0b53120151a20a46edf3ef85b8ac450f")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("3b55904d3b37c810fc230b991a257939","2e4c626e67df46b2a7258e73c04c4f73","b1095d0837dd11b5280fcb29b5a1bb84","18baedf43f4a68455e8d36b657aff03c","d75e1c01c59b63d73f22e84a8a8819bf","6ff538dfd4b6a6fa796ea74eed50c80e","e93eda81803040e70d64168c8a83228f","2442ff56720d1887cb46dd37ed732407","4704cd96029606d6f501826d41805486","0b53120151a20a46edf3ef85b8ac450f")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("3b55904d3b37c810fc230b991a257939","2e4c626e67df46b2a7258e73c04c4f73","b1095d0837dd11b5280fcb29b5a1bb84","18baedf43f4a68455e8d36b657aff03c","d75e1c01c59b63d73f22e84a8a8819bf","6ff538dfd4b6a6fa796ea74eed50c80e","e93eda81803040e70d64168c8a83228f","2442ff56720d1887cb46dd37ed732407","4704cd96029606d6f501826d41805486","0b53120151a20a46edf3ef85b8ac450f")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring64 NOT NULL AND customstring64 IN ("3b55904d3b37c810fc230b991a257939","2e4c626e67df46b2a7258e73c04c4f73","b1095d0837dd11b5280fcb29b5a1bb84","18baedf43f4a68455e8d36b657aff03c","d75e1c01c59b63d73f22e84a8a8819bf","6ff538dfd4b6a6fa796ea74eed50c80e","e93eda81803040e70d64168c8a83228f","2442ff56720d1887cb46dd37ed732407","4704cd96029606d6f501826d41805486","0b53120151a20a46edf3ef85b8ac450f")
