index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("384f3719ba4fbcf355cc206e27f3bfca94e7bf14dd928de62ab5f74de90df34a","44ede6e1b9be1c013f13d82645f7a9cff7d92b267778f19b46aa5c1f7fa3c10b","c7441a27727069ce11f8d54676f8397e85301b4d65d4d722c6b239a495fd0282","5da3db74eee74412c1290393a0a0487c63b2c022e57aebcd632f0c3caf23d8bc","5b731854c58c2c1316633e570c9ec82474347e64b07ace48017d0be2b6331eed","2a9ff0a0e962d28c488af9767770d48b9128b19ee43e8df392efb2f1c5a696f","54e6e6b23dec0432da2b36713a206169468f4f9d7691ccf449d7d946617eca45")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("384f3719ba4fbcf355cc206e27f3bfca94e7bf14dd928de62ab5f74de90df34a","44ede6e1b9be1c013f13d82645f7a9cff7d92b267778f19b46aa5c1f7fa3c10b","c7441a27727069ce11f8d54676f8397e85301b4d65d4d722c6b239a495fd0282","5da3db74eee74412c1290393a0a0487c63b2c022e57aebcd632f0c3caf23d8bc","5b731854c58c2c1316633e570c9ec82474347e64b07ace48017d0be2b6331eed","2a9ff0a0e962d28c488af9767770d48b9128b19ee43e8df392efb2f1c5a696f","54e6e6b23dec0432da2b36713a206169468f4f9d7691ccf449d7d946617eca45")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("384f3719ba4fbcf355cc206e27f3bfca94e7bf14dd928de62ab5f74de90df34a","44ede6e1b9be1c013f13d82645f7a9cff7d92b267778f19b46aa5c1f7fa3c10b","c7441a27727069ce11f8d54676f8397e85301b4d65d4d722c6b239a495fd0282","5da3db74eee74412c1290393a0a0487c63b2c022e57aebcd632f0c3caf23d8bc","5b731854c58c2c1316633e570c9ec82474347e64b07ace48017d0be2b6331eed","2a9ff0a0e962d28c488af9767770d48b9128b19ee43e8df392efb2f1c5a696f","54e6e6b23dec0432da2b36713a206169468f4f9d7691ccf449d7d946617eca45")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("384f3719ba4fbcf355cc206e27f3bfca94e7bf14dd928de62ab5f74de90df34a","44ede6e1b9be1c013f13d82645f7a9cff7d92b267778f19b46aa5c1f7fa3c10b","c7441a27727069ce11f8d54676f8397e85301b4d65d4d722c6b239a495fd0282","5da3db74eee74412c1290393a0a0487c63b2c022e57aebcd632f0c3caf23d8bc","5b731854c58c2c1316633e570c9ec82474347e64b07ace48017d0be2b6331eed","2a9ff0a0e962d28c488af9767770d48b9128b19ee43e8df392efb2f1c5a696f","54e6e6b23dec0432da2b36713a206169468f4f9d7691ccf449d7d946617eca45")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("384f3719ba4fbcf355cc206e27f3bfca94e7bf14dd928de62ab5f74de90df34a","44ede6e1b9be1c013f13d82645f7a9cff7d92b267778f19b46aa5c1f7fa3c10b","c7441a27727069ce11f8d54676f8397e85301b4d65d4d722c6b239a495fd0282","5da3db74eee74412c1290393a0a0487c63b2c022e57aebcd632f0c3caf23d8bc","5b731854c58c2c1316633e570c9ec82474347e64b07ace48017d0be2b6331eed","2a9ff0a0e962d28c488af9767770d48b9128b19ee43e8df392efb2f1c5a696f","54e6e6b23dec0432da2b36713a206169468f4f9d7691ccf449d7d946617eca45")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("384f3719ba4fbcf355cc206e27f3bfca94e7bf14dd928de62ab5f74de90df34a","44ede6e1b9be1c013f13d82645f7a9cff7d92b267778f19b46aa5c1f7fa3c10b","c7441a27727069ce11f8d54676f8397e85301b4d65d4d722c6b239a495fd0282","5da3db74eee74412c1290393a0a0487c63b2c022e57aebcd632f0c3caf23d8bc","5b731854c58c2c1316633e570c9ec82474347e64b07ace48017d0be2b6331eed","2a9ff0a0e962d28c488af9767770d48b9128b19ee43e8df392efb2f1c5a696f","54e6e6b23dec0432da2b36713a206169468f4f9d7691ccf449d7d946617eca45")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("384f3719ba4fbcf355cc206e27f3bfca94e7bf14dd928de62ab5f74de90df34a","44ede6e1b9be1c013f13d82645f7a9cff7d92b267778f19b46aa5c1f7fa3c10b","c7441a27727069ce11f8d54676f8397e85301b4d65d4d722c6b239a495fd0282","5da3db74eee74412c1290393a0a0487c63b2c022e57aebcd632f0c3caf23d8bc","5b731854c58c2c1316633e570c9ec82474347e64b07ace48017d0be2b6331eed","2a9ff0a0e962d28c488af9767770d48b9128b19ee43e8df392efb2f1c5a696f","54e6e6b23dec0432da2b36713a206169468f4f9d7691ccf449d7d946617eca45")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("384f3719ba4fbcf355cc206e27f3bfca94e7bf14dd928de62ab5f74de90df34a","44ede6e1b9be1c013f13d82645f7a9cff7d92b267778f19b46aa5c1f7fa3c10b","c7441a27727069ce11f8d54676f8397e85301b4d65d4d722c6b239a495fd0282","5da3db74eee74412c1290393a0a0487c63b2c022e57aebcd632f0c3caf23d8bc","5b731854c58c2c1316633e570c9ec82474347e64b07ace48017d0be2b6331eed","2a9ff0a0e962d28c488af9767770d48b9128b19ee43e8df392efb2f1c5a696f","54e6e6b23dec0432da2b36713a206169468f4f9d7691ccf449d7d946617eca45")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("384f3719ba4fbcf355cc206e27f3bfca94e7bf14dd928de62ab5f74de90df34a","44ede6e1b9be1c013f13d82645f7a9cff7d92b267778f19b46aa5c1f7fa3c10b","c7441a27727069ce11f8d54676f8397e85301b4d65d4d722c6b239a495fd0282","5da3db74eee74412c1290393a0a0487c63b2c022e57aebcd632f0c3caf23d8bc","5b731854c58c2c1316633e570c9ec82474347e64b07ace48017d0be2b6331eed","2a9ff0a0e962d28c488af9767770d48b9128b19ee43e8df392efb2f1c5a696f","54e6e6b23dec0432da2b36713a206169468f4f9d7691ccf449d7d946617eca45")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("384f3719ba4fbcf355cc206e27f3bfca94e7bf14dd928de62ab5f74de90df34a","44ede6e1b9be1c013f13d82645f7a9cff7d92b267778f19b46aa5c1f7fa3c10b","c7441a27727069ce11f8d54676f8397e85301b4d65d4d722c6b239a495fd0282","5da3db74eee74412c1290393a0a0487c63b2c022e57aebcd632f0c3caf23d8bc","5b731854c58c2c1316633e570c9ec82474347e64b07ace48017d0be2b6331eed","2a9ff0a0e962d28c488af9767770d48b9128b19ee43e8df392efb2f1c5a696f","54e6e6b23dec0432da2b36713a206169468f4f9d7691ccf449d7d946617eca45")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("384f3719ba4fbcf355cc206e27f3bfca94e7bf14dd928de62ab5f74de90df34a","44ede6e1b9be1c013f13d82645f7a9cff7d92b267778f19b46aa5c1f7fa3c10b","c7441a27727069ce11f8d54676f8397e85301b4d65d4d722c6b239a495fd0282","5da3db74eee74412c1290393a0a0487c63b2c022e57aebcd632f0c3caf23d8bc","5b731854c58c2c1316633e570c9ec82474347e64b07ace48017d0be2b6331eed","2a9ff0a0e962d28c488af9767770d48b9128b19ee43e8df392efb2f1c5a696f","54e6e6b23dec0432da2b36713a206169468f4f9d7691ccf449d7d946617eca45")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("384f3719ba4fbcf355cc206e27f3bfca94e7bf14dd928de62ab5f74de90df34a","44ede6e1b9be1c013f13d82645f7a9cff7d92b267778f19b46aa5c1f7fa3c10b","c7441a27727069ce11f8d54676f8397e85301b4d65d4d722c6b239a495fd0282","5da3db74eee74412c1290393a0a0487c63b2c022e57aebcd632f0c3caf23d8bc","5b731854c58c2c1316633e570c9ec82474347e64b07ace48017d0be2b6331eed","2a9ff0a0e962d28c488af9767770d48b9128b19ee43e8df392efb2f1c5a696f","54e6e6b23dec0432da2b36713a206169468f4f9d7691ccf449d7d946617eca45")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("384f3719ba4fbcf355cc206e27f3bfca94e7bf14dd928de62ab5f74de90df34a","44ede6e1b9be1c013f13d82645f7a9cff7d92b267778f19b46aa5c1f7fa3c10b","c7441a27727069ce11f8d54676f8397e85301b4d65d4d722c6b239a495fd0282","5da3db74eee74412c1290393a0a0487c63b2c022e57aebcd632f0c3caf23d8bc","5b731854c58c2c1316633e570c9ec82474347e64b07ace48017d0be2b6331eed","2a9ff0a0e962d28c488af9767770d48b9128b19ee43e8df392efb2f1c5a696f","54e6e6b23dec0432da2b36713a206169468f4f9d7691ccf449d7d946617eca45")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("384f3719ba4fbcf355cc206e27f3bfca94e7bf14dd928de62ab5f74de90df34a","44ede6e1b9be1c013f13d82645f7a9cff7d92b267778f19b46aa5c1f7fa3c10b","c7441a27727069ce11f8d54676f8397e85301b4d65d4d722c6b239a495fd0282","5da3db74eee74412c1290393a0a0487c63b2c022e57aebcd632f0c3caf23d8bc","5b731854c58c2c1316633e570c9ec82474347e64b07ace48017d0be2b6331eed","2a9ff0a0e962d28c488af9767770d48b9128b19ee43e8df392efb2f1c5a696f","54e6e6b23dec0432da2b36713a206169468f4f9d7691ccf449d7d946617eca45")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("384f3719ba4fbcf355cc206e27f3bfca94e7bf14dd928de62ab5f74de90df34a","44ede6e1b9be1c013f13d82645f7a9cff7d92b267778f19b46aa5c1f7fa3c10b","c7441a27727069ce11f8d54676f8397e85301b4d65d4d722c6b239a495fd0282","5da3db74eee74412c1290393a0a0487c63b2c022e57aebcd632f0c3caf23d8bc","5b731854c58c2c1316633e570c9ec82474347e64b07ace48017d0be2b6331eed","2a9ff0a0e962d28c488af9767770d48b9128b19ee43e8df392efb2f1c5a696f","54e6e6b23dec0432da2b36713a206169468f4f9d7691ccf449d7d946617eca45")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("384f3719ba4fbcf355cc206e27f3bfca94e7bf14dd928de62ab5f74de90df34a","44ede6e1b9be1c013f13d82645f7a9cff7d92b267778f19b46aa5c1f7fa3c10b","c7441a27727069ce11f8d54676f8397e85301b4d65d4d722c6b239a495fd0282","5da3db74eee74412c1290393a0a0487c63b2c022e57aebcd632f0c3caf23d8bc","5b731854c58c2c1316633e570c9ec82474347e64b07ace48017d0be2b6331eed","2a9ff0a0e962d28c488af9767770d48b9128b19ee43e8df392efb2f1c5a696f","54e6e6b23dec0432da2b36713a206169468f4f9d7691ccf449d7d946617eca45")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("384f3719ba4fbcf355cc206e27f3bfca94e7bf14dd928de62ab5f74de90df34a","44ede6e1b9be1c013f13d82645f7a9cff7d92b267778f19b46aa5c1f7fa3c10b","c7441a27727069ce11f8d54676f8397e85301b4d65d4d722c6b239a495fd0282","5da3db74eee74412c1290393a0a0487c63b2c022e57aebcd632f0c3caf23d8bc","5b731854c58c2c1316633e570c9ec82474347e64b07ace48017d0be2b6331eed","2a9ff0a0e962d28c488af9767770d48b9128b19ee43e8df392efb2f1c5a696f","54e6e6b23dec0432da2b36713a206169468f4f9d7691ccf449d7d946617eca45")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("384f3719ba4fbcf355cc206e27f3bfca94e7bf14dd928de62ab5f74de90df34a","44ede6e1b9be1c013f13d82645f7a9cff7d92b267778f19b46aa5c1f7fa3c10b","c7441a27727069ce11f8d54676f8397e85301b4d65d4d722c6b239a495fd0282","5da3db74eee74412c1290393a0a0487c63b2c022e57aebcd632f0c3caf23d8bc","5b731854c58c2c1316633e570c9ec82474347e64b07ace48017d0be2b6331eed","2a9ff0a0e962d28c488af9767770d48b9128b19ee43e8df392efb2f1c5a696f","54e6e6b23dec0432da2b36713a206169468f4f9d7691ccf449d7d946617eca45")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("384f3719ba4fbcf355cc206e27f3bfca94e7bf14dd928de62ab5f74de90df34a","44ede6e1b9be1c013f13d82645f7a9cff7d92b267778f19b46aa5c1f7fa3c10b","c7441a27727069ce11f8d54676f8397e85301b4d65d4d722c6b239a495fd0282","5da3db74eee74412c1290393a0a0487c63b2c022e57aebcd632f0c3caf23d8bc","5b731854c58c2c1316633e570c9ec82474347e64b07ace48017d0be2b6331eed","2a9ff0a0e962d28c488af9767770d48b9128b19ee43e8df392efb2f1c5a696f","54e6e6b23dec0432da2b36713a206169468f4f9d7691ccf449d7d946617eca45")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("384f3719ba4fbcf355cc206e27f3bfca94e7bf14dd928de62ab5f74de90df34a","44ede6e1b9be1c013f13d82645f7a9cff7d92b267778f19b46aa5c1f7fa3c10b","c7441a27727069ce11f8d54676f8397e85301b4d65d4d722c6b239a495fd0282","5da3db74eee74412c1290393a0a0487c63b2c022e57aebcd632f0c3caf23d8bc","5b731854c58c2c1316633e570c9ec82474347e64b07ace48017d0be2b6331eed","2a9ff0a0e962d28c488af9767770d48b9128b19ee43e8df392efb2f1c5a696f","54e6e6b23dec0432da2b36713a206169468f4f9d7691ccf449d7d946617eca45")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("384f3719ba4fbcf355cc206e27f3bfca94e7bf14dd928de62ab5f74de90df34a","44ede6e1b9be1c013f13d82645f7a9cff7d92b267778f19b46aa5c1f7fa3c10b","c7441a27727069ce11f8d54676f8397e85301b4d65d4d722c6b239a495fd0282","5da3db74eee74412c1290393a0a0487c63b2c022e57aebcd632f0c3caf23d8bc","5b731854c58c2c1316633e570c9ec82474347e64b07ace48017d0be2b6331eed","2a9ff0a0e962d28c488af9767770d48b9128b19ee43e8df392efb2f1c5a696f","54e6e6b23dec0432da2b36713a206169468f4f9d7691ccf449d7d946617eca45")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("384f3719ba4fbcf355cc206e27f3bfca94e7bf14dd928de62ab5f74de90df34a","44ede6e1b9be1c013f13d82645f7a9cff7d92b267778f19b46aa5c1f7fa3c10b","c7441a27727069ce11f8d54676f8397e85301b4d65d4d722c6b239a495fd0282","5da3db74eee74412c1290393a0a0487c63b2c022e57aebcd632f0c3caf23d8bc","5b731854c58c2c1316633e570c9ec82474347e64b07ace48017d0be2b6331eed","2a9ff0a0e962d28c488af9767770d48b9128b19ee43e8df392efb2f1c5a696f","54e6e6b23dec0432da2b36713a206169468f4f9d7691ccf449d7d946617eca45")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("384f3719ba4fbcf355cc206e27f3bfca94e7bf14dd928de62ab5f74de90df34a","44ede6e1b9be1c013f13d82645f7a9cff7d92b267778f19b46aa5c1f7fa3c10b","c7441a27727069ce11f8d54676f8397e85301b4d65d4d722c6b239a495fd0282","5da3db74eee74412c1290393a0a0487c63b2c022e57aebcd632f0c3caf23d8bc","5b731854c58c2c1316633e570c9ec82474347e64b07ace48017d0be2b6331eed","2a9ff0a0e962d28c488af9767770d48b9128b19ee43e8df392efb2f1c5a696f","54e6e6b23dec0432da2b36713a206169468f4f9d7691ccf449d7d946617eca45")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("384f3719ba4fbcf355cc206e27f3bfca94e7bf14dd928de62ab5f74de90df34a","44ede6e1b9be1c013f13d82645f7a9cff7d92b267778f19b46aa5c1f7fa3c10b","c7441a27727069ce11f8d54676f8397e85301b4d65d4d722c6b239a495fd0282","5da3db74eee74412c1290393a0a0487c63b2c022e57aebcd632f0c3caf23d8bc","5b731854c58c2c1316633e570c9ec82474347e64b07ace48017d0be2b6331eed","2a9ff0a0e962d28c488af9767770d48b9128b19ee43e8df392efb2f1c5a696f","54e6e6b23dec0432da2b36713a206169468f4f9d7691ccf449d7d946617eca45")
