index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("e14a5d6a959ff1aa4bde3ff3b6ca9b36929afabc","d54bc7736523279da8b58b561df85278","b0dbef65d1c3575f0e4fe6c466a952deeed804a1","99331a27afa84009e140880a8739d96f97baa1676d67ba7a3278fe61bfb79022","7491f5a975f3b6f71beb4ae5d6d1e2db","7088f6ff79b3be4640f2663f3238fd1db7dcaf4e","60a9f28b0fb727587b7b8fd326a86685","5deb33f73ddf3ce8592207a1017b39cd","4029583855e92b84363f6609bd578bd1b4bafb3aae479f0dbf4da2e15ce569f2","38f1800a2d870841093394535cae3690b51ae08a954e9e9b2a0bc86de4a8e338","2e9a2e5098bf7140b2279fb2825ea77af576f36a93f36cad7938f4588d234d3a","08042ae79e699583602ae7a55d7e2b3d945921d2")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("e14a5d6a959ff1aa4bde3ff3b6ca9b36929afabc","d54bc7736523279da8b58b561df85278","b0dbef65d1c3575f0e4fe6c466a952deeed804a1","99331a27afa84009e140880a8739d96f97baa1676d67ba7a3278fe61bfb79022","7491f5a975f3b6f71beb4ae5d6d1e2db","7088f6ff79b3be4640f2663f3238fd1db7dcaf4e","60a9f28b0fb727587b7b8fd326a86685","5deb33f73ddf3ce8592207a1017b39cd","4029583855e92b84363f6609bd578bd1b4bafb3aae479f0dbf4da2e15ce569f2","38f1800a2d870841093394535cae3690b51ae08a954e9e9b2a0bc86de4a8e338","2e9a2e5098bf7140b2279fb2825ea77af576f36a93f36cad7938f4588d234d3a","08042ae79e699583602ae7a55d7e2b3d945921d2")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("e14a5d6a959ff1aa4bde3ff3b6ca9b36929afabc","d54bc7736523279da8b58b561df85278","b0dbef65d1c3575f0e4fe6c466a952deeed804a1","99331a27afa84009e140880a8739d96f97baa1676d67ba7a3278fe61bfb79022","7491f5a975f3b6f71beb4ae5d6d1e2db","7088f6ff79b3be4640f2663f3238fd1db7dcaf4e","60a9f28b0fb727587b7b8fd326a86685","5deb33f73ddf3ce8592207a1017b39cd","4029583855e92b84363f6609bd578bd1b4bafb3aae479f0dbf4da2e15ce569f2","38f1800a2d870841093394535cae3690b51ae08a954e9e9b2a0bc86de4a8e338","2e9a2e5098bf7140b2279fb2825ea77af576f36a93f36cad7938f4588d234d3a","08042ae79e699583602ae7a55d7e2b3d945921d2")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("e14a5d6a959ff1aa4bde3ff3b6ca9b36929afabc","d54bc7736523279da8b58b561df85278","b0dbef65d1c3575f0e4fe6c466a952deeed804a1","99331a27afa84009e140880a8739d96f97baa1676d67ba7a3278fe61bfb79022","7491f5a975f3b6f71beb4ae5d6d1e2db","7088f6ff79b3be4640f2663f3238fd1db7dcaf4e","60a9f28b0fb727587b7b8fd326a86685","5deb33f73ddf3ce8592207a1017b39cd","4029583855e92b84363f6609bd578bd1b4bafb3aae479f0dbf4da2e15ce569f2","38f1800a2d870841093394535cae3690b51ae08a954e9e9b2a0bc86de4a8e338","2e9a2e5098bf7140b2279fb2825ea77af576f36a93f36cad7938f4588d234d3a","08042ae79e699583602ae7a55d7e2b3d945921d2")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("e14a5d6a959ff1aa4bde3ff3b6ca9b36929afabc","d54bc7736523279da8b58b561df85278","b0dbef65d1c3575f0e4fe6c466a952deeed804a1","99331a27afa84009e140880a8739d96f97baa1676d67ba7a3278fe61bfb79022","7491f5a975f3b6f71beb4ae5d6d1e2db","7088f6ff79b3be4640f2663f3238fd1db7dcaf4e","60a9f28b0fb727587b7b8fd326a86685","5deb33f73ddf3ce8592207a1017b39cd","4029583855e92b84363f6609bd578bd1b4bafb3aae479f0dbf4da2e15ce569f2","38f1800a2d870841093394535cae3690b51ae08a954e9e9b2a0bc86de4a8e338","2e9a2e5098bf7140b2279fb2825ea77af576f36a93f36cad7938f4588d234d3a","08042ae79e699583602ae7a55d7e2b3d945921d2")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("e14a5d6a959ff1aa4bde3ff3b6ca9b36929afabc","d54bc7736523279da8b58b561df85278","b0dbef65d1c3575f0e4fe6c466a952deeed804a1","99331a27afa84009e140880a8739d96f97baa1676d67ba7a3278fe61bfb79022","7491f5a975f3b6f71beb4ae5d6d1e2db","7088f6ff79b3be4640f2663f3238fd1db7dcaf4e","60a9f28b0fb727587b7b8fd326a86685","5deb33f73ddf3ce8592207a1017b39cd","4029583855e92b84363f6609bd578bd1b4bafb3aae479f0dbf4da2e15ce569f2","38f1800a2d870841093394535cae3690b51ae08a954e9e9b2a0bc86de4a8e338","2e9a2e5098bf7140b2279fb2825ea77af576f36a93f36cad7938f4588d234d3a","08042ae79e699583602ae7a55d7e2b3d945921d2")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("e14a5d6a959ff1aa4bde3ff3b6ca9b36929afabc","d54bc7736523279da8b58b561df85278","b0dbef65d1c3575f0e4fe6c466a952deeed804a1","99331a27afa84009e140880a8739d96f97baa1676d67ba7a3278fe61bfb79022","7491f5a975f3b6f71beb4ae5d6d1e2db","7088f6ff79b3be4640f2663f3238fd1db7dcaf4e","60a9f28b0fb727587b7b8fd326a86685","5deb33f73ddf3ce8592207a1017b39cd","4029583855e92b84363f6609bd578bd1b4bafb3aae479f0dbf4da2e15ce569f2","38f1800a2d870841093394535cae3690b51ae08a954e9e9b2a0bc86de4a8e338","2e9a2e5098bf7140b2279fb2825ea77af576f36a93f36cad7938f4588d234d3a","08042ae79e699583602ae7a55d7e2b3d945921d2")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("e14a5d6a959ff1aa4bde3ff3b6ca9b36929afabc","d54bc7736523279da8b58b561df85278","b0dbef65d1c3575f0e4fe6c466a952deeed804a1","99331a27afa84009e140880a8739d96f97baa1676d67ba7a3278fe61bfb79022","7491f5a975f3b6f71beb4ae5d6d1e2db","7088f6ff79b3be4640f2663f3238fd1db7dcaf4e","60a9f28b0fb727587b7b8fd326a86685","5deb33f73ddf3ce8592207a1017b39cd","4029583855e92b84363f6609bd578bd1b4bafb3aae479f0dbf4da2e15ce569f2","38f1800a2d870841093394535cae3690b51ae08a954e9e9b2a0bc86de4a8e338","2e9a2e5098bf7140b2279fb2825ea77af576f36a93f36cad7938f4588d234d3a","08042ae79e699583602ae7a55d7e2b3d945921d2")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("e14a5d6a959ff1aa4bde3ff3b6ca9b36929afabc","d54bc7736523279da8b58b561df85278","b0dbef65d1c3575f0e4fe6c466a952deeed804a1","99331a27afa84009e140880a8739d96f97baa1676d67ba7a3278fe61bfb79022","7491f5a975f3b6f71beb4ae5d6d1e2db","7088f6ff79b3be4640f2663f3238fd1db7dcaf4e","60a9f28b0fb727587b7b8fd326a86685","5deb33f73ddf3ce8592207a1017b39cd","4029583855e92b84363f6609bd578bd1b4bafb3aae479f0dbf4da2e15ce569f2","38f1800a2d870841093394535cae3690b51ae08a954e9e9b2a0bc86de4a8e338","2e9a2e5098bf7140b2279fb2825ea77af576f36a93f36cad7938f4588d234d3a","08042ae79e699583602ae7a55d7e2b3d945921d2")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("e14a5d6a959ff1aa4bde3ff3b6ca9b36929afabc","d54bc7736523279da8b58b561df85278","b0dbef65d1c3575f0e4fe6c466a952deeed804a1","99331a27afa84009e140880a8739d96f97baa1676d67ba7a3278fe61bfb79022","7491f5a975f3b6f71beb4ae5d6d1e2db","7088f6ff79b3be4640f2663f3238fd1db7dcaf4e","60a9f28b0fb727587b7b8fd326a86685","5deb33f73ddf3ce8592207a1017b39cd","4029583855e92b84363f6609bd578bd1b4bafb3aae479f0dbf4da2e15ce569f2","38f1800a2d870841093394535cae3690b51ae08a954e9e9b2a0bc86de4a8e338","2e9a2e5098bf7140b2279fb2825ea77af576f36a93f36cad7938f4588d234d3a","08042ae79e699583602ae7a55d7e2b3d945921d2")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("e14a5d6a959ff1aa4bde3ff3b6ca9b36929afabc","d54bc7736523279da8b58b561df85278","b0dbef65d1c3575f0e4fe6c466a952deeed804a1","99331a27afa84009e140880a8739d96f97baa1676d67ba7a3278fe61bfb79022","7491f5a975f3b6f71beb4ae5d6d1e2db","7088f6ff79b3be4640f2663f3238fd1db7dcaf4e","60a9f28b0fb727587b7b8fd326a86685","5deb33f73ddf3ce8592207a1017b39cd","4029583855e92b84363f6609bd578bd1b4bafb3aae479f0dbf4da2e15ce569f2","38f1800a2d870841093394535cae3690b51ae08a954e9e9b2a0bc86de4a8e338","2e9a2e5098bf7140b2279fb2825ea77af576f36a93f36cad7938f4588d234d3a","08042ae79e699583602ae7a55d7e2b3d945921d2")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("e14a5d6a959ff1aa4bde3ff3b6ca9b36929afabc","d54bc7736523279da8b58b561df85278","b0dbef65d1c3575f0e4fe6c466a952deeed804a1","99331a27afa84009e140880a8739d96f97baa1676d67ba7a3278fe61bfb79022","7491f5a975f3b6f71beb4ae5d6d1e2db","7088f6ff79b3be4640f2663f3238fd1db7dcaf4e","60a9f28b0fb727587b7b8fd326a86685","5deb33f73ddf3ce8592207a1017b39cd","4029583855e92b84363f6609bd578bd1b4bafb3aae479f0dbf4da2e15ce569f2","38f1800a2d870841093394535cae3690b51ae08a954e9e9b2a0bc86de4a8e338","2e9a2e5098bf7140b2279fb2825ea77af576f36a93f36cad7938f4588d234d3a","08042ae79e699583602ae7a55d7e2b3d945921d2")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("e14a5d6a959ff1aa4bde3ff3b6ca9b36929afabc","d54bc7736523279da8b58b561df85278","b0dbef65d1c3575f0e4fe6c466a952deeed804a1","99331a27afa84009e140880a8739d96f97baa1676d67ba7a3278fe61bfb79022","7491f5a975f3b6f71beb4ae5d6d1e2db","7088f6ff79b3be4640f2663f3238fd1db7dcaf4e","60a9f28b0fb727587b7b8fd326a86685","5deb33f73ddf3ce8592207a1017b39cd","4029583855e92b84363f6609bd578bd1b4bafb3aae479f0dbf4da2e15ce569f2","38f1800a2d870841093394535cae3690b51ae08a954e9e9b2a0bc86de4a8e338","2e9a2e5098bf7140b2279fb2825ea77af576f36a93f36cad7938f4588d234d3a","08042ae79e699583602ae7a55d7e2b3d945921d2")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("e14a5d6a959ff1aa4bde3ff3b6ca9b36929afabc","d54bc7736523279da8b58b561df85278","b0dbef65d1c3575f0e4fe6c466a952deeed804a1","99331a27afa84009e140880a8739d96f97baa1676d67ba7a3278fe61bfb79022","7491f5a975f3b6f71beb4ae5d6d1e2db","7088f6ff79b3be4640f2663f3238fd1db7dcaf4e","60a9f28b0fb727587b7b8fd326a86685","5deb33f73ddf3ce8592207a1017b39cd","4029583855e92b84363f6609bd578bd1b4bafb3aae479f0dbf4da2e15ce569f2","38f1800a2d870841093394535cae3690b51ae08a954e9e9b2a0bc86de4a8e338","2e9a2e5098bf7140b2279fb2825ea77af576f36a93f36cad7938f4588d234d3a","08042ae79e699583602ae7a55d7e2b3d945921d2")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("e14a5d6a959ff1aa4bde3ff3b6ca9b36929afabc","d54bc7736523279da8b58b561df85278","b0dbef65d1c3575f0e4fe6c466a952deeed804a1","99331a27afa84009e140880a8739d96f97baa1676d67ba7a3278fe61bfb79022","7491f5a975f3b6f71beb4ae5d6d1e2db","7088f6ff79b3be4640f2663f3238fd1db7dcaf4e","60a9f28b0fb727587b7b8fd326a86685","5deb33f73ddf3ce8592207a1017b39cd","4029583855e92b84363f6609bd578bd1b4bafb3aae479f0dbf4da2e15ce569f2","38f1800a2d870841093394535cae3690b51ae08a954e9e9b2a0bc86de4a8e338","2e9a2e5098bf7140b2279fb2825ea77af576f36a93f36cad7938f4588d234d3a","08042ae79e699583602ae7a55d7e2b3d945921d2")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("e14a5d6a959ff1aa4bde3ff3b6ca9b36929afabc","d54bc7736523279da8b58b561df85278","b0dbef65d1c3575f0e4fe6c466a952deeed804a1","99331a27afa84009e140880a8739d96f97baa1676d67ba7a3278fe61bfb79022","7491f5a975f3b6f71beb4ae5d6d1e2db","7088f6ff79b3be4640f2663f3238fd1db7dcaf4e","60a9f28b0fb727587b7b8fd326a86685","5deb33f73ddf3ce8592207a1017b39cd","4029583855e92b84363f6609bd578bd1b4bafb3aae479f0dbf4da2e15ce569f2","38f1800a2d870841093394535cae3690b51ae08a954e9e9b2a0bc86de4a8e338","2e9a2e5098bf7140b2279fb2825ea77af576f36a93f36cad7938f4588d234d3a","08042ae79e699583602ae7a55d7e2b3d945921d2")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("e14a5d6a959ff1aa4bde3ff3b6ca9b36929afabc","d54bc7736523279da8b58b561df85278","b0dbef65d1c3575f0e4fe6c466a952deeed804a1","99331a27afa84009e140880a8739d96f97baa1676d67ba7a3278fe61bfb79022","7491f5a975f3b6f71beb4ae5d6d1e2db","7088f6ff79b3be4640f2663f3238fd1db7dcaf4e","60a9f28b0fb727587b7b8fd326a86685","5deb33f73ddf3ce8592207a1017b39cd","4029583855e92b84363f6609bd578bd1b4bafb3aae479f0dbf4da2e15ce569f2","38f1800a2d870841093394535cae3690b51ae08a954e9e9b2a0bc86de4a8e338","2e9a2e5098bf7140b2279fb2825ea77af576f36a93f36cad7938f4588d234d3a","08042ae79e699583602ae7a55d7e2b3d945921d2")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("e14a5d6a959ff1aa4bde3ff3b6ca9b36929afabc","d54bc7736523279da8b58b561df85278","b0dbef65d1c3575f0e4fe6c466a952deeed804a1","99331a27afa84009e140880a8739d96f97baa1676d67ba7a3278fe61bfb79022","7491f5a975f3b6f71beb4ae5d6d1e2db","7088f6ff79b3be4640f2663f3238fd1db7dcaf4e","60a9f28b0fb727587b7b8fd326a86685","5deb33f73ddf3ce8592207a1017b39cd","4029583855e92b84363f6609bd578bd1b4bafb3aae479f0dbf4da2e15ce569f2","38f1800a2d870841093394535cae3690b51ae08a954e9e9b2a0bc86de4a8e338","2e9a2e5098bf7140b2279fb2825ea77af576f36a93f36cad7938f4588d234d3a","08042ae79e699583602ae7a55d7e2b3d945921d2")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("e14a5d6a959ff1aa4bde3ff3b6ca9b36929afabc","d54bc7736523279da8b58b561df85278","b0dbef65d1c3575f0e4fe6c466a952deeed804a1","99331a27afa84009e140880a8739d96f97baa1676d67ba7a3278fe61bfb79022","7491f5a975f3b6f71beb4ae5d6d1e2db","7088f6ff79b3be4640f2663f3238fd1db7dcaf4e","60a9f28b0fb727587b7b8fd326a86685","5deb33f73ddf3ce8592207a1017b39cd","4029583855e92b84363f6609bd578bd1b4bafb3aae479f0dbf4da2e15ce569f2","38f1800a2d870841093394535cae3690b51ae08a954e9e9b2a0bc86de4a8e338","2e9a2e5098bf7140b2279fb2825ea77af576f36a93f36cad7938f4588d234d3a","08042ae79e699583602ae7a55d7e2b3d945921d2")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("e14a5d6a959ff1aa4bde3ff3b6ca9b36929afabc","d54bc7736523279da8b58b561df85278","b0dbef65d1c3575f0e4fe6c466a952deeed804a1","99331a27afa84009e140880a8739d96f97baa1676d67ba7a3278fe61bfb79022","7491f5a975f3b6f71beb4ae5d6d1e2db","7088f6ff79b3be4640f2663f3238fd1db7dcaf4e","60a9f28b0fb727587b7b8fd326a86685","5deb33f73ddf3ce8592207a1017b39cd","4029583855e92b84363f6609bd578bd1b4bafb3aae479f0dbf4da2e15ce569f2","38f1800a2d870841093394535cae3690b51ae08a954e9e9b2a0bc86de4a8e338","2e9a2e5098bf7140b2279fb2825ea77af576f36a93f36cad7938f4588d234d3a","08042ae79e699583602ae7a55d7e2b3d945921d2")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("e14a5d6a959ff1aa4bde3ff3b6ca9b36929afabc","d54bc7736523279da8b58b561df85278","b0dbef65d1c3575f0e4fe6c466a952deeed804a1","99331a27afa84009e140880a8739d96f97baa1676d67ba7a3278fe61bfb79022","7491f5a975f3b6f71beb4ae5d6d1e2db","7088f6ff79b3be4640f2663f3238fd1db7dcaf4e","60a9f28b0fb727587b7b8fd326a86685","5deb33f73ddf3ce8592207a1017b39cd","4029583855e92b84363f6609bd578bd1b4bafb3aae479f0dbf4da2e15ce569f2","38f1800a2d870841093394535cae3690b51ae08a954e9e9b2a0bc86de4a8e338","2e9a2e5098bf7140b2279fb2825ea77af576f36a93f36cad7938f4588d234d3a","08042ae79e699583602ae7a55d7e2b3d945921d2")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("e14a5d6a959ff1aa4bde3ff3b6ca9b36929afabc","d54bc7736523279da8b58b561df85278","b0dbef65d1c3575f0e4fe6c466a952deeed804a1","99331a27afa84009e140880a8739d96f97baa1676d67ba7a3278fe61bfb79022","7491f5a975f3b6f71beb4ae5d6d1e2db","7088f6ff79b3be4640f2663f3238fd1db7dcaf4e","60a9f28b0fb727587b7b8fd326a86685","5deb33f73ddf3ce8592207a1017b39cd","4029583855e92b84363f6609bd578bd1b4bafb3aae479f0dbf4da2e15ce569f2","38f1800a2d870841093394535cae3690b51ae08a954e9e9b2a0bc86de4a8e338","2e9a2e5098bf7140b2279fb2825ea77af576f36a93f36cad7938f4588d234d3a","08042ae79e699583602ae7a55d7e2b3d945921d2")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("e14a5d6a959ff1aa4bde3ff3b6ca9b36929afabc","d54bc7736523279da8b58b561df85278","b0dbef65d1c3575f0e4fe6c466a952deeed804a1","99331a27afa84009e140880a8739d96f97baa1676d67ba7a3278fe61bfb79022","7491f5a975f3b6f71beb4ae5d6d1e2db","7088f6ff79b3be4640f2663f3238fd1db7dcaf4e","60a9f28b0fb727587b7b8fd326a86685","5deb33f73ddf3ce8592207a1017b39cd","4029583855e92b84363f6609bd578bd1b4bafb3aae479f0dbf4da2e15ce569f2","38f1800a2d870841093394535cae3690b51ae08a954e9e9b2a0bc86de4a8e338","2e9a2e5098bf7140b2279fb2825ea77af576f36a93f36cad7938f4588d234d3a","08042ae79e699583602ae7a55d7e2b3d945921d2")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("e14a5d6a959ff1aa4bde3ff3b6ca9b36929afabc","d54bc7736523279da8b58b561df85278","b0dbef65d1c3575f0e4fe6c466a952deeed804a1","99331a27afa84009e140880a8739d96f97baa1676d67ba7a3278fe61bfb79022","7491f5a975f3b6f71beb4ae5d6d1e2db","7088f6ff79b3be4640f2663f3238fd1db7dcaf4e","60a9f28b0fb727587b7b8fd326a86685","5deb33f73ddf3ce8592207a1017b39cd","4029583855e92b84363f6609bd578bd1b4bafb3aae479f0dbf4da2e15ce569f2","38f1800a2d870841093394535cae3690b51ae08a954e9e9b2a0bc86de4a8e338","2e9a2e5098bf7140b2279fb2825ea77af576f36a93f36cad7938f4588d234d3a","08042ae79e699583602ae7a55d7e2b3d945921d2")
