index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("c55b8ebf5ec4c76fb9182e86cb2a29eb363d919c","9a875f6ce282e8009aa9432784f8124067032c99","ae7ab96520de3a18e5e111b5eaab095312d7fe84","412f10aad96fd78da6736387e2c84931ac20313f","0000d38a234679f88dd6343d34e26dcb50c30000","47cbbfee58e6a134d00ea3a8f1ddfff60a8d94d6","b60c32fb28aa6160df6f472f494f162b997aa49fb06776dce250aff80602a8a3")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("c55b8ebf5ec4c76fb9182e86cb2a29eb363d919c","9a875f6ce282e8009aa9432784f8124067032c99","ae7ab96520de3a18e5e111b5eaab095312d7fe84","412f10aad96fd78da6736387e2c84931ac20313f","0000d38a234679f88dd6343d34e26dcb50c30000","47cbbfee58e6a134d00ea3a8f1ddfff60a8d94d6","b60c32fb28aa6160df6f472f494f162b997aa49fb06776dce250aff80602a8a3")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("c55b8ebf5ec4c76fb9182e86cb2a29eb363d919c","9a875f6ce282e8009aa9432784f8124067032c99","ae7ab96520de3a18e5e111b5eaab095312d7fe84","412f10aad96fd78da6736387e2c84931ac20313f","0000d38a234679f88dd6343d34e26dcb50c30000","47cbbfee58e6a134d00ea3a8f1ddfff60a8d94d6","b60c32fb28aa6160df6f472f494f162b997aa49fb06776dce250aff80602a8a3")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring64 NOT NULL AND customstring64 IN ("c55b8ebf5ec4c76fb9182e86cb2a29eb363d919c","9a875f6ce282e8009aa9432784f8124067032c99","ae7ab96520de3a18e5e111b5eaab095312d7fe84","412f10aad96fd78da6736387e2c84931ac20313f","0000d38a234679f88dd6343d34e26dcb50c30000","47cbbfee58e6a134d00ea3a8f1ddfff60a8d94d6","b60c32fb28aa6160df6f472f494f162b997aa49fb06776dce250aff80602a8a3")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("c55b8ebf5ec4c76fb9182e86cb2a29eb363d919c","9a875f6ce282e8009aa9432784f8124067032c99","ae7ab96520de3a18e5e111b5eaab095312d7fe84","412f10aad96fd78da6736387e2c84931ac20313f","0000d38a234679f88dd6343d34e26dcb50c30000","47cbbfee58e6a134d00ea3a8f1ddfff60a8d94d6","b60c32fb28aa6160df6f472f494f162b997aa49fb06776dce250aff80602a8a3")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("c55b8ebf5ec4c76fb9182e86cb2a29eb363d919c","9a875f6ce282e8009aa9432784f8124067032c99","ae7ab96520de3a18e5e111b5eaab095312d7fe84","412f10aad96fd78da6736387e2c84931ac20313f","0000d38a234679f88dd6343d34e26dcb50c30000","47cbbfee58e6a134d00ea3a8f1ddfff60a8d94d6","b60c32fb28aa6160df6f472f494f162b997aa49fb06776dce250aff80602a8a3")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("c55b8ebf5ec4c76fb9182e86cb2a29eb363d919c","9a875f6ce282e8009aa9432784f8124067032c99","ae7ab96520de3a18e5e111b5eaab095312d7fe84","412f10aad96fd78da6736387e2c84931ac20313f","0000d38a234679f88dd6343d34e26dcb50c30000","47cbbfee58e6a134d00ea3a8f1ddfff60a8d94d6","b60c32fb28aa6160df6f472f494f162b997aa49fb06776dce250aff80602a8a3")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("c55b8ebf5ec4c76fb9182e86cb2a29eb363d919c","9a875f6ce282e8009aa9432784f8124067032c99","ae7ab96520de3a18e5e111b5eaab095312d7fe84","412f10aad96fd78da6736387e2c84931ac20313f","0000d38a234679f88dd6343d34e26dcb50c30000","47cbbfee58e6a134d00ea3a8f1ddfff60a8d94d6","b60c32fb28aa6160df6f472f494f162b997aa49fb06776dce250aff80602a8a3")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("c55b8ebf5ec4c76fb9182e86cb2a29eb363d919c","9a875f6ce282e8009aa9432784f8124067032c99","ae7ab96520de3a18e5e111b5eaab095312d7fe84","412f10aad96fd78da6736387e2c84931ac20313f","0000d38a234679f88dd6343d34e26dcb50c30000","47cbbfee58e6a134d00ea3a8f1ddfff60a8d94d6","b60c32fb28aa6160df6f472f494f162b997aa49fb06776dce250aff80602a8a3")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("c55b8ebf5ec4c76fb9182e86cb2a29eb363d919c","9a875f6ce282e8009aa9432784f8124067032c99","ae7ab96520de3a18e5e111b5eaab095312d7fe84","412f10aad96fd78da6736387e2c84931ac20313f","0000d38a234679f88dd6343d34e26dcb50c30000","47cbbfee58e6a134d00ea3a8f1ddfff60a8d94d6","b60c32fb28aa6160df6f472f494f162b997aa49fb06776dce250aff80602a8a3")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("c55b8ebf5ec4c76fb9182e86cb2a29eb363d919c","9a875f6ce282e8009aa9432784f8124067032c99","ae7ab96520de3a18e5e111b5eaab095312d7fe84","412f10aad96fd78da6736387e2c84931ac20313f","0000d38a234679f88dd6343d34e26dcb50c30000","47cbbfee58e6a134d00ea3a8f1ddfff60a8d94d6","b60c32fb28aa6160df6f472f494f162b997aa49fb06776dce250aff80602a8a3")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("c55b8ebf5ec4c76fb9182e86cb2a29eb363d919c","9a875f6ce282e8009aa9432784f8124067032c99","ae7ab96520de3a18e5e111b5eaab095312d7fe84","412f10aad96fd78da6736387e2c84931ac20313f","0000d38a234679f88dd6343d34e26dcb50c30000","47cbbfee58e6a134d00ea3a8f1ddfff60a8d94d6","b60c32fb28aa6160df6f472f494f162b997aa49fb06776dce250aff80602a8a3")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("c55b8ebf5ec4c76fb9182e86cb2a29eb363d919c","9a875f6ce282e8009aa9432784f8124067032c99","ae7ab96520de3a18e5e111b5eaab095312d7fe84","412f10aad96fd78da6736387e2c84931ac20313f","0000d38a234679f88dd6343d34e26dcb50c30000","47cbbfee58e6a134d00ea3a8f1ddfff60a8d94d6","b60c32fb28aa6160df6f472f494f162b997aa49fb06776dce250aff80602a8a3")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("c55b8ebf5ec4c76fb9182e86cb2a29eb363d919c","9a875f6ce282e8009aa9432784f8124067032c99","ae7ab96520de3a18e5e111b5eaab095312d7fe84","412f10aad96fd78da6736387e2c84931ac20313f","0000d38a234679f88dd6343d34e26dcb50c30000","47cbbfee58e6a134d00ea3a8f1ddfff60a8d94d6","b60c32fb28aa6160df6f472f494f162b997aa49fb06776dce250aff80602a8a3")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("c55b8ebf5ec4c76fb9182e86cb2a29eb363d919c","9a875f6ce282e8009aa9432784f8124067032c99","ae7ab96520de3a18e5e111b5eaab095312d7fe84","412f10aad96fd78da6736387e2c84931ac20313f","0000d38a234679f88dd6343d34e26dcb50c30000","47cbbfee58e6a134d00ea3a8f1ddfff60a8d94d6","b60c32fb28aa6160df6f472f494f162b997aa49fb06776dce250aff80602a8a3")
index=activity AND rg_functionality="Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("c55b8ebf5ec4c76fb9182e86cb2a29eb363d919c","9a875f6ce282e8009aa9432784f8124067032c99","ae7ab96520de3a18e5e111b5eaab095312d7fe84","412f10aad96fd78da6736387e2c84931ac20313f","0000d38a234679f88dd6343d34e26dcb50c30000","47cbbfee58e6a134d00ea3a8f1ddfff60a8d94d6","b60c32fb28aa6160df6f472f494f162b997aa49fb06776dce250aff80602a8a3")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("c55b8ebf5ec4c76fb9182e86cb2a29eb363d919c","9a875f6ce282e8009aa9432784f8124067032c99","ae7ab96520de3a18e5e111b5eaab095312d7fe84","412f10aad96fd78da6736387e2c84931ac20313f","0000d38a234679f88dd6343d34e26dcb50c30000","47cbbfee58e6a134d00ea3a8f1ddfff60a8d94d6","b60c32fb28aa6160df6f472f494f162b997aa49fb06776dce250aff80602a8a3")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("c55b8ebf5ec4c76fb9182e86cb2a29eb363d919c","9a875f6ce282e8009aa9432784f8124067032c99","ae7ab96520de3a18e5e111b5eaab095312d7fe84","412f10aad96fd78da6736387e2c84931ac20313f","0000d38a234679f88dd6343d34e26dcb50c30000","47cbbfee58e6a134d00ea3a8f1ddfff60a8d94d6","b60c32fb28aa6160df6f472f494f162b997aa49fb06776dce250aff80602a8a3")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("c55b8ebf5ec4c76fb9182e86cb2a29eb363d919c","9a875f6ce282e8009aa9432784f8124067032c99","ae7ab96520de3a18e5e111b5eaab095312d7fe84","412f10aad96fd78da6736387e2c84931ac20313f","0000d38a234679f88dd6343d34e26dcb50c30000","47cbbfee58e6a134d00ea3a8f1ddfff60a8d94d6","b60c32fb28aa6160df6f472f494f162b997aa49fb06776dce250aff80602a8a3")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("c55b8ebf5ec4c76fb9182e86cb2a29eb363d919c","9a875f6ce282e8009aa9432784f8124067032c99","ae7ab96520de3a18e5e111b5eaab095312d7fe84","412f10aad96fd78da6736387e2c84931ac20313f","0000d38a234679f88dd6343d34e26dcb50c30000","47cbbfee58e6a134d00ea3a8f1ddfff60a8d94d6","b60c32fb28aa6160df6f472f494f162b997aa49fb06776dce250aff80602a8a3")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("c55b8ebf5ec4c76fb9182e86cb2a29eb363d919c","9a875f6ce282e8009aa9432784f8124067032c99","ae7ab96520de3a18e5e111b5eaab095312d7fe84","412f10aad96fd78da6736387e2c84931ac20313f","0000d38a234679f88dd6343d34e26dcb50c30000","47cbbfee58e6a134d00ea3a8f1ddfff60a8d94d6","b60c32fb28aa6160df6f472f494f162b997aa49fb06776dce250aff80602a8a3")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("c55b8ebf5ec4c76fb9182e86cb2a29eb363d919c","9a875f6ce282e8009aa9432784f8124067032c99","ae7ab96520de3a18e5e111b5eaab095312d7fe84","412f10aad96fd78da6736387e2c84931ac20313f","0000d38a234679f88dd6343d34e26dcb50c30000","47cbbfee58e6a134d00ea3a8f1ddfff60a8d94d6","b60c32fb28aa6160df6f472f494f162b997aa49fb06776dce250aff80602a8a3")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("c55b8ebf5ec4c76fb9182e86cb2a29eb363d919c","9a875f6ce282e8009aa9432784f8124067032c99","ae7ab96520de3a18e5e111b5eaab095312d7fe84","412f10aad96fd78da6736387e2c84931ac20313f","0000d38a234679f88dd6343d34e26dcb50c30000","47cbbfee58e6a134d00ea3a8f1ddfff60a8d94d6","b60c32fb28aa6160df6f472f494f162b997aa49fb06776dce250aff80602a8a3")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring64 NOT NULL AND customstring64 IN ("c55b8ebf5ec4c76fb9182e86cb2a29eb363d919c","9a875f6ce282e8009aa9432784f8124067032c99","ae7ab96520de3a18e5e111b5eaab095312d7fe84","412f10aad96fd78da6736387e2c84931ac20313f","0000d38a234679f88dd6343d34e26dcb50c30000","47cbbfee58e6a134d00ea3a8f1ddfff60a8d94d6","b60c32fb28aa6160df6f472f494f162b997aa49fb06776dce250aff80602a8a3")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("c55b8ebf5ec4c76fb9182e86cb2a29eb363d919c","9a875f6ce282e8009aa9432784f8124067032c99","ae7ab96520de3a18e5e111b5eaab095312d7fe84","412f10aad96fd78da6736387e2c84931ac20313f","0000d38a234679f88dd6343d34e26dcb50c30000","47cbbfee58e6a134d00ea3a8f1ddfff60a8d94d6","b60c32fb28aa6160df6f472f494f162b997aa49fb06776dce250aff80602a8a3")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("c55b8ebf5ec4c76fb9182e86cb2a29eb363d919c","9a875f6ce282e8009aa9432784f8124067032c99","ae7ab96520de3a18e5e111b5eaab095312d7fe84","412f10aad96fd78da6736387e2c84931ac20313f","0000d38a234679f88dd6343d34e26dcb50c30000","47cbbfee58e6a134d00ea3a8f1ddfff60a8d94d6","b60c32fb28aa6160df6f472f494f162b997aa49fb06776dce250aff80602a8a3")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("c55b8ebf5ec4c76fb9182e86cb2a29eb363d919c","9a875f6ce282e8009aa9432784f8124067032c99","ae7ab96520de3a18e5e111b5eaab095312d7fe84","412f10aad96fd78da6736387e2c84931ac20313f","0000d38a234679f88dd6343d34e26dcb50c30000","47cbbfee58e6a134d00ea3a8f1ddfff60a8d94d6","b60c32fb28aa6160df6f472f494f162b997aa49fb06776dce250aff80602a8a3")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring64 NOT NULL AND customstring64 IN ("c55b8ebf5ec4c76fb9182e86cb2a29eb363d919c","9a875f6ce282e8009aa9432784f8124067032c99","ae7ab96520de3a18e5e111b5eaab095312d7fe84","412f10aad96fd78da6736387e2c84931ac20313f","0000d38a234679f88dd6343d34e26dcb50c30000","47cbbfee58e6a134d00ea3a8f1ddfff60a8d94d6","b60c32fb28aa6160df6f472f494f162b997aa49fb06776dce250aff80602a8a3")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("c55b8ebf5ec4c76fb9182e86cb2a29eb363d919c","9a875f6ce282e8009aa9432784f8124067032c99","ae7ab96520de3a18e5e111b5eaab095312d7fe84","412f10aad96fd78da6736387e2c84931ac20313f","0000d38a234679f88dd6343d34e26dcb50c30000","47cbbfee58e6a134d00ea3a8f1ddfff60a8d94d6","b60c32fb28aa6160df6f472f494f162b997aa49fb06776dce250aff80602a8a3")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("c55b8ebf5ec4c76fb9182e86cb2a29eb363d919c","9a875f6ce282e8009aa9432784f8124067032c99","ae7ab96520de3a18e5e111b5eaab095312d7fe84","412f10aad96fd78da6736387e2c84931ac20313f","0000d38a234679f88dd6343d34e26dcb50c30000","47cbbfee58e6a134d00ea3a8f1ddfff60a8d94d6","b60c32fb28aa6160df6f472f494f162b997aa49fb06776dce250aff80602a8a3")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("c55b8ebf5ec4c76fb9182e86cb2a29eb363d919c","9a875f6ce282e8009aa9432784f8124067032c99","ae7ab96520de3a18e5e111b5eaab095312d7fe84","412f10aad96fd78da6736387e2c84931ac20313f","0000d38a234679f88dd6343d34e26dcb50c30000","47cbbfee58e6a134d00ea3a8f1ddfff60a8d94d6","b60c32fb28aa6160df6f472f494f162b997aa49fb06776dce250aff80602a8a3")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring64 NOT NULL AND customstring64 IN ("c55b8ebf5ec4c76fb9182e86cb2a29eb363d919c","9a875f6ce282e8009aa9432784f8124067032c99","ae7ab96520de3a18e5e111b5eaab095312d7fe84","412f10aad96fd78da6736387e2c84931ac20313f","0000d38a234679f88dd6343d34e26dcb50c30000","47cbbfee58e6a134d00ea3a8f1ddfff60a8d94d6","b60c32fb28aa6160df6f472f494f162b997aa49fb06776dce250aff80602a8a3")
