index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("369042ac123b4933e6649ea3080152fa569f1717e0b9d560b85f0ca2e49373c2","a12933ab47993f5b6d09bec935163c7f077576a8b7b8362e397fe4f1ce4e791c","1f7556682b8f150a15d0e621257bdb05a150d4b9a0bb55b8d872ce1233919c6e","11062ef5f43e936ecd281c850144f8847ac4aef41d442ab8946636cbbe3aa68a","2d72877dc9c873a127599090b11b2fffaa74adc0cc268fec48d802307715c500","3ce30c271c6c0ed4665a6b338453946529df80388cba670278c7537982da65b0","58c3b432a0cb2907079d737b8a6b8d3eb8f66180aedb2ed6daea22a4cec3d2dd","819cda49654a3651c3bb31b2e22cb9e6ae25317caee5277471bc0b1784a27228","9a84a5f14dc96a056655ac9bde6d197f6be3e99ac6186c2247b5e8285df9c331","b1c11a60c9e3dfd7384348ea7560b47808d04801193d42ecbcce8dd1c280a748","b9a0ab6783fc1e24b947c012dde5dc639629ebf7845b0f1fb4045b721be96565","50da5db0df4641a8c9c6604c9ef679d2648d6b79c89f7e61d99174d0ec005d52")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("369042ac123b4933e6649ea3080152fa569f1717e0b9d560b85f0ca2e49373c2","a12933ab47993f5b6d09bec935163c7f077576a8b7b8362e397fe4f1ce4e791c","1f7556682b8f150a15d0e621257bdb05a150d4b9a0bb55b8d872ce1233919c6e","11062ef5f43e936ecd281c850144f8847ac4aef41d442ab8946636cbbe3aa68a","2d72877dc9c873a127599090b11b2fffaa74adc0cc268fec48d802307715c500","3ce30c271c6c0ed4665a6b338453946529df80388cba670278c7537982da65b0","58c3b432a0cb2907079d737b8a6b8d3eb8f66180aedb2ed6daea22a4cec3d2dd","819cda49654a3651c3bb31b2e22cb9e6ae25317caee5277471bc0b1784a27228","9a84a5f14dc96a056655ac9bde6d197f6be3e99ac6186c2247b5e8285df9c331","b1c11a60c9e3dfd7384348ea7560b47808d04801193d42ecbcce8dd1c280a748","b9a0ab6783fc1e24b947c012dde5dc639629ebf7845b0f1fb4045b721be96565","50da5db0df4641a8c9c6604c9ef679d2648d6b79c89f7e61d99174d0ec005d52")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("369042ac123b4933e6649ea3080152fa569f1717e0b9d560b85f0ca2e49373c2","a12933ab47993f5b6d09bec935163c7f077576a8b7b8362e397fe4f1ce4e791c","1f7556682b8f150a15d0e621257bdb05a150d4b9a0bb55b8d872ce1233919c6e","11062ef5f43e936ecd281c850144f8847ac4aef41d442ab8946636cbbe3aa68a","2d72877dc9c873a127599090b11b2fffaa74adc0cc268fec48d802307715c500","3ce30c271c6c0ed4665a6b338453946529df80388cba670278c7537982da65b0","58c3b432a0cb2907079d737b8a6b8d3eb8f66180aedb2ed6daea22a4cec3d2dd","819cda49654a3651c3bb31b2e22cb9e6ae25317caee5277471bc0b1784a27228","9a84a5f14dc96a056655ac9bde6d197f6be3e99ac6186c2247b5e8285df9c331","b1c11a60c9e3dfd7384348ea7560b47808d04801193d42ecbcce8dd1c280a748","b9a0ab6783fc1e24b947c012dde5dc639629ebf7845b0f1fb4045b721be96565","50da5db0df4641a8c9c6604c9ef679d2648d6b79c89f7e61d99174d0ec005d52")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring64 NOT NULL AND customstring64 IN ("369042ac123b4933e6649ea3080152fa569f1717e0b9d560b85f0ca2e49373c2","a12933ab47993f5b6d09bec935163c7f077576a8b7b8362e397fe4f1ce4e791c","1f7556682b8f150a15d0e621257bdb05a150d4b9a0bb55b8d872ce1233919c6e","11062ef5f43e936ecd281c850144f8847ac4aef41d442ab8946636cbbe3aa68a","2d72877dc9c873a127599090b11b2fffaa74adc0cc268fec48d802307715c500","3ce30c271c6c0ed4665a6b338453946529df80388cba670278c7537982da65b0","58c3b432a0cb2907079d737b8a6b8d3eb8f66180aedb2ed6daea22a4cec3d2dd","819cda49654a3651c3bb31b2e22cb9e6ae25317caee5277471bc0b1784a27228","9a84a5f14dc96a056655ac9bde6d197f6be3e99ac6186c2247b5e8285df9c331","b1c11a60c9e3dfd7384348ea7560b47808d04801193d42ecbcce8dd1c280a748","b9a0ab6783fc1e24b947c012dde5dc639629ebf7845b0f1fb4045b721be96565","50da5db0df4641a8c9c6604c9ef679d2648d6b79c89f7e61d99174d0ec005d52")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("369042ac123b4933e6649ea3080152fa569f1717e0b9d560b85f0ca2e49373c2","a12933ab47993f5b6d09bec935163c7f077576a8b7b8362e397fe4f1ce4e791c","1f7556682b8f150a15d0e621257bdb05a150d4b9a0bb55b8d872ce1233919c6e","11062ef5f43e936ecd281c850144f8847ac4aef41d442ab8946636cbbe3aa68a","2d72877dc9c873a127599090b11b2fffaa74adc0cc268fec48d802307715c500","3ce30c271c6c0ed4665a6b338453946529df80388cba670278c7537982da65b0","58c3b432a0cb2907079d737b8a6b8d3eb8f66180aedb2ed6daea22a4cec3d2dd","819cda49654a3651c3bb31b2e22cb9e6ae25317caee5277471bc0b1784a27228","9a84a5f14dc96a056655ac9bde6d197f6be3e99ac6186c2247b5e8285df9c331","b1c11a60c9e3dfd7384348ea7560b47808d04801193d42ecbcce8dd1c280a748","b9a0ab6783fc1e24b947c012dde5dc639629ebf7845b0f1fb4045b721be96565","50da5db0df4641a8c9c6604c9ef679d2648d6b79c89f7e61d99174d0ec005d52")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("369042ac123b4933e6649ea3080152fa569f1717e0b9d560b85f0ca2e49373c2","a12933ab47993f5b6d09bec935163c7f077576a8b7b8362e397fe4f1ce4e791c","1f7556682b8f150a15d0e621257bdb05a150d4b9a0bb55b8d872ce1233919c6e","11062ef5f43e936ecd281c850144f8847ac4aef41d442ab8946636cbbe3aa68a","2d72877dc9c873a127599090b11b2fffaa74adc0cc268fec48d802307715c500","3ce30c271c6c0ed4665a6b338453946529df80388cba670278c7537982da65b0","58c3b432a0cb2907079d737b8a6b8d3eb8f66180aedb2ed6daea22a4cec3d2dd","819cda49654a3651c3bb31b2e22cb9e6ae25317caee5277471bc0b1784a27228","9a84a5f14dc96a056655ac9bde6d197f6be3e99ac6186c2247b5e8285df9c331","b1c11a60c9e3dfd7384348ea7560b47808d04801193d42ecbcce8dd1c280a748","b9a0ab6783fc1e24b947c012dde5dc639629ebf7845b0f1fb4045b721be96565","50da5db0df4641a8c9c6604c9ef679d2648d6b79c89f7e61d99174d0ec005d52")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("369042ac123b4933e6649ea3080152fa569f1717e0b9d560b85f0ca2e49373c2","a12933ab47993f5b6d09bec935163c7f077576a8b7b8362e397fe4f1ce4e791c","1f7556682b8f150a15d0e621257bdb05a150d4b9a0bb55b8d872ce1233919c6e","11062ef5f43e936ecd281c850144f8847ac4aef41d442ab8946636cbbe3aa68a","2d72877dc9c873a127599090b11b2fffaa74adc0cc268fec48d802307715c500","3ce30c271c6c0ed4665a6b338453946529df80388cba670278c7537982da65b0","58c3b432a0cb2907079d737b8a6b8d3eb8f66180aedb2ed6daea22a4cec3d2dd","819cda49654a3651c3bb31b2e22cb9e6ae25317caee5277471bc0b1784a27228","9a84a5f14dc96a056655ac9bde6d197f6be3e99ac6186c2247b5e8285df9c331","b1c11a60c9e3dfd7384348ea7560b47808d04801193d42ecbcce8dd1c280a748","b9a0ab6783fc1e24b947c012dde5dc639629ebf7845b0f1fb4045b721be96565","50da5db0df4641a8c9c6604c9ef679d2648d6b79c89f7e61d99174d0ec005d52")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("369042ac123b4933e6649ea3080152fa569f1717e0b9d560b85f0ca2e49373c2","a12933ab47993f5b6d09bec935163c7f077576a8b7b8362e397fe4f1ce4e791c","1f7556682b8f150a15d0e621257bdb05a150d4b9a0bb55b8d872ce1233919c6e","11062ef5f43e936ecd281c850144f8847ac4aef41d442ab8946636cbbe3aa68a","2d72877dc9c873a127599090b11b2fffaa74adc0cc268fec48d802307715c500","3ce30c271c6c0ed4665a6b338453946529df80388cba670278c7537982da65b0","58c3b432a0cb2907079d737b8a6b8d3eb8f66180aedb2ed6daea22a4cec3d2dd","819cda49654a3651c3bb31b2e22cb9e6ae25317caee5277471bc0b1784a27228","9a84a5f14dc96a056655ac9bde6d197f6be3e99ac6186c2247b5e8285df9c331","b1c11a60c9e3dfd7384348ea7560b47808d04801193d42ecbcce8dd1c280a748","b9a0ab6783fc1e24b947c012dde5dc639629ebf7845b0f1fb4045b721be96565","50da5db0df4641a8c9c6604c9ef679d2648d6b79c89f7e61d99174d0ec005d52")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("369042ac123b4933e6649ea3080152fa569f1717e0b9d560b85f0ca2e49373c2","a12933ab47993f5b6d09bec935163c7f077576a8b7b8362e397fe4f1ce4e791c","1f7556682b8f150a15d0e621257bdb05a150d4b9a0bb55b8d872ce1233919c6e","11062ef5f43e936ecd281c850144f8847ac4aef41d442ab8946636cbbe3aa68a","2d72877dc9c873a127599090b11b2fffaa74adc0cc268fec48d802307715c500","3ce30c271c6c0ed4665a6b338453946529df80388cba670278c7537982da65b0","58c3b432a0cb2907079d737b8a6b8d3eb8f66180aedb2ed6daea22a4cec3d2dd","819cda49654a3651c3bb31b2e22cb9e6ae25317caee5277471bc0b1784a27228","9a84a5f14dc96a056655ac9bde6d197f6be3e99ac6186c2247b5e8285df9c331","b1c11a60c9e3dfd7384348ea7560b47808d04801193d42ecbcce8dd1c280a748","b9a0ab6783fc1e24b947c012dde5dc639629ebf7845b0f1fb4045b721be96565","50da5db0df4641a8c9c6604c9ef679d2648d6b79c89f7e61d99174d0ec005d52")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("369042ac123b4933e6649ea3080152fa569f1717e0b9d560b85f0ca2e49373c2","a12933ab47993f5b6d09bec935163c7f077576a8b7b8362e397fe4f1ce4e791c","1f7556682b8f150a15d0e621257bdb05a150d4b9a0bb55b8d872ce1233919c6e","11062ef5f43e936ecd281c850144f8847ac4aef41d442ab8946636cbbe3aa68a","2d72877dc9c873a127599090b11b2fffaa74adc0cc268fec48d802307715c500","3ce30c271c6c0ed4665a6b338453946529df80388cba670278c7537982da65b0","58c3b432a0cb2907079d737b8a6b8d3eb8f66180aedb2ed6daea22a4cec3d2dd","819cda49654a3651c3bb31b2e22cb9e6ae25317caee5277471bc0b1784a27228","9a84a5f14dc96a056655ac9bde6d197f6be3e99ac6186c2247b5e8285df9c331","b1c11a60c9e3dfd7384348ea7560b47808d04801193d42ecbcce8dd1c280a748","b9a0ab6783fc1e24b947c012dde5dc639629ebf7845b0f1fb4045b721be96565","50da5db0df4641a8c9c6604c9ef679d2648d6b79c89f7e61d99174d0ec005d52")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("369042ac123b4933e6649ea3080152fa569f1717e0b9d560b85f0ca2e49373c2","a12933ab47993f5b6d09bec935163c7f077576a8b7b8362e397fe4f1ce4e791c","1f7556682b8f150a15d0e621257bdb05a150d4b9a0bb55b8d872ce1233919c6e","11062ef5f43e936ecd281c850144f8847ac4aef41d442ab8946636cbbe3aa68a","2d72877dc9c873a127599090b11b2fffaa74adc0cc268fec48d802307715c500","3ce30c271c6c0ed4665a6b338453946529df80388cba670278c7537982da65b0","58c3b432a0cb2907079d737b8a6b8d3eb8f66180aedb2ed6daea22a4cec3d2dd","819cda49654a3651c3bb31b2e22cb9e6ae25317caee5277471bc0b1784a27228","9a84a5f14dc96a056655ac9bde6d197f6be3e99ac6186c2247b5e8285df9c331","b1c11a60c9e3dfd7384348ea7560b47808d04801193d42ecbcce8dd1c280a748","b9a0ab6783fc1e24b947c012dde5dc639629ebf7845b0f1fb4045b721be96565","50da5db0df4641a8c9c6604c9ef679d2648d6b79c89f7e61d99174d0ec005d52")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("369042ac123b4933e6649ea3080152fa569f1717e0b9d560b85f0ca2e49373c2","a12933ab47993f5b6d09bec935163c7f077576a8b7b8362e397fe4f1ce4e791c","1f7556682b8f150a15d0e621257bdb05a150d4b9a0bb55b8d872ce1233919c6e","11062ef5f43e936ecd281c850144f8847ac4aef41d442ab8946636cbbe3aa68a","2d72877dc9c873a127599090b11b2fffaa74adc0cc268fec48d802307715c500","3ce30c271c6c0ed4665a6b338453946529df80388cba670278c7537982da65b0","58c3b432a0cb2907079d737b8a6b8d3eb8f66180aedb2ed6daea22a4cec3d2dd","819cda49654a3651c3bb31b2e22cb9e6ae25317caee5277471bc0b1784a27228","9a84a5f14dc96a056655ac9bde6d197f6be3e99ac6186c2247b5e8285df9c331","b1c11a60c9e3dfd7384348ea7560b47808d04801193d42ecbcce8dd1c280a748","b9a0ab6783fc1e24b947c012dde5dc639629ebf7845b0f1fb4045b721be96565","50da5db0df4641a8c9c6604c9ef679d2648d6b79c89f7e61d99174d0ec005d52")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("369042ac123b4933e6649ea3080152fa569f1717e0b9d560b85f0ca2e49373c2","a12933ab47993f5b6d09bec935163c7f077576a8b7b8362e397fe4f1ce4e791c","1f7556682b8f150a15d0e621257bdb05a150d4b9a0bb55b8d872ce1233919c6e","11062ef5f43e936ecd281c850144f8847ac4aef41d442ab8946636cbbe3aa68a","2d72877dc9c873a127599090b11b2fffaa74adc0cc268fec48d802307715c500","3ce30c271c6c0ed4665a6b338453946529df80388cba670278c7537982da65b0","58c3b432a0cb2907079d737b8a6b8d3eb8f66180aedb2ed6daea22a4cec3d2dd","819cda49654a3651c3bb31b2e22cb9e6ae25317caee5277471bc0b1784a27228","9a84a5f14dc96a056655ac9bde6d197f6be3e99ac6186c2247b5e8285df9c331","b1c11a60c9e3dfd7384348ea7560b47808d04801193d42ecbcce8dd1c280a748","b9a0ab6783fc1e24b947c012dde5dc639629ebf7845b0f1fb4045b721be96565","50da5db0df4641a8c9c6604c9ef679d2648d6b79c89f7e61d99174d0ec005d52")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("369042ac123b4933e6649ea3080152fa569f1717e0b9d560b85f0ca2e49373c2","a12933ab47993f5b6d09bec935163c7f077576a8b7b8362e397fe4f1ce4e791c","1f7556682b8f150a15d0e621257bdb05a150d4b9a0bb55b8d872ce1233919c6e","11062ef5f43e936ecd281c850144f8847ac4aef41d442ab8946636cbbe3aa68a","2d72877dc9c873a127599090b11b2fffaa74adc0cc268fec48d802307715c500","3ce30c271c6c0ed4665a6b338453946529df80388cba670278c7537982da65b0","58c3b432a0cb2907079d737b8a6b8d3eb8f66180aedb2ed6daea22a4cec3d2dd","819cda49654a3651c3bb31b2e22cb9e6ae25317caee5277471bc0b1784a27228","9a84a5f14dc96a056655ac9bde6d197f6be3e99ac6186c2247b5e8285df9c331","b1c11a60c9e3dfd7384348ea7560b47808d04801193d42ecbcce8dd1c280a748","b9a0ab6783fc1e24b947c012dde5dc639629ebf7845b0f1fb4045b721be96565","50da5db0df4641a8c9c6604c9ef679d2648d6b79c89f7e61d99174d0ec005d52")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("369042ac123b4933e6649ea3080152fa569f1717e0b9d560b85f0ca2e49373c2","a12933ab47993f5b6d09bec935163c7f077576a8b7b8362e397fe4f1ce4e791c","1f7556682b8f150a15d0e621257bdb05a150d4b9a0bb55b8d872ce1233919c6e","11062ef5f43e936ecd281c850144f8847ac4aef41d442ab8946636cbbe3aa68a","2d72877dc9c873a127599090b11b2fffaa74adc0cc268fec48d802307715c500","3ce30c271c6c0ed4665a6b338453946529df80388cba670278c7537982da65b0","58c3b432a0cb2907079d737b8a6b8d3eb8f66180aedb2ed6daea22a4cec3d2dd","819cda49654a3651c3bb31b2e22cb9e6ae25317caee5277471bc0b1784a27228","9a84a5f14dc96a056655ac9bde6d197f6be3e99ac6186c2247b5e8285df9c331","b1c11a60c9e3dfd7384348ea7560b47808d04801193d42ecbcce8dd1c280a748","b9a0ab6783fc1e24b947c012dde5dc639629ebf7845b0f1fb4045b721be96565","50da5db0df4641a8c9c6604c9ef679d2648d6b79c89f7e61d99174d0ec005d52")
index=activity AND rg_functionality="Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("369042ac123b4933e6649ea3080152fa569f1717e0b9d560b85f0ca2e49373c2","a12933ab47993f5b6d09bec935163c7f077576a8b7b8362e397fe4f1ce4e791c","1f7556682b8f150a15d0e621257bdb05a150d4b9a0bb55b8d872ce1233919c6e","11062ef5f43e936ecd281c850144f8847ac4aef41d442ab8946636cbbe3aa68a","2d72877dc9c873a127599090b11b2fffaa74adc0cc268fec48d802307715c500","3ce30c271c6c0ed4665a6b338453946529df80388cba670278c7537982da65b0","58c3b432a0cb2907079d737b8a6b8d3eb8f66180aedb2ed6daea22a4cec3d2dd","819cda49654a3651c3bb31b2e22cb9e6ae25317caee5277471bc0b1784a27228","9a84a5f14dc96a056655ac9bde6d197f6be3e99ac6186c2247b5e8285df9c331","b1c11a60c9e3dfd7384348ea7560b47808d04801193d42ecbcce8dd1c280a748","b9a0ab6783fc1e24b947c012dde5dc639629ebf7845b0f1fb4045b721be96565","50da5db0df4641a8c9c6604c9ef679d2648d6b79c89f7e61d99174d0ec005d52")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("369042ac123b4933e6649ea3080152fa569f1717e0b9d560b85f0ca2e49373c2","a12933ab47993f5b6d09bec935163c7f077576a8b7b8362e397fe4f1ce4e791c","1f7556682b8f150a15d0e621257bdb05a150d4b9a0bb55b8d872ce1233919c6e","11062ef5f43e936ecd281c850144f8847ac4aef41d442ab8946636cbbe3aa68a","2d72877dc9c873a127599090b11b2fffaa74adc0cc268fec48d802307715c500","3ce30c271c6c0ed4665a6b338453946529df80388cba670278c7537982da65b0","58c3b432a0cb2907079d737b8a6b8d3eb8f66180aedb2ed6daea22a4cec3d2dd","819cda49654a3651c3bb31b2e22cb9e6ae25317caee5277471bc0b1784a27228","9a84a5f14dc96a056655ac9bde6d197f6be3e99ac6186c2247b5e8285df9c331","b1c11a60c9e3dfd7384348ea7560b47808d04801193d42ecbcce8dd1c280a748","b9a0ab6783fc1e24b947c012dde5dc639629ebf7845b0f1fb4045b721be96565","50da5db0df4641a8c9c6604c9ef679d2648d6b79c89f7e61d99174d0ec005d52")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("369042ac123b4933e6649ea3080152fa569f1717e0b9d560b85f0ca2e49373c2","a12933ab47993f5b6d09bec935163c7f077576a8b7b8362e397fe4f1ce4e791c","1f7556682b8f150a15d0e621257bdb05a150d4b9a0bb55b8d872ce1233919c6e","11062ef5f43e936ecd281c850144f8847ac4aef41d442ab8946636cbbe3aa68a","2d72877dc9c873a127599090b11b2fffaa74adc0cc268fec48d802307715c500","3ce30c271c6c0ed4665a6b338453946529df80388cba670278c7537982da65b0","58c3b432a0cb2907079d737b8a6b8d3eb8f66180aedb2ed6daea22a4cec3d2dd","819cda49654a3651c3bb31b2e22cb9e6ae25317caee5277471bc0b1784a27228","9a84a5f14dc96a056655ac9bde6d197f6be3e99ac6186c2247b5e8285df9c331","b1c11a60c9e3dfd7384348ea7560b47808d04801193d42ecbcce8dd1c280a748","b9a0ab6783fc1e24b947c012dde5dc639629ebf7845b0f1fb4045b721be96565","50da5db0df4641a8c9c6604c9ef679d2648d6b79c89f7e61d99174d0ec005d52")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("369042ac123b4933e6649ea3080152fa569f1717e0b9d560b85f0ca2e49373c2","a12933ab47993f5b6d09bec935163c7f077576a8b7b8362e397fe4f1ce4e791c","1f7556682b8f150a15d0e621257bdb05a150d4b9a0bb55b8d872ce1233919c6e","11062ef5f43e936ecd281c850144f8847ac4aef41d442ab8946636cbbe3aa68a","2d72877dc9c873a127599090b11b2fffaa74adc0cc268fec48d802307715c500","3ce30c271c6c0ed4665a6b338453946529df80388cba670278c7537982da65b0","58c3b432a0cb2907079d737b8a6b8d3eb8f66180aedb2ed6daea22a4cec3d2dd","819cda49654a3651c3bb31b2e22cb9e6ae25317caee5277471bc0b1784a27228","9a84a5f14dc96a056655ac9bde6d197f6be3e99ac6186c2247b5e8285df9c331","b1c11a60c9e3dfd7384348ea7560b47808d04801193d42ecbcce8dd1c280a748","b9a0ab6783fc1e24b947c012dde5dc639629ebf7845b0f1fb4045b721be96565","50da5db0df4641a8c9c6604c9ef679d2648d6b79c89f7e61d99174d0ec005d52")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("369042ac123b4933e6649ea3080152fa569f1717e0b9d560b85f0ca2e49373c2","a12933ab47993f5b6d09bec935163c7f077576a8b7b8362e397fe4f1ce4e791c","1f7556682b8f150a15d0e621257bdb05a150d4b9a0bb55b8d872ce1233919c6e","11062ef5f43e936ecd281c850144f8847ac4aef41d442ab8946636cbbe3aa68a","2d72877dc9c873a127599090b11b2fffaa74adc0cc268fec48d802307715c500","3ce30c271c6c0ed4665a6b338453946529df80388cba670278c7537982da65b0","58c3b432a0cb2907079d737b8a6b8d3eb8f66180aedb2ed6daea22a4cec3d2dd","819cda49654a3651c3bb31b2e22cb9e6ae25317caee5277471bc0b1784a27228","9a84a5f14dc96a056655ac9bde6d197f6be3e99ac6186c2247b5e8285df9c331","b1c11a60c9e3dfd7384348ea7560b47808d04801193d42ecbcce8dd1c280a748","b9a0ab6783fc1e24b947c012dde5dc639629ebf7845b0f1fb4045b721be96565","50da5db0df4641a8c9c6604c9ef679d2648d6b79c89f7e61d99174d0ec005d52")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("369042ac123b4933e6649ea3080152fa569f1717e0b9d560b85f0ca2e49373c2","a12933ab47993f5b6d09bec935163c7f077576a8b7b8362e397fe4f1ce4e791c","1f7556682b8f150a15d0e621257bdb05a150d4b9a0bb55b8d872ce1233919c6e","11062ef5f43e936ecd281c850144f8847ac4aef41d442ab8946636cbbe3aa68a","2d72877dc9c873a127599090b11b2fffaa74adc0cc268fec48d802307715c500","3ce30c271c6c0ed4665a6b338453946529df80388cba670278c7537982da65b0","58c3b432a0cb2907079d737b8a6b8d3eb8f66180aedb2ed6daea22a4cec3d2dd","819cda49654a3651c3bb31b2e22cb9e6ae25317caee5277471bc0b1784a27228","9a84a5f14dc96a056655ac9bde6d197f6be3e99ac6186c2247b5e8285df9c331","b1c11a60c9e3dfd7384348ea7560b47808d04801193d42ecbcce8dd1c280a748","b9a0ab6783fc1e24b947c012dde5dc639629ebf7845b0f1fb4045b721be96565","50da5db0df4641a8c9c6604c9ef679d2648d6b79c89f7e61d99174d0ec005d52")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("369042ac123b4933e6649ea3080152fa569f1717e0b9d560b85f0ca2e49373c2","a12933ab47993f5b6d09bec935163c7f077576a8b7b8362e397fe4f1ce4e791c","1f7556682b8f150a15d0e621257bdb05a150d4b9a0bb55b8d872ce1233919c6e","11062ef5f43e936ecd281c850144f8847ac4aef41d442ab8946636cbbe3aa68a","2d72877dc9c873a127599090b11b2fffaa74adc0cc268fec48d802307715c500","3ce30c271c6c0ed4665a6b338453946529df80388cba670278c7537982da65b0","58c3b432a0cb2907079d737b8a6b8d3eb8f66180aedb2ed6daea22a4cec3d2dd","819cda49654a3651c3bb31b2e22cb9e6ae25317caee5277471bc0b1784a27228","9a84a5f14dc96a056655ac9bde6d197f6be3e99ac6186c2247b5e8285df9c331","b1c11a60c9e3dfd7384348ea7560b47808d04801193d42ecbcce8dd1c280a748","b9a0ab6783fc1e24b947c012dde5dc639629ebf7845b0f1fb4045b721be96565","50da5db0df4641a8c9c6604c9ef679d2648d6b79c89f7e61d99174d0ec005d52")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("369042ac123b4933e6649ea3080152fa569f1717e0b9d560b85f0ca2e49373c2","a12933ab47993f5b6d09bec935163c7f077576a8b7b8362e397fe4f1ce4e791c","1f7556682b8f150a15d0e621257bdb05a150d4b9a0bb55b8d872ce1233919c6e","11062ef5f43e936ecd281c850144f8847ac4aef41d442ab8946636cbbe3aa68a","2d72877dc9c873a127599090b11b2fffaa74adc0cc268fec48d802307715c500","3ce30c271c6c0ed4665a6b338453946529df80388cba670278c7537982da65b0","58c3b432a0cb2907079d737b8a6b8d3eb8f66180aedb2ed6daea22a4cec3d2dd","819cda49654a3651c3bb31b2e22cb9e6ae25317caee5277471bc0b1784a27228","9a84a5f14dc96a056655ac9bde6d197f6be3e99ac6186c2247b5e8285df9c331","b1c11a60c9e3dfd7384348ea7560b47808d04801193d42ecbcce8dd1c280a748","b9a0ab6783fc1e24b947c012dde5dc639629ebf7845b0f1fb4045b721be96565","50da5db0df4641a8c9c6604c9ef679d2648d6b79c89f7e61d99174d0ec005d52")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring64 NOT NULL AND customstring64 IN ("369042ac123b4933e6649ea3080152fa569f1717e0b9d560b85f0ca2e49373c2","a12933ab47993f5b6d09bec935163c7f077576a8b7b8362e397fe4f1ce4e791c","1f7556682b8f150a15d0e621257bdb05a150d4b9a0bb55b8d872ce1233919c6e","11062ef5f43e936ecd281c850144f8847ac4aef41d442ab8946636cbbe3aa68a","2d72877dc9c873a127599090b11b2fffaa74adc0cc268fec48d802307715c500","3ce30c271c6c0ed4665a6b338453946529df80388cba670278c7537982da65b0","58c3b432a0cb2907079d737b8a6b8d3eb8f66180aedb2ed6daea22a4cec3d2dd","819cda49654a3651c3bb31b2e22cb9e6ae25317caee5277471bc0b1784a27228","9a84a5f14dc96a056655ac9bde6d197f6be3e99ac6186c2247b5e8285df9c331","b1c11a60c9e3dfd7384348ea7560b47808d04801193d42ecbcce8dd1c280a748","b9a0ab6783fc1e24b947c012dde5dc639629ebf7845b0f1fb4045b721be96565","50da5db0df4641a8c9c6604c9ef679d2648d6b79c89f7e61d99174d0ec005d52")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("369042ac123b4933e6649ea3080152fa569f1717e0b9d560b85f0ca2e49373c2","a12933ab47993f5b6d09bec935163c7f077576a8b7b8362e397fe4f1ce4e791c","1f7556682b8f150a15d0e621257bdb05a150d4b9a0bb55b8d872ce1233919c6e","11062ef5f43e936ecd281c850144f8847ac4aef41d442ab8946636cbbe3aa68a","2d72877dc9c873a127599090b11b2fffaa74adc0cc268fec48d802307715c500","3ce30c271c6c0ed4665a6b338453946529df80388cba670278c7537982da65b0","58c3b432a0cb2907079d737b8a6b8d3eb8f66180aedb2ed6daea22a4cec3d2dd","819cda49654a3651c3bb31b2e22cb9e6ae25317caee5277471bc0b1784a27228","9a84a5f14dc96a056655ac9bde6d197f6be3e99ac6186c2247b5e8285df9c331","b1c11a60c9e3dfd7384348ea7560b47808d04801193d42ecbcce8dd1c280a748","b9a0ab6783fc1e24b947c012dde5dc639629ebf7845b0f1fb4045b721be96565","50da5db0df4641a8c9c6604c9ef679d2648d6b79c89f7e61d99174d0ec005d52")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("369042ac123b4933e6649ea3080152fa569f1717e0b9d560b85f0ca2e49373c2","a12933ab47993f5b6d09bec935163c7f077576a8b7b8362e397fe4f1ce4e791c","1f7556682b8f150a15d0e621257bdb05a150d4b9a0bb55b8d872ce1233919c6e","11062ef5f43e936ecd281c850144f8847ac4aef41d442ab8946636cbbe3aa68a","2d72877dc9c873a127599090b11b2fffaa74adc0cc268fec48d802307715c500","3ce30c271c6c0ed4665a6b338453946529df80388cba670278c7537982da65b0","58c3b432a0cb2907079d737b8a6b8d3eb8f66180aedb2ed6daea22a4cec3d2dd","819cda49654a3651c3bb31b2e22cb9e6ae25317caee5277471bc0b1784a27228","9a84a5f14dc96a056655ac9bde6d197f6be3e99ac6186c2247b5e8285df9c331","b1c11a60c9e3dfd7384348ea7560b47808d04801193d42ecbcce8dd1c280a748","b9a0ab6783fc1e24b947c012dde5dc639629ebf7845b0f1fb4045b721be96565","50da5db0df4641a8c9c6604c9ef679d2648d6b79c89f7e61d99174d0ec005d52")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("369042ac123b4933e6649ea3080152fa569f1717e0b9d560b85f0ca2e49373c2","a12933ab47993f5b6d09bec935163c7f077576a8b7b8362e397fe4f1ce4e791c","1f7556682b8f150a15d0e621257bdb05a150d4b9a0bb55b8d872ce1233919c6e","11062ef5f43e936ecd281c850144f8847ac4aef41d442ab8946636cbbe3aa68a","2d72877dc9c873a127599090b11b2fffaa74adc0cc268fec48d802307715c500","3ce30c271c6c0ed4665a6b338453946529df80388cba670278c7537982da65b0","58c3b432a0cb2907079d737b8a6b8d3eb8f66180aedb2ed6daea22a4cec3d2dd","819cda49654a3651c3bb31b2e22cb9e6ae25317caee5277471bc0b1784a27228","9a84a5f14dc96a056655ac9bde6d197f6be3e99ac6186c2247b5e8285df9c331","b1c11a60c9e3dfd7384348ea7560b47808d04801193d42ecbcce8dd1c280a748","b9a0ab6783fc1e24b947c012dde5dc639629ebf7845b0f1fb4045b721be96565","50da5db0df4641a8c9c6604c9ef679d2648d6b79c89f7e61d99174d0ec005d52")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring64 NOT NULL AND customstring64 IN ("369042ac123b4933e6649ea3080152fa569f1717e0b9d560b85f0ca2e49373c2","a12933ab47993f5b6d09bec935163c7f077576a8b7b8362e397fe4f1ce4e791c","1f7556682b8f150a15d0e621257bdb05a150d4b9a0bb55b8d872ce1233919c6e","11062ef5f43e936ecd281c850144f8847ac4aef41d442ab8946636cbbe3aa68a","2d72877dc9c873a127599090b11b2fffaa74adc0cc268fec48d802307715c500","3ce30c271c6c0ed4665a6b338453946529df80388cba670278c7537982da65b0","58c3b432a0cb2907079d737b8a6b8d3eb8f66180aedb2ed6daea22a4cec3d2dd","819cda49654a3651c3bb31b2e22cb9e6ae25317caee5277471bc0b1784a27228","9a84a5f14dc96a056655ac9bde6d197f6be3e99ac6186c2247b5e8285df9c331","b1c11a60c9e3dfd7384348ea7560b47808d04801193d42ecbcce8dd1c280a748","b9a0ab6783fc1e24b947c012dde5dc639629ebf7845b0f1fb4045b721be96565","50da5db0df4641a8c9c6604c9ef679d2648d6b79c89f7e61d99174d0ec005d52")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("369042ac123b4933e6649ea3080152fa569f1717e0b9d560b85f0ca2e49373c2","a12933ab47993f5b6d09bec935163c7f077576a8b7b8362e397fe4f1ce4e791c","1f7556682b8f150a15d0e621257bdb05a150d4b9a0bb55b8d872ce1233919c6e","11062ef5f43e936ecd281c850144f8847ac4aef41d442ab8946636cbbe3aa68a","2d72877dc9c873a127599090b11b2fffaa74adc0cc268fec48d802307715c500","3ce30c271c6c0ed4665a6b338453946529df80388cba670278c7537982da65b0","58c3b432a0cb2907079d737b8a6b8d3eb8f66180aedb2ed6daea22a4cec3d2dd","819cda49654a3651c3bb31b2e22cb9e6ae25317caee5277471bc0b1784a27228","9a84a5f14dc96a056655ac9bde6d197f6be3e99ac6186c2247b5e8285df9c331","b1c11a60c9e3dfd7384348ea7560b47808d04801193d42ecbcce8dd1c280a748","b9a0ab6783fc1e24b947c012dde5dc639629ebf7845b0f1fb4045b721be96565","50da5db0df4641a8c9c6604c9ef679d2648d6b79c89f7e61d99174d0ec005d52")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("369042ac123b4933e6649ea3080152fa569f1717e0b9d560b85f0ca2e49373c2","a12933ab47993f5b6d09bec935163c7f077576a8b7b8362e397fe4f1ce4e791c","1f7556682b8f150a15d0e621257bdb05a150d4b9a0bb55b8d872ce1233919c6e","11062ef5f43e936ecd281c850144f8847ac4aef41d442ab8946636cbbe3aa68a","2d72877dc9c873a127599090b11b2fffaa74adc0cc268fec48d802307715c500","3ce30c271c6c0ed4665a6b338453946529df80388cba670278c7537982da65b0","58c3b432a0cb2907079d737b8a6b8d3eb8f66180aedb2ed6daea22a4cec3d2dd","819cda49654a3651c3bb31b2e22cb9e6ae25317caee5277471bc0b1784a27228","9a84a5f14dc96a056655ac9bde6d197f6be3e99ac6186c2247b5e8285df9c331","b1c11a60c9e3dfd7384348ea7560b47808d04801193d42ecbcce8dd1c280a748","b9a0ab6783fc1e24b947c012dde5dc639629ebf7845b0f1fb4045b721be96565","50da5db0df4641a8c9c6604c9ef679d2648d6b79c89f7e61d99174d0ec005d52")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("369042ac123b4933e6649ea3080152fa569f1717e0b9d560b85f0ca2e49373c2","a12933ab47993f5b6d09bec935163c7f077576a8b7b8362e397fe4f1ce4e791c","1f7556682b8f150a15d0e621257bdb05a150d4b9a0bb55b8d872ce1233919c6e","11062ef5f43e936ecd281c850144f8847ac4aef41d442ab8946636cbbe3aa68a","2d72877dc9c873a127599090b11b2fffaa74adc0cc268fec48d802307715c500","3ce30c271c6c0ed4665a6b338453946529df80388cba670278c7537982da65b0","58c3b432a0cb2907079d737b8a6b8d3eb8f66180aedb2ed6daea22a4cec3d2dd","819cda49654a3651c3bb31b2e22cb9e6ae25317caee5277471bc0b1784a27228","9a84a5f14dc96a056655ac9bde6d197f6be3e99ac6186c2247b5e8285df9c331","b1c11a60c9e3dfd7384348ea7560b47808d04801193d42ecbcce8dd1c280a748","b9a0ab6783fc1e24b947c012dde5dc639629ebf7845b0f1fb4045b721be96565","50da5db0df4641a8c9c6604c9ef679d2648d6b79c89f7e61d99174d0ec005d52")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring64 NOT NULL AND customstring64 IN ("369042ac123b4933e6649ea3080152fa569f1717e0b9d560b85f0ca2e49373c2","a12933ab47993f5b6d09bec935163c7f077576a8b7b8362e397fe4f1ce4e791c","1f7556682b8f150a15d0e621257bdb05a150d4b9a0bb55b8d872ce1233919c6e","11062ef5f43e936ecd281c850144f8847ac4aef41d442ab8946636cbbe3aa68a","2d72877dc9c873a127599090b11b2fffaa74adc0cc268fec48d802307715c500","3ce30c271c6c0ed4665a6b338453946529df80388cba670278c7537982da65b0","58c3b432a0cb2907079d737b8a6b8d3eb8f66180aedb2ed6daea22a4cec3d2dd","819cda49654a3651c3bb31b2e22cb9e6ae25317caee5277471bc0b1784a27228","9a84a5f14dc96a056655ac9bde6d197f6be3e99ac6186c2247b5e8285df9c331","b1c11a60c9e3dfd7384348ea7560b47808d04801193d42ecbcce8dd1c280a748","b9a0ab6783fc1e24b947c012dde5dc639629ebf7845b0f1fb4045b721be96565","50da5db0df4641a8c9c6604c9ef679d2648d6b79c89f7e61d99174d0ec005d52")
