index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("bf5a2450f5287f775c2427590c29c27e28e3662c2f68296c64cdacdb639f3b97","38dea3732044129bd99314de582ba3d58a649c8967fe12b98cd867ca6e349ffe","06adb754096f5853999038c000d8cdafa69bb1696b1011e781ab18bbea6107ce","40fd3597c44d10e201304b80c20dd8f2a1ad1ee1032f90d83d7917e037a1d130","0d16de10ce708b990d1b0ae26ac12792c91864426c88a8c73a475f7f33db014b","dea780f228acbd536b5cbb35efe1a41d18771f6ed987c9d19b175de44f1d566c","98fcabe279d4001b29949d980aa9ae8396b352ef7c4a90b9dbe07650a7d4b797","444986ba74685fde34afbbf6a6963c5f35f12a1a65a705e5184c545a18c080c6","7382cf09d04de58beeba4d71fec9777815924fe66849c89e4230b8f26bff2650","b1355a4eef0c265a9d918cec16f7299f4acc51daf8e3d59ef445cb46914f48ff","dd8377e9c3620d0732bedecd0d219f77f7bcffbc49470a9b7ff22db33fe4a185","d938cb8accbc51046158350155f1af9248fc8459ef2b92be752b93dae77504a6","17dc38bd4e01496a91d82e6de763df6fd94c00eb1e90e0cccd7f07f84b549f43","e314b233b41a5688a4e43f876ccb10718351d3f396b4df623b4ebb0a093be7e0","7860a6e7264839c59506d5d69e40311e0c1e6af11b2351ccffe8d9b09acde9a3","d815e32b7998d3927792e579d4ad8430792ca1043b3570f0ee73855529516d21")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("bf5a2450f5287f775c2427590c29c27e28e3662c2f68296c64cdacdb639f3b97","38dea3732044129bd99314de582ba3d58a649c8967fe12b98cd867ca6e349ffe","06adb754096f5853999038c000d8cdafa69bb1696b1011e781ab18bbea6107ce","40fd3597c44d10e201304b80c20dd8f2a1ad1ee1032f90d83d7917e037a1d130","0d16de10ce708b990d1b0ae26ac12792c91864426c88a8c73a475f7f33db014b","dea780f228acbd536b5cbb35efe1a41d18771f6ed987c9d19b175de44f1d566c","98fcabe279d4001b29949d980aa9ae8396b352ef7c4a90b9dbe07650a7d4b797","444986ba74685fde34afbbf6a6963c5f35f12a1a65a705e5184c545a18c080c6","7382cf09d04de58beeba4d71fec9777815924fe66849c89e4230b8f26bff2650","b1355a4eef0c265a9d918cec16f7299f4acc51daf8e3d59ef445cb46914f48ff","dd8377e9c3620d0732bedecd0d219f77f7bcffbc49470a9b7ff22db33fe4a185","d938cb8accbc51046158350155f1af9248fc8459ef2b92be752b93dae77504a6","17dc38bd4e01496a91d82e6de763df6fd94c00eb1e90e0cccd7f07f84b549f43","e314b233b41a5688a4e43f876ccb10718351d3f396b4df623b4ebb0a093be7e0","7860a6e7264839c59506d5d69e40311e0c1e6af11b2351ccffe8d9b09acde9a3","d815e32b7998d3927792e579d4ad8430792ca1043b3570f0ee73855529516d21")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("bf5a2450f5287f775c2427590c29c27e28e3662c2f68296c64cdacdb639f3b97","38dea3732044129bd99314de582ba3d58a649c8967fe12b98cd867ca6e349ffe","06adb754096f5853999038c000d8cdafa69bb1696b1011e781ab18bbea6107ce","40fd3597c44d10e201304b80c20dd8f2a1ad1ee1032f90d83d7917e037a1d130","0d16de10ce708b990d1b0ae26ac12792c91864426c88a8c73a475f7f33db014b","dea780f228acbd536b5cbb35efe1a41d18771f6ed987c9d19b175de44f1d566c","98fcabe279d4001b29949d980aa9ae8396b352ef7c4a90b9dbe07650a7d4b797","444986ba74685fde34afbbf6a6963c5f35f12a1a65a705e5184c545a18c080c6","7382cf09d04de58beeba4d71fec9777815924fe66849c89e4230b8f26bff2650","b1355a4eef0c265a9d918cec16f7299f4acc51daf8e3d59ef445cb46914f48ff","dd8377e9c3620d0732bedecd0d219f77f7bcffbc49470a9b7ff22db33fe4a185","d938cb8accbc51046158350155f1af9248fc8459ef2b92be752b93dae77504a6","17dc38bd4e01496a91d82e6de763df6fd94c00eb1e90e0cccd7f07f84b549f43","e314b233b41a5688a4e43f876ccb10718351d3f396b4df623b4ebb0a093be7e0","7860a6e7264839c59506d5d69e40311e0c1e6af11b2351ccffe8d9b09acde9a3","d815e32b7998d3927792e579d4ad8430792ca1043b3570f0ee73855529516d21")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring64 NOT NULL AND customstring64 IN ("bf5a2450f5287f775c2427590c29c27e28e3662c2f68296c64cdacdb639f3b97","38dea3732044129bd99314de582ba3d58a649c8967fe12b98cd867ca6e349ffe","06adb754096f5853999038c000d8cdafa69bb1696b1011e781ab18bbea6107ce","40fd3597c44d10e201304b80c20dd8f2a1ad1ee1032f90d83d7917e037a1d130","0d16de10ce708b990d1b0ae26ac12792c91864426c88a8c73a475f7f33db014b","dea780f228acbd536b5cbb35efe1a41d18771f6ed987c9d19b175de44f1d566c","98fcabe279d4001b29949d980aa9ae8396b352ef7c4a90b9dbe07650a7d4b797","444986ba74685fde34afbbf6a6963c5f35f12a1a65a705e5184c545a18c080c6","7382cf09d04de58beeba4d71fec9777815924fe66849c89e4230b8f26bff2650","b1355a4eef0c265a9d918cec16f7299f4acc51daf8e3d59ef445cb46914f48ff","dd8377e9c3620d0732bedecd0d219f77f7bcffbc49470a9b7ff22db33fe4a185","d938cb8accbc51046158350155f1af9248fc8459ef2b92be752b93dae77504a6","17dc38bd4e01496a91d82e6de763df6fd94c00eb1e90e0cccd7f07f84b549f43","e314b233b41a5688a4e43f876ccb10718351d3f396b4df623b4ebb0a093be7e0","7860a6e7264839c59506d5d69e40311e0c1e6af11b2351ccffe8d9b09acde9a3","d815e32b7998d3927792e579d4ad8430792ca1043b3570f0ee73855529516d21")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("bf5a2450f5287f775c2427590c29c27e28e3662c2f68296c64cdacdb639f3b97","38dea3732044129bd99314de582ba3d58a649c8967fe12b98cd867ca6e349ffe","06adb754096f5853999038c000d8cdafa69bb1696b1011e781ab18bbea6107ce","40fd3597c44d10e201304b80c20dd8f2a1ad1ee1032f90d83d7917e037a1d130","0d16de10ce708b990d1b0ae26ac12792c91864426c88a8c73a475f7f33db014b","dea780f228acbd536b5cbb35efe1a41d18771f6ed987c9d19b175de44f1d566c","98fcabe279d4001b29949d980aa9ae8396b352ef7c4a90b9dbe07650a7d4b797","444986ba74685fde34afbbf6a6963c5f35f12a1a65a705e5184c545a18c080c6","7382cf09d04de58beeba4d71fec9777815924fe66849c89e4230b8f26bff2650","b1355a4eef0c265a9d918cec16f7299f4acc51daf8e3d59ef445cb46914f48ff","dd8377e9c3620d0732bedecd0d219f77f7bcffbc49470a9b7ff22db33fe4a185","d938cb8accbc51046158350155f1af9248fc8459ef2b92be752b93dae77504a6","17dc38bd4e01496a91d82e6de763df6fd94c00eb1e90e0cccd7f07f84b549f43","e314b233b41a5688a4e43f876ccb10718351d3f396b4df623b4ebb0a093be7e0","7860a6e7264839c59506d5d69e40311e0c1e6af11b2351ccffe8d9b09acde9a3","d815e32b7998d3927792e579d4ad8430792ca1043b3570f0ee73855529516d21")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("bf5a2450f5287f775c2427590c29c27e28e3662c2f68296c64cdacdb639f3b97","38dea3732044129bd99314de582ba3d58a649c8967fe12b98cd867ca6e349ffe","06adb754096f5853999038c000d8cdafa69bb1696b1011e781ab18bbea6107ce","40fd3597c44d10e201304b80c20dd8f2a1ad1ee1032f90d83d7917e037a1d130","0d16de10ce708b990d1b0ae26ac12792c91864426c88a8c73a475f7f33db014b","dea780f228acbd536b5cbb35efe1a41d18771f6ed987c9d19b175de44f1d566c","98fcabe279d4001b29949d980aa9ae8396b352ef7c4a90b9dbe07650a7d4b797","444986ba74685fde34afbbf6a6963c5f35f12a1a65a705e5184c545a18c080c6","7382cf09d04de58beeba4d71fec9777815924fe66849c89e4230b8f26bff2650","b1355a4eef0c265a9d918cec16f7299f4acc51daf8e3d59ef445cb46914f48ff","dd8377e9c3620d0732bedecd0d219f77f7bcffbc49470a9b7ff22db33fe4a185","d938cb8accbc51046158350155f1af9248fc8459ef2b92be752b93dae77504a6","17dc38bd4e01496a91d82e6de763df6fd94c00eb1e90e0cccd7f07f84b549f43","e314b233b41a5688a4e43f876ccb10718351d3f396b4df623b4ebb0a093be7e0","7860a6e7264839c59506d5d69e40311e0c1e6af11b2351ccffe8d9b09acde9a3","d815e32b7998d3927792e579d4ad8430792ca1043b3570f0ee73855529516d21")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("bf5a2450f5287f775c2427590c29c27e28e3662c2f68296c64cdacdb639f3b97","38dea3732044129bd99314de582ba3d58a649c8967fe12b98cd867ca6e349ffe","06adb754096f5853999038c000d8cdafa69bb1696b1011e781ab18bbea6107ce","40fd3597c44d10e201304b80c20dd8f2a1ad1ee1032f90d83d7917e037a1d130","0d16de10ce708b990d1b0ae26ac12792c91864426c88a8c73a475f7f33db014b","dea780f228acbd536b5cbb35efe1a41d18771f6ed987c9d19b175de44f1d566c","98fcabe279d4001b29949d980aa9ae8396b352ef7c4a90b9dbe07650a7d4b797","444986ba74685fde34afbbf6a6963c5f35f12a1a65a705e5184c545a18c080c6","7382cf09d04de58beeba4d71fec9777815924fe66849c89e4230b8f26bff2650","b1355a4eef0c265a9d918cec16f7299f4acc51daf8e3d59ef445cb46914f48ff","dd8377e9c3620d0732bedecd0d219f77f7bcffbc49470a9b7ff22db33fe4a185","d938cb8accbc51046158350155f1af9248fc8459ef2b92be752b93dae77504a6","17dc38bd4e01496a91d82e6de763df6fd94c00eb1e90e0cccd7f07f84b549f43","e314b233b41a5688a4e43f876ccb10718351d3f396b4df623b4ebb0a093be7e0","7860a6e7264839c59506d5d69e40311e0c1e6af11b2351ccffe8d9b09acde9a3","d815e32b7998d3927792e579d4ad8430792ca1043b3570f0ee73855529516d21")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("bf5a2450f5287f775c2427590c29c27e28e3662c2f68296c64cdacdb639f3b97","38dea3732044129bd99314de582ba3d58a649c8967fe12b98cd867ca6e349ffe","06adb754096f5853999038c000d8cdafa69bb1696b1011e781ab18bbea6107ce","40fd3597c44d10e201304b80c20dd8f2a1ad1ee1032f90d83d7917e037a1d130","0d16de10ce708b990d1b0ae26ac12792c91864426c88a8c73a475f7f33db014b","dea780f228acbd536b5cbb35efe1a41d18771f6ed987c9d19b175de44f1d566c","98fcabe279d4001b29949d980aa9ae8396b352ef7c4a90b9dbe07650a7d4b797","444986ba74685fde34afbbf6a6963c5f35f12a1a65a705e5184c545a18c080c6","7382cf09d04de58beeba4d71fec9777815924fe66849c89e4230b8f26bff2650","b1355a4eef0c265a9d918cec16f7299f4acc51daf8e3d59ef445cb46914f48ff","dd8377e9c3620d0732bedecd0d219f77f7bcffbc49470a9b7ff22db33fe4a185","d938cb8accbc51046158350155f1af9248fc8459ef2b92be752b93dae77504a6","17dc38bd4e01496a91d82e6de763df6fd94c00eb1e90e0cccd7f07f84b549f43","e314b233b41a5688a4e43f876ccb10718351d3f396b4df623b4ebb0a093be7e0","7860a6e7264839c59506d5d69e40311e0c1e6af11b2351ccffe8d9b09acde9a3","d815e32b7998d3927792e579d4ad8430792ca1043b3570f0ee73855529516d21")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("bf5a2450f5287f775c2427590c29c27e28e3662c2f68296c64cdacdb639f3b97","38dea3732044129bd99314de582ba3d58a649c8967fe12b98cd867ca6e349ffe","06adb754096f5853999038c000d8cdafa69bb1696b1011e781ab18bbea6107ce","40fd3597c44d10e201304b80c20dd8f2a1ad1ee1032f90d83d7917e037a1d130","0d16de10ce708b990d1b0ae26ac12792c91864426c88a8c73a475f7f33db014b","dea780f228acbd536b5cbb35efe1a41d18771f6ed987c9d19b175de44f1d566c","98fcabe279d4001b29949d980aa9ae8396b352ef7c4a90b9dbe07650a7d4b797","444986ba74685fde34afbbf6a6963c5f35f12a1a65a705e5184c545a18c080c6","7382cf09d04de58beeba4d71fec9777815924fe66849c89e4230b8f26bff2650","b1355a4eef0c265a9d918cec16f7299f4acc51daf8e3d59ef445cb46914f48ff","dd8377e9c3620d0732bedecd0d219f77f7bcffbc49470a9b7ff22db33fe4a185","d938cb8accbc51046158350155f1af9248fc8459ef2b92be752b93dae77504a6","17dc38bd4e01496a91d82e6de763df6fd94c00eb1e90e0cccd7f07f84b549f43","e314b233b41a5688a4e43f876ccb10718351d3f396b4df623b4ebb0a093be7e0","7860a6e7264839c59506d5d69e40311e0c1e6af11b2351ccffe8d9b09acde9a3","d815e32b7998d3927792e579d4ad8430792ca1043b3570f0ee73855529516d21")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("bf5a2450f5287f775c2427590c29c27e28e3662c2f68296c64cdacdb639f3b97","38dea3732044129bd99314de582ba3d58a649c8967fe12b98cd867ca6e349ffe","06adb754096f5853999038c000d8cdafa69bb1696b1011e781ab18bbea6107ce","40fd3597c44d10e201304b80c20dd8f2a1ad1ee1032f90d83d7917e037a1d130","0d16de10ce708b990d1b0ae26ac12792c91864426c88a8c73a475f7f33db014b","dea780f228acbd536b5cbb35efe1a41d18771f6ed987c9d19b175de44f1d566c","98fcabe279d4001b29949d980aa9ae8396b352ef7c4a90b9dbe07650a7d4b797","444986ba74685fde34afbbf6a6963c5f35f12a1a65a705e5184c545a18c080c6","7382cf09d04de58beeba4d71fec9777815924fe66849c89e4230b8f26bff2650","b1355a4eef0c265a9d918cec16f7299f4acc51daf8e3d59ef445cb46914f48ff","dd8377e9c3620d0732bedecd0d219f77f7bcffbc49470a9b7ff22db33fe4a185","d938cb8accbc51046158350155f1af9248fc8459ef2b92be752b93dae77504a6","17dc38bd4e01496a91d82e6de763df6fd94c00eb1e90e0cccd7f07f84b549f43","e314b233b41a5688a4e43f876ccb10718351d3f396b4df623b4ebb0a093be7e0","7860a6e7264839c59506d5d69e40311e0c1e6af11b2351ccffe8d9b09acde9a3","d815e32b7998d3927792e579d4ad8430792ca1043b3570f0ee73855529516d21")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("bf5a2450f5287f775c2427590c29c27e28e3662c2f68296c64cdacdb639f3b97","38dea3732044129bd99314de582ba3d58a649c8967fe12b98cd867ca6e349ffe","06adb754096f5853999038c000d8cdafa69bb1696b1011e781ab18bbea6107ce","40fd3597c44d10e201304b80c20dd8f2a1ad1ee1032f90d83d7917e037a1d130","0d16de10ce708b990d1b0ae26ac12792c91864426c88a8c73a475f7f33db014b","dea780f228acbd536b5cbb35efe1a41d18771f6ed987c9d19b175de44f1d566c","98fcabe279d4001b29949d980aa9ae8396b352ef7c4a90b9dbe07650a7d4b797","444986ba74685fde34afbbf6a6963c5f35f12a1a65a705e5184c545a18c080c6","7382cf09d04de58beeba4d71fec9777815924fe66849c89e4230b8f26bff2650","b1355a4eef0c265a9d918cec16f7299f4acc51daf8e3d59ef445cb46914f48ff","dd8377e9c3620d0732bedecd0d219f77f7bcffbc49470a9b7ff22db33fe4a185","d938cb8accbc51046158350155f1af9248fc8459ef2b92be752b93dae77504a6","17dc38bd4e01496a91d82e6de763df6fd94c00eb1e90e0cccd7f07f84b549f43","e314b233b41a5688a4e43f876ccb10718351d3f396b4df623b4ebb0a093be7e0","7860a6e7264839c59506d5d69e40311e0c1e6af11b2351ccffe8d9b09acde9a3","d815e32b7998d3927792e579d4ad8430792ca1043b3570f0ee73855529516d21")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("bf5a2450f5287f775c2427590c29c27e28e3662c2f68296c64cdacdb639f3b97","38dea3732044129bd99314de582ba3d58a649c8967fe12b98cd867ca6e349ffe","06adb754096f5853999038c000d8cdafa69bb1696b1011e781ab18bbea6107ce","40fd3597c44d10e201304b80c20dd8f2a1ad1ee1032f90d83d7917e037a1d130","0d16de10ce708b990d1b0ae26ac12792c91864426c88a8c73a475f7f33db014b","dea780f228acbd536b5cbb35efe1a41d18771f6ed987c9d19b175de44f1d566c","98fcabe279d4001b29949d980aa9ae8396b352ef7c4a90b9dbe07650a7d4b797","444986ba74685fde34afbbf6a6963c5f35f12a1a65a705e5184c545a18c080c6","7382cf09d04de58beeba4d71fec9777815924fe66849c89e4230b8f26bff2650","b1355a4eef0c265a9d918cec16f7299f4acc51daf8e3d59ef445cb46914f48ff","dd8377e9c3620d0732bedecd0d219f77f7bcffbc49470a9b7ff22db33fe4a185","d938cb8accbc51046158350155f1af9248fc8459ef2b92be752b93dae77504a6","17dc38bd4e01496a91d82e6de763df6fd94c00eb1e90e0cccd7f07f84b549f43","e314b233b41a5688a4e43f876ccb10718351d3f396b4df623b4ebb0a093be7e0","7860a6e7264839c59506d5d69e40311e0c1e6af11b2351ccffe8d9b09acde9a3","d815e32b7998d3927792e579d4ad8430792ca1043b3570f0ee73855529516d21")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("bf5a2450f5287f775c2427590c29c27e28e3662c2f68296c64cdacdb639f3b97","38dea3732044129bd99314de582ba3d58a649c8967fe12b98cd867ca6e349ffe","06adb754096f5853999038c000d8cdafa69bb1696b1011e781ab18bbea6107ce","40fd3597c44d10e201304b80c20dd8f2a1ad1ee1032f90d83d7917e037a1d130","0d16de10ce708b990d1b0ae26ac12792c91864426c88a8c73a475f7f33db014b","dea780f228acbd536b5cbb35efe1a41d18771f6ed987c9d19b175de44f1d566c","98fcabe279d4001b29949d980aa9ae8396b352ef7c4a90b9dbe07650a7d4b797","444986ba74685fde34afbbf6a6963c5f35f12a1a65a705e5184c545a18c080c6","7382cf09d04de58beeba4d71fec9777815924fe66849c89e4230b8f26bff2650","b1355a4eef0c265a9d918cec16f7299f4acc51daf8e3d59ef445cb46914f48ff","dd8377e9c3620d0732bedecd0d219f77f7bcffbc49470a9b7ff22db33fe4a185","d938cb8accbc51046158350155f1af9248fc8459ef2b92be752b93dae77504a6","17dc38bd4e01496a91d82e6de763df6fd94c00eb1e90e0cccd7f07f84b549f43","e314b233b41a5688a4e43f876ccb10718351d3f396b4df623b4ebb0a093be7e0","7860a6e7264839c59506d5d69e40311e0c1e6af11b2351ccffe8d9b09acde9a3","d815e32b7998d3927792e579d4ad8430792ca1043b3570f0ee73855529516d21")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("bf5a2450f5287f775c2427590c29c27e28e3662c2f68296c64cdacdb639f3b97","38dea3732044129bd99314de582ba3d58a649c8967fe12b98cd867ca6e349ffe","06adb754096f5853999038c000d8cdafa69bb1696b1011e781ab18bbea6107ce","40fd3597c44d10e201304b80c20dd8f2a1ad1ee1032f90d83d7917e037a1d130","0d16de10ce708b990d1b0ae26ac12792c91864426c88a8c73a475f7f33db014b","dea780f228acbd536b5cbb35efe1a41d18771f6ed987c9d19b175de44f1d566c","98fcabe279d4001b29949d980aa9ae8396b352ef7c4a90b9dbe07650a7d4b797","444986ba74685fde34afbbf6a6963c5f35f12a1a65a705e5184c545a18c080c6","7382cf09d04de58beeba4d71fec9777815924fe66849c89e4230b8f26bff2650","b1355a4eef0c265a9d918cec16f7299f4acc51daf8e3d59ef445cb46914f48ff","dd8377e9c3620d0732bedecd0d219f77f7bcffbc49470a9b7ff22db33fe4a185","d938cb8accbc51046158350155f1af9248fc8459ef2b92be752b93dae77504a6","17dc38bd4e01496a91d82e6de763df6fd94c00eb1e90e0cccd7f07f84b549f43","e314b233b41a5688a4e43f876ccb10718351d3f396b4df623b4ebb0a093be7e0","7860a6e7264839c59506d5d69e40311e0c1e6af11b2351ccffe8d9b09acde9a3","d815e32b7998d3927792e579d4ad8430792ca1043b3570f0ee73855529516d21")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("bf5a2450f5287f775c2427590c29c27e28e3662c2f68296c64cdacdb639f3b97","38dea3732044129bd99314de582ba3d58a649c8967fe12b98cd867ca6e349ffe","06adb754096f5853999038c000d8cdafa69bb1696b1011e781ab18bbea6107ce","40fd3597c44d10e201304b80c20dd8f2a1ad1ee1032f90d83d7917e037a1d130","0d16de10ce708b990d1b0ae26ac12792c91864426c88a8c73a475f7f33db014b","dea780f228acbd536b5cbb35efe1a41d18771f6ed987c9d19b175de44f1d566c","98fcabe279d4001b29949d980aa9ae8396b352ef7c4a90b9dbe07650a7d4b797","444986ba74685fde34afbbf6a6963c5f35f12a1a65a705e5184c545a18c080c6","7382cf09d04de58beeba4d71fec9777815924fe66849c89e4230b8f26bff2650","b1355a4eef0c265a9d918cec16f7299f4acc51daf8e3d59ef445cb46914f48ff","dd8377e9c3620d0732bedecd0d219f77f7bcffbc49470a9b7ff22db33fe4a185","d938cb8accbc51046158350155f1af9248fc8459ef2b92be752b93dae77504a6","17dc38bd4e01496a91d82e6de763df6fd94c00eb1e90e0cccd7f07f84b549f43","e314b233b41a5688a4e43f876ccb10718351d3f396b4df623b4ebb0a093be7e0","7860a6e7264839c59506d5d69e40311e0c1e6af11b2351ccffe8d9b09acde9a3","d815e32b7998d3927792e579d4ad8430792ca1043b3570f0ee73855529516d21")
index=activity AND rg_functionality="Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("bf5a2450f5287f775c2427590c29c27e28e3662c2f68296c64cdacdb639f3b97","38dea3732044129bd99314de582ba3d58a649c8967fe12b98cd867ca6e349ffe","06adb754096f5853999038c000d8cdafa69bb1696b1011e781ab18bbea6107ce","40fd3597c44d10e201304b80c20dd8f2a1ad1ee1032f90d83d7917e037a1d130","0d16de10ce708b990d1b0ae26ac12792c91864426c88a8c73a475f7f33db014b","dea780f228acbd536b5cbb35efe1a41d18771f6ed987c9d19b175de44f1d566c","98fcabe279d4001b29949d980aa9ae8396b352ef7c4a90b9dbe07650a7d4b797","444986ba74685fde34afbbf6a6963c5f35f12a1a65a705e5184c545a18c080c6","7382cf09d04de58beeba4d71fec9777815924fe66849c89e4230b8f26bff2650","b1355a4eef0c265a9d918cec16f7299f4acc51daf8e3d59ef445cb46914f48ff","dd8377e9c3620d0732bedecd0d219f77f7bcffbc49470a9b7ff22db33fe4a185","d938cb8accbc51046158350155f1af9248fc8459ef2b92be752b93dae77504a6","17dc38bd4e01496a91d82e6de763df6fd94c00eb1e90e0cccd7f07f84b549f43","e314b233b41a5688a4e43f876ccb10718351d3f396b4df623b4ebb0a093be7e0","7860a6e7264839c59506d5d69e40311e0c1e6af11b2351ccffe8d9b09acde9a3","d815e32b7998d3927792e579d4ad8430792ca1043b3570f0ee73855529516d21")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("bf5a2450f5287f775c2427590c29c27e28e3662c2f68296c64cdacdb639f3b97","38dea3732044129bd99314de582ba3d58a649c8967fe12b98cd867ca6e349ffe","06adb754096f5853999038c000d8cdafa69bb1696b1011e781ab18bbea6107ce","40fd3597c44d10e201304b80c20dd8f2a1ad1ee1032f90d83d7917e037a1d130","0d16de10ce708b990d1b0ae26ac12792c91864426c88a8c73a475f7f33db014b","dea780f228acbd536b5cbb35efe1a41d18771f6ed987c9d19b175de44f1d566c","98fcabe279d4001b29949d980aa9ae8396b352ef7c4a90b9dbe07650a7d4b797","444986ba74685fde34afbbf6a6963c5f35f12a1a65a705e5184c545a18c080c6","7382cf09d04de58beeba4d71fec9777815924fe66849c89e4230b8f26bff2650","b1355a4eef0c265a9d918cec16f7299f4acc51daf8e3d59ef445cb46914f48ff","dd8377e9c3620d0732bedecd0d219f77f7bcffbc49470a9b7ff22db33fe4a185","d938cb8accbc51046158350155f1af9248fc8459ef2b92be752b93dae77504a6","17dc38bd4e01496a91d82e6de763df6fd94c00eb1e90e0cccd7f07f84b549f43","e314b233b41a5688a4e43f876ccb10718351d3f396b4df623b4ebb0a093be7e0","7860a6e7264839c59506d5d69e40311e0c1e6af11b2351ccffe8d9b09acde9a3","d815e32b7998d3927792e579d4ad8430792ca1043b3570f0ee73855529516d21")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("bf5a2450f5287f775c2427590c29c27e28e3662c2f68296c64cdacdb639f3b97","38dea3732044129bd99314de582ba3d58a649c8967fe12b98cd867ca6e349ffe","06adb754096f5853999038c000d8cdafa69bb1696b1011e781ab18bbea6107ce","40fd3597c44d10e201304b80c20dd8f2a1ad1ee1032f90d83d7917e037a1d130","0d16de10ce708b990d1b0ae26ac12792c91864426c88a8c73a475f7f33db014b","dea780f228acbd536b5cbb35efe1a41d18771f6ed987c9d19b175de44f1d566c","98fcabe279d4001b29949d980aa9ae8396b352ef7c4a90b9dbe07650a7d4b797","444986ba74685fde34afbbf6a6963c5f35f12a1a65a705e5184c545a18c080c6","7382cf09d04de58beeba4d71fec9777815924fe66849c89e4230b8f26bff2650","b1355a4eef0c265a9d918cec16f7299f4acc51daf8e3d59ef445cb46914f48ff","dd8377e9c3620d0732bedecd0d219f77f7bcffbc49470a9b7ff22db33fe4a185","d938cb8accbc51046158350155f1af9248fc8459ef2b92be752b93dae77504a6","17dc38bd4e01496a91d82e6de763df6fd94c00eb1e90e0cccd7f07f84b549f43","e314b233b41a5688a4e43f876ccb10718351d3f396b4df623b4ebb0a093be7e0","7860a6e7264839c59506d5d69e40311e0c1e6af11b2351ccffe8d9b09acde9a3","d815e32b7998d3927792e579d4ad8430792ca1043b3570f0ee73855529516d21")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("bf5a2450f5287f775c2427590c29c27e28e3662c2f68296c64cdacdb639f3b97","38dea3732044129bd99314de582ba3d58a649c8967fe12b98cd867ca6e349ffe","06adb754096f5853999038c000d8cdafa69bb1696b1011e781ab18bbea6107ce","40fd3597c44d10e201304b80c20dd8f2a1ad1ee1032f90d83d7917e037a1d130","0d16de10ce708b990d1b0ae26ac12792c91864426c88a8c73a475f7f33db014b","dea780f228acbd536b5cbb35efe1a41d18771f6ed987c9d19b175de44f1d566c","98fcabe279d4001b29949d980aa9ae8396b352ef7c4a90b9dbe07650a7d4b797","444986ba74685fde34afbbf6a6963c5f35f12a1a65a705e5184c545a18c080c6","7382cf09d04de58beeba4d71fec9777815924fe66849c89e4230b8f26bff2650","b1355a4eef0c265a9d918cec16f7299f4acc51daf8e3d59ef445cb46914f48ff","dd8377e9c3620d0732bedecd0d219f77f7bcffbc49470a9b7ff22db33fe4a185","d938cb8accbc51046158350155f1af9248fc8459ef2b92be752b93dae77504a6","17dc38bd4e01496a91d82e6de763df6fd94c00eb1e90e0cccd7f07f84b549f43","e314b233b41a5688a4e43f876ccb10718351d3f396b4df623b4ebb0a093be7e0","7860a6e7264839c59506d5d69e40311e0c1e6af11b2351ccffe8d9b09acde9a3","d815e32b7998d3927792e579d4ad8430792ca1043b3570f0ee73855529516d21")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("bf5a2450f5287f775c2427590c29c27e28e3662c2f68296c64cdacdb639f3b97","38dea3732044129bd99314de582ba3d58a649c8967fe12b98cd867ca6e349ffe","06adb754096f5853999038c000d8cdafa69bb1696b1011e781ab18bbea6107ce","40fd3597c44d10e201304b80c20dd8f2a1ad1ee1032f90d83d7917e037a1d130","0d16de10ce708b990d1b0ae26ac12792c91864426c88a8c73a475f7f33db014b","dea780f228acbd536b5cbb35efe1a41d18771f6ed987c9d19b175de44f1d566c","98fcabe279d4001b29949d980aa9ae8396b352ef7c4a90b9dbe07650a7d4b797","444986ba74685fde34afbbf6a6963c5f35f12a1a65a705e5184c545a18c080c6","7382cf09d04de58beeba4d71fec9777815924fe66849c89e4230b8f26bff2650","b1355a4eef0c265a9d918cec16f7299f4acc51daf8e3d59ef445cb46914f48ff","dd8377e9c3620d0732bedecd0d219f77f7bcffbc49470a9b7ff22db33fe4a185","d938cb8accbc51046158350155f1af9248fc8459ef2b92be752b93dae77504a6","17dc38bd4e01496a91d82e6de763df6fd94c00eb1e90e0cccd7f07f84b549f43","e314b233b41a5688a4e43f876ccb10718351d3f396b4df623b4ebb0a093be7e0","7860a6e7264839c59506d5d69e40311e0c1e6af11b2351ccffe8d9b09acde9a3","d815e32b7998d3927792e579d4ad8430792ca1043b3570f0ee73855529516d21")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("bf5a2450f5287f775c2427590c29c27e28e3662c2f68296c64cdacdb639f3b97","38dea3732044129bd99314de582ba3d58a649c8967fe12b98cd867ca6e349ffe","06adb754096f5853999038c000d8cdafa69bb1696b1011e781ab18bbea6107ce","40fd3597c44d10e201304b80c20dd8f2a1ad1ee1032f90d83d7917e037a1d130","0d16de10ce708b990d1b0ae26ac12792c91864426c88a8c73a475f7f33db014b","dea780f228acbd536b5cbb35efe1a41d18771f6ed987c9d19b175de44f1d566c","98fcabe279d4001b29949d980aa9ae8396b352ef7c4a90b9dbe07650a7d4b797","444986ba74685fde34afbbf6a6963c5f35f12a1a65a705e5184c545a18c080c6","7382cf09d04de58beeba4d71fec9777815924fe66849c89e4230b8f26bff2650","b1355a4eef0c265a9d918cec16f7299f4acc51daf8e3d59ef445cb46914f48ff","dd8377e9c3620d0732bedecd0d219f77f7bcffbc49470a9b7ff22db33fe4a185","d938cb8accbc51046158350155f1af9248fc8459ef2b92be752b93dae77504a6","17dc38bd4e01496a91d82e6de763df6fd94c00eb1e90e0cccd7f07f84b549f43","e314b233b41a5688a4e43f876ccb10718351d3f396b4df623b4ebb0a093be7e0","7860a6e7264839c59506d5d69e40311e0c1e6af11b2351ccffe8d9b09acde9a3","d815e32b7998d3927792e579d4ad8430792ca1043b3570f0ee73855529516d21")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("bf5a2450f5287f775c2427590c29c27e28e3662c2f68296c64cdacdb639f3b97","38dea3732044129bd99314de582ba3d58a649c8967fe12b98cd867ca6e349ffe","06adb754096f5853999038c000d8cdafa69bb1696b1011e781ab18bbea6107ce","40fd3597c44d10e201304b80c20dd8f2a1ad1ee1032f90d83d7917e037a1d130","0d16de10ce708b990d1b0ae26ac12792c91864426c88a8c73a475f7f33db014b","dea780f228acbd536b5cbb35efe1a41d18771f6ed987c9d19b175de44f1d566c","98fcabe279d4001b29949d980aa9ae8396b352ef7c4a90b9dbe07650a7d4b797","444986ba74685fde34afbbf6a6963c5f35f12a1a65a705e5184c545a18c080c6","7382cf09d04de58beeba4d71fec9777815924fe66849c89e4230b8f26bff2650","b1355a4eef0c265a9d918cec16f7299f4acc51daf8e3d59ef445cb46914f48ff","dd8377e9c3620d0732bedecd0d219f77f7bcffbc49470a9b7ff22db33fe4a185","d938cb8accbc51046158350155f1af9248fc8459ef2b92be752b93dae77504a6","17dc38bd4e01496a91d82e6de763df6fd94c00eb1e90e0cccd7f07f84b549f43","e314b233b41a5688a4e43f876ccb10718351d3f396b4df623b4ebb0a093be7e0","7860a6e7264839c59506d5d69e40311e0c1e6af11b2351ccffe8d9b09acde9a3","d815e32b7998d3927792e579d4ad8430792ca1043b3570f0ee73855529516d21")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("bf5a2450f5287f775c2427590c29c27e28e3662c2f68296c64cdacdb639f3b97","38dea3732044129bd99314de582ba3d58a649c8967fe12b98cd867ca6e349ffe","06adb754096f5853999038c000d8cdafa69bb1696b1011e781ab18bbea6107ce","40fd3597c44d10e201304b80c20dd8f2a1ad1ee1032f90d83d7917e037a1d130","0d16de10ce708b990d1b0ae26ac12792c91864426c88a8c73a475f7f33db014b","dea780f228acbd536b5cbb35efe1a41d18771f6ed987c9d19b175de44f1d566c","98fcabe279d4001b29949d980aa9ae8396b352ef7c4a90b9dbe07650a7d4b797","444986ba74685fde34afbbf6a6963c5f35f12a1a65a705e5184c545a18c080c6","7382cf09d04de58beeba4d71fec9777815924fe66849c89e4230b8f26bff2650","b1355a4eef0c265a9d918cec16f7299f4acc51daf8e3d59ef445cb46914f48ff","dd8377e9c3620d0732bedecd0d219f77f7bcffbc49470a9b7ff22db33fe4a185","d938cb8accbc51046158350155f1af9248fc8459ef2b92be752b93dae77504a6","17dc38bd4e01496a91d82e6de763df6fd94c00eb1e90e0cccd7f07f84b549f43","e314b233b41a5688a4e43f876ccb10718351d3f396b4df623b4ebb0a093be7e0","7860a6e7264839c59506d5d69e40311e0c1e6af11b2351ccffe8d9b09acde9a3","d815e32b7998d3927792e579d4ad8430792ca1043b3570f0ee73855529516d21")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring64 NOT NULL AND customstring64 IN ("bf5a2450f5287f775c2427590c29c27e28e3662c2f68296c64cdacdb639f3b97","38dea3732044129bd99314de582ba3d58a649c8967fe12b98cd867ca6e349ffe","06adb754096f5853999038c000d8cdafa69bb1696b1011e781ab18bbea6107ce","40fd3597c44d10e201304b80c20dd8f2a1ad1ee1032f90d83d7917e037a1d130","0d16de10ce708b990d1b0ae26ac12792c91864426c88a8c73a475f7f33db014b","dea780f228acbd536b5cbb35efe1a41d18771f6ed987c9d19b175de44f1d566c","98fcabe279d4001b29949d980aa9ae8396b352ef7c4a90b9dbe07650a7d4b797","444986ba74685fde34afbbf6a6963c5f35f12a1a65a705e5184c545a18c080c6","7382cf09d04de58beeba4d71fec9777815924fe66849c89e4230b8f26bff2650","b1355a4eef0c265a9d918cec16f7299f4acc51daf8e3d59ef445cb46914f48ff","dd8377e9c3620d0732bedecd0d219f77f7bcffbc49470a9b7ff22db33fe4a185","d938cb8accbc51046158350155f1af9248fc8459ef2b92be752b93dae77504a6","17dc38bd4e01496a91d82e6de763df6fd94c00eb1e90e0cccd7f07f84b549f43","e314b233b41a5688a4e43f876ccb10718351d3f396b4df623b4ebb0a093be7e0","7860a6e7264839c59506d5d69e40311e0c1e6af11b2351ccffe8d9b09acde9a3","d815e32b7998d3927792e579d4ad8430792ca1043b3570f0ee73855529516d21")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("bf5a2450f5287f775c2427590c29c27e28e3662c2f68296c64cdacdb639f3b97","38dea3732044129bd99314de582ba3d58a649c8967fe12b98cd867ca6e349ffe","06adb754096f5853999038c000d8cdafa69bb1696b1011e781ab18bbea6107ce","40fd3597c44d10e201304b80c20dd8f2a1ad1ee1032f90d83d7917e037a1d130","0d16de10ce708b990d1b0ae26ac12792c91864426c88a8c73a475f7f33db014b","dea780f228acbd536b5cbb35efe1a41d18771f6ed987c9d19b175de44f1d566c","98fcabe279d4001b29949d980aa9ae8396b352ef7c4a90b9dbe07650a7d4b797","444986ba74685fde34afbbf6a6963c5f35f12a1a65a705e5184c545a18c080c6","7382cf09d04de58beeba4d71fec9777815924fe66849c89e4230b8f26bff2650","b1355a4eef0c265a9d918cec16f7299f4acc51daf8e3d59ef445cb46914f48ff","dd8377e9c3620d0732bedecd0d219f77f7bcffbc49470a9b7ff22db33fe4a185","d938cb8accbc51046158350155f1af9248fc8459ef2b92be752b93dae77504a6","17dc38bd4e01496a91d82e6de763df6fd94c00eb1e90e0cccd7f07f84b549f43","e314b233b41a5688a4e43f876ccb10718351d3f396b4df623b4ebb0a093be7e0","7860a6e7264839c59506d5d69e40311e0c1e6af11b2351ccffe8d9b09acde9a3","d815e32b7998d3927792e579d4ad8430792ca1043b3570f0ee73855529516d21")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("bf5a2450f5287f775c2427590c29c27e28e3662c2f68296c64cdacdb639f3b97","38dea3732044129bd99314de582ba3d58a649c8967fe12b98cd867ca6e349ffe","06adb754096f5853999038c000d8cdafa69bb1696b1011e781ab18bbea6107ce","40fd3597c44d10e201304b80c20dd8f2a1ad1ee1032f90d83d7917e037a1d130","0d16de10ce708b990d1b0ae26ac12792c91864426c88a8c73a475f7f33db014b","dea780f228acbd536b5cbb35efe1a41d18771f6ed987c9d19b175de44f1d566c","98fcabe279d4001b29949d980aa9ae8396b352ef7c4a90b9dbe07650a7d4b797","444986ba74685fde34afbbf6a6963c5f35f12a1a65a705e5184c545a18c080c6","7382cf09d04de58beeba4d71fec9777815924fe66849c89e4230b8f26bff2650","b1355a4eef0c265a9d918cec16f7299f4acc51daf8e3d59ef445cb46914f48ff","dd8377e9c3620d0732bedecd0d219f77f7bcffbc49470a9b7ff22db33fe4a185","d938cb8accbc51046158350155f1af9248fc8459ef2b92be752b93dae77504a6","17dc38bd4e01496a91d82e6de763df6fd94c00eb1e90e0cccd7f07f84b549f43","e314b233b41a5688a4e43f876ccb10718351d3f396b4df623b4ebb0a093be7e0","7860a6e7264839c59506d5d69e40311e0c1e6af11b2351ccffe8d9b09acde9a3","d815e32b7998d3927792e579d4ad8430792ca1043b3570f0ee73855529516d21")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("bf5a2450f5287f775c2427590c29c27e28e3662c2f68296c64cdacdb639f3b97","38dea3732044129bd99314de582ba3d58a649c8967fe12b98cd867ca6e349ffe","06adb754096f5853999038c000d8cdafa69bb1696b1011e781ab18bbea6107ce","40fd3597c44d10e201304b80c20dd8f2a1ad1ee1032f90d83d7917e037a1d130","0d16de10ce708b990d1b0ae26ac12792c91864426c88a8c73a475f7f33db014b","dea780f228acbd536b5cbb35efe1a41d18771f6ed987c9d19b175de44f1d566c","98fcabe279d4001b29949d980aa9ae8396b352ef7c4a90b9dbe07650a7d4b797","444986ba74685fde34afbbf6a6963c5f35f12a1a65a705e5184c545a18c080c6","7382cf09d04de58beeba4d71fec9777815924fe66849c89e4230b8f26bff2650","b1355a4eef0c265a9d918cec16f7299f4acc51daf8e3d59ef445cb46914f48ff","dd8377e9c3620d0732bedecd0d219f77f7bcffbc49470a9b7ff22db33fe4a185","d938cb8accbc51046158350155f1af9248fc8459ef2b92be752b93dae77504a6","17dc38bd4e01496a91d82e6de763df6fd94c00eb1e90e0cccd7f07f84b549f43","e314b233b41a5688a4e43f876ccb10718351d3f396b4df623b4ebb0a093be7e0","7860a6e7264839c59506d5d69e40311e0c1e6af11b2351ccffe8d9b09acde9a3","d815e32b7998d3927792e579d4ad8430792ca1043b3570f0ee73855529516d21")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring64 NOT NULL AND customstring64 IN ("bf5a2450f5287f775c2427590c29c27e28e3662c2f68296c64cdacdb639f3b97","38dea3732044129bd99314de582ba3d58a649c8967fe12b98cd867ca6e349ffe","06adb754096f5853999038c000d8cdafa69bb1696b1011e781ab18bbea6107ce","40fd3597c44d10e201304b80c20dd8f2a1ad1ee1032f90d83d7917e037a1d130","0d16de10ce708b990d1b0ae26ac12792c91864426c88a8c73a475f7f33db014b","dea780f228acbd536b5cbb35efe1a41d18771f6ed987c9d19b175de44f1d566c","98fcabe279d4001b29949d980aa9ae8396b352ef7c4a90b9dbe07650a7d4b797","444986ba74685fde34afbbf6a6963c5f35f12a1a65a705e5184c545a18c080c6","7382cf09d04de58beeba4d71fec9777815924fe66849c89e4230b8f26bff2650","b1355a4eef0c265a9d918cec16f7299f4acc51daf8e3d59ef445cb46914f48ff","dd8377e9c3620d0732bedecd0d219f77f7bcffbc49470a9b7ff22db33fe4a185","d938cb8accbc51046158350155f1af9248fc8459ef2b92be752b93dae77504a6","17dc38bd4e01496a91d82e6de763df6fd94c00eb1e90e0cccd7f07f84b549f43","e314b233b41a5688a4e43f876ccb10718351d3f396b4df623b4ebb0a093be7e0","7860a6e7264839c59506d5d69e40311e0c1e6af11b2351ccffe8d9b09acde9a3","d815e32b7998d3927792e579d4ad8430792ca1043b3570f0ee73855529516d21")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("bf5a2450f5287f775c2427590c29c27e28e3662c2f68296c64cdacdb639f3b97","38dea3732044129bd99314de582ba3d58a649c8967fe12b98cd867ca6e349ffe","06adb754096f5853999038c000d8cdafa69bb1696b1011e781ab18bbea6107ce","40fd3597c44d10e201304b80c20dd8f2a1ad1ee1032f90d83d7917e037a1d130","0d16de10ce708b990d1b0ae26ac12792c91864426c88a8c73a475f7f33db014b","dea780f228acbd536b5cbb35efe1a41d18771f6ed987c9d19b175de44f1d566c","98fcabe279d4001b29949d980aa9ae8396b352ef7c4a90b9dbe07650a7d4b797","444986ba74685fde34afbbf6a6963c5f35f12a1a65a705e5184c545a18c080c6","7382cf09d04de58beeba4d71fec9777815924fe66849c89e4230b8f26bff2650","b1355a4eef0c265a9d918cec16f7299f4acc51daf8e3d59ef445cb46914f48ff","dd8377e9c3620d0732bedecd0d219f77f7bcffbc49470a9b7ff22db33fe4a185","d938cb8accbc51046158350155f1af9248fc8459ef2b92be752b93dae77504a6","17dc38bd4e01496a91d82e6de763df6fd94c00eb1e90e0cccd7f07f84b549f43","e314b233b41a5688a4e43f876ccb10718351d3f396b4df623b4ebb0a093be7e0","7860a6e7264839c59506d5d69e40311e0c1e6af11b2351ccffe8d9b09acde9a3","d815e32b7998d3927792e579d4ad8430792ca1043b3570f0ee73855529516d21")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("bf5a2450f5287f775c2427590c29c27e28e3662c2f68296c64cdacdb639f3b97","38dea3732044129bd99314de582ba3d58a649c8967fe12b98cd867ca6e349ffe","06adb754096f5853999038c000d8cdafa69bb1696b1011e781ab18bbea6107ce","40fd3597c44d10e201304b80c20dd8f2a1ad1ee1032f90d83d7917e037a1d130","0d16de10ce708b990d1b0ae26ac12792c91864426c88a8c73a475f7f33db014b","dea780f228acbd536b5cbb35efe1a41d18771f6ed987c9d19b175de44f1d566c","98fcabe279d4001b29949d980aa9ae8396b352ef7c4a90b9dbe07650a7d4b797","444986ba74685fde34afbbf6a6963c5f35f12a1a65a705e5184c545a18c080c6","7382cf09d04de58beeba4d71fec9777815924fe66849c89e4230b8f26bff2650","b1355a4eef0c265a9d918cec16f7299f4acc51daf8e3d59ef445cb46914f48ff","dd8377e9c3620d0732bedecd0d219f77f7bcffbc49470a9b7ff22db33fe4a185","d938cb8accbc51046158350155f1af9248fc8459ef2b92be752b93dae77504a6","17dc38bd4e01496a91d82e6de763df6fd94c00eb1e90e0cccd7f07f84b549f43","e314b233b41a5688a4e43f876ccb10718351d3f396b4df623b4ebb0a093be7e0","7860a6e7264839c59506d5d69e40311e0c1e6af11b2351ccffe8d9b09acde9a3","d815e32b7998d3927792e579d4ad8430792ca1043b3570f0ee73855529516d21")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("bf5a2450f5287f775c2427590c29c27e28e3662c2f68296c64cdacdb639f3b97","38dea3732044129bd99314de582ba3d58a649c8967fe12b98cd867ca6e349ffe","06adb754096f5853999038c000d8cdafa69bb1696b1011e781ab18bbea6107ce","40fd3597c44d10e201304b80c20dd8f2a1ad1ee1032f90d83d7917e037a1d130","0d16de10ce708b990d1b0ae26ac12792c91864426c88a8c73a475f7f33db014b","dea780f228acbd536b5cbb35efe1a41d18771f6ed987c9d19b175de44f1d566c","98fcabe279d4001b29949d980aa9ae8396b352ef7c4a90b9dbe07650a7d4b797","444986ba74685fde34afbbf6a6963c5f35f12a1a65a705e5184c545a18c080c6","7382cf09d04de58beeba4d71fec9777815924fe66849c89e4230b8f26bff2650","b1355a4eef0c265a9d918cec16f7299f4acc51daf8e3d59ef445cb46914f48ff","dd8377e9c3620d0732bedecd0d219f77f7bcffbc49470a9b7ff22db33fe4a185","d938cb8accbc51046158350155f1af9248fc8459ef2b92be752b93dae77504a6","17dc38bd4e01496a91d82e6de763df6fd94c00eb1e90e0cccd7f07f84b549f43","e314b233b41a5688a4e43f876ccb10718351d3f396b4df623b4ebb0a093be7e0","7860a6e7264839c59506d5d69e40311e0c1e6af11b2351ccffe8d9b09acde9a3","d815e32b7998d3927792e579d4ad8430792ca1043b3570f0ee73855529516d21")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring64 NOT NULL AND customstring64 IN ("bf5a2450f5287f775c2427590c29c27e28e3662c2f68296c64cdacdb639f3b97","38dea3732044129bd99314de582ba3d58a649c8967fe12b98cd867ca6e349ffe","06adb754096f5853999038c000d8cdafa69bb1696b1011e781ab18bbea6107ce","40fd3597c44d10e201304b80c20dd8f2a1ad1ee1032f90d83d7917e037a1d130","0d16de10ce708b990d1b0ae26ac12792c91864426c88a8c73a475f7f33db014b","dea780f228acbd536b5cbb35efe1a41d18771f6ed987c9d19b175de44f1d566c","98fcabe279d4001b29949d980aa9ae8396b352ef7c4a90b9dbe07650a7d4b797","444986ba74685fde34afbbf6a6963c5f35f12a1a65a705e5184c545a18c080c6","7382cf09d04de58beeba4d71fec9777815924fe66849c89e4230b8f26bff2650","b1355a4eef0c265a9d918cec16f7299f4acc51daf8e3d59ef445cb46914f48ff","dd8377e9c3620d0732bedecd0d219f77f7bcffbc49470a9b7ff22db33fe4a185","d938cb8accbc51046158350155f1af9248fc8459ef2b92be752b93dae77504a6","17dc38bd4e01496a91d82e6de763df6fd94c00eb1e90e0cccd7f07f84b549f43","e314b233b41a5688a4e43f876ccb10718351d3f396b4df623b4ebb0a093be7e0","7860a6e7264839c59506d5d69e40311e0c1e6af11b2351ccffe8d9b09acde9a3","d815e32b7998d3927792e579d4ad8430792ca1043b3570f0ee73855529516d21")
index=activity AND rg_functionality="Endpoint Management Systems" AND requesturl NOT NULL AND requesturl IN ("http://88.151.192.128/djfhu34u9983234s3fnvmxxzpkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0pkg.zip","http://81.19.139.14/987yuhgzsd234dfwhjkaqppkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0sud/sud.exe","http://45.95.232.82/dfghujfdkg3fmsud/sud.exe","http://185.216.68.142:9000/hooks/xxx?id=%computername%")
index=activity AND rg_functionality="Endpoint Management Systems" AND Message NOT NULL AND Message IN ("http://88.151.192.128/djfhu34u9983234s3fnvmxxzpkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0pkg.zip","http://81.19.139.14/987yuhgzsd234dfwhjkaqppkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0sud/sud.exe","http://45.95.232.82/dfghujfdkg3fmsud/sud.exe","http://185.216.68.142:9000/hooks/xxx?id=%computername%")
index=activity AND rg_functionality="Endpoint Management Systems" AND Requestcontext NOT NULL AND Requestcontext IN ("http://88.151.192.128/djfhu34u9983234s3fnvmxxzpkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0pkg.zip","http://81.19.139.14/987yuhgzsd234dfwhjkaqppkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0sud/sud.exe","http://45.95.232.82/dfghujfdkg3fmsud/sud.exe","http://185.216.68.142:9000/hooks/xxx?id=%computername%")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("http://88.151.192.128/djfhu34u9983234s3fnvmxxzpkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0pkg.zip","http://81.19.139.14/987yuhgzsd234dfwhjkaqppkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0sud/sud.exe","http://45.95.232.82/dfghujfdkg3fmsud/sud.exe","http://185.216.68.142:9000/hooks/xxx?id=%computername%")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND requesturl NOT NULL AND requesturl IN ("http://88.151.192.128/djfhu34u9983234s3fnvmxxzpkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0pkg.zip","http://81.19.139.14/987yuhgzsd234dfwhjkaqppkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0sud/sud.exe","http://45.95.232.82/dfghujfdkg3fmsud/sud.exe","http://185.216.68.142:9000/hooks/xxx?id=%computername%")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND Message NOT NULL AND Message IN ("http://88.151.192.128/djfhu34u9983234s3fnvmxxzpkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0pkg.zip","http://81.19.139.14/987yuhgzsd234dfwhjkaqppkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0sud/sud.exe","http://45.95.232.82/dfghujfdkg3fmsud/sud.exe","http://185.216.68.142:9000/hooks/xxx?id=%computername%")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND Requestcontext NOT NULL AND Requestcontext IN ("http://88.151.192.128/djfhu34u9983234s3fnvmxxzpkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0pkg.zip","http://81.19.139.14/987yuhgzsd234dfwhjkaqppkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0sud/sud.exe","http://45.95.232.82/dfghujfdkg3fmsud/sud.exe","http://185.216.68.142:9000/hooks/xxx?id=%computername%")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("http://88.151.192.128/djfhu34u9983234s3fnvmxxzpkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0pkg.zip","http://81.19.139.14/987yuhgzsd234dfwhjkaqppkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0sud/sud.exe","http://45.95.232.82/dfghujfdkg3fmsud/sud.exe","http://185.216.68.142:9000/hooks/xxx?id=%computername%")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND requesturl NOT NULL AND requesturl IN ("http://88.151.192.128/djfhu34u9983234s3fnvmxxzpkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0pkg.zip","http://81.19.139.14/987yuhgzsd234dfwhjkaqppkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0sud/sud.exe","http://45.95.232.82/dfghujfdkg3fmsud/sud.exe","http://185.216.68.142:9000/hooks/xxx?id=%computername%")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND Message NOT NULL AND Message IN ("http://88.151.192.128/djfhu34u9983234s3fnvmxxzpkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0pkg.zip","http://81.19.139.14/987yuhgzsd234dfwhjkaqppkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0sud/sud.exe","http://45.95.232.82/dfghujfdkg3fmsud/sud.exe","http://185.216.68.142:9000/hooks/xxx?id=%computername%")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND Requestcontext NOT NULL AND Requestcontext IN ("http://88.151.192.128/djfhu34u9983234s3fnvmxxzpkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0pkg.zip","http://81.19.139.14/987yuhgzsd234dfwhjkaqppkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0sud/sud.exe","http://45.95.232.82/dfghujfdkg3fmsud/sud.exe","http://185.216.68.142:9000/hooks/xxx?id=%computername%")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("http://88.151.192.128/djfhu34u9983234s3fnvmxxzpkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0pkg.zip","http://81.19.139.14/987yuhgzsd234dfwhjkaqppkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0sud/sud.exe","http://45.95.232.82/dfghujfdkg3fmsud/sud.exe","http://185.216.68.142:9000/hooks/xxx?id=%computername%")
index=activity AND rg_functionality="Email / Email Security" AND requesturl NOT NULL AND requesturl IN ("http://88.151.192.128/djfhu34u9983234s3fnvmxxzpkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0pkg.zip","http://81.19.139.14/987yuhgzsd234dfwhjkaqppkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0sud/sud.exe","http://45.95.232.82/dfghujfdkg3fmsud/sud.exe","http://185.216.68.142:9000/hooks/xxx?id=%computername%")
index=activity AND rg_functionality="Email / Email Security" AND Message NOT NULL AND Message IN ("http://88.151.192.128/djfhu34u9983234s3fnvmxxzpkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0pkg.zip","http://81.19.139.14/987yuhgzsd234dfwhjkaqppkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0sud/sud.exe","http://45.95.232.82/dfghujfdkg3fmsud/sud.exe","http://185.216.68.142:9000/hooks/xxx?id=%computername%")
index=activity AND rg_functionality="Email / Email Security" AND Requestcontext NOT NULL AND Requestcontext IN ("http://88.151.192.128/djfhu34u9983234s3fnvmxxzpkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0pkg.zip","http://81.19.139.14/987yuhgzsd234dfwhjkaqppkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0sud/sud.exe","http://45.95.232.82/dfghujfdkg3fmsud/sud.exe","http://185.216.68.142:9000/hooks/xxx?id=%computername%")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("http://88.151.192.128/djfhu34u9983234s3fnvmxxzpkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0pkg.zip","http://81.19.139.14/987yuhgzsd234dfwhjkaqppkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0sud/sud.exe","http://45.95.232.82/dfghujfdkg3fmsud/sud.exe","http://185.216.68.142:9000/hooks/xxx?id=%computername%")
index=activity AND rg_functionality="Cloud Email / Email Security" AND requesturl NOT NULL AND requesturl IN ("http://88.151.192.128/djfhu34u9983234s3fnvmxxzpkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0pkg.zip","http://81.19.139.14/987yuhgzsd234dfwhjkaqppkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0sud/sud.exe","http://45.95.232.82/dfghujfdkg3fmsud/sud.exe","http://185.216.68.142:9000/hooks/xxx?id=%computername%")
index=activity AND rg_functionality="Cloud Email / Email Security" AND Message NOT NULL AND Message IN ("http://88.151.192.128/djfhu34u9983234s3fnvmxxzpkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0pkg.zip","http://81.19.139.14/987yuhgzsd234dfwhjkaqppkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0sud/sud.exe","http://45.95.232.82/dfghujfdkg3fmsud/sud.exe","http://185.216.68.142:9000/hooks/xxx?id=%computername%")
index=activity AND rg_functionality="Cloud Email / Email Security" AND Requestcontext NOT NULL AND Requestcontext IN ("http://88.151.192.128/djfhu34u9983234s3fnvmxxzpkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0pkg.zip","http://81.19.139.14/987yuhgzsd234dfwhjkaqppkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0sud/sud.exe","http://45.95.232.82/dfghujfdkg3fmsud/sud.exe","http://185.216.68.142:9000/hooks/xxx?id=%computername%")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("http://88.151.192.128/djfhu34u9983234s3fnvmxxzpkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0pkg.zip","http://81.19.139.14/987yuhgzsd234dfwhjkaqppkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0sud/sud.exe","http://45.95.232.82/dfghujfdkg3fmsud/sud.exe","http://185.216.68.142:9000/hooks/xxx?id=%computername%")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND requesturl NOT NULL AND requesturl IN ("http://88.151.192.128/djfhu34u9983234s3fnvmxxzpkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0pkg.zip","http://81.19.139.14/987yuhgzsd234dfwhjkaqppkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0sud/sud.exe","http://45.95.232.82/dfghujfdkg3fmsud/sud.exe","http://185.216.68.142:9000/hooks/xxx?id=%computername%")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND Message NOT NULL AND Message IN ("http://88.151.192.128/djfhu34u9983234s3fnvmxxzpkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0pkg.zip","http://81.19.139.14/987yuhgzsd234dfwhjkaqppkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0sud/sud.exe","http://45.95.232.82/dfghujfdkg3fmsud/sud.exe","http://185.216.68.142:9000/hooks/xxx?id=%computername%")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND Requestcontext NOT NULL AND Requestcontext IN ("http://88.151.192.128/djfhu34u9983234s3fnvmxxzpkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0pkg.zip","http://81.19.139.14/987yuhgzsd234dfwhjkaqppkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0sud/sud.exe","http://45.95.232.82/dfghujfdkg3fmsud/sud.exe","http://185.216.68.142:9000/hooks/xxx?id=%computername%")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("http://88.151.192.128/djfhu34u9983234s3fnvmxxzpkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0pkg.zip","http://81.19.139.14/987yuhgzsd234dfwhjkaqppkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0sud/sud.exe","http://45.95.232.82/dfghujfdkg3fmsud/sud.exe","http://185.216.68.142:9000/hooks/xxx?id=%computername%")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND requesturl NOT NULL AND requesturl IN ("http://88.151.192.128/djfhu34u9983234s3fnvmxxzpkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0pkg.zip","http://81.19.139.14/987yuhgzsd234dfwhjkaqppkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0sud/sud.exe","http://45.95.232.82/dfghujfdkg3fmsud/sud.exe","http://185.216.68.142:9000/hooks/xxx?id=%computername%")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND Message NOT NULL AND Message IN ("http://88.151.192.128/djfhu34u9983234s3fnvmxxzpkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0pkg.zip","http://81.19.139.14/987yuhgzsd234dfwhjkaqppkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0sud/sud.exe","http://45.95.232.82/dfghujfdkg3fmsud/sud.exe","http://185.216.68.142:9000/hooks/xxx?id=%computername%")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND Requestcontext NOT NULL AND Requestcontext IN ("http://88.151.192.128/djfhu34u9983234s3fnvmxxzpkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0pkg.zip","http://81.19.139.14/987yuhgzsd234dfwhjkaqppkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0sud/sud.exe","http://45.95.232.82/dfghujfdkg3fmsud/sud.exe","http://185.216.68.142:9000/hooks/xxx?id=%computername%")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("http://88.151.192.128/djfhu34u9983234s3fnvmxxzpkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0pkg.zip","http://81.19.139.14/987yuhgzsd234dfwhjkaqppkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0sud/sud.exe","http://45.95.232.82/dfghujfdkg3fmsud/sud.exe","http://185.216.68.142:9000/hooks/xxx?id=%computername%")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND requesturl NOT NULL AND requesturl IN ("http://88.151.192.128/djfhu34u9983234s3fnvmxxzpkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0pkg.zip","http://81.19.139.14/987yuhgzsd234dfwhjkaqppkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0sud/sud.exe","http://45.95.232.82/dfghujfdkg3fmsud/sud.exe","http://185.216.68.142:9000/hooks/xxx?id=%computername%")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND Message NOT NULL AND Message IN ("http://88.151.192.128/djfhu34u9983234s3fnvmxxzpkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0pkg.zip","http://81.19.139.14/987yuhgzsd234dfwhjkaqppkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0sud/sud.exe","http://45.95.232.82/dfghujfdkg3fmsud/sud.exe","http://185.216.68.142:9000/hooks/xxx?id=%computername%")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND Requestcontext NOT NULL AND Requestcontext IN ("http://88.151.192.128/djfhu34u9983234s3fnvmxxzpkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0pkg.zip","http://81.19.139.14/987yuhgzsd234dfwhjkaqppkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0sud/sud.exe","http://45.95.232.82/dfghujfdkg3fmsud/sud.exe","http://185.216.68.142:9000/hooks/xxx?id=%computername%")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("http://88.151.192.128/djfhu34u9983234s3fnvmxxzpkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0pkg.zip","http://81.19.139.14/987yuhgzsd234dfwhjkaqppkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0sud/sud.exe","http://45.95.232.82/dfghujfdkg3fmsud/sud.exe","http://185.216.68.142:9000/hooks/xxx?id=%computername%")
index=activity AND rg_functionality="Web Proxy" AND requesturl NOT NULL AND requesturl IN ("http://88.151.192.128/djfhu34u9983234s3fnvmxxzpkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0pkg.zip","http://81.19.139.14/987yuhgzsd234dfwhjkaqppkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0sud/sud.exe","http://45.95.232.82/dfghujfdkg3fmsud/sud.exe","http://185.216.68.142:9000/hooks/xxx?id=%computername%")
index=activity AND rg_functionality="Web Proxy" AND Message NOT NULL AND Message IN ("http://88.151.192.128/djfhu34u9983234s3fnvmxxzpkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0pkg.zip","http://81.19.139.14/987yuhgzsd234dfwhjkaqppkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0sud/sud.exe","http://45.95.232.82/dfghujfdkg3fmsud/sud.exe","http://185.216.68.142:9000/hooks/xxx?id=%computername%")
index=activity AND rg_functionality="Web Proxy" AND Requestcontext NOT NULL AND Requestcontext IN ("http://88.151.192.128/djfhu34u9983234s3fnvmxxzpkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0pkg.zip","http://81.19.139.14/987yuhgzsd234dfwhjkaqppkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0sud/sud.exe","http://45.95.232.82/dfghujfdkg3fmsud/sud.exe","http://185.216.68.142:9000/hooks/xxx?id=%computername%")
index=activity AND rg_functionality="Web Proxy" AND customstring3 NOT NULL AND customstring3 IN ("http://88.151.192.128/djfhu34u9983234s3fnvmxxzpkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0pkg.zip","http://81.19.139.14/987yuhgzsd234dfwhjkaqppkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0sud/sud.exe","http://45.95.232.82/dfghujfdkg3fmsud/sud.exe","http://185.216.68.142:9000/hooks/xxx?id=%computername%")
index=activity AND rg_functionality="Next Generation Firewall" AND requesturl NOT NULL AND requesturl IN ("http://88.151.192.128/djfhu34u9983234s3fnvmxxzpkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0pkg.zip","http://81.19.139.14/987yuhgzsd234dfwhjkaqppkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0sud/sud.exe","http://45.95.232.82/dfghujfdkg3fmsud/sud.exe","http://185.216.68.142:9000/hooks/xxx?id=%computername%")
index=activity AND rg_functionality="Next Generation Firewall" AND Message NOT NULL AND Message IN ("http://88.151.192.128/djfhu34u9983234s3fnvmxxzpkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0pkg.zip","http://81.19.139.14/987yuhgzsd234dfwhjkaqppkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0sud/sud.exe","http://45.95.232.82/dfghujfdkg3fmsud/sud.exe","http://185.216.68.142:9000/hooks/xxx?id=%computername%")
index=activity AND rg_functionality="Next Generation Firewall" AND Requestcontext NOT NULL AND Requestcontext IN ("http://88.151.192.128/djfhu34u9983234s3fnvmxxzpkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0pkg.zip","http://81.19.139.14/987yuhgzsd234dfwhjkaqppkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0sud/sud.exe","http://45.95.232.82/dfghujfdkg3fmsud/sud.exe","http://185.216.68.142:9000/hooks/xxx?id=%computername%")
index=activity AND rg_functionality="Next Generation Firewall" AND customstring3 NOT NULL AND customstring3 IN ("http://88.151.192.128/djfhu34u9983234s3fnvmxxzpkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0pkg.zip","http://81.19.139.14/987yuhgzsd234dfwhjkaqppkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0sud/sud.exe","http://45.95.232.82/dfghujfdkg3fmsud/sud.exe","http://185.216.68.142:9000/hooks/xxx?id=%computername%")
index=activity AND rg_functionality="Flow" AND requesturl NOT NULL AND requesturl IN ("http://88.151.192.128/djfhu34u9983234s3fnvmxxzpkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0pkg.zip","http://81.19.139.14/987yuhgzsd234dfwhjkaqppkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0sud/sud.exe","http://45.95.232.82/dfghujfdkg3fmsud/sud.exe","http://185.216.68.142:9000/hooks/xxx?id=%computername%")
index=activity AND rg_functionality="Flow" AND Message NOT NULL AND Message IN ("http://88.151.192.128/djfhu34u9983234s3fnvmxxzpkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0pkg.zip","http://81.19.139.14/987yuhgzsd234dfwhjkaqppkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0sud/sud.exe","http://45.95.232.82/dfghujfdkg3fmsud/sud.exe","http://185.216.68.142:9000/hooks/xxx?id=%computername%")
index=activity AND rg_functionality="Flow" AND Requestcontext NOT NULL AND Requestcontext IN ("http://88.151.192.128/djfhu34u9983234s3fnvmxxzpkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0pkg.zip","http://81.19.139.14/987yuhgzsd234dfwhjkaqppkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0sud/sud.exe","http://45.95.232.82/dfghujfdkg3fmsud/sud.exe","http://185.216.68.142:9000/hooks/xxx?id=%computername%")
index=activity AND rg_functionality="Flow" AND customstring3 NOT NULL AND customstring3 IN ("http://88.151.192.128/djfhu34u9983234s3fnvmxxzpkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0pkg.zip","http://81.19.139.14/987yuhgzsd234dfwhjkaqppkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0sud/sud.exe","http://45.95.232.82/dfghujfdkg3fmsud/sud.exe","http://185.216.68.142:9000/hooks/xxx?id=%computername%")
index=activity AND rg_functionality="Web Server" AND requesturl NOT NULL AND requesturl IN ("http://88.151.192.128/djfhu34u9983234s3fnvmxxzpkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0pkg.zip","http://81.19.139.14/987yuhgzsd234dfwhjkaqppkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0sud/sud.exe","http://45.95.232.82/dfghujfdkg3fmsud/sud.exe","http://185.216.68.142:9000/hooks/xxx?id=%computername%")
index=activity AND rg_functionality="Web Server" AND Message NOT NULL AND Message IN ("http://88.151.192.128/djfhu34u9983234s3fnvmxxzpkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0pkg.zip","http://81.19.139.14/987yuhgzsd234dfwhjkaqppkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0sud/sud.exe","http://45.95.232.82/dfghujfdkg3fmsud/sud.exe","http://185.216.68.142:9000/hooks/xxx?id=%computername%")
index=activity AND rg_functionality="Web Server" AND Requestcontext NOT NULL AND Requestcontext IN ("http://88.151.192.128/djfhu34u9983234s3fnvmxxzpkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0pkg.zip","http://81.19.139.14/987yuhgzsd234dfwhjkaqppkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0sud/sud.exe","http://45.95.232.82/dfghujfdkg3fmsud/sud.exe","http://185.216.68.142:9000/hooks/xxx?id=%computername%")
index=activity AND rg_functionality="Web Server" AND customstring3 NOT NULL AND customstring3 IN ("http://88.151.192.128/djfhu34u9983234s3fnvmxxzpkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0pkg.zip","http://81.19.139.14/987yuhgzsd234dfwhjkaqppkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0sud/sud.exe","http://45.95.232.82/dfghujfdkg3fmsud/sud.exe","http://185.216.68.142:9000/hooks/xxx?id=%computername%")
index=activity AND rg_functionality="Email / Email Security" AND requesturl NOT NULL AND requesturl IN ("http://88.151.192.128/djfhu34u9983234s3fnvmxxzpkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0pkg.zip","http://81.19.139.14/987yuhgzsd234dfwhjkaqppkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0sud/sud.exe","http://45.95.232.82/dfghujfdkg3fmsud/sud.exe","http://185.216.68.142:9000/hooks/xxx?id=%computername%")
index=activity AND rg_functionality="Email / Email Security" AND Message NOT NULL AND Message IN ("http://88.151.192.128/djfhu34u9983234s3fnvmxxzpkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0pkg.zip","http://81.19.139.14/987yuhgzsd234dfwhjkaqppkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0sud/sud.exe","http://45.95.232.82/dfghujfdkg3fmsud/sud.exe","http://185.216.68.142:9000/hooks/xxx?id=%computername%")
index=activity AND rg_functionality="Email / Email Security" AND Requestcontext NOT NULL AND Requestcontext IN ("http://88.151.192.128/djfhu34u9983234s3fnvmxxzpkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0pkg.zip","http://81.19.139.14/987yuhgzsd234dfwhjkaqppkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0sud/sud.exe","http://45.95.232.82/dfghujfdkg3fmsud/sud.exe","http://185.216.68.142:9000/hooks/xxx?id=%computername%")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("http://88.151.192.128/djfhu34u9983234s3fnvmxxzpkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0pkg.zip","http://81.19.139.14/987yuhgzsd234dfwhjkaqppkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0sud/sud.exe","http://45.95.232.82/dfghujfdkg3fmsud/sud.exe","http://185.216.68.142:9000/hooks/xxx?id=%computername%")
index=activity AND rg_functionality="Cloud Email / Email Security" AND requesturl NOT NULL AND requesturl IN ("http://88.151.192.128/djfhu34u9983234s3fnvmxxzpkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0pkg.zip","http://81.19.139.14/987yuhgzsd234dfwhjkaqppkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0sud/sud.exe","http://45.95.232.82/dfghujfdkg3fmsud/sud.exe","http://185.216.68.142:9000/hooks/xxx?id=%computername%")
index=activity AND rg_functionality="Cloud Email / Email Security" AND Message NOT NULL AND Message IN ("http://88.151.192.128/djfhu34u9983234s3fnvmxxzpkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0pkg.zip","http://81.19.139.14/987yuhgzsd234dfwhjkaqppkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0sud/sud.exe","http://45.95.232.82/dfghujfdkg3fmsud/sud.exe","http://185.216.68.142:9000/hooks/xxx?id=%computername%")
index=activity AND rg_functionality="Cloud Email / Email Security" AND Requestcontext NOT NULL AND Requestcontext IN ("http://88.151.192.128/djfhu34u9983234s3fnvmxxzpkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0pkg.zip","http://81.19.139.14/987yuhgzsd234dfwhjkaqppkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0sud/sud.exe","http://45.95.232.82/dfghujfdkg3fmsud/sud.exe","http://185.216.68.142:9000/hooks/xxx?id=%computername%")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("http://88.151.192.128/djfhu34u9983234s3fnvmxxzpkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0pkg.zip","http://81.19.139.14/987yuhgzsd234dfwhjkaqppkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0sud/sud.exe","http://45.95.232.82/dfghujfdkg3fmsud/sud.exe","http://185.216.68.142:9000/hooks/xxx?id=%computername%")
index=activity AND rg_functionality="Web Application Firewall" AND requesturl NOT NULL AND requesturl IN ("http://88.151.192.128/djfhu34u9983234s3fnvmxxzpkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0pkg.zip","http://81.19.139.14/987yuhgzsd234dfwhjkaqppkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0sud/sud.exe","http://45.95.232.82/dfghujfdkg3fmsud/sud.exe","http://185.216.68.142:9000/hooks/xxx?id=%computername%")
index=activity AND rg_functionality="Web Application Firewall" AND Message NOT NULL AND Message IN ("http://88.151.192.128/djfhu34u9983234s3fnvmxxzpkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0pkg.zip","http://81.19.139.14/987yuhgzsd234dfwhjkaqppkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0sud/sud.exe","http://45.95.232.82/dfghujfdkg3fmsud/sud.exe","http://185.216.68.142:9000/hooks/xxx?id=%computername%")
index=activity AND rg_functionality="Web Application Firewall" AND Requestcontext NOT NULL AND Requestcontext IN ("http://88.151.192.128/djfhu34u9983234s3fnvmxxzpkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0pkg.zip","http://81.19.139.14/987yuhgzsd234dfwhjkaqppkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0sud/sud.exe","http://45.95.232.82/dfghujfdkg3fmsud/sud.exe","http://185.216.68.142:9000/hooks/xxx?id=%computername%")
index=activity AND rg_functionality="Web Application Firewall" AND customstring3 NOT NULL AND customstring3 IN ("http://88.151.192.128/djfhu34u9983234s3fnvmxxzpkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0pkg.zip","http://81.19.139.14/987yuhgzsd234dfwhjkaqppkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0sud/sud.exe","http://45.95.232.82/dfghujfdkg3fmsud/sud.exe","http://185.216.68.142:9000/hooks/xxx?id=%computername%")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND requesturl NOT NULL AND requesturl IN ("http://88.151.192.128/djfhu34u9983234s3fnvmxxzpkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0pkg.zip","http://81.19.139.14/987yuhgzsd234dfwhjkaqppkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0sud/sud.exe","http://45.95.232.82/dfghujfdkg3fmsud/sud.exe","http://185.216.68.142:9000/hooks/xxx?id=%computername%")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND Message NOT NULL AND Message IN ("http://88.151.192.128/djfhu34u9983234s3fnvmxxzpkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0pkg.zip","http://81.19.139.14/987yuhgzsd234dfwhjkaqppkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0sud/sud.exe","http://45.95.232.82/dfghujfdkg3fmsud/sud.exe","http://185.216.68.142:9000/hooks/xxx?id=%computername%")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND Requestcontext NOT NULL AND Requestcontext IN ("http://88.151.192.128/djfhu34u9983234s3fnvmxxzpkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0pkg.zip","http://81.19.139.14/987yuhgzsd234dfwhjkaqppkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0sud/sud.exe","http://45.95.232.82/dfghujfdkg3fmsud/sud.exe","http://185.216.68.142:9000/hooks/xxx?id=%computername%")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("http://88.151.192.128/djfhu34u9983234s3fnvmxxzpkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0pkg.zip","http://81.19.139.14/987yuhgzsd234dfwhjkaqppkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0sud/sud.exe","http://45.95.232.82/dfghujfdkg3fmsud/sud.exe","http://185.216.68.142:9000/hooks/xxx?id=%computername%")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND requesturl NOT NULL AND requesturl IN ("http://88.151.192.128/djfhu34u9983234s3fnvmxxzpkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0pkg.zip","http://81.19.139.14/987yuhgzsd234dfwhjkaqppkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0sud/sud.exe","http://45.95.232.82/dfghujfdkg3fmsud/sud.exe","http://185.216.68.142:9000/hooks/xxx?id=%computername%")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND Message NOT NULL AND Message IN ("http://88.151.192.128/djfhu34u9983234s3fnvmxxzpkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0pkg.zip","http://81.19.139.14/987yuhgzsd234dfwhjkaqppkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0sud/sud.exe","http://45.95.232.82/dfghujfdkg3fmsud/sud.exe","http://185.216.68.142:9000/hooks/xxx?id=%computername%")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND Requestcontext NOT NULL AND Requestcontext IN ("http://88.151.192.128/djfhu34u9983234s3fnvmxxzpkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0pkg.zip","http://81.19.139.14/987yuhgzsd234dfwhjkaqppkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0sud/sud.exe","http://45.95.232.82/dfghujfdkg3fmsud/sud.exe","http://185.216.68.142:9000/hooks/xxx?id=%computername%")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND customstring3 NOT NULL AND customstring3 IN ("http://88.151.192.128/djfhu34u9983234s3fnvmxxzpkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0pkg.zip","http://81.19.139.14/987yuhgzsd234dfwhjkaqppkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0sud/sud.exe","http://45.95.232.82/dfghujfdkg3fmsud/sud.exe","http://185.216.68.142:9000/hooks/xxx?id=%computername%")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND requesturl NOT NULL AND requesturl IN ("http://88.151.192.128/djfhu34u9983234s3fnvmxxzpkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0pkg.zip","http://81.19.139.14/987yuhgzsd234dfwhjkaqppkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0sud/sud.exe","http://45.95.232.82/dfghujfdkg3fmsud/sud.exe","http://185.216.68.142:9000/hooks/xxx?id=%computername%")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND Message NOT NULL AND Message IN ("http://88.151.192.128/djfhu34u9983234s3fnvmxxzpkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0pkg.zip","http://81.19.139.14/987yuhgzsd234dfwhjkaqppkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0sud/sud.exe","http://45.95.232.82/dfghujfdkg3fmsud/sud.exe","http://185.216.68.142:9000/hooks/xxx?id=%computername%")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND Requestcontext NOT NULL AND Requestcontext IN ("http://88.151.192.128/djfhu34u9983234s3fnvmxxzpkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0pkg.zip","http://81.19.139.14/987yuhgzsd234dfwhjkaqppkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0sud/sud.exe","http://45.95.232.82/dfghujfdkg3fmsud/sud.exe","http://185.216.68.142:9000/hooks/xxx?id=%computername%")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND customstring3 NOT NULL AND customstring3 IN ("http://88.151.192.128/djfhu34u9983234s3fnvmxxzpkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0pkg.zip","http://81.19.139.14/987yuhgzsd234dfwhjkaqppkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0sud/sud.exe","http://45.95.232.82/dfghujfdkg3fmsud/sud.exe","http://185.216.68.142:9000/hooks/xxx?id=%computername%")
index=activity AND rg_functionality="Cloud Application Security Broker" AND requesturl NOT NULL AND requesturl IN ("http://88.151.192.128/djfhu34u9983234s3fnvmxxzpkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0pkg.zip","http://81.19.139.14/987yuhgzsd234dfwhjkaqppkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0sud/sud.exe","http://45.95.232.82/dfghujfdkg3fmsud/sud.exe","http://185.216.68.142:9000/hooks/xxx?id=%computername%")
index=activity AND rg_functionality="Cloud Application Security Broker" AND Message NOT NULL AND Message IN ("http://88.151.192.128/djfhu34u9983234s3fnvmxxzpkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0pkg.zip","http://81.19.139.14/987yuhgzsd234dfwhjkaqppkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0sud/sud.exe","http://45.95.232.82/dfghujfdkg3fmsud/sud.exe","http://185.216.68.142:9000/hooks/xxx?id=%computername%")
index=activity AND rg_functionality="Cloud Application Security Broker" AND Requestcontext NOT NULL AND Requestcontext IN ("http://88.151.192.128/djfhu34u9983234s3fnvmxxzpkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0pkg.zip","http://81.19.139.14/987yuhgzsd234dfwhjkaqppkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0sud/sud.exe","http://45.95.232.82/dfghujfdkg3fmsud/sud.exe","http://185.216.68.142:9000/hooks/xxx?id=%computername%")
index=activity AND rg_functionality="Cloud Application Security Broker" AND customstring3 NOT NULL AND customstring3 IN ("http://88.151.192.128/djfhu34u9983234s3fnvmxxzpkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0pkg.zip","http://81.19.139.14/987yuhgzsd234dfwhjkaqppkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0sud/sud.exe","http://45.95.232.82/dfghujfdkg3fmsud/sud.exe","http://185.216.68.142:9000/hooks/xxx?id=%computername%")
index=activity AND rg_functionality="Source Code Repository" AND requesturl NOT NULL AND requesturl IN ("http://88.151.192.128/djfhu34u9983234s3fnvmxxzpkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0pkg.zip","http://81.19.139.14/987yuhgzsd234dfwhjkaqppkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0sud/sud.exe","http://45.95.232.82/dfghujfdkg3fmsud/sud.exe","http://185.216.68.142:9000/hooks/xxx?id=%computername%")
index=activity AND rg_functionality="Source Code Repository" AND Message NOT NULL AND Message IN ("http://88.151.192.128/djfhu34u9983234s3fnvmxxzpkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0pkg.zip","http://81.19.139.14/987yuhgzsd234dfwhjkaqppkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0sud/sud.exe","http://45.95.232.82/dfghujfdkg3fmsud/sud.exe","http://185.216.68.142:9000/hooks/xxx?id=%computername%")
index=activity AND rg_functionality="Source Code Repository" AND Requestcontext NOT NULL AND Requestcontext IN ("http://88.151.192.128/djfhu34u9983234s3fnvmxxzpkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0pkg.zip","http://81.19.139.14/987yuhgzsd234dfwhjkaqppkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0sud/sud.exe","http://45.95.232.82/dfghujfdkg3fmsud/sud.exe","http://185.216.68.142:9000/hooks/xxx?id=%computername%")
index=activity AND rg_functionality="Source Code Repository" AND customstring3 NOT NULL AND customstring3 IN ("http://88.151.192.128/djfhu34u9983234s3fnvmxxzpkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0pkg.zip","http://81.19.139.14/987yuhgzsd234dfwhjkaqppkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0sud/sud.exe","http://45.95.232.82/dfghujfdkg3fmsud/sud.exe","http://185.216.68.142:9000/hooks/xxx?id=%computername%")
index=activity AND rg_functionality="Authentication / VPN" AND requesturl NOT NULL AND requesturl IN ("http://88.151.192.128/djfhu34u9983234s3fnvmxxzpkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0pkg.zip","http://81.19.139.14/987yuhgzsd234dfwhjkaqppkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0sud/sud.exe","http://45.95.232.82/dfghujfdkg3fmsud/sud.exe","http://185.216.68.142:9000/hooks/xxx?id=%computername%")
index=activity AND rg_functionality="Authentication / VPN" AND Message NOT NULL AND Message IN ("http://88.151.192.128/djfhu34u9983234s3fnvmxxzpkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0pkg.zip","http://81.19.139.14/987yuhgzsd234dfwhjkaqppkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0sud/sud.exe","http://45.95.232.82/dfghujfdkg3fmsud/sud.exe","http://185.216.68.142:9000/hooks/xxx?id=%computername%")
index=activity AND rg_functionality="Authentication / VPN" AND Requestcontext NOT NULL AND Requestcontext IN ("http://88.151.192.128/djfhu34u9983234s3fnvmxxzpkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0pkg.zip","http://81.19.139.14/987yuhgzsd234dfwhjkaqppkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0sud/sud.exe","http://45.95.232.82/dfghujfdkg3fmsud/sud.exe","http://185.216.68.142:9000/hooks/xxx?id=%computername%")
index=activity AND rg_functionality="Authentication / VPN" AND customstring3 NOT NULL AND customstring3 IN ("http://88.151.192.128/djfhu34u9983234s3fnvmxxzpkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0pkg.zip","http://81.19.139.14/987yuhgzsd234dfwhjkaqppkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0sud/sud.exe","http://45.95.232.82/dfghujfdkg3fmsud/sud.exe","http://185.216.68.142:9000/hooks/xxx?id=%computername%")
index=activity AND rg_functionality="Cloud Content Management System" AND requesturl NOT NULL AND requesturl IN ("http://88.151.192.128/djfhu34u9983234s3fnvmxxzpkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0pkg.zip","http://81.19.139.14/987yuhgzsd234dfwhjkaqppkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0sud/sud.exe","http://45.95.232.82/dfghujfdkg3fmsud/sud.exe","http://185.216.68.142:9000/hooks/xxx?id=%computername%")
index=activity AND rg_functionality="Cloud Content Management System" AND Message NOT NULL AND Message IN ("http://88.151.192.128/djfhu34u9983234s3fnvmxxzpkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0pkg.zip","http://81.19.139.14/987yuhgzsd234dfwhjkaqppkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0sud/sud.exe","http://45.95.232.82/dfghujfdkg3fmsud/sud.exe","http://185.216.68.142:9000/hooks/xxx?id=%computername%")
index=activity AND rg_functionality="Cloud Content Management System" AND Requestcontext NOT NULL AND Requestcontext IN ("http://88.151.192.128/djfhu34u9983234s3fnvmxxzpkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0pkg.zip","http://81.19.139.14/987yuhgzsd234dfwhjkaqppkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0sud/sud.exe","http://45.95.232.82/dfghujfdkg3fmsud/sud.exe","http://185.216.68.142:9000/hooks/xxx?id=%computername%")
index=activity AND rg_functionality="Cloud Content Management System" AND customstring3 NOT NULL AND customstring3 IN ("http://88.151.192.128/djfhu34u9983234s3fnvmxxzpkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0pkg.zip","http://81.19.139.14/987yuhgzsd234dfwhjkaqppkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0sud/sud.exe","http://45.95.232.82/dfghujfdkg3fmsud/sud.exe","http://185.216.68.142:9000/hooks/xxx?id=%computername%")
index=activity AND rg_functionality="Cloud Services / Applications" AND requesturl NOT NULL AND requesturl IN ("http://88.151.192.128/djfhu34u9983234s3fnvmxxzpkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0pkg.zip","http://81.19.139.14/987yuhgzsd234dfwhjkaqppkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0sud/sud.exe","http://45.95.232.82/dfghujfdkg3fmsud/sud.exe","http://185.216.68.142:9000/hooks/xxx?id=%computername%")
index=activity AND rg_functionality="Cloud Services / Applications" AND Message NOT NULL AND Message IN ("http://88.151.192.128/djfhu34u9983234s3fnvmxxzpkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0pkg.zip","http://81.19.139.14/987yuhgzsd234dfwhjkaqppkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0sud/sud.exe","http://45.95.232.82/dfghujfdkg3fmsud/sud.exe","http://185.216.68.142:9000/hooks/xxx?id=%computername%")
index=activity AND rg_functionality="Cloud Services / Applications" AND Requestcontext NOT NULL AND Requestcontext IN ("http://88.151.192.128/djfhu34u9983234s3fnvmxxzpkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0pkg.zip","http://81.19.139.14/987yuhgzsd234dfwhjkaqppkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0sud/sud.exe","http://45.95.232.82/dfghujfdkg3fmsud/sud.exe","http://185.216.68.142:9000/hooks/xxx?id=%computername%")
index=activity AND rg_functionality="Cloud Services / Applications" AND customstring3 NOT NULL AND customstring3 IN ("http://88.151.192.128/djfhu34u9983234s3fnvmxxzpkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0pkg.zip","http://81.19.139.14/987yuhgzsd234dfwhjkaqppkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0sud/sud.exe","http://45.95.232.82/dfghujfdkg3fmsud/sud.exe","http://185.216.68.142:9000/hooks/xxx?id=%computername%")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND requesturl NOT NULL AND requesturl IN ("http://88.151.192.128/djfhu34u9983234s3fnvmxxzpkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0pkg.zip","http://81.19.139.14/987yuhgzsd234dfwhjkaqppkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0sud/sud.exe","http://45.95.232.82/dfghujfdkg3fmsud/sud.exe","http://185.216.68.142:9000/hooks/xxx?id=%computername%")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND Message NOT NULL AND Message IN ("http://88.151.192.128/djfhu34u9983234s3fnvmxxzpkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0pkg.zip","http://81.19.139.14/987yuhgzsd234dfwhjkaqppkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0sud/sud.exe","http://45.95.232.82/dfghujfdkg3fmsud/sud.exe","http://185.216.68.142:9000/hooks/xxx?id=%computername%")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND Requestcontext NOT NULL AND Requestcontext IN ("http://88.151.192.128/djfhu34u9983234s3fnvmxxzpkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0pkg.zip","http://81.19.139.14/987yuhgzsd234dfwhjkaqppkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0sud/sud.exe","http://45.95.232.82/dfghujfdkg3fmsud/sud.exe","http://185.216.68.142:9000/hooks/xxx?id=%computername%")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("http://88.151.192.128/djfhu34u9983234s3fnvmxxzpkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0pkg.zip","http://81.19.139.14/987yuhgzsd234dfwhjkaqppkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0sud/sud.exe","http://45.95.232.82/dfghujfdkg3fmsud/sud.exe","http://185.216.68.142:9000/hooks/xxx?id=%computername%")
index=activity AND rg_functionality="Web Application Firewall" AND requesturl NOT NULL AND requesturl IN ("http://88.151.192.128/djfhu34u9983234s3fnvmxxzpkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0pkg.zip","http://81.19.139.14/987yuhgzsd234dfwhjkaqppkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0sud/sud.exe","http://45.95.232.82/dfghujfdkg3fmsud/sud.exe","http://185.216.68.142:9000/hooks/xxx?id=%computername%")
index=activity AND rg_functionality="Web Application Firewall" AND Message NOT NULL AND Message IN ("http://88.151.192.128/djfhu34u9983234s3fnvmxxzpkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0pkg.zip","http://81.19.139.14/987yuhgzsd234dfwhjkaqppkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0sud/sud.exe","http://45.95.232.82/dfghujfdkg3fmsud/sud.exe","http://185.216.68.142:9000/hooks/xxx?id=%computername%")
index=activity AND rg_functionality="Web Application Firewall" AND Requestcontext NOT NULL AND Requestcontext IN ("http://88.151.192.128/djfhu34u9983234s3fnvmxxzpkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0pkg.zip","http://81.19.139.14/987yuhgzsd234dfwhjkaqppkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0sud/sud.exe","http://45.95.232.82/dfghujfdkg3fmsud/sud.exe","http://185.216.68.142:9000/hooks/xxx?id=%computername%")
index=activity AND rg_functionality="Web Application Firewall" AND customstring3 NOT NULL AND customstring3 IN ("http://88.151.192.128/djfhu34u9983234s3fnvmxxzpkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0pkg.zip","http://81.19.139.14/987yuhgzsd234dfwhjkaqppkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0sud/sud.exe","http://45.95.232.82/dfghujfdkg3fmsud/sud.exe","http://185.216.68.142:9000/hooks/xxx?id=%computername%")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND requesturl NOT NULL AND requesturl IN ("http://88.151.192.128/djfhu34u9983234s3fnvmxxzpkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0pkg.zip","http://81.19.139.14/987yuhgzsd234dfwhjkaqppkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0sud/sud.exe","http://45.95.232.82/dfghujfdkg3fmsud/sud.exe","http://185.216.68.142:9000/hooks/xxx?id=%computername%")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND Message NOT NULL AND Message IN ("http://88.151.192.128/djfhu34u9983234s3fnvmxxzpkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0pkg.zip","http://81.19.139.14/987yuhgzsd234dfwhjkaqppkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0sud/sud.exe","http://45.95.232.82/dfghujfdkg3fmsud/sud.exe","http://185.216.68.142:9000/hooks/xxx?id=%computername%")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND Requestcontext NOT NULL AND Requestcontext IN ("http://88.151.192.128/djfhu34u9983234s3fnvmxxzpkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0pkg.zip","http://81.19.139.14/987yuhgzsd234dfwhjkaqppkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0sud/sud.exe","http://45.95.232.82/dfghujfdkg3fmsud/sud.exe","http://185.216.68.142:9000/hooks/xxx?id=%computername%")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND customstring3 NOT NULL AND customstring3 IN ("http://88.151.192.128/djfhu34u9983234s3fnvmxxzpkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0pkg.zip","http://81.19.139.14/987yuhgzsd234dfwhjkaqppkg.zip","http://81.19.139.62/f8d79yuhjhlgdjlsjkf83da0sud/sud.exe","http://45.95.232.82/dfghujfdkg3fmsud/sud.exe","http://185.216.68.142:9000/hooks/xxx?id=%computername%")
