index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("4a2ec9f72b910c0a8e3efc4c334f5bad","e5f4188682e40e79800ccd165289c844","1b71d870f34587e0a2717f9925086eab","333b09f8865aae5d257b6f11f2fe5d08","b3831f0bace886aaba81873edc20aba4","100cd9d907e986ba8d5fc6d0488557d9","8b694068e5088e0c32739956e28b077e","0a178f76c48c038e8bad03a62b52cfc9","671b42e854ae2ee3341456fbec7c7787","3394fc2ba0a976818691751aa7f86d05","d280a258704bf9155bceaf4f731988ea","daffbfd71f8595ab6d6b8c94cc81a778","037e2ca3c97e1a5645cdc45fb0d98064","cffdd24742610fe5710dbc9ebd258c64","f62ea2cbd220596072010e91dd65b673","9f6c82c240ba5ef6bb85d28c0cdf7f7f","b63b783a9aca15726babd599d2963869","966373dbe28f4111f6ce47038fb343da","9c03d0da190d1046583ba9fa83a8bcd3")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("4a2ec9f72b910c0a8e3efc4c334f5bad","e5f4188682e40e79800ccd165289c844","1b71d870f34587e0a2717f9925086eab","333b09f8865aae5d257b6f11f2fe5d08","b3831f0bace886aaba81873edc20aba4","100cd9d907e986ba8d5fc6d0488557d9","8b694068e5088e0c32739956e28b077e","0a178f76c48c038e8bad03a62b52cfc9","671b42e854ae2ee3341456fbec7c7787","3394fc2ba0a976818691751aa7f86d05","d280a258704bf9155bceaf4f731988ea","daffbfd71f8595ab6d6b8c94cc81a778","037e2ca3c97e1a5645cdc45fb0d98064","cffdd24742610fe5710dbc9ebd258c64","f62ea2cbd220596072010e91dd65b673","9f6c82c240ba5ef6bb85d28c0cdf7f7f","b63b783a9aca15726babd599d2963869","966373dbe28f4111f6ce47038fb343da","9c03d0da190d1046583ba9fa83a8bcd3")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("4a2ec9f72b910c0a8e3efc4c334f5bad","e5f4188682e40e79800ccd165289c844","1b71d870f34587e0a2717f9925086eab","333b09f8865aae5d257b6f11f2fe5d08","b3831f0bace886aaba81873edc20aba4","100cd9d907e986ba8d5fc6d0488557d9","8b694068e5088e0c32739956e28b077e","0a178f76c48c038e8bad03a62b52cfc9","671b42e854ae2ee3341456fbec7c7787","3394fc2ba0a976818691751aa7f86d05","d280a258704bf9155bceaf4f731988ea","daffbfd71f8595ab6d6b8c94cc81a778","037e2ca3c97e1a5645cdc45fb0d98064","cffdd24742610fe5710dbc9ebd258c64","f62ea2cbd220596072010e91dd65b673","9f6c82c240ba5ef6bb85d28c0cdf7f7f","b63b783a9aca15726babd599d2963869","966373dbe28f4111f6ce47038fb343da","9c03d0da190d1046583ba9fa83a8bcd3")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring64 NOT NULL AND customstring64 IN ("4a2ec9f72b910c0a8e3efc4c334f5bad","e5f4188682e40e79800ccd165289c844","1b71d870f34587e0a2717f9925086eab","333b09f8865aae5d257b6f11f2fe5d08","b3831f0bace886aaba81873edc20aba4","100cd9d907e986ba8d5fc6d0488557d9","8b694068e5088e0c32739956e28b077e","0a178f76c48c038e8bad03a62b52cfc9","671b42e854ae2ee3341456fbec7c7787","3394fc2ba0a976818691751aa7f86d05","d280a258704bf9155bceaf4f731988ea","daffbfd71f8595ab6d6b8c94cc81a778","037e2ca3c97e1a5645cdc45fb0d98064","cffdd24742610fe5710dbc9ebd258c64","f62ea2cbd220596072010e91dd65b673","9f6c82c240ba5ef6bb85d28c0cdf7f7f","b63b783a9aca15726babd599d2963869","966373dbe28f4111f6ce47038fb343da","9c03d0da190d1046583ba9fa83a8bcd3")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("4a2ec9f72b910c0a8e3efc4c334f5bad","e5f4188682e40e79800ccd165289c844","1b71d870f34587e0a2717f9925086eab","333b09f8865aae5d257b6f11f2fe5d08","b3831f0bace886aaba81873edc20aba4","100cd9d907e986ba8d5fc6d0488557d9","8b694068e5088e0c32739956e28b077e","0a178f76c48c038e8bad03a62b52cfc9","671b42e854ae2ee3341456fbec7c7787","3394fc2ba0a976818691751aa7f86d05","d280a258704bf9155bceaf4f731988ea","daffbfd71f8595ab6d6b8c94cc81a778","037e2ca3c97e1a5645cdc45fb0d98064","cffdd24742610fe5710dbc9ebd258c64","f62ea2cbd220596072010e91dd65b673","9f6c82c240ba5ef6bb85d28c0cdf7f7f","b63b783a9aca15726babd599d2963869","966373dbe28f4111f6ce47038fb343da","9c03d0da190d1046583ba9fa83a8bcd3")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("4a2ec9f72b910c0a8e3efc4c334f5bad","e5f4188682e40e79800ccd165289c844","1b71d870f34587e0a2717f9925086eab","333b09f8865aae5d257b6f11f2fe5d08","b3831f0bace886aaba81873edc20aba4","100cd9d907e986ba8d5fc6d0488557d9","8b694068e5088e0c32739956e28b077e","0a178f76c48c038e8bad03a62b52cfc9","671b42e854ae2ee3341456fbec7c7787","3394fc2ba0a976818691751aa7f86d05","d280a258704bf9155bceaf4f731988ea","daffbfd71f8595ab6d6b8c94cc81a778","037e2ca3c97e1a5645cdc45fb0d98064","cffdd24742610fe5710dbc9ebd258c64","f62ea2cbd220596072010e91dd65b673","9f6c82c240ba5ef6bb85d28c0cdf7f7f","b63b783a9aca15726babd599d2963869","966373dbe28f4111f6ce47038fb343da","9c03d0da190d1046583ba9fa83a8bcd3")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("4a2ec9f72b910c0a8e3efc4c334f5bad","e5f4188682e40e79800ccd165289c844","1b71d870f34587e0a2717f9925086eab","333b09f8865aae5d257b6f11f2fe5d08","b3831f0bace886aaba81873edc20aba4","100cd9d907e986ba8d5fc6d0488557d9","8b694068e5088e0c32739956e28b077e","0a178f76c48c038e8bad03a62b52cfc9","671b42e854ae2ee3341456fbec7c7787","3394fc2ba0a976818691751aa7f86d05","d280a258704bf9155bceaf4f731988ea","daffbfd71f8595ab6d6b8c94cc81a778","037e2ca3c97e1a5645cdc45fb0d98064","cffdd24742610fe5710dbc9ebd258c64","f62ea2cbd220596072010e91dd65b673","9f6c82c240ba5ef6bb85d28c0cdf7f7f","b63b783a9aca15726babd599d2963869","966373dbe28f4111f6ce47038fb343da","9c03d0da190d1046583ba9fa83a8bcd3")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("4a2ec9f72b910c0a8e3efc4c334f5bad","e5f4188682e40e79800ccd165289c844","1b71d870f34587e0a2717f9925086eab","333b09f8865aae5d257b6f11f2fe5d08","b3831f0bace886aaba81873edc20aba4","100cd9d907e986ba8d5fc6d0488557d9","8b694068e5088e0c32739956e28b077e","0a178f76c48c038e8bad03a62b52cfc9","671b42e854ae2ee3341456fbec7c7787","3394fc2ba0a976818691751aa7f86d05","d280a258704bf9155bceaf4f731988ea","daffbfd71f8595ab6d6b8c94cc81a778","037e2ca3c97e1a5645cdc45fb0d98064","cffdd24742610fe5710dbc9ebd258c64","f62ea2cbd220596072010e91dd65b673","9f6c82c240ba5ef6bb85d28c0cdf7f7f","b63b783a9aca15726babd599d2963869","966373dbe28f4111f6ce47038fb343da","9c03d0da190d1046583ba9fa83a8bcd3")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("4a2ec9f72b910c0a8e3efc4c334f5bad","e5f4188682e40e79800ccd165289c844","1b71d870f34587e0a2717f9925086eab","333b09f8865aae5d257b6f11f2fe5d08","b3831f0bace886aaba81873edc20aba4","100cd9d907e986ba8d5fc6d0488557d9","8b694068e5088e0c32739956e28b077e","0a178f76c48c038e8bad03a62b52cfc9","671b42e854ae2ee3341456fbec7c7787","3394fc2ba0a976818691751aa7f86d05","d280a258704bf9155bceaf4f731988ea","daffbfd71f8595ab6d6b8c94cc81a778","037e2ca3c97e1a5645cdc45fb0d98064","cffdd24742610fe5710dbc9ebd258c64","f62ea2cbd220596072010e91dd65b673","9f6c82c240ba5ef6bb85d28c0cdf7f7f","b63b783a9aca15726babd599d2963869","966373dbe28f4111f6ce47038fb343da","9c03d0da190d1046583ba9fa83a8bcd3")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("4a2ec9f72b910c0a8e3efc4c334f5bad","e5f4188682e40e79800ccd165289c844","1b71d870f34587e0a2717f9925086eab","333b09f8865aae5d257b6f11f2fe5d08","b3831f0bace886aaba81873edc20aba4","100cd9d907e986ba8d5fc6d0488557d9","8b694068e5088e0c32739956e28b077e","0a178f76c48c038e8bad03a62b52cfc9","671b42e854ae2ee3341456fbec7c7787","3394fc2ba0a976818691751aa7f86d05","d280a258704bf9155bceaf4f731988ea","daffbfd71f8595ab6d6b8c94cc81a778","037e2ca3c97e1a5645cdc45fb0d98064","cffdd24742610fe5710dbc9ebd258c64","f62ea2cbd220596072010e91dd65b673","9f6c82c240ba5ef6bb85d28c0cdf7f7f","b63b783a9aca15726babd599d2963869","966373dbe28f4111f6ce47038fb343da","9c03d0da190d1046583ba9fa83a8bcd3")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("4a2ec9f72b910c0a8e3efc4c334f5bad","e5f4188682e40e79800ccd165289c844","1b71d870f34587e0a2717f9925086eab","333b09f8865aae5d257b6f11f2fe5d08","b3831f0bace886aaba81873edc20aba4","100cd9d907e986ba8d5fc6d0488557d9","8b694068e5088e0c32739956e28b077e","0a178f76c48c038e8bad03a62b52cfc9","671b42e854ae2ee3341456fbec7c7787","3394fc2ba0a976818691751aa7f86d05","d280a258704bf9155bceaf4f731988ea","daffbfd71f8595ab6d6b8c94cc81a778","037e2ca3c97e1a5645cdc45fb0d98064","cffdd24742610fe5710dbc9ebd258c64","f62ea2cbd220596072010e91dd65b673","9f6c82c240ba5ef6bb85d28c0cdf7f7f","b63b783a9aca15726babd599d2963869","966373dbe28f4111f6ce47038fb343da","9c03d0da190d1046583ba9fa83a8bcd3")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("4a2ec9f72b910c0a8e3efc4c334f5bad","e5f4188682e40e79800ccd165289c844","1b71d870f34587e0a2717f9925086eab","333b09f8865aae5d257b6f11f2fe5d08","b3831f0bace886aaba81873edc20aba4","100cd9d907e986ba8d5fc6d0488557d9","8b694068e5088e0c32739956e28b077e","0a178f76c48c038e8bad03a62b52cfc9","671b42e854ae2ee3341456fbec7c7787","3394fc2ba0a976818691751aa7f86d05","d280a258704bf9155bceaf4f731988ea","daffbfd71f8595ab6d6b8c94cc81a778","037e2ca3c97e1a5645cdc45fb0d98064","cffdd24742610fe5710dbc9ebd258c64","f62ea2cbd220596072010e91dd65b673","9f6c82c240ba5ef6bb85d28c0cdf7f7f","b63b783a9aca15726babd599d2963869","966373dbe28f4111f6ce47038fb343da","9c03d0da190d1046583ba9fa83a8bcd3")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("4a2ec9f72b910c0a8e3efc4c334f5bad","e5f4188682e40e79800ccd165289c844","1b71d870f34587e0a2717f9925086eab","333b09f8865aae5d257b6f11f2fe5d08","b3831f0bace886aaba81873edc20aba4","100cd9d907e986ba8d5fc6d0488557d9","8b694068e5088e0c32739956e28b077e","0a178f76c48c038e8bad03a62b52cfc9","671b42e854ae2ee3341456fbec7c7787","3394fc2ba0a976818691751aa7f86d05","d280a258704bf9155bceaf4f731988ea","daffbfd71f8595ab6d6b8c94cc81a778","037e2ca3c97e1a5645cdc45fb0d98064","cffdd24742610fe5710dbc9ebd258c64","f62ea2cbd220596072010e91dd65b673","9f6c82c240ba5ef6bb85d28c0cdf7f7f","b63b783a9aca15726babd599d2963869","966373dbe28f4111f6ce47038fb343da","9c03d0da190d1046583ba9fa83a8bcd3")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("4a2ec9f72b910c0a8e3efc4c334f5bad","e5f4188682e40e79800ccd165289c844","1b71d870f34587e0a2717f9925086eab","333b09f8865aae5d257b6f11f2fe5d08","b3831f0bace886aaba81873edc20aba4","100cd9d907e986ba8d5fc6d0488557d9","8b694068e5088e0c32739956e28b077e","0a178f76c48c038e8bad03a62b52cfc9","671b42e854ae2ee3341456fbec7c7787","3394fc2ba0a976818691751aa7f86d05","d280a258704bf9155bceaf4f731988ea","daffbfd71f8595ab6d6b8c94cc81a778","037e2ca3c97e1a5645cdc45fb0d98064","cffdd24742610fe5710dbc9ebd258c64","f62ea2cbd220596072010e91dd65b673","9f6c82c240ba5ef6bb85d28c0cdf7f7f","b63b783a9aca15726babd599d2963869","966373dbe28f4111f6ce47038fb343da","9c03d0da190d1046583ba9fa83a8bcd3")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("4a2ec9f72b910c0a8e3efc4c334f5bad","e5f4188682e40e79800ccd165289c844","1b71d870f34587e0a2717f9925086eab","333b09f8865aae5d257b6f11f2fe5d08","b3831f0bace886aaba81873edc20aba4","100cd9d907e986ba8d5fc6d0488557d9","8b694068e5088e0c32739956e28b077e","0a178f76c48c038e8bad03a62b52cfc9","671b42e854ae2ee3341456fbec7c7787","3394fc2ba0a976818691751aa7f86d05","d280a258704bf9155bceaf4f731988ea","daffbfd71f8595ab6d6b8c94cc81a778","037e2ca3c97e1a5645cdc45fb0d98064","cffdd24742610fe5710dbc9ebd258c64","f62ea2cbd220596072010e91dd65b673","9f6c82c240ba5ef6bb85d28c0cdf7f7f","b63b783a9aca15726babd599d2963869","966373dbe28f4111f6ce47038fb343da","9c03d0da190d1046583ba9fa83a8bcd3")
index=activity AND rg_functionality="Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("4a2ec9f72b910c0a8e3efc4c334f5bad","e5f4188682e40e79800ccd165289c844","1b71d870f34587e0a2717f9925086eab","333b09f8865aae5d257b6f11f2fe5d08","b3831f0bace886aaba81873edc20aba4","100cd9d907e986ba8d5fc6d0488557d9","8b694068e5088e0c32739956e28b077e","0a178f76c48c038e8bad03a62b52cfc9","671b42e854ae2ee3341456fbec7c7787","3394fc2ba0a976818691751aa7f86d05","d280a258704bf9155bceaf4f731988ea","daffbfd71f8595ab6d6b8c94cc81a778","037e2ca3c97e1a5645cdc45fb0d98064","cffdd24742610fe5710dbc9ebd258c64","f62ea2cbd220596072010e91dd65b673","9f6c82c240ba5ef6bb85d28c0cdf7f7f","b63b783a9aca15726babd599d2963869","966373dbe28f4111f6ce47038fb343da","9c03d0da190d1046583ba9fa83a8bcd3")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("4a2ec9f72b910c0a8e3efc4c334f5bad","e5f4188682e40e79800ccd165289c844","1b71d870f34587e0a2717f9925086eab","333b09f8865aae5d257b6f11f2fe5d08","b3831f0bace886aaba81873edc20aba4","100cd9d907e986ba8d5fc6d0488557d9","8b694068e5088e0c32739956e28b077e","0a178f76c48c038e8bad03a62b52cfc9","671b42e854ae2ee3341456fbec7c7787","3394fc2ba0a976818691751aa7f86d05","d280a258704bf9155bceaf4f731988ea","daffbfd71f8595ab6d6b8c94cc81a778","037e2ca3c97e1a5645cdc45fb0d98064","cffdd24742610fe5710dbc9ebd258c64","f62ea2cbd220596072010e91dd65b673","9f6c82c240ba5ef6bb85d28c0cdf7f7f","b63b783a9aca15726babd599d2963869","966373dbe28f4111f6ce47038fb343da","9c03d0da190d1046583ba9fa83a8bcd3")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("4a2ec9f72b910c0a8e3efc4c334f5bad","e5f4188682e40e79800ccd165289c844","1b71d870f34587e0a2717f9925086eab","333b09f8865aae5d257b6f11f2fe5d08","b3831f0bace886aaba81873edc20aba4","100cd9d907e986ba8d5fc6d0488557d9","8b694068e5088e0c32739956e28b077e","0a178f76c48c038e8bad03a62b52cfc9","671b42e854ae2ee3341456fbec7c7787","3394fc2ba0a976818691751aa7f86d05","d280a258704bf9155bceaf4f731988ea","daffbfd71f8595ab6d6b8c94cc81a778","037e2ca3c97e1a5645cdc45fb0d98064","cffdd24742610fe5710dbc9ebd258c64","f62ea2cbd220596072010e91dd65b673","9f6c82c240ba5ef6bb85d28c0cdf7f7f","b63b783a9aca15726babd599d2963869","966373dbe28f4111f6ce47038fb343da","9c03d0da190d1046583ba9fa83a8bcd3")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("4a2ec9f72b910c0a8e3efc4c334f5bad","e5f4188682e40e79800ccd165289c844","1b71d870f34587e0a2717f9925086eab","333b09f8865aae5d257b6f11f2fe5d08","b3831f0bace886aaba81873edc20aba4","100cd9d907e986ba8d5fc6d0488557d9","8b694068e5088e0c32739956e28b077e","0a178f76c48c038e8bad03a62b52cfc9","671b42e854ae2ee3341456fbec7c7787","3394fc2ba0a976818691751aa7f86d05","d280a258704bf9155bceaf4f731988ea","daffbfd71f8595ab6d6b8c94cc81a778","037e2ca3c97e1a5645cdc45fb0d98064","cffdd24742610fe5710dbc9ebd258c64","f62ea2cbd220596072010e91dd65b673","9f6c82c240ba5ef6bb85d28c0cdf7f7f","b63b783a9aca15726babd599d2963869","966373dbe28f4111f6ce47038fb343da","9c03d0da190d1046583ba9fa83a8bcd3")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("4a2ec9f72b910c0a8e3efc4c334f5bad","e5f4188682e40e79800ccd165289c844","1b71d870f34587e0a2717f9925086eab","333b09f8865aae5d257b6f11f2fe5d08","b3831f0bace886aaba81873edc20aba4","100cd9d907e986ba8d5fc6d0488557d9","8b694068e5088e0c32739956e28b077e","0a178f76c48c038e8bad03a62b52cfc9","671b42e854ae2ee3341456fbec7c7787","3394fc2ba0a976818691751aa7f86d05","d280a258704bf9155bceaf4f731988ea","daffbfd71f8595ab6d6b8c94cc81a778","037e2ca3c97e1a5645cdc45fb0d98064","cffdd24742610fe5710dbc9ebd258c64","f62ea2cbd220596072010e91dd65b673","9f6c82c240ba5ef6bb85d28c0cdf7f7f","b63b783a9aca15726babd599d2963869","966373dbe28f4111f6ce47038fb343da","9c03d0da190d1046583ba9fa83a8bcd3")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("4a2ec9f72b910c0a8e3efc4c334f5bad","e5f4188682e40e79800ccd165289c844","1b71d870f34587e0a2717f9925086eab","333b09f8865aae5d257b6f11f2fe5d08","b3831f0bace886aaba81873edc20aba4","100cd9d907e986ba8d5fc6d0488557d9","8b694068e5088e0c32739956e28b077e","0a178f76c48c038e8bad03a62b52cfc9","671b42e854ae2ee3341456fbec7c7787","3394fc2ba0a976818691751aa7f86d05","d280a258704bf9155bceaf4f731988ea","daffbfd71f8595ab6d6b8c94cc81a778","037e2ca3c97e1a5645cdc45fb0d98064","cffdd24742610fe5710dbc9ebd258c64","f62ea2cbd220596072010e91dd65b673","9f6c82c240ba5ef6bb85d28c0cdf7f7f","b63b783a9aca15726babd599d2963869","966373dbe28f4111f6ce47038fb343da","9c03d0da190d1046583ba9fa83a8bcd3")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("4a2ec9f72b910c0a8e3efc4c334f5bad","e5f4188682e40e79800ccd165289c844","1b71d870f34587e0a2717f9925086eab","333b09f8865aae5d257b6f11f2fe5d08","b3831f0bace886aaba81873edc20aba4","100cd9d907e986ba8d5fc6d0488557d9","8b694068e5088e0c32739956e28b077e","0a178f76c48c038e8bad03a62b52cfc9","671b42e854ae2ee3341456fbec7c7787","3394fc2ba0a976818691751aa7f86d05","d280a258704bf9155bceaf4f731988ea","daffbfd71f8595ab6d6b8c94cc81a778","037e2ca3c97e1a5645cdc45fb0d98064","cffdd24742610fe5710dbc9ebd258c64","f62ea2cbd220596072010e91dd65b673","9f6c82c240ba5ef6bb85d28c0cdf7f7f","b63b783a9aca15726babd599d2963869","966373dbe28f4111f6ce47038fb343da","9c03d0da190d1046583ba9fa83a8bcd3")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("4a2ec9f72b910c0a8e3efc4c334f5bad","e5f4188682e40e79800ccd165289c844","1b71d870f34587e0a2717f9925086eab","333b09f8865aae5d257b6f11f2fe5d08","b3831f0bace886aaba81873edc20aba4","100cd9d907e986ba8d5fc6d0488557d9","8b694068e5088e0c32739956e28b077e","0a178f76c48c038e8bad03a62b52cfc9","671b42e854ae2ee3341456fbec7c7787","3394fc2ba0a976818691751aa7f86d05","d280a258704bf9155bceaf4f731988ea","daffbfd71f8595ab6d6b8c94cc81a778","037e2ca3c97e1a5645cdc45fb0d98064","cffdd24742610fe5710dbc9ebd258c64","f62ea2cbd220596072010e91dd65b673","9f6c82c240ba5ef6bb85d28c0cdf7f7f","b63b783a9aca15726babd599d2963869","966373dbe28f4111f6ce47038fb343da","9c03d0da190d1046583ba9fa83a8bcd3")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring64 NOT NULL AND customstring64 IN ("4a2ec9f72b910c0a8e3efc4c334f5bad","e5f4188682e40e79800ccd165289c844","1b71d870f34587e0a2717f9925086eab","333b09f8865aae5d257b6f11f2fe5d08","b3831f0bace886aaba81873edc20aba4","100cd9d907e986ba8d5fc6d0488557d9","8b694068e5088e0c32739956e28b077e","0a178f76c48c038e8bad03a62b52cfc9","671b42e854ae2ee3341456fbec7c7787","3394fc2ba0a976818691751aa7f86d05","d280a258704bf9155bceaf4f731988ea","daffbfd71f8595ab6d6b8c94cc81a778","037e2ca3c97e1a5645cdc45fb0d98064","cffdd24742610fe5710dbc9ebd258c64","f62ea2cbd220596072010e91dd65b673","9f6c82c240ba5ef6bb85d28c0cdf7f7f","b63b783a9aca15726babd599d2963869","966373dbe28f4111f6ce47038fb343da","9c03d0da190d1046583ba9fa83a8bcd3")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("4a2ec9f72b910c0a8e3efc4c334f5bad","e5f4188682e40e79800ccd165289c844","1b71d870f34587e0a2717f9925086eab","333b09f8865aae5d257b6f11f2fe5d08","b3831f0bace886aaba81873edc20aba4","100cd9d907e986ba8d5fc6d0488557d9","8b694068e5088e0c32739956e28b077e","0a178f76c48c038e8bad03a62b52cfc9","671b42e854ae2ee3341456fbec7c7787","3394fc2ba0a976818691751aa7f86d05","d280a258704bf9155bceaf4f731988ea","daffbfd71f8595ab6d6b8c94cc81a778","037e2ca3c97e1a5645cdc45fb0d98064","cffdd24742610fe5710dbc9ebd258c64","f62ea2cbd220596072010e91dd65b673","9f6c82c240ba5ef6bb85d28c0cdf7f7f","b63b783a9aca15726babd599d2963869","966373dbe28f4111f6ce47038fb343da","9c03d0da190d1046583ba9fa83a8bcd3")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("4a2ec9f72b910c0a8e3efc4c334f5bad","e5f4188682e40e79800ccd165289c844","1b71d870f34587e0a2717f9925086eab","333b09f8865aae5d257b6f11f2fe5d08","b3831f0bace886aaba81873edc20aba4","100cd9d907e986ba8d5fc6d0488557d9","8b694068e5088e0c32739956e28b077e","0a178f76c48c038e8bad03a62b52cfc9","671b42e854ae2ee3341456fbec7c7787","3394fc2ba0a976818691751aa7f86d05","d280a258704bf9155bceaf4f731988ea","daffbfd71f8595ab6d6b8c94cc81a778","037e2ca3c97e1a5645cdc45fb0d98064","cffdd24742610fe5710dbc9ebd258c64","f62ea2cbd220596072010e91dd65b673","9f6c82c240ba5ef6bb85d28c0cdf7f7f","b63b783a9aca15726babd599d2963869","966373dbe28f4111f6ce47038fb343da","9c03d0da190d1046583ba9fa83a8bcd3")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("4a2ec9f72b910c0a8e3efc4c334f5bad","e5f4188682e40e79800ccd165289c844","1b71d870f34587e0a2717f9925086eab","333b09f8865aae5d257b6f11f2fe5d08","b3831f0bace886aaba81873edc20aba4","100cd9d907e986ba8d5fc6d0488557d9","8b694068e5088e0c32739956e28b077e","0a178f76c48c038e8bad03a62b52cfc9","671b42e854ae2ee3341456fbec7c7787","3394fc2ba0a976818691751aa7f86d05","d280a258704bf9155bceaf4f731988ea","daffbfd71f8595ab6d6b8c94cc81a778","037e2ca3c97e1a5645cdc45fb0d98064","cffdd24742610fe5710dbc9ebd258c64","f62ea2cbd220596072010e91dd65b673","9f6c82c240ba5ef6bb85d28c0cdf7f7f","b63b783a9aca15726babd599d2963869","966373dbe28f4111f6ce47038fb343da","9c03d0da190d1046583ba9fa83a8bcd3")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring64 NOT NULL AND customstring64 IN ("4a2ec9f72b910c0a8e3efc4c334f5bad","e5f4188682e40e79800ccd165289c844","1b71d870f34587e0a2717f9925086eab","333b09f8865aae5d257b6f11f2fe5d08","b3831f0bace886aaba81873edc20aba4","100cd9d907e986ba8d5fc6d0488557d9","8b694068e5088e0c32739956e28b077e","0a178f76c48c038e8bad03a62b52cfc9","671b42e854ae2ee3341456fbec7c7787","3394fc2ba0a976818691751aa7f86d05","d280a258704bf9155bceaf4f731988ea","daffbfd71f8595ab6d6b8c94cc81a778","037e2ca3c97e1a5645cdc45fb0d98064","cffdd24742610fe5710dbc9ebd258c64","f62ea2cbd220596072010e91dd65b673","9f6c82c240ba5ef6bb85d28c0cdf7f7f","b63b783a9aca15726babd599d2963869","966373dbe28f4111f6ce47038fb343da","9c03d0da190d1046583ba9fa83a8bcd3")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("4a2ec9f72b910c0a8e3efc4c334f5bad","e5f4188682e40e79800ccd165289c844","1b71d870f34587e0a2717f9925086eab","333b09f8865aae5d257b6f11f2fe5d08","b3831f0bace886aaba81873edc20aba4","100cd9d907e986ba8d5fc6d0488557d9","8b694068e5088e0c32739956e28b077e","0a178f76c48c038e8bad03a62b52cfc9","671b42e854ae2ee3341456fbec7c7787","3394fc2ba0a976818691751aa7f86d05","d280a258704bf9155bceaf4f731988ea","daffbfd71f8595ab6d6b8c94cc81a778","037e2ca3c97e1a5645cdc45fb0d98064","cffdd24742610fe5710dbc9ebd258c64","f62ea2cbd220596072010e91dd65b673","9f6c82c240ba5ef6bb85d28c0cdf7f7f","b63b783a9aca15726babd599d2963869","966373dbe28f4111f6ce47038fb343da","9c03d0da190d1046583ba9fa83a8bcd3")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("4a2ec9f72b910c0a8e3efc4c334f5bad","e5f4188682e40e79800ccd165289c844","1b71d870f34587e0a2717f9925086eab","333b09f8865aae5d257b6f11f2fe5d08","b3831f0bace886aaba81873edc20aba4","100cd9d907e986ba8d5fc6d0488557d9","8b694068e5088e0c32739956e28b077e","0a178f76c48c038e8bad03a62b52cfc9","671b42e854ae2ee3341456fbec7c7787","3394fc2ba0a976818691751aa7f86d05","d280a258704bf9155bceaf4f731988ea","daffbfd71f8595ab6d6b8c94cc81a778","037e2ca3c97e1a5645cdc45fb0d98064","cffdd24742610fe5710dbc9ebd258c64","f62ea2cbd220596072010e91dd65b673","9f6c82c240ba5ef6bb85d28c0cdf7f7f","b63b783a9aca15726babd599d2963869","966373dbe28f4111f6ce47038fb343da","9c03d0da190d1046583ba9fa83a8bcd3")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("4a2ec9f72b910c0a8e3efc4c334f5bad","e5f4188682e40e79800ccd165289c844","1b71d870f34587e0a2717f9925086eab","333b09f8865aae5d257b6f11f2fe5d08","b3831f0bace886aaba81873edc20aba4","100cd9d907e986ba8d5fc6d0488557d9","8b694068e5088e0c32739956e28b077e","0a178f76c48c038e8bad03a62b52cfc9","671b42e854ae2ee3341456fbec7c7787","3394fc2ba0a976818691751aa7f86d05","d280a258704bf9155bceaf4f731988ea","daffbfd71f8595ab6d6b8c94cc81a778","037e2ca3c97e1a5645cdc45fb0d98064","cffdd24742610fe5710dbc9ebd258c64","f62ea2cbd220596072010e91dd65b673","9f6c82c240ba5ef6bb85d28c0cdf7f7f","b63b783a9aca15726babd599d2963869","966373dbe28f4111f6ce47038fb343da","9c03d0da190d1046583ba9fa83a8bcd3")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring64 NOT NULL AND customstring64 IN ("4a2ec9f72b910c0a8e3efc4c334f5bad","e5f4188682e40e79800ccd165289c844","1b71d870f34587e0a2717f9925086eab","333b09f8865aae5d257b6f11f2fe5d08","b3831f0bace886aaba81873edc20aba4","100cd9d907e986ba8d5fc6d0488557d9","8b694068e5088e0c32739956e28b077e","0a178f76c48c038e8bad03a62b52cfc9","671b42e854ae2ee3341456fbec7c7787","3394fc2ba0a976818691751aa7f86d05","d280a258704bf9155bceaf4f731988ea","daffbfd71f8595ab6d6b8c94cc81a778","037e2ca3c97e1a5645cdc45fb0d98064","cffdd24742610fe5710dbc9ebd258c64","f62ea2cbd220596072010e91dd65b673","9f6c82c240ba5ef6bb85d28c0cdf7f7f","b63b783a9aca15726babd599d2963869","966373dbe28f4111f6ce47038fb343da","9c03d0da190d1046583ba9fa83a8bcd3")
index=activity AND rg_functionality="O365 General" AND filehash NOT NULL AND filehash IN ("4a2ec9f72b910c0a8e3efc4c334f5bad","e5f4188682e40e79800ccd165289c844","1b71d870f34587e0a2717f9925086eab","333b09f8865aae5d257b6f11f2fe5d08","b3831f0bace886aaba81873edc20aba4","100cd9d907e986ba8d5fc6d0488557d9","8b694068e5088e0c32739956e28b077e","0a178f76c48c038e8bad03a62b52cfc9","671b42e854ae2ee3341456fbec7c7787","3394fc2ba0a976818691751aa7f86d05","d280a258704bf9155bceaf4f731988ea","daffbfd71f8595ab6d6b8c94cc81a778","037e2ca3c97e1a5645cdc45fb0d98064","cffdd24742610fe5710dbc9ebd258c64","f62ea2cbd220596072010e91dd65b673","9f6c82c240ba5ef6bb85d28c0cdf7f7f","b63b783a9aca15726babd599d2963869","966373dbe28f4111f6ce47038fb343da","9c03d0da190d1046583ba9fa83a8bcd3")
index=activity AND rg_functionality="O365 General" AND oldfilehash NOT NULL AND oldfilehash IN ("4a2ec9f72b910c0a8e3efc4c334f5bad","e5f4188682e40e79800ccd165289c844","1b71d870f34587e0a2717f9925086eab","333b09f8865aae5d257b6f11f2fe5d08","b3831f0bace886aaba81873edc20aba4","100cd9d907e986ba8d5fc6d0488557d9","8b694068e5088e0c32739956e28b077e","0a178f76c48c038e8bad03a62b52cfc9","671b42e854ae2ee3341456fbec7c7787","3394fc2ba0a976818691751aa7f86d05","d280a258704bf9155bceaf4f731988ea","daffbfd71f8595ab6d6b8c94cc81a778","037e2ca3c97e1a5645cdc45fb0d98064","cffdd24742610fe5710dbc9ebd258c64","f62ea2cbd220596072010e91dd65b673","9f6c82c240ba5ef6bb85d28c0cdf7f7f","b63b783a9aca15726babd599d2963869","966373dbe28f4111f6ce47038fb343da","9c03d0da190d1046583ba9fa83a8bcd3")
index=activity AND rg_functionality="O365 General" AND customstring3 NOT NULL AND customstring3 IN ("4a2ec9f72b910c0a8e3efc4c334f5bad","e5f4188682e40e79800ccd165289c844","1b71d870f34587e0a2717f9925086eab","333b09f8865aae5d257b6f11f2fe5d08","b3831f0bace886aaba81873edc20aba4","100cd9d907e986ba8d5fc6d0488557d9","8b694068e5088e0c32739956e28b077e","0a178f76c48c038e8bad03a62b52cfc9","671b42e854ae2ee3341456fbec7c7787","3394fc2ba0a976818691751aa7f86d05","d280a258704bf9155bceaf4f731988ea","daffbfd71f8595ab6d6b8c94cc81a778","037e2ca3c97e1a5645cdc45fb0d98064","cffdd24742610fe5710dbc9ebd258c64","f62ea2cbd220596072010e91dd65b673","9f6c82c240ba5ef6bb85d28c0cdf7f7f","b63b783a9aca15726babd599d2963869","966373dbe28f4111f6ce47038fb343da","9c03d0da190d1046583ba9fa83a8bcd3")
index=activity AND rg_functionality="O365 General" AND customstring64 NOT NULL AND customstring64 IN ("4a2ec9f72b910c0a8e3efc4c334f5bad","e5f4188682e40e79800ccd165289c844","1b71d870f34587e0a2717f9925086eab","333b09f8865aae5d257b6f11f2fe5d08","b3831f0bace886aaba81873edc20aba4","100cd9d907e986ba8d5fc6d0488557d9","8b694068e5088e0c32739956e28b077e","0a178f76c48c038e8bad03a62b52cfc9","671b42e854ae2ee3341456fbec7c7787","3394fc2ba0a976818691751aa7f86d05","d280a258704bf9155bceaf4f731988ea","daffbfd71f8595ab6d6b8c94cc81a778","037e2ca3c97e1a5645cdc45fb0d98064","cffdd24742610fe5710dbc9ebd258c64","f62ea2cbd220596072010e91dd65b673","9f6c82c240ba5ef6bb85d28c0cdf7f7f","b63b783a9aca15726babd599d2963869","966373dbe28f4111f6ce47038fb343da","9c03d0da190d1046583ba9fa83a8bcd3")
