index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("1cc0536ae396eba7fbde9f35dc2fc8e3","b7ac2fd5108f69e90ad02a1c31f8b50ab4612aa6","5dc8aa3c906a469e734540d1fea1549220c63505b5508e539e4a16b841902ed1","6860c43374ad280c3927b16af66e3593","94658e04988b02c395402992f46f1e975f9440e1","0a127dfa75ecdc85e88810809c94231949606d93d232f40dad9823d3ac09b767")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("1cc0536ae396eba7fbde9f35dc2fc8e3","b7ac2fd5108f69e90ad02a1c31f8b50ab4612aa6","5dc8aa3c906a469e734540d1fea1549220c63505b5508e539e4a16b841902ed1","6860c43374ad280c3927b16af66e3593","94658e04988b02c395402992f46f1e975f9440e1","0a127dfa75ecdc85e88810809c94231949606d93d232f40dad9823d3ac09b767")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("1cc0536ae396eba7fbde9f35dc2fc8e3","b7ac2fd5108f69e90ad02a1c31f8b50ab4612aa6","5dc8aa3c906a469e734540d1fea1549220c63505b5508e539e4a16b841902ed1","6860c43374ad280c3927b16af66e3593","94658e04988b02c395402992f46f1e975f9440e1","0a127dfa75ecdc85e88810809c94231949606d93d232f40dad9823d3ac09b767")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("1cc0536ae396eba7fbde9f35dc2fc8e3","b7ac2fd5108f69e90ad02a1c31f8b50ab4612aa6","5dc8aa3c906a469e734540d1fea1549220c63505b5508e539e4a16b841902ed1","6860c43374ad280c3927b16af66e3593","94658e04988b02c395402992f46f1e975f9440e1","0a127dfa75ecdc85e88810809c94231949606d93d232f40dad9823d3ac09b767")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("1cc0536ae396eba7fbde9f35dc2fc8e3","b7ac2fd5108f69e90ad02a1c31f8b50ab4612aa6","5dc8aa3c906a469e734540d1fea1549220c63505b5508e539e4a16b841902ed1","6860c43374ad280c3927b16af66e3593","94658e04988b02c395402992f46f1e975f9440e1","0a127dfa75ecdc85e88810809c94231949606d93d232f40dad9823d3ac09b767")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("1cc0536ae396eba7fbde9f35dc2fc8e3","b7ac2fd5108f69e90ad02a1c31f8b50ab4612aa6","5dc8aa3c906a469e734540d1fea1549220c63505b5508e539e4a16b841902ed1","6860c43374ad280c3927b16af66e3593","94658e04988b02c395402992f46f1e975f9440e1","0a127dfa75ecdc85e88810809c94231949606d93d232f40dad9823d3ac09b767")
