index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("4ca4f673e4389a352854f5feb0793dac43519ade8049b5dd9356d0cbe0f06148","55dc772d1b59c387b5f33428d5167437dc2d6e2423765f4080ee3b6a04947ae9","4b410c47465359ef40d470c9286fb980e656698c4ee4d969c86c84fbd012af0d","c49e9b556d271a853449ec915e4a929f5fa7ae04da4dc714c220ed0d703a36f7","ad97b1c79735b1b97c4c4432cacac2fce6316889eafb41a0d97f2b0e565ee850","c722651d72c47e224007c2111e0489a028521ccdf5331c92e6cd9cfe07076918","2140adec9cde046b35634e93b83da4cc9a8aa0a71c21e32ba1dce2742314e8dc","a31d742d7e36fefed01971d8cba827c71e69d59167e080d2f551210c85fddaa5","a31d742d7e36fefed01971d8cba827c71e69d59167e080d2f551210c85fddaa5","2df309018ab935c47306b06ebf5700dcf790fff7cebabfb99274fe867042ecf0","b7f1d82fb80e02b9ebe955e8f061f31dc60f7513d1f9ad0a831407c1ba0df87e","2c700126b22ea8b22b8b05c2da05de79df4ab7db9f88267316530fa662b4db2c","c3ccfe415c3d3b89bde029669f42b7f04df72ad2da4bd15d82495b58ebde46d6","4c79934beb1ea19f17e39fd1946158d3dd7d075aa29d8cd259834f8cd7e04ef8","2bdd086a5fce1f32ea41be86febfb4be7782c997cfcb028d2f58fee5dd4b0f8a","90c9e0ee1d74b596a0acf1e04b41c2c5f15d16b2acd39d3dc8f90b071888ac99")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("4ca4f673e4389a352854f5feb0793dac43519ade8049b5dd9356d0cbe0f06148","55dc772d1b59c387b5f33428d5167437dc2d6e2423765f4080ee3b6a04947ae9","4b410c47465359ef40d470c9286fb980e656698c4ee4d969c86c84fbd012af0d","c49e9b556d271a853449ec915e4a929f5fa7ae04da4dc714c220ed0d703a36f7","ad97b1c79735b1b97c4c4432cacac2fce6316889eafb41a0d97f2b0e565ee850","c722651d72c47e224007c2111e0489a028521ccdf5331c92e6cd9cfe07076918","2140adec9cde046b35634e93b83da4cc9a8aa0a71c21e32ba1dce2742314e8dc","a31d742d7e36fefed01971d8cba827c71e69d59167e080d2f551210c85fddaa5","a31d742d7e36fefed01971d8cba827c71e69d59167e080d2f551210c85fddaa5","2df309018ab935c47306b06ebf5700dcf790fff7cebabfb99274fe867042ecf0","b7f1d82fb80e02b9ebe955e8f061f31dc60f7513d1f9ad0a831407c1ba0df87e","2c700126b22ea8b22b8b05c2da05de79df4ab7db9f88267316530fa662b4db2c","c3ccfe415c3d3b89bde029669f42b7f04df72ad2da4bd15d82495b58ebde46d6","4c79934beb1ea19f17e39fd1946158d3dd7d075aa29d8cd259834f8cd7e04ef8","2bdd086a5fce1f32ea41be86febfb4be7782c997cfcb028d2f58fee5dd4b0f8a","90c9e0ee1d74b596a0acf1e04b41c2c5f15d16b2acd39d3dc8f90b071888ac99")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("4ca4f673e4389a352854f5feb0793dac43519ade8049b5dd9356d0cbe0f06148","55dc772d1b59c387b5f33428d5167437dc2d6e2423765f4080ee3b6a04947ae9","4b410c47465359ef40d470c9286fb980e656698c4ee4d969c86c84fbd012af0d","c49e9b556d271a853449ec915e4a929f5fa7ae04da4dc714c220ed0d703a36f7","ad97b1c79735b1b97c4c4432cacac2fce6316889eafb41a0d97f2b0e565ee850","c722651d72c47e224007c2111e0489a028521ccdf5331c92e6cd9cfe07076918","2140adec9cde046b35634e93b83da4cc9a8aa0a71c21e32ba1dce2742314e8dc","a31d742d7e36fefed01971d8cba827c71e69d59167e080d2f551210c85fddaa5","a31d742d7e36fefed01971d8cba827c71e69d59167e080d2f551210c85fddaa5","2df309018ab935c47306b06ebf5700dcf790fff7cebabfb99274fe867042ecf0","b7f1d82fb80e02b9ebe955e8f061f31dc60f7513d1f9ad0a831407c1ba0df87e","2c700126b22ea8b22b8b05c2da05de79df4ab7db9f88267316530fa662b4db2c","c3ccfe415c3d3b89bde029669f42b7f04df72ad2da4bd15d82495b58ebde46d6","4c79934beb1ea19f17e39fd1946158d3dd7d075aa29d8cd259834f8cd7e04ef8","2bdd086a5fce1f32ea41be86febfb4be7782c997cfcb028d2f58fee5dd4b0f8a","90c9e0ee1d74b596a0acf1e04b41c2c5f15d16b2acd39d3dc8f90b071888ac99")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring64 NOT NULL AND customstring64 IN ("4ca4f673e4389a352854f5feb0793dac43519ade8049b5dd9356d0cbe0f06148","55dc772d1b59c387b5f33428d5167437dc2d6e2423765f4080ee3b6a04947ae9","4b410c47465359ef40d470c9286fb980e656698c4ee4d969c86c84fbd012af0d","c49e9b556d271a853449ec915e4a929f5fa7ae04da4dc714c220ed0d703a36f7","ad97b1c79735b1b97c4c4432cacac2fce6316889eafb41a0d97f2b0e565ee850","c722651d72c47e224007c2111e0489a028521ccdf5331c92e6cd9cfe07076918","2140adec9cde046b35634e93b83da4cc9a8aa0a71c21e32ba1dce2742314e8dc","a31d742d7e36fefed01971d8cba827c71e69d59167e080d2f551210c85fddaa5","a31d742d7e36fefed01971d8cba827c71e69d59167e080d2f551210c85fddaa5","2df309018ab935c47306b06ebf5700dcf790fff7cebabfb99274fe867042ecf0","b7f1d82fb80e02b9ebe955e8f061f31dc60f7513d1f9ad0a831407c1ba0df87e","2c700126b22ea8b22b8b05c2da05de79df4ab7db9f88267316530fa662b4db2c","c3ccfe415c3d3b89bde029669f42b7f04df72ad2da4bd15d82495b58ebde46d6","4c79934beb1ea19f17e39fd1946158d3dd7d075aa29d8cd259834f8cd7e04ef8","2bdd086a5fce1f32ea41be86febfb4be7782c997cfcb028d2f58fee5dd4b0f8a","90c9e0ee1d74b596a0acf1e04b41c2c5f15d16b2acd39d3dc8f90b071888ac99")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("4ca4f673e4389a352854f5feb0793dac43519ade8049b5dd9356d0cbe0f06148","55dc772d1b59c387b5f33428d5167437dc2d6e2423765f4080ee3b6a04947ae9","4b410c47465359ef40d470c9286fb980e656698c4ee4d969c86c84fbd012af0d","c49e9b556d271a853449ec915e4a929f5fa7ae04da4dc714c220ed0d703a36f7","ad97b1c79735b1b97c4c4432cacac2fce6316889eafb41a0d97f2b0e565ee850","c722651d72c47e224007c2111e0489a028521ccdf5331c92e6cd9cfe07076918","2140adec9cde046b35634e93b83da4cc9a8aa0a71c21e32ba1dce2742314e8dc","a31d742d7e36fefed01971d8cba827c71e69d59167e080d2f551210c85fddaa5","a31d742d7e36fefed01971d8cba827c71e69d59167e080d2f551210c85fddaa5","2df309018ab935c47306b06ebf5700dcf790fff7cebabfb99274fe867042ecf0","b7f1d82fb80e02b9ebe955e8f061f31dc60f7513d1f9ad0a831407c1ba0df87e","2c700126b22ea8b22b8b05c2da05de79df4ab7db9f88267316530fa662b4db2c","c3ccfe415c3d3b89bde029669f42b7f04df72ad2da4bd15d82495b58ebde46d6","4c79934beb1ea19f17e39fd1946158d3dd7d075aa29d8cd259834f8cd7e04ef8","2bdd086a5fce1f32ea41be86febfb4be7782c997cfcb028d2f58fee5dd4b0f8a","90c9e0ee1d74b596a0acf1e04b41c2c5f15d16b2acd39d3dc8f90b071888ac99")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("4ca4f673e4389a352854f5feb0793dac43519ade8049b5dd9356d0cbe0f06148","55dc772d1b59c387b5f33428d5167437dc2d6e2423765f4080ee3b6a04947ae9","4b410c47465359ef40d470c9286fb980e656698c4ee4d969c86c84fbd012af0d","c49e9b556d271a853449ec915e4a929f5fa7ae04da4dc714c220ed0d703a36f7","ad97b1c79735b1b97c4c4432cacac2fce6316889eafb41a0d97f2b0e565ee850","c722651d72c47e224007c2111e0489a028521ccdf5331c92e6cd9cfe07076918","2140adec9cde046b35634e93b83da4cc9a8aa0a71c21e32ba1dce2742314e8dc","a31d742d7e36fefed01971d8cba827c71e69d59167e080d2f551210c85fddaa5","a31d742d7e36fefed01971d8cba827c71e69d59167e080d2f551210c85fddaa5","2df309018ab935c47306b06ebf5700dcf790fff7cebabfb99274fe867042ecf0","b7f1d82fb80e02b9ebe955e8f061f31dc60f7513d1f9ad0a831407c1ba0df87e","2c700126b22ea8b22b8b05c2da05de79df4ab7db9f88267316530fa662b4db2c","c3ccfe415c3d3b89bde029669f42b7f04df72ad2da4bd15d82495b58ebde46d6","4c79934beb1ea19f17e39fd1946158d3dd7d075aa29d8cd259834f8cd7e04ef8","2bdd086a5fce1f32ea41be86febfb4be7782c997cfcb028d2f58fee5dd4b0f8a","90c9e0ee1d74b596a0acf1e04b41c2c5f15d16b2acd39d3dc8f90b071888ac99")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("4ca4f673e4389a352854f5feb0793dac43519ade8049b5dd9356d0cbe0f06148","55dc772d1b59c387b5f33428d5167437dc2d6e2423765f4080ee3b6a04947ae9","4b410c47465359ef40d470c9286fb980e656698c4ee4d969c86c84fbd012af0d","c49e9b556d271a853449ec915e4a929f5fa7ae04da4dc714c220ed0d703a36f7","ad97b1c79735b1b97c4c4432cacac2fce6316889eafb41a0d97f2b0e565ee850","c722651d72c47e224007c2111e0489a028521ccdf5331c92e6cd9cfe07076918","2140adec9cde046b35634e93b83da4cc9a8aa0a71c21e32ba1dce2742314e8dc","a31d742d7e36fefed01971d8cba827c71e69d59167e080d2f551210c85fddaa5","a31d742d7e36fefed01971d8cba827c71e69d59167e080d2f551210c85fddaa5","2df309018ab935c47306b06ebf5700dcf790fff7cebabfb99274fe867042ecf0","b7f1d82fb80e02b9ebe955e8f061f31dc60f7513d1f9ad0a831407c1ba0df87e","2c700126b22ea8b22b8b05c2da05de79df4ab7db9f88267316530fa662b4db2c","c3ccfe415c3d3b89bde029669f42b7f04df72ad2da4bd15d82495b58ebde46d6","4c79934beb1ea19f17e39fd1946158d3dd7d075aa29d8cd259834f8cd7e04ef8","2bdd086a5fce1f32ea41be86febfb4be7782c997cfcb028d2f58fee5dd4b0f8a","90c9e0ee1d74b596a0acf1e04b41c2c5f15d16b2acd39d3dc8f90b071888ac99")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("4ca4f673e4389a352854f5feb0793dac43519ade8049b5dd9356d0cbe0f06148","55dc772d1b59c387b5f33428d5167437dc2d6e2423765f4080ee3b6a04947ae9","4b410c47465359ef40d470c9286fb980e656698c4ee4d969c86c84fbd012af0d","c49e9b556d271a853449ec915e4a929f5fa7ae04da4dc714c220ed0d703a36f7","ad97b1c79735b1b97c4c4432cacac2fce6316889eafb41a0d97f2b0e565ee850","c722651d72c47e224007c2111e0489a028521ccdf5331c92e6cd9cfe07076918","2140adec9cde046b35634e93b83da4cc9a8aa0a71c21e32ba1dce2742314e8dc","a31d742d7e36fefed01971d8cba827c71e69d59167e080d2f551210c85fddaa5","a31d742d7e36fefed01971d8cba827c71e69d59167e080d2f551210c85fddaa5","2df309018ab935c47306b06ebf5700dcf790fff7cebabfb99274fe867042ecf0","b7f1d82fb80e02b9ebe955e8f061f31dc60f7513d1f9ad0a831407c1ba0df87e","2c700126b22ea8b22b8b05c2da05de79df4ab7db9f88267316530fa662b4db2c","c3ccfe415c3d3b89bde029669f42b7f04df72ad2da4bd15d82495b58ebde46d6","4c79934beb1ea19f17e39fd1946158d3dd7d075aa29d8cd259834f8cd7e04ef8","2bdd086a5fce1f32ea41be86febfb4be7782c997cfcb028d2f58fee5dd4b0f8a","90c9e0ee1d74b596a0acf1e04b41c2c5f15d16b2acd39d3dc8f90b071888ac99")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("4ca4f673e4389a352854f5feb0793dac43519ade8049b5dd9356d0cbe0f06148","55dc772d1b59c387b5f33428d5167437dc2d6e2423765f4080ee3b6a04947ae9","4b410c47465359ef40d470c9286fb980e656698c4ee4d969c86c84fbd012af0d","c49e9b556d271a853449ec915e4a929f5fa7ae04da4dc714c220ed0d703a36f7","ad97b1c79735b1b97c4c4432cacac2fce6316889eafb41a0d97f2b0e565ee850","c722651d72c47e224007c2111e0489a028521ccdf5331c92e6cd9cfe07076918","2140adec9cde046b35634e93b83da4cc9a8aa0a71c21e32ba1dce2742314e8dc","a31d742d7e36fefed01971d8cba827c71e69d59167e080d2f551210c85fddaa5","a31d742d7e36fefed01971d8cba827c71e69d59167e080d2f551210c85fddaa5","2df309018ab935c47306b06ebf5700dcf790fff7cebabfb99274fe867042ecf0","b7f1d82fb80e02b9ebe955e8f061f31dc60f7513d1f9ad0a831407c1ba0df87e","2c700126b22ea8b22b8b05c2da05de79df4ab7db9f88267316530fa662b4db2c","c3ccfe415c3d3b89bde029669f42b7f04df72ad2da4bd15d82495b58ebde46d6","4c79934beb1ea19f17e39fd1946158d3dd7d075aa29d8cd259834f8cd7e04ef8","2bdd086a5fce1f32ea41be86febfb4be7782c997cfcb028d2f58fee5dd4b0f8a","90c9e0ee1d74b596a0acf1e04b41c2c5f15d16b2acd39d3dc8f90b071888ac99")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("4ca4f673e4389a352854f5feb0793dac43519ade8049b5dd9356d0cbe0f06148","55dc772d1b59c387b5f33428d5167437dc2d6e2423765f4080ee3b6a04947ae9","4b410c47465359ef40d470c9286fb980e656698c4ee4d969c86c84fbd012af0d","c49e9b556d271a853449ec915e4a929f5fa7ae04da4dc714c220ed0d703a36f7","ad97b1c79735b1b97c4c4432cacac2fce6316889eafb41a0d97f2b0e565ee850","c722651d72c47e224007c2111e0489a028521ccdf5331c92e6cd9cfe07076918","2140adec9cde046b35634e93b83da4cc9a8aa0a71c21e32ba1dce2742314e8dc","a31d742d7e36fefed01971d8cba827c71e69d59167e080d2f551210c85fddaa5","a31d742d7e36fefed01971d8cba827c71e69d59167e080d2f551210c85fddaa5","2df309018ab935c47306b06ebf5700dcf790fff7cebabfb99274fe867042ecf0","b7f1d82fb80e02b9ebe955e8f061f31dc60f7513d1f9ad0a831407c1ba0df87e","2c700126b22ea8b22b8b05c2da05de79df4ab7db9f88267316530fa662b4db2c","c3ccfe415c3d3b89bde029669f42b7f04df72ad2da4bd15d82495b58ebde46d6","4c79934beb1ea19f17e39fd1946158d3dd7d075aa29d8cd259834f8cd7e04ef8","2bdd086a5fce1f32ea41be86febfb4be7782c997cfcb028d2f58fee5dd4b0f8a","90c9e0ee1d74b596a0acf1e04b41c2c5f15d16b2acd39d3dc8f90b071888ac99")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("4ca4f673e4389a352854f5feb0793dac43519ade8049b5dd9356d0cbe0f06148","55dc772d1b59c387b5f33428d5167437dc2d6e2423765f4080ee3b6a04947ae9","4b410c47465359ef40d470c9286fb980e656698c4ee4d969c86c84fbd012af0d","c49e9b556d271a853449ec915e4a929f5fa7ae04da4dc714c220ed0d703a36f7","ad97b1c79735b1b97c4c4432cacac2fce6316889eafb41a0d97f2b0e565ee850","c722651d72c47e224007c2111e0489a028521ccdf5331c92e6cd9cfe07076918","2140adec9cde046b35634e93b83da4cc9a8aa0a71c21e32ba1dce2742314e8dc","a31d742d7e36fefed01971d8cba827c71e69d59167e080d2f551210c85fddaa5","a31d742d7e36fefed01971d8cba827c71e69d59167e080d2f551210c85fddaa5","2df309018ab935c47306b06ebf5700dcf790fff7cebabfb99274fe867042ecf0","b7f1d82fb80e02b9ebe955e8f061f31dc60f7513d1f9ad0a831407c1ba0df87e","2c700126b22ea8b22b8b05c2da05de79df4ab7db9f88267316530fa662b4db2c","c3ccfe415c3d3b89bde029669f42b7f04df72ad2da4bd15d82495b58ebde46d6","4c79934beb1ea19f17e39fd1946158d3dd7d075aa29d8cd259834f8cd7e04ef8","2bdd086a5fce1f32ea41be86febfb4be7782c997cfcb028d2f58fee5dd4b0f8a","90c9e0ee1d74b596a0acf1e04b41c2c5f15d16b2acd39d3dc8f90b071888ac99")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("4ca4f673e4389a352854f5feb0793dac43519ade8049b5dd9356d0cbe0f06148","55dc772d1b59c387b5f33428d5167437dc2d6e2423765f4080ee3b6a04947ae9","4b410c47465359ef40d470c9286fb980e656698c4ee4d969c86c84fbd012af0d","c49e9b556d271a853449ec915e4a929f5fa7ae04da4dc714c220ed0d703a36f7","ad97b1c79735b1b97c4c4432cacac2fce6316889eafb41a0d97f2b0e565ee850","c722651d72c47e224007c2111e0489a028521ccdf5331c92e6cd9cfe07076918","2140adec9cde046b35634e93b83da4cc9a8aa0a71c21e32ba1dce2742314e8dc","a31d742d7e36fefed01971d8cba827c71e69d59167e080d2f551210c85fddaa5","a31d742d7e36fefed01971d8cba827c71e69d59167e080d2f551210c85fddaa5","2df309018ab935c47306b06ebf5700dcf790fff7cebabfb99274fe867042ecf0","b7f1d82fb80e02b9ebe955e8f061f31dc60f7513d1f9ad0a831407c1ba0df87e","2c700126b22ea8b22b8b05c2da05de79df4ab7db9f88267316530fa662b4db2c","c3ccfe415c3d3b89bde029669f42b7f04df72ad2da4bd15d82495b58ebde46d6","4c79934beb1ea19f17e39fd1946158d3dd7d075aa29d8cd259834f8cd7e04ef8","2bdd086a5fce1f32ea41be86febfb4be7782c997cfcb028d2f58fee5dd4b0f8a","90c9e0ee1d74b596a0acf1e04b41c2c5f15d16b2acd39d3dc8f90b071888ac99")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("4ca4f673e4389a352854f5feb0793dac43519ade8049b5dd9356d0cbe0f06148","55dc772d1b59c387b5f33428d5167437dc2d6e2423765f4080ee3b6a04947ae9","4b410c47465359ef40d470c9286fb980e656698c4ee4d969c86c84fbd012af0d","c49e9b556d271a853449ec915e4a929f5fa7ae04da4dc714c220ed0d703a36f7","ad97b1c79735b1b97c4c4432cacac2fce6316889eafb41a0d97f2b0e565ee850","c722651d72c47e224007c2111e0489a028521ccdf5331c92e6cd9cfe07076918","2140adec9cde046b35634e93b83da4cc9a8aa0a71c21e32ba1dce2742314e8dc","a31d742d7e36fefed01971d8cba827c71e69d59167e080d2f551210c85fddaa5","a31d742d7e36fefed01971d8cba827c71e69d59167e080d2f551210c85fddaa5","2df309018ab935c47306b06ebf5700dcf790fff7cebabfb99274fe867042ecf0","b7f1d82fb80e02b9ebe955e8f061f31dc60f7513d1f9ad0a831407c1ba0df87e","2c700126b22ea8b22b8b05c2da05de79df4ab7db9f88267316530fa662b4db2c","c3ccfe415c3d3b89bde029669f42b7f04df72ad2da4bd15d82495b58ebde46d6","4c79934beb1ea19f17e39fd1946158d3dd7d075aa29d8cd259834f8cd7e04ef8","2bdd086a5fce1f32ea41be86febfb4be7782c997cfcb028d2f58fee5dd4b0f8a","90c9e0ee1d74b596a0acf1e04b41c2c5f15d16b2acd39d3dc8f90b071888ac99")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("4ca4f673e4389a352854f5feb0793dac43519ade8049b5dd9356d0cbe0f06148","55dc772d1b59c387b5f33428d5167437dc2d6e2423765f4080ee3b6a04947ae9","4b410c47465359ef40d470c9286fb980e656698c4ee4d969c86c84fbd012af0d","c49e9b556d271a853449ec915e4a929f5fa7ae04da4dc714c220ed0d703a36f7","ad97b1c79735b1b97c4c4432cacac2fce6316889eafb41a0d97f2b0e565ee850","c722651d72c47e224007c2111e0489a028521ccdf5331c92e6cd9cfe07076918","2140adec9cde046b35634e93b83da4cc9a8aa0a71c21e32ba1dce2742314e8dc","a31d742d7e36fefed01971d8cba827c71e69d59167e080d2f551210c85fddaa5","a31d742d7e36fefed01971d8cba827c71e69d59167e080d2f551210c85fddaa5","2df309018ab935c47306b06ebf5700dcf790fff7cebabfb99274fe867042ecf0","b7f1d82fb80e02b9ebe955e8f061f31dc60f7513d1f9ad0a831407c1ba0df87e","2c700126b22ea8b22b8b05c2da05de79df4ab7db9f88267316530fa662b4db2c","c3ccfe415c3d3b89bde029669f42b7f04df72ad2da4bd15d82495b58ebde46d6","4c79934beb1ea19f17e39fd1946158d3dd7d075aa29d8cd259834f8cd7e04ef8","2bdd086a5fce1f32ea41be86febfb4be7782c997cfcb028d2f58fee5dd4b0f8a","90c9e0ee1d74b596a0acf1e04b41c2c5f15d16b2acd39d3dc8f90b071888ac99")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("4ca4f673e4389a352854f5feb0793dac43519ade8049b5dd9356d0cbe0f06148","55dc772d1b59c387b5f33428d5167437dc2d6e2423765f4080ee3b6a04947ae9","4b410c47465359ef40d470c9286fb980e656698c4ee4d969c86c84fbd012af0d","c49e9b556d271a853449ec915e4a929f5fa7ae04da4dc714c220ed0d703a36f7","ad97b1c79735b1b97c4c4432cacac2fce6316889eafb41a0d97f2b0e565ee850","c722651d72c47e224007c2111e0489a028521ccdf5331c92e6cd9cfe07076918","2140adec9cde046b35634e93b83da4cc9a8aa0a71c21e32ba1dce2742314e8dc","a31d742d7e36fefed01971d8cba827c71e69d59167e080d2f551210c85fddaa5","a31d742d7e36fefed01971d8cba827c71e69d59167e080d2f551210c85fddaa5","2df309018ab935c47306b06ebf5700dcf790fff7cebabfb99274fe867042ecf0","b7f1d82fb80e02b9ebe955e8f061f31dc60f7513d1f9ad0a831407c1ba0df87e","2c700126b22ea8b22b8b05c2da05de79df4ab7db9f88267316530fa662b4db2c","c3ccfe415c3d3b89bde029669f42b7f04df72ad2da4bd15d82495b58ebde46d6","4c79934beb1ea19f17e39fd1946158d3dd7d075aa29d8cd259834f8cd7e04ef8","2bdd086a5fce1f32ea41be86febfb4be7782c997cfcb028d2f58fee5dd4b0f8a","90c9e0ee1d74b596a0acf1e04b41c2c5f15d16b2acd39d3dc8f90b071888ac99")
index=activity AND rg_functionality="Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("4ca4f673e4389a352854f5feb0793dac43519ade8049b5dd9356d0cbe0f06148","55dc772d1b59c387b5f33428d5167437dc2d6e2423765f4080ee3b6a04947ae9","4b410c47465359ef40d470c9286fb980e656698c4ee4d969c86c84fbd012af0d","c49e9b556d271a853449ec915e4a929f5fa7ae04da4dc714c220ed0d703a36f7","ad97b1c79735b1b97c4c4432cacac2fce6316889eafb41a0d97f2b0e565ee850","c722651d72c47e224007c2111e0489a028521ccdf5331c92e6cd9cfe07076918","2140adec9cde046b35634e93b83da4cc9a8aa0a71c21e32ba1dce2742314e8dc","a31d742d7e36fefed01971d8cba827c71e69d59167e080d2f551210c85fddaa5","a31d742d7e36fefed01971d8cba827c71e69d59167e080d2f551210c85fddaa5","2df309018ab935c47306b06ebf5700dcf790fff7cebabfb99274fe867042ecf0","b7f1d82fb80e02b9ebe955e8f061f31dc60f7513d1f9ad0a831407c1ba0df87e","2c700126b22ea8b22b8b05c2da05de79df4ab7db9f88267316530fa662b4db2c","c3ccfe415c3d3b89bde029669f42b7f04df72ad2da4bd15d82495b58ebde46d6","4c79934beb1ea19f17e39fd1946158d3dd7d075aa29d8cd259834f8cd7e04ef8","2bdd086a5fce1f32ea41be86febfb4be7782c997cfcb028d2f58fee5dd4b0f8a","90c9e0ee1d74b596a0acf1e04b41c2c5f15d16b2acd39d3dc8f90b071888ac99")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("4ca4f673e4389a352854f5feb0793dac43519ade8049b5dd9356d0cbe0f06148","55dc772d1b59c387b5f33428d5167437dc2d6e2423765f4080ee3b6a04947ae9","4b410c47465359ef40d470c9286fb980e656698c4ee4d969c86c84fbd012af0d","c49e9b556d271a853449ec915e4a929f5fa7ae04da4dc714c220ed0d703a36f7","ad97b1c79735b1b97c4c4432cacac2fce6316889eafb41a0d97f2b0e565ee850","c722651d72c47e224007c2111e0489a028521ccdf5331c92e6cd9cfe07076918","2140adec9cde046b35634e93b83da4cc9a8aa0a71c21e32ba1dce2742314e8dc","a31d742d7e36fefed01971d8cba827c71e69d59167e080d2f551210c85fddaa5","a31d742d7e36fefed01971d8cba827c71e69d59167e080d2f551210c85fddaa5","2df309018ab935c47306b06ebf5700dcf790fff7cebabfb99274fe867042ecf0","b7f1d82fb80e02b9ebe955e8f061f31dc60f7513d1f9ad0a831407c1ba0df87e","2c700126b22ea8b22b8b05c2da05de79df4ab7db9f88267316530fa662b4db2c","c3ccfe415c3d3b89bde029669f42b7f04df72ad2da4bd15d82495b58ebde46d6","4c79934beb1ea19f17e39fd1946158d3dd7d075aa29d8cd259834f8cd7e04ef8","2bdd086a5fce1f32ea41be86febfb4be7782c997cfcb028d2f58fee5dd4b0f8a","90c9e0ee1d74b596a0acf1e04b41c2c5f15d16b2acd39d3dc8f90b071888ac99")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("4ca4f673e4389a352854f5feb0793dac43519ade8049b5dd9356d0cbe0f06148","55dc772d1b59c387b5f33428d5167437dc2d6e2423765f4080ee3b6a04947ae9","4b410c47465359ef40d470c9286fb980e656698c4ee4d969c86c84fbd012af0d","c49e9b556d271a853449ec915e4a929f5fa7ae04da4dc714c220ed0d703a36f7","ad97b1c79735b1b97c4c4432cacac2fce6316889eafb41a0d97f2b0e565ee850","c722651d72c47e224007c2111e0489a028521ccdf5331c92e6cd9cfe07076918","2140adec9cde046b35634e93b83da4cc9a8aa0a71c21e32ba1dce2742314e8dc","a31d742d7e36fefed01971d8cba827c71e69d59167e080d2f551210c85fddaa5","a31d742d7e36fefed01971d8cba827c71e69d59167e080d2f551210c85fddaa5","2df309018ab935c47306b06ebf5700dcf790fff7cebabfb99274fe867042ecf0","b7f1d82fb80e02b9ebe955e8f061f31dc60f7513d1f9ad0a831407c1ba0df87e","2c700126b22ea8b22b8b05c2da05de79df4ab7db9f88267316530fa662b4db2c","c3ccfe415c3d3b89bde029669f42b7f04df72ad2da4bd15d82495b58ebde46d6","4c79934beb1ea19f17e39fd1946158d3dd7d075aa29d8cd259834f8cd7e04ef8","2bdd086a5fce1f32ea41be86febfb4be7782c997cfcb028d2f58fee5dd4b0f8a","90c9e0ee1d74b596a0acf1e04b41c2c5f15d16b2acd39d3dc8f90b071888ac99")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("4ca4f673e4389a352854f5feb0793dac43519ade8049b5dd9356d0cbe0f06148","55dc772d1b59c387b5f33428d5167437dc2d6e2423765f4080ee3b6a04947ae9","4b410c47465359ef40d470c9286fb980e656698c4ee4d969c86c84fbd012af0d","c49e9b556d271a853449ec915e4a929f5fa7ae04da4dc714c220ed0d703a36f7","ad97b1c79735b1b97c4c4432cacac2fce6316889eafb41a0d97f2b0e565ee850","c722651d72c47e224007c2111e0489a028521ccdf5331c92e6cd9cfe07076918","2140adec9cde046b35634e93b83da4cc9a8aa0a71c21e32ba1dce2742314e8dc","a31d742d7e36fefed01971d8cba827c71e69d59167e080d2f551210c85fddaa5","a31d742d7e36fefed01971d8cba827c71e69d59167e080d2f551210c85fddaa5","2df309018ab935c47306b06ebf5700dcf790fff7cebabfb99274fe867042ecf0","b7f1d82fb80e02b9ebe955e8f061f31dc60f7513d1f9ad0a831407c1ba0df87e","2c700126b22ea8b22b8b05c2da05de79df4ab7db9f88267316530fa662b4db2c","c3ccfe415c3d3b89bde029669f42b7f04df72ad2da4bd15d82495b58ebde46d6","4c79934beb1ea19f17e39fd1946158d3dd7d075aa29d8cd259834f8cd7e04ef8","2bdd086a5fce1f32ea41be86febfb4be7782c997cfcb028d2f58fee5dd4b0f8a","90c9e0ee1d74b596a0acf1e04b41c2c5f15d16b2acd39d3dc8f90b071888ac99")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("4ca4f673e4389a352854f5feb0793dac43519ade8049b5dd9356d0cbe0f06148","55dc772d1b59c387b5f33428d5167437dc2d6e2423765f4080ee3b6a04947ae9","4b410c47465359ef40d470c9286fb980e656698c4ee4d969c86c84fbd012af0d","c49e9b556d271a853449ec915e4a929f5fa7ae04da4dc714c220ed0d703a36f7","ad97b1c79735b1b97c4c4432cacac2fce6316889eafb41a0d97f2b0e565ee850","c722651d72c47e224007c2111e0489a028521ccdf5331c92e6cd9cfe07076918","2140adec9cde046b35634e93b83da4cc9a8aa0a71c21e32ba1dce2742314e8dc","a31d742d7e36fefed01971d8cba827c71e69d59167e080d2f551210c85fddaa5","a31d742d7e36fefed01971d8cba827c71e69d59167e080d2f551210c85fddaa5","2df309018ab935c47306b06ebf5700dcf790fff7cebabfb99274fe867042ecf0","b7f1d82fb80e02b9ebe955e8f061f31dc60f7513d1f9ad0a831407c1ba0df87e","2c700126b22ea8b22b8b05c2da05de79df4ab7db9f88267316530fa662b4db2c","c3ccfe415c3d3b89bde029669f42b7f04df72ad2da4bd15d82495b58ebde46d6","4c79934beb1ea19f17e39fd1946158d3dd7d075aa29d8cd259834f8cd7e04ef8","2bdd086a5fce1f32ea41be86febfb4be7782c997cfcb028d2f58fee5dd4b0f8a","90c9e0ee1d74b596a0acf1e04b41c2c5f15d16b2acd39d3dc8f90b071888ac99")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("4ca4f673e4389a352854f5feb0793dac43519ade8049b5dd9356d0cbe0f06148","55dc772d1b59c387b5f33428d5167437dc2d6e2423765f4080ee3b6a04947ae9","4b410c47465359ef40d470c9286fb980e656698c4ee4d969c86c84fbd012af0d","c49e9b556d271a853449ec915e4a929f5fa7ae04da4dc714c220ed0d703a36f7","ad97b1c79735b1b97c4c4432cacac2fce6316889eafb41a0d97f2b0e565ee850","c722651d72c47e224007c2111e0489a028521ccdf5331c92e6cd9cfe07076918","2140adec9cde046b35634e93b83da4cc9a8aa0a71c21e32ba1dce2742314e8dc","a31d742d7e36fefed01971d8cba827c71e69d59167e080d2f551210c85fddaa5","a31d742d7e36fefed01971d8cba827c71e69d59167e080d2f551210c85fddaa5","2df309018ab935c47306b06ebf5700dcf790fff7cebabfb99274fe867042ecf0","b7f1d82fb80e02b9ebe955e8f061f31dc60f7513d1f9ad0a831407c1ba0df87e","2c700126b22ea8b22b8b05c2da05de79df4ab7db9f88267316530fa662b4db2c","c3ccfe415c3d3b89bde029669f42b7f04df72ad2da4bd15d82495b58ebde46d6","4c79934beb1ea19f17e39fd1946158d3dd7d075aa29d8cd259834f8cd7e04ef8","2bdd086a5fce1f32ea41be86febfb4be7782c997cfcb028d2f58fee5dd4b0f8a","90c9e0ee1d74b596a0acf1e04b41c2c5f15d16b2acd39d3dc8f90b071888ac99")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("4ca4f673e4389a352854f5feb0793dac43519ade8049b5dd9356d0cbe0f06148","55dc772d1b59c387b5f33428d5167437dc2d6e2423765f4080ee3b6a04947ae9","4b410c47465359ef40d470c9286fb980e656698c4ee4d969c86c84fbd012af0d","c49e9b556d271a853449ec915e4a929f5fa7ae04da4dc714c220ed0d703a36f7","ad97b1c79735b1b97c4c4432cacac2fce6316889eafb41a0d97f2b0e565ee850","c722651d72c47e224007c2111e0489a028521ccdf5331c92e6cd9cfe07076918","2140adec9cde046b35634e93b83da4cc9a8aa0a71c21e32ba1dce2742314e8dc","a31d742d7e36fefed01971d8cba827c71e69d59167e080d2f551210c85fddaa5","a31d742d7e36fefed01971d8cba827c71e69d59167e080d2f551210c85fddaa5","2df309018ab935c47306b06ebf5700dcf790fff7cebabfb99274fe867042ecf0","b7f1d82fb80e02b9ebe955e8f061f31dc60f7513d1f9ad0a831407c1ba0df87e","2c700126b22ea8b22b8b05c2da05de79df4ab7db9f88267316530fa662b4db2c","c3ccfe415c3d3b89bde029669f42b7f04df72ad2da4bd15d82495b58ebde46d6","4c79934beb1ea19f17e39fd1946158d3dd7d075aa29d8cd259834f8cd7e04ef8","2bdd086a5fce1f32ea41be86febfb4be7782c997cfcb028d2f58fee5dd4b0f8a","90c9e0ee1d74b596a0acf1e04b41c2c5f15d16b2acd39d3dc8f90b071888ac99")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("4ca4f673e4389a352854f5feb0793dac43519ade8049b5dd9356d0cbe0f06148","55dc772d1b59c387b5f33428d5167437dc2d6e2423765f4080ee3b6a04947ae9","4b410c47465359ef40d470c9286fb980e656698c4ee4d969c86c84fbd012af0d","c49e9b556d271a853449ec915e4a929f5fa7ae04da4dc714c220ed0d703a36f7","ad97b1c79735b1b97c4c4432cacac2fce6316889eafb41a0d97f2b0e565ee850","c722651d72c47e224007c2111e0489a028521ccdf5331c92e6cd9cfe07076918","2140adec9cde046b35634e93b83da4cc9a8aa0a71c21e32ba1dce2742314e8dc","a31d742d7e36fefed01971d8cba827c71e69d59167e080d2f551210c85fddaa5","a31d742d7e36fefed01971d8cba827c71e69d59167e080d2f551210c85fddaa5","2df309018ab935c47306b06ebf5700dcf790fff7cebabfb99274fe867042ecf0","b7f1d82fb80e02b9ebe955e8f061f31dc60f7513d1f9ad0a831407c1ba0df87e","2c700126b22ea8b22b8b05c2da05de79df4ab7db9f88267316530fa662b4db2c","c3ccfe415c3d3b89bde029669f42b7f04df72ad2da4bd15d82495b58ebde46d6","4c79934beb1ea19f17e39fd1946158d3dd7d075aa29d8cd259834f8cd7e04ef8","2bdd086a5fce1f32ea41be86febfb4be7782c997cfcb028d2f58fee5dd4b0f8a","90c9e0ee1d74b596a0acf1e04b41c2c5f15d16b2acd39d3dc8f90b071888ac99")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring64 NOT NULL AND customstring64 IN ("4ca4f673e4389a352854f5feb0793dac43519ade8049b5dd9356d0cbe0f06148","55dc772d1b59c387b5f33428d5167437dc2d6e2423765f4080ee3b6a04947ae9","4b410c47465359ef40d470c9286fb980e656698c4ee4d969c86c84fbd012af0d","c49e9b556d271a853449ec915e4a929f5fa7ae04da4dc714c220ed0d703a36f7","ad97b1c79735b1b97c4c4432cacac2fce6316889eafb41a0d97f2b0e565ee850","c722651d72c47e224007c2111e0489a028521ccdf5331c92e6cd9cfe07076918","2140adec9cde046b35634e93b83da4cc9a8aa0a71c21e32ba1dce2742314e8dc","a31d742d7e36fefed01971d8cba827c71e69d59167e080d2f551210c85fddaa5","a31d742d7e36fefed01971d8cba827c71e69d59167e080d2f551210c85fddaa5","2df309018ab935c47306b06ebf5700dcf790fff7cebabfb99274fe867042ecf0","b7f1d82fb80e02b9ebe955e8f061f31dc60f7513d1f9ad0a831407c1ba0df87e","2c700126b22ea8b22b8b05c2da05de79df4ab7db9f88267316530fa662b4db2c","c3ccfe415c3d3b89bde029669f42b7f04df72ad2da4bd15d82495b58ebde46d6","4c79934beb1ea19f17e39fd1946158d3dd7d075aa29d8cd259834f8cd7e04ef8","2bdd086a5fce1f32ea41be86febfb4be7782c997cfcb028d2f58fee5dd4b0f8a","90c9e0ee1d74b596a0acf1e04b41c2c5f15d16b2acd39d3dc8f90b071888ac99")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("4ca4f673e4389a352854f5feb0793dac43519ade8049b5dd9356d0cbe0f06148","55dc772d1b59c387b5f33428d5167437dc2d6e2423765f4080ee3b6a04947ae9","4b410c47465359ef40d470c9286fb980e656698c4ee4d969c86c84fbd012af0d","c49e9b556d271a853449ec915e4a929f5fa7ae04da4dc714c220ed0d703a36f7","ad97b1c79735b1b97c4c4432cacac2fce6316889eafb41a0d97f2b0e565ee850","c722651d72c47e224007c2111e0489a028521ccdf5331c92e6cd9cfe07076918","2140adec9cde046b35634e93b83da4cc9a8aa0a71c21e32ba1dce2742314e8dc","a31d742d7e36fefed01971d8cba827c71e69d59167e080d2f551210c85fddaa5","a31d742d7e36fefed01971d8cba827c71e69d59167e080d2f551210c85fddaa5","2df309018ab935c47306b06ebf5700dcf790fff7cebabfb99274fe867042ecf0","b7f1d82fb80e02b9ebe955e8f061f31dc60f7513d1f9ad0a831407c1ba0df87e","2c700126b22ea8b22b8b05c2da05de79df4ab7db9f88267316530fa662b4db2c","c3ccfe415c3d3b89bde029669f42b7f04df72ad2da4bd15d82495b58ebde46d6","4c79934beb1ea19f17e39fd1946158d3dd7d075aa29d8cd259834f8cd7e04ef8","2bdd086a5fce1f32ea41be86febfb4be7782c997cfcb028d2f58fee5dd4b0f8a","90c9e0ee1d74b596a0acf1e04b41c2c5f15d16b2acd39d3dc8f90b071888ac99")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("4ca4f673e4389a352854f5feb0793dac43519ade8049b5dd9356d0cbe0f06148","55dc772d1b59c387b5f33428d5167437dc2d6e2423765f4080ee3b6a04947ae9","4b410c47465359ef40d470c9286fb980e656698c4ee4d969c86c84fbd012af0d","c49e9b556d271a853449ec915e4a929f5fa7ae04da4dc714c220ed0d703a36f7","ad97b1c79735b1b97c4c4432cacac2fce6316889eafb41a0d97f2b0e565ee850","c722651d72c47e224007c2111e0489a028521ccdf5331c92e6cd9cfe07076918","2140adec9cde046b35634e93b83da4cc9a8aa0a71c21e32ba1dce2742314e8dc","a31d742d7e36fefed01971d8cba827c71e69d59167e080d2f551210c85fddaa5","a31d742d7e36fefed01971d8cba827c71e69d59167e080d2f551210c85fddaa5","2df309018ab935c47306b06ebf5700dcf790fff7cebabfb99274fe867042ecf0","b7f1d82fb80e02b9ebe955e8f061f31dc60f7513d1f9ad0a831407c1ba0df87e","2c700126b22ea8b22b8b05c2da05de79df4ab7db9f88267316530fa662b4db2c","c3ccfe415c3d3b89bde029669f42b7f04df72ad2da4bd15d82495b58ebde46d6","4c79934beb1ea19f17e39fd1946158d3dd7d075aa29d8cd259834f8cd7e04ef8","2bdd086a5fce1f32ea41be86febfb4be7782c997cfcb028d2f58fee5dd4b0f8a","90c9e0ee1d74b596a0acf1e04b41c2c5f15d16b2acd39d3dc8f90b071888ac99")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("4ca4f673e4389a352854f5feb0793dac43519ade8049b5dd9356d0cbe0f06148","55dc772d1b59c387b5f33428d5167437dc2d6e2423765f4080ee3b6a04947ae9","4b410c47465359ef40d470c9286fb980e656698c4ee4d969c86c84fbd012af0d","c49e9b556d271a853449ec915e4a929f5fa7ae04da4dc714c220ed0d703a36f7","ad97b1c79735b1b97c4c4432cacac2fce6316889eafb41a0d97f2b0e565ee850","c722651d72c47e224007c2111e0489a028521ccdf5331c92e6cd9cfe07076918","2140adec9cde046b35634e93b83da4cc9a8aa0a71c21e32ba1dce2742314e8dc","a31d742d7e36fefed01971d8cba827c71e69d59167e080d2f551210c85fddaa5","a31d742d7e36fefed01971d8cba827c71e69d59167e080d2f551210c85fddaa5","2df309018ab935c47306b06ebf5700dcf790fff7cebabfb99274fe867042ecf0","b7f1d82fb80e02b9ebe955e8f061f31dc60f7513d1f9ad0a831407c1ba0df87e","2c700126b22ea8b22b8b05c2da05de79df4ab7db9f88267316530fa662b4db2c","c3ccfe415c3d3b89bde029669f42b7f04df72ad2da4bd15d82495b58ebde46d6","4c79934beb1ea19f17e39fd1946158d3dd7d075aa29d8cd259834f8cd7e04ef8","2bdd086a5fce1f32ea41be86febfb4be7782c997cfcb028d2f58fee5dd4b0f8a","90c9e0ee1d74b596a0acf1e04b41c2c5f15d16b2acd39d3dc8f90b071888ac99")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring64 NOT NULL AND customstring64 IN ("4ca4f673e4389a352854f5feb0793dac43519ade8049b5dd9356d0cbe0f06148","55dc772d1b59c387b5f33428d5167437dc2d6e2423765f4080ee3b6a04947ae9","4b410c47465359ef40d470c9286fb980e656698c4ee4d969c86c84fbd012af0d","c49e9b556d271a853449ec915e4a929f5fa7ae04da4dc714c220ed0d703a36f7","ad97b1c79735b1b97c4c4432cacac2fce6316889eafb41a0d97f2b0e565ee850","c722651d72c47e224007c2111e0489a028521ccdf5331c92e6cd9cfe07076918","2140adec9cde046b35634e93b83da4cc9a8aa0a71c21e32ba1dce2742314e8dc","a31d742d7e36fefed01971d8cba827c71e69d59167e080d2f551210c85fddaa5","a31d742d7e36fefed01971d8cba827c71e69d59167e080d2f551210c85fddaa5","2df309018ab935c47306b06ebf5700dcf790fff7cebabfb99274fe867042ecf0","b7f1d82fb80e02b9ebe955e8f061f31dc60f7513d1f9ad0a831407c1ba0df87e","2c700126b22ea8b22b8b05c2da05de79df4ab7db9f88267316530fa662b4db2c","c3ccfe415c3d3b89bde029669f42b7f04df72ad2da4bd15d82495b58ebde46d6","4c79934beb1ea19f17e39fd1946158d3dd7d075aa29d8cd259834f8cd7e04ef8","2bdd086a5fce1f32ea41be86febfb4be7782c997cfcb028d2f58fee5dd4b0f8a","90c9e0ee1d74b596a0acf1e04b41c2c5f15d16b2acd39d3dc8f90b071888ac99")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("4ca4f673e4389a352854f5feb0793dac43519ade8049b5dd9356d0cbe0f06148","55dc772d1b59c387b5f33428d5167437dc2d6e2423765f4080ee3b6a04947ae9","4b410c47465359ef40d470c9286fb980e656698c4ee4d969c86c84fbd012af0d","c49e9b556d271a853449ec915e4a929f5fa7ae04da4dc714c220ed0d703a36f7","ad97b1c79735b1b97c4c4432cacac2fce6316889eafb41a0d97f2b0e565ee850","c722651d72c47e224007c2111e0489a028521ccdf5331c92e6cd9cfe07076918","2140adec9cde046b35634e93b83da4cc9a8aa0a71c21e32ba1dce2742314e8dc","a31d742d7e36fefed01971d8cba827c71e69d59167e080d2f551210c85fddaa5","a31d742d7e36fefed01971d8cba827c71e69d59167e080d2f551210c85fddaa5","2df309018ab935c47306b06ebf5700dcf790fff7cebabfb99274fe867042ecf0","b7f1d82fb80e02b9ebe955e8f061f31dc60f7513d1f9ad0a831407c1ba0df87e","2c700126b22ea8b22b8b05c2da05de79df4ab7db9f88267316530fa662b4db2c","c3ccfe415c3d3b89bde029669f42b7f04df72ad2da4bd15d82495b58ebde46d6","4c79934beb1ea19f17e39fd1946158d3dd7d075aa29d8cd259834f8cd7e04ef8","2bdd086a5fce1f32ea41be86febfb4be7782c997cfcb028d2f58fee5dd4b0f8a","90c9e0ee1d74b596a0acf1e04b41c2c5f15d16b2acd39d3dc8f90b071888ac99")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("4ca4f673e4389a352854f5feb0793dac43519ade8049b5dd9356d0cbe0f06148","55dc772d1b59c387b5f33428d5167437dc2d6e2423765f4080ee3b6a04947ae9","4b410c47465359ef40d470c9286fb980e656698c4ee4d969c86c84fbd012af0d","c49e9b556d271a853449ec915e4a929f5fa7ae04da4dc714c220ed0d703a36f7","ad97b1c79735b1b97c4c4432cacac2fce6316889eafb41a0d97f2b0e565ee850","c722651d72c47e224007c2111e0489a028521ccdf5331c92e6cd9cfe07076918","2140adec9cde046b35634e93b83da4cc9a8aa0a71c21e32ba1dce2742314e8dc","a31d742d7e36fefed01971d8cba827c71e69d59167e080d2f551210c85fddaa5","a31d742d7e36fefed01971d8cba827c71e69d59167e080d2f551210c85fddaa5","2df309018ab935c47306b06ebf5700dcf790fff7cebabfb99274fe867042ecf0","b7f1d82fb80e02b9ebe955e8f061f31dc60f7513d1f9ad0a831407c1ba0df87e","2c700126b22ea8b22b8b05c2da05de79df4ab7db9f88267316530fa662b4db2c","c3ccfe415c3d3b89bde029669f42b7f04df72ad2da4bd15d82495b58ebde46d6","4c79934beb1ea19f17e39fd1946158d3dd7d075aa29d8cd259834f8cd7e04ef8","2bdd086a5fce1f32ea41be86febfb4be7782c997cfcb028d2f58fee5dd4b0f8a","90c9e0ee1d74b596a0acf1e04b41c2c5f15d16b2acd39d3dc8f90b071888ac99")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("4ca4f673e4389a352854f5feb0793dac43519ade8049b5dd9356d0cbe0f06148","55dc772d1b59c387b5f33428d5167437dc2d6e2423765f4080ee3b6a04947ae9","4b410c47465359ef40d470c9286fb980e656698c4ee4d969c86c84fbd012af0d","c49e9b556d271a853449ec915e4a929f5fa7ae04da4dc714c220ed0d703a36f7","ad97b1c79735b1b97c4c4432cacac2fce6316889eafb41a0d97f2b0e565ee850","c722651d72c47e224007c2111e0489a028521ccdf5331c92e6cd9cfe07076918","2140adec9cde046b35634e93b83da4cc9a8aa0a71c21e32ba1dce2742314e8dc","a31d742d7e36fefed01971d8cba827c71e69d59167e080d2f551210c85fddaa5","a31d742d7e36fefed01971d8cba827c71e69d59167e080d2f551210c85fddaa5","2df309018ab935c47306b06ebf5700dcf790fff7cebabfb99274fe867042ecf0","b7f1d82fb80e02b9ebe955e8f061f31dc60f7513d1f9ad0a831407c1ba0df87e","2c700126b22ea8b22b8b05c2da05de79df4ab7db9f88267316530fa662b4db2c","c3ccfe415c3d3b89bde029669f42b7f04df72ad2da4bd15d82495b58ebde46d6","4c79934beb1ea19f17e39fd1946158d3dd7d075aa29d8cd259834f8cd7e04ef8","2bdd086a5fce1f32ea41be86febfb4be7782c997cfcb028d2f58fee5dd4b0f8a","90c9e0ee1d74b596a0acf1e04b41c2c5f15d16b2acd39d3dc8f90b071888ac99")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring64 NOT NULL AND customstring64 IN ("4ca4f673e4389a352854f5feb0793dac43519ade8049b5dd9356d0cbe0f06148","55dc772d1b59c387b5f33428d5167437dc2d6e2423765f4080ee3b6a04947ae9","4b410c47465359ef40d470c9286fb980e656698c4ee4d969c86c84fbd012af0d","c49e9b556d271a853449ec915e4a929f5fa7ae04da4dc714c220ed0d703a36f7","ad97b1c79735b1b97c4c4432cacac2fce6316889eafb41a0d97f2b0e565ee850","c722651d72c47e224007c2111e0489a028521ccdf5331c92e6cd9cfe07076918","2140adec9cde046b35634e93b83da4cc9a8aa0a71c21e32ba1dce2742314e8dc","a31d742d7e36fefed01971d8cba827c71e69d59167e080d2f551210c85fddaa5","a31d742d7e36fefed01971d8cba827c71e69d59167e080d2f551210c85fddaa5","2df309018ab935c47306b06ebf5700dcf790fff7cebabfb99274fe867042ecf0","b7f1d82fb80e02b9ebe955e8f061f31dc60f7513d1f9ad0a831407c1ba0df87e","2c700126b22ea8b22b8b05c2da05de79df4ab7db9f88267316530fa662b4db2c","c3ccfe415c3d3b89bde029669f42b7f04df72ad2da4bd15d82495b58ebde46d6","4c79934beb1ea19f17e39fd1946158d3dd7d075aa29d8cd259834f8cd7e04ef8","2bdd086a5fce1f32ea41be86febfb4be7782c997cfcb028d2f58fee5dd4b0f8a","90c9e0ee1d74b596a0acf1e04b41c2c5f15d16b2acd39d3dc8f90b071888ac99")
index=activity AND rg_functionality="O365 General" AND filehash NOT NULL AND filehash IN ("4ca4f673e4389a352854f5feb0793dac43519ade8049b5dd9356d0cbe0f06148","55dc772d1b59c387b5f33428d5167437dc2d6e2423765f4080ee3b6a04947ae9","4b410c47465359ef40d470c9286fb980e656698c4ee4d969c86c84fbd012af0d","c49e9b556d271a853449ec915e4a929f5fa7ae04da4dc714c220ed0d703a36f7","ad97b1c79735b1b97c4c4432cacac2fce6316889eafb41a0d97f2b0e565ee850","c722651d72c47e224007c2111e0489a028521ccdf5331c92e6cd9cfe07076918","2140adec9cde046b35634e93b83da4cc9a8aa0a71c21e32ba1dce2742314e8dc","a31d742d7e36fefed01971d8cba827c71e69d59167e080d2f551210c85fddaa5","a31d742d7e36fefed01971d8cba827c71e69d59167e080d2f551210c85fddaa5","2df309018ab935c47306b06ebf5700dcf790fff7cebabfb99274fe867042ecf0","b7f1d82fb80e02b9ebe955e8f061f31dc60f7513d1f9ad0a831407c1ba0df87e","2c700126b22ea8b22b8b05c2da05de79df4ab7db9f88267316530fa662b4db2c","c3ccfe415c3d3b89bde029669f42b7f04df72ad2da4bd15d82495b58ebde46d6","4c79934beb1ea19f17e39fd1946158d3dd7d075aa29d8cd259834f8cd7e04ef8","2bdd086a5fce1f32ea41be86febfb4be7782c997cfcb028d2f58fee5dd4b0f8a","90c9e0ee1d74b596a0acf1e04b41c2c5f15d16b2acd39d3dc8f90b071888ac99")
index=activity AND rg_functionality="O365 General" AND oldfilehash NOT NULL AND oldfilehash IN ("4ca4f673e4389a352854f5feb0793dac43519ade8049b5dd9356d0cbe0f06148","55dc772d1b59c387b5f33428d5167437dc2d6e2423765f4080ee3b6a04947ae9","4b410c47465359ef40d470c9286fb980e656698c4ee4d969c86c84fbd012af0d","c49e9b556d271a853449ec915e4a929f5fa7ae04da4dc714c220ed0d703a36f7","ad97b1c79735b1b97c4c4432cacac2fce6316889eafb41a0d97f2b0e565ee850","c722651d72c47e224007c2111e0489a028521ccdf5331c92e6cd9cfe07076918","2140adec9cde046b35634e93b83da4cc9a8aa0a71c21e32ba1dce2742314e8dc","a31d742d7e36fefed01971d8cba827c71e69d59167e080d2f551210c85fddaa5","a31d742d7e36fefed01971d8cba827c71e69d59167e080d2f551210c85fddaa5","2df309018ab935c47306b06ebf5700dcf790fff7cebabfb99274fe867042ecf0","b7f1d82fb80e02b9ebe955e8f061f31dc60f7513d1f9ad0a831407c1ba0df87e","2c700126b22ea8b22b8b05c2da05de79df4ab7db9f88267316530fa662b4db2c","c3ccfe415c3d3b89bde029669f42b7f04df72ad2da4bd15d82495b58ebde46d6","4c79934beb1ea19f17e39fd1946158d3dd7d075aa29d8cd259834f8cd7e04ef8","2bdd086a5fce1f32ea41be86febfb4be7782c997cfcb028d2f58fee5dd4b0f8a","90c9e0ee1d74b596a0acf1e04b41c2c5f15d16b2acd39d3dc8f90b071888ac99")
index=activity AND rg_functionality="O365 General" AND customstring3 NOT NULL AND customstring3 IN ("4ca4f673e4389a352854f5feb0793dac43519ade8049b5dd9356d0cbe0f06148","55dc772d1b59c387b5f33428d5167437dc2d6e2423765f4080ee3b6a04947ae9","4b410c47465359ef40d470c9286fb980e656698c4ee4d969c86c84fbd012af0d","c49e9b556d271a853449ec915e4a929f5fa7ae04da4dc714c220ed0d703a36f7","ad97b1c79735b1b97c4c4432cacac2fce6316889eafb41a0d97f2b0e565ee850","c722651d72c47e224007c2111e0489a028521ccdf5331c92e6cd9cfe07076918","2140adec9cde046b35634e93b83da4cc9a8aa0a71c21e32ba1dce2742314e8dc","a31d742d7e36fefed01971d8cba827c71e69d59167e080d2f551210c85fddaa5","a31d742d7e36fefed01971d8cba827c71e69d59167e080d2f551210c85fddaa5","2df309018ab935c47306b06ebf5700dcf790fff7cebabfb99274fe867042ecf0","b7f1d82fb80e02b9ebe955e8f061f31dc60f7513d1f9ad0a831407c1ba0df87e","2c700126b22ea8b22b8b05c2da05de79df4ab7db9f88267316530fa662b4db2c","c3ccfe415c3d3b89bde029669f42b7f04df72ad2da4bd15d82495b58ebde46d6","4c79934beb1ea19f17e39fd1946158d3dd7d075aa29d8cd259834f8cd7e04ef8","2bdd086a5fce1f32ea41be86febfb4be7782c997cfcb028d2f58fee5dd4b0f8a","90c9e0ee1d74b596a0acf1e04b41c2c5f15d16b2acd39d3dc8f90b071888ac99")
index=activity AND rg_functionality="O365 General" AND customstring64 NOT NULL AND customstring64 IN ("4ca4f673e4389a352854f5feb0793dac43519ade8049b5dd9356d0cbe0f06148","55dc772d1b59c387b5f33428d5167437dc2d6e2423765f4080ee3b6a04947ae9","4b410c47465359ef40d470c9286fb980e656698c4ee4d969c86c84fbd012af0d","c49e9b556d271a853449ec915e4a929f5fa7ae04da4dc714c220ed0d703a36f7","ad97b1c79735b1b97c4c4432cacac2fce6316889eafb41a0d97f2b0e565ee850","c722651d72c47e224007c2111e0489a028521ccdf5331c92e6cd9cfe07076918","2140adec9cde046b35634e93b83da4cc9a8aa0a71c21e32ba1dce2742314e8dc","a31d742d7e36fefed01971d8cba827c71e69d59167e080d2f551210c85fddaa5","a31d742d7e36fefed01971d8cba827c71e69d59167e080d2f551210c85fddaa5","2df309018ab935c47306b06ebf5700dcf790fff7cebabfb99274fe867042ecf0","b7f1d82fb80e02b9ebe955e8f061f31dc60f7513d1f9ad0a831407c1ba0df87e","2c700126b22ea8b22b8b05c2da05de79df4ab7db9f88267316530fa662b4db2c","c3ccfe415c3d3b89bde029669f42b7f04df72ad2da4bd15d82495b58ebde46d6","4c79934beb1ea19f17e39fd1946158d3dd7d075aa29d8cd259834f8cd7e04ef8","2bdd086a5fce1f32ea41be86febfb4be7782c997cfcb028d2f58fee5dd4b0f8a","90c9e0ee1d74b596a0acf1e04b41c2c5f15d16b2acd39d3dc8f90b071888ac99")
