index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("9E42E07073E03BDEA4CD978D9E7B44A9574972818593306BE1F3DCFDEE722238","19ED36F063221E161D740651E6578D50E0D3CACEE89D27A6EBED4AB4272585BD","54E3B5A2521A84741DC15810E6FED9D739EB8083CB1FE097CB98B345AF24E939","EC16E2DE3A55772F5DFAC8BF8F5A365600FAD40A244A574CBAB987515AA40CBF","475D6E80CF4EF70926A65DF5551F59E35B71A0E92F0FE4DD28559A9DEBA60C28")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("9E42E07073E03BDEA4CD978D9E7B44A9574972818593306BE1F3DCFDEE722238","19ED36F063221E161D740651E6578D50E0D3CACEE89D27A6EBED4AB4272585BD","54E3B5A2521A84741DC15810E6FED9D739EB8083CB1FE097CB98B345AF24E939","EC16E2DE3A55772F5DFAC8BF8F5A365600FAD40A244A574CBAB987515AA40CBF","475D6E80CF4EF70926A65DF5551F59E35B71A0E92F0FE4DD28559A9DEBA60C28")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("9E42E07073E03BDEA4CD978D9E7B44A9574972818593306BE1F3DCFDEE722238","19ED36F063221E161D740651E6578D50E0D3CACEE89D27A6EBED4AB4272585BD","54E3B5A2521A84741DC15810E6FED9D739EB8083CB1FE097CB98B345AF24E939","EC16E2DE3A55772F5DFAC8BF8F5A365600FAD40A244A574CBAB987515AA40CBF","475D6E80CF4EF70926A65DF5551F59E35B71A0E92F0FE4DD28559A9DEBA60C28")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring64 NOT NULL AND customstring64 IN ("9E42E07073E03BDEA4CD978D9E7B44A9574972818593306BE1F3DCFDEE722238","19ED36F063221E161D740651E6578D50E0D3CACEE89D27A6EBED4AB4272585BD","54E3B5A2521A84741DC15810E6FED9D739EB8083CB1FE097CB98B345AF24E939","EC16E2DE3A55772F5DFAC8BF8F5A365600FAD40A244A574CBAB987515AA40CBF","475D6E80CF4EF70926A65DF5551F59E35B71A0E92F0FE4DD28559A9DEBA60C28")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("9E42E07073E03BDEA4CD978D9E7B44A9574972818593306BE1F3DCFDEE722238","19ED36F063221E161D740651E6578D50E0D3CACEE89D27A6EBED4AB4272585BD","54E3B5A2521A84741DC15810E6FED9D739EB8083CB1FE097CB98B345AF24E939","EC16E2DE3A55772F5DFAC8BF8F5A365600FAD40A244A574CBAB987515AA40CBF","475D6E80CF4EF70926A65DF5551F59E35B71A0E92F0FE4DD28559A9DEBA60C28")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("9E42E07073E03BDEA4CD978D9E7B44A9574972818593306BE1F3DCFDEE722238","19ED36F063221E161D740651E6578D50E0D3CACEE89D27A6EBED4AB4272585BD","54E3B5A2521A84741DC15810E6FED9D739EB8083CB1FE097CB98B345AF24E939","EC16E2DE3A55772F5DFAC8BF8F5A365600FAD40A244A574CBAB987515AA40CBF","475D6E80CF4EF70926A65DF5551F59E35B71A0E92F0FE4DD28559A9DEBA60C28")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("9E42E07073E03BDEA4CD978D9E7B44A9574972818593306BE1F3DCFDEE722238","19ED36F063221E161D740651E6578D50E0D3CACEE89D27A6EBED4AB4272585BD","54E3B5A2521A84741DC15810E6FED9D739EB8083CB1FE097CB98B345AF24E939","EC16E2DE3A55772F5DFAC8BF8F5A365600FAD40A244A574CBAB987515AA40CBF","475D6E80CF4EF70926A65DF5551F59E35B71A0E92F0FE4DD28559A9DEBA60C28")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("9E42E07073E03BDEA4CD978D9E7B44A9574972818593306BE1F3DCFDEE722238","19ED36F063221E161D740651E6578D50E0D3CACEE89D27A6EBED4AB4272585BD","54E3B5A2521A84741DC15810E6FED9D739EB8083CB1FE097CB98B345AF24E939","EC16E2DE3A55772F5DFAC8BF8F5A365600FAD40A244A574CBAB987515AA40CBF","475D6E80CF4EF70926A65DF5551F59E35B71A0E92F0FE4DD28559A9DEBA60C28")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("9E42E07073E03BDEA4CD978D9E7B44A9574972818593306BE1F3DCFDEE722238","19ED36F063221E161D740651E6578D50E0D3CACEE89D27A6EBED4AB4272585BD","54E3B5A2521A84741DC15810E6FED9D739EB8083CB1FE097CB98B345AF24E939","EC16E2DE3A55772F5DFAC8BF8F5A365600FAD40A244A574CBAB987515AA40CBF","475D6E80CF4EF70926A65DF5551F59E35B71A0E92F0FE4DD28559A9DEBA60C28")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("9E42E07073E03BDEA4CD978D9E7B44A9574972818593306BE1F3DCFDEE722238","19ED36F063221E161D740651E6578D50E0D3CACEE89D27A6EBED4AB4272585BD","54E3B5A2521A84741DC15810E6FED9D739EB8083CB1FE097CB98B345AF24E939","EC16E2DE3A55772F5DFAC8BF8F5A365600FAD40A244A574CBAB987515AA40CBF","475D6E80CF4EF70926A65DF5551F59E35B71A0E92F0FE4DD28559A9DEBA60C28")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("9E42E07073E03BDEA4CD978D9E7B44A9574972818593306BE1F3DCFDEE722238","19ED36F063221E161D740651E6578D50E0D3CACEE89D27A6EBED4AB4272585BD","54E3B5A2521A84741DC15810E6FED9D739EB8083CB1FE097CB98B345AF24E939","EC16E2DE3A55772F5DFAC8BF8F5A365600FAD40A244A574CBAB987515AA40CBF","475D6E80CF4EF70926A65DF5551F59E35B71A0E92F0FE4DD28559A9DEBA60C28")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("9E42E07073E03BDEA4CD978D9E7B44A9574972818593306BE1F3DCFDEE722238","19ED36F063221E161D740651E6578D50E0D3CACEE89D27A6EBED4AB4272585BD","54E3B5A2521A84741DC15810E6FED9D739EB8083CB1FE097CB98B345AF24E939","EC16E2DE3A55772F5DFAC8BF8F5A365600FAD40A244A574CBAB987515AA40CBF","475D6E80CF4EF70926A65DF5551F59E35B71A0E92F0FE4DD28559A9DEBA60C28")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("9E42E07073E03BDEA4CD978D9E7B44A9574972818593306BE1F3DCFDEE722238","19ED36F063221E161D740651E6578D50E0D3CACEE89D27A6EBED4AB4272585BD","54E3B5A2521A84741DC15810E6FED9D739EB8083CB1FE097CB98B345AF24E939","EC16E2DE3A55772F5DFAC8BF8F5A365600FAD40A244A574CBAB987515AA40CBF","475D6E80CF4EF70926A65DF5551F59E35B71A0E92F0FE4DD28559A9DEBA60C28")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("9E42E07073E03BDEA4CD978D9E7B44A9574972818593306BE1F3DCFDEE722238","19ED36F063221E161D740651E6578D50E0D3CACEE89D27A6EBED4AB4272585BD","54E3B5A2521A84741DC15810E6FED9D739EB8083CB1FE097CB98B345AF24E939","EC16E2DE3A55772F5DFAC8BF8F5A365600FAD40A244A574CBAB987515AA40CBF","475D6E80CF4EF70926A65DF5551F59E35B71A0E92F0FE4DD28559A9DEBA60C28")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("9E42E07073E03BDEA4CD978D9E7B44A9574972818593306BE1F3DCFDEE722238","19ED36F063221E161D740651E6578D50E0D3CACEE89D27A6EBED4AB4272585BD","54E3B5A2521A84741DC15810E6FED9D739EB8083CB1FE097CB98B345AF24E939","EC16E2DE3A55772F5DFAC8BF8F5A365600FAD40A244A574CBAB987515AA40CBF","475D6E80CF4EF70926A65DF5551F59E35B71A0E92F0FE4DD28559A9DEBA60C28")
index=activity AND rg_functionality="Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("9E42E07073E03BDEA4CD978D9E7B44A9574972818593306BE1F3DCFDEE722238","19ED36F063221E161D740651E6578D50E0D3CACEE89D27A6EBED4AB4272585BD","54E3B5A2521A84741DC15810E6FED9D739EB8083CB1FE097CB98B345AF24E939","EC16E2DE3A55772F5DFAC8BF8F5A365600FAD40A244A574CBAB987515AA40CBF","475D6E80CF4EF70926A65DF5551F59E35B71A0E92F0FE4DD28559A9DEBA60C28")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("9E42E07073E03BDEA4CD978D9E7B44A9574972818593306BE1F3DCFDEE722238","19ED36F063221E161D740651E6578D50E0D3CACEE89D27A6EBED4AB4272585BD","54E3B5A2521A84741DC15810E6FED9D739EB8083CB1FE097CB98B345AF24E939","EC16E2DE3A55772F5DFAC8BF8F5A365600FAD40A244A574CBAB987515AA40CBF","475D6E80CF4EF70926A65DF5551F59E35B71A0E92F0FE4DD28559A9DEBA60C28")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("9E42E07073E03BDEA4CD978D9E7B44A9574972818593306BE1F3DCFDEE722238","19ED36F063221E161D740651E6578D50E0D3CACEE89D27A6EBED4AB4272585BD","54E3B5A2521A84741DC15810E6FED9D739EB8083CB1FE097CB98B345AF24E939","EC16E2DE3A55772F5DFAC8BF8F5A365600FAD40A244A574CBAB987515AA40CBF","475D6E80CF4EF70926A65DF5551F59E35B71A0E92F0FE4DD28559A9DEBA60C28")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("9E42E07073E03BDEA4CD978D9E7B44A9574972818593306BE1F3DCFDEE722238","19ED36F063221E161D740651E6578D50E0D3CACEE89D27A6EBED4AB4272585BD","54E3B5A2521A84741DC15810E6FED9D739EB8083CB1FE097CB98B345AF24E939","EC16E2DE3A55772F5DFAC8BF8F5A365600FAD40A244A574CBAB987515AA40CBF","475D6E80CF4EF70926A65DF5551F59E35B71A0E92F0FE4DD28559A9DEBA60C28")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("9E42E07073E03BDEA4CD978D9E7B44A9574972818593306BE1F3DCFDEE722238","19ED36F063221E161D740651E6578D50E0D3CACEE89D27A6EBED4AB4272585BD","54E3B5A2521A84741DC15810E6FED9D739EB8083CB1FE097CB98B345AF24E939","EC16E2DE3A55772F5DFAC8BF8F5A365600FAD40A244A574CBAB987515AA40CBF","475D6E80CF4EF70926A65DF5551F59E35B71A0E92F0FE4DD28559A9DEBA60C28")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("9E42E07073E03BDEA4CD978D9E7B44A9574972818593306BE1F3DCFDEE722238","19ED36F063221E161D740651E6578D50E0D3CACEE89D27A6EBED4AB4272585BD","54E3B5A2521A84741DC15810E6FED9D739EB8083CB1FE097CB98B345AF24E939","EC16E2DE3A55772F5DFAC8BF8F5A365600FAD40A244A574CBAB987515AA40CBF","475D6E80CF4EF70926A65DF5551F59E35B71A0E92F0FE4DD28559A9DEBA60C28")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("9E42E07073E03BDEA4CD978D9E7B44A9574972818593306BE1F3DCFDEE722238","19ED36F063221E161D740651E6578D50E0D3CACEE89D27A6EBED4AB4272585BD","54E3B5A2521A84741DC15810E6FED9D739EB8083CB1FE097CB98B345AF24E939","EC16E2DE3A55772F5DFAC8BF8F5A365600FAD40A244A574CBAB987515AA40CBF","475D6E80CF4EF70926A65DF5551F59E35B71A0E92F0FE4DD28559A9DEBA60C28")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("9E42E07073E03BDEA4CD978D9E7B44A9574972818593306BE1F3DCFDEE722238","19ED36F063221E161D740651E6578D50E0D3CACEE89D27A6EBED4AB4272585BD","54E3B5A2521A84741DC15810E6FED9D739EB8083CB1FE097CB98B345AF24E939","EC16E2DE3A55772F5DFAC8BF8F5A365600FAD40A244A574CBAB987515AA40CBF","475D6E80CF4EF70926A65DF5551F59E35B71A0E92F0FE4DD28559A9DEBA60C28")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring64 NOT NULL AND customstring64 IN ("9E42E07073E03BDEA4CD978D9E7B44A9574972818593306BE1F3DCFDEE722238","19ED36F063221E161D740651E6578D50E0D3CACEE89D27A6EBED4AB4272585BD","54E3B5A2521A84741DC15810E6FED9D739EB8083CB1FE097CB98B345AF24E939","EC16E2DE3A55772F5DFAC8BF8F5A365600FAD40A244A574CBAB987515AA40CBF","475D6E80CF4EF70926A65DF5551F59E35B71A0E92F0FE4DD28559A9DEBA60C28")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("9E42E07073E03BDEA4CD978D9E7B44A9574972818593306BE1F3DCFDEE722238","19ED36F063221E161D740651E6578D50E0D3CACEE89D27A6EBED4AB4272585BD","54E3B5A2521A84741DC15810E6FED9D739EB8083CB1FE097CB98B345AF24E939","EC16E2DE3A55772F5DFAC8BF8F5A365600FAD40A244A574CBAB987515AA40CBF","475D6E80CF4EF70926A65DF5551F59E35B71A0E92F0FE4DD28559A9DEBA60C28")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("9E42E07073E03BDEA4CD978D9E7B44A9574972818593306BE1F3DCFDEE722238","19ED36F063221E161D740651E6578D50E0D3CACEE89D27A6EBED4AB4272585BD","54E3B5A2521A84741DC15810E6FED9D739EB8083CB1FE097CB98B345AF24E939","EC16E2DE3A55772F5DFAC8BF8F5A365600FAD40A244A574CBAB987515AA40CBF","475D6E80CF4EF70926A65DF5551F59E35B71A0E92F0FE4DD28559A9DEBA60C28")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("9E42E07073E03BDEA4CD978D9E7B44A9574972818593306BE1F3DCFDEE722238","19ED36F063221E161D740651E6578D50E0D3CACEE89D27A6EBED4AB4272585BD","54E3B5A2521A84741DC15810E6FED9D739EB8083CB1FE097CB98B345AF24E939","EC16E2DE3A55772F5DFAC8BF8F5A365600FAD40A244A574CBAB987515AA40CBF","475D6E80CF4EF70926A65DF5551F59E35B71A0E92F0FE4DD28559A9DEBA60C28")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring64 NOT NULL AND customstring64 IN ("9E42E07073E03BDEA4CD978D9E7B44A9574972818593306BE1F3DCFDEE722238","19ED36F063221E161D740651E6578D50E0D3CACEE89D27A6EBED4AB4272585BD","54E3B5A2521A84741DC15810E6FED9D739EB8083CB1FE097CB98B345AF24E939","EC16E2DE3A55772F5DFAC8BF8F5A365600FAD40A244A574CBAB987515AA40CBF","475D6E80CF4EF70926A65DF5551F59E35B71A0E92F0FE4DD28559A9DEBA60C28")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("9E42E07073E03BDEA4CD978D9E7B44A9574972818593306BE1F3DCFDEE722238","19ED36F063221E161D740651E6578D50E0D3CACEE89D27A6EBED4AB4272585BD","54E3B5A2521A84741DC15810E6FED9D739EB8083CB1FE097CB98B345AF24E939","EC16E2DE3A55772F5DFAC8BF8F5A365600FAD40A244A574CBAB987515AA40CBF","475D6E80CF4EF70926A65DF5551F59E35B71A0E92F0FE4DD28559A9DEBA60C28")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("9E42E07073E03BDEA4CD978D9E7B44A9574972818593306BE1F3DCFDEE722238","19ED36F063221E161D740651E6578D50E0D3CACEE89D27A6EBED4AB4272585BD","54E3B5A2521A84741DC15810E6FED9D739EB8083CB1FE097CB98B345AF24E939","EC16E2DE3A55772F5DFAC8BF8F5A365600FAD40A244A574CBAB987515AA40CBF","475D6E80CF4EF70926A65DF5551F59E35B71A0E92F0FE4DD28559A9DEBA60C28")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("9E42E07073E03BDEA4CD978D9E7B44A9574972818593306BE1F3DCFDEE722238","19ED36F063221E161D740651E6578D50E0D3CACEE89D27A6EBED4AB4272585BD","54E3B5A2521A84741DC15810E6FED9D739EB8083CB1FE097CB98B345AF24E939","EC16E2DE3A55772F5DFAC8BF8F5A365600FAD40A244A574CBAB987515AA40CBF","475D6E80CF4EF70926A65DF5551F59E35B71A0E92F0FE4DD28559A9DEBA60C28")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring64 NOT NULL AND customstring64 IN ("9E42E07073E03BDEA4CD978D9E7B44A9574972818593306BE1F3DCFDEE722238","19ED36F063221E161D740651E6578D50E0D3CACEE89D27A6EBED4AB4272585BD","54E3B5A2521A84741DC15810E6FED9D739EB8083CB1FE097CB98B345AF24E939","EC16E2DE3A55772F5DFAC8BF8F5A365600FAD40A244A574CBAB987515AA40CBF","475D6E80CF4EF70926A65DF5551F59E35B71A0E92F0FE4DD28559A9DEBA60C28")
