index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("15db49717a9e9c1e26f5b1745870b028e0133d430ec14d52884cec28ccd3c8ab","aa2d46665ea230e856689c614edcd9d932d9edad0083bf89c903299d148634a2","a28d0550524996ca63f26cb19f4b4d82019a1be24490343e9b916d2750162cda","8571a354b5cdd9ec3735b84fa207e72c7aea1ab82ea2e4ffea1373335b3e88f4","94017628658035206820723763a2a698a4fd7be98fc2c541aad6aa0281ef090e","950243a133db44e93b764e03c8d06b99310686d010b52b67f4effa57f0d72e04","cca5df85920dd2bdaaa2abc152383c9a1391a3e1c4217382a9b0fce5a83d6e0b")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("15db49717a9e9c1e26f5b1745870b028e0133d430ec14d52884cec28ccd3c8ab","aa2d46665ea230e856689c614edcd9d932d9edad0083bf89c903299d148634a2","a28d0550524996ca63f26cb19f4b4d82019a1be24490343e9b916d2750162cda","8571a354b5cdd9ec3735b84fa207e72c7aea1ab82ea2e4ffea1373335b3e88f4","94017628658035206820723763a2a698a4fd7be98fc2c541aad6aa0281ef090e","950243a133db44e93b764e03c8d06b99310686d010b52b67f4effa57f0d72e04","cca5df85920dd2bdaaa2abc152383c9a1391a3e1c4217382a9b0fce5a83d6e0b")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("15db49717a9e9c1e26f5b1745870b028e0133d430ec14d52884cec28ccd3c8ab","aa2d46665ea230e856689c614edcd9d932d9edad0083bf89c903299d148634a2","a28d0550524996ca63f26cb19f4b4d82019a1be24490343e9b916d2750162cda","8571a354b5cdd9ec3735b84fa207e72c7aea1ab82ea2e4ffea1373335b3e88f4","94017628658035206820723763a2a698a4fd7be98fc2c541aad6aa0281ef090e","950243a133db44e93b764e03c8d06b99310686d010b52b67f4effa57f0d72e04","cca5df85920dd2bdaaa2abc152383c9a1391a3e1c4217382a9b0fce5a83d6e0b")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring64 NOT NULL AND customstring64 IN ("15db49717a9e9c1e26f5b1745870b028e0133d430ec14d52884cec28ccd3c8ab","aa2d46665ea230e856689c614edcd9d932d9edad0083bf89c903299d148634a2","a28d0550524996ca63f26cb19f4b4d82019a1be24490343e9b916d2750162cda","8571a354b5cdd9ec3735b84fa207e72c7aea1ab82ea2e4ffea1373335b3e88f4","94017628658035206820723763a2a698a4fd7be98fc2c541aad6aa0281ef090e","950243a133db44e93b764e03c8d06b99310686d010b52b67f4effa57f0d72e04","cca5df85920dd2bdaaa2abc152383c9a1391a3e1c4217382a9b0fce5a83d6e0b")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("15db49717a9e9c1e26f5b1745870b028e0133d430ec14d52884cec28ccd3c8ab","aa2d46665ea230e856689c614edcd9d932d9edad0083bf89c903299d148634a2","a28d0550524996ca63f26cb19f4b4d82019a1be24490343e9b916d2750162cda","8571a354b5cdd9ec3735b84fa207e72c7aea1ab82ea2e4ffea1373335b3e88f4","94017628658035206820723763a2a698a4fd7be98fc2c541aad6aa0281ef090e","950243a133db44e93b764e03c8d06b99310686d010b52b67f4effa57f0d72e04","cca5df85920dd2bdaaa2abc152383c9a1391a3e1c4217382a9b0fce5a83d6e0b")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("15db49717a9e9c1e26f5b1745870b028e0133d430ec14d52884cec28ccd3c8ab","aa2d46665ea230e856689c614edcd9d932d9edad0083bf89c903299d148634a2","a28d0550524996ca63f26cb19f4b4d82019a1be24490343e9b916d2750162cda","8571a354b5cdd9ec3735b84fa207e72c7aea1ab82ea2e4ffea1373335b3e88f4","94017628658035206820723763a2a698a4fd7be98fc2c541aad6aa0281ef090e","950243a133db44e93b764e03c8d06b99310686d010b52b67f4effa57f0d72e04","cca5df85920dd2bdaaa2abc152383c9a1391a3e1c4217382a9b0fce5a83d6e0b")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("15db49717a9e9c1e26f5b1745870b028e0133d430ec14d52884cec28ccd3c8ab","aa2d46665ea230e856689c614edcd9d932d9edad0083bf89c903299d148634a2","a28d0550524996ca63f26cb19f4b4d82019a1be24490343e9b916d2750162cda","8571a354b5cdd9ec3735b84fa207e72c7aea1ab82ea2e4ffea1373335b3e88f4","94017628658035206820723763a2a698a4fd7be98fc2c541aad6aa0281ef090e","950243a133db44e93b764e03c8d06b99310686d010b52b67f4effa57f0d72e04","cca5df85920dd2bdaaa2abc152383c9a1391a3e1c4217382a9b0fce5a83d6e0b")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("15db49717a9e9c1e26f5b1745870b028e0133d430ec14d52884cec28ccd3c8ab","aa2d46665ea230e856689c614edcd9d932d9edad0083bf89c903299d148634a2","a28d0550524996ca63f26cb19f4b4d82019a1be24490343e9b916d2750162cda","8571a354b5cdd9ec3735b84fa207e72c7aea1ab82ea2e4ffea1373335b3e88f4","94017628658035206820723763a2a698a4fd7be98fc2c541aad6aa0281ef090e","950243a133db44e93b764e03c8d06b99310686d010b52b67f4effa57f0d72e04","cca5df85920dd2bdaaa2abc152383c9a1391a3e1c4217382a9b0fce5a83d6e0b")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("15db49717a9e9c1e26f5b1745870b028e0133d430ec14d52884cec28ccd3c8ab","aa2d46665ea230e856689c614edcd9d932d9edad0083bf89c903299d148634a2","a28d0550524996ca63f26cb19f4b4d82019a1be24490343e9b916d2750162cda","8571a354b5cdd9ec3735b84fa207e72c7aea1ab82ea2e4ffea1373335b3e88f4","94017628658035206820723763a2a698a4fd7be98fc2c541aad6aa0281ef090e","950243a133db44e93b764e03c8d06b99310686d010b52b67f4effa57f0d72e04","cca5df85920dd2bdaaa2abc152383c9a1391a3e1c4217382a9b0fce5a83d6e0b")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("15db49717a9e9c1e26f5b1745870b028e0133d430ec14d52884cec28ccd3c8ab","aa2d46665ea230e856689c614edcd9d932d9edad0083bf89c903299d148634a2","a28d0550524996ca63f26cb19f4b4d82019a1be24490343e9b916d2750162cda","8571a354b5cdd9ec3735b84fa207e72c7aea1ab82ea2e4ffea1373335b3e88f4","94017628658035206820723763a2a698a4fd7be98fc2c541aad6aa0281ef090e","950243a133db44e93b764e03c8d06b99310686d010b52b67f4effa57f0d72e04","cca5df85920dd2bdaaa2abc152383c9a1391a3e1c4217382a9b0fce5a83d6e0b")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("15db49717a9e9c1e26f5b1745870b028e0133d430ec14d52884cec28ccd3c8ab","aa2d46665ea230e856689c614edcd9d932d9edad0083bf89c903299d148634a2","a28d0550524996ca63f26cb19f4b4d82019a1be24490343e9b916d2750162cda","8571a354b5cdd9ec3735b84fa207e72c7aea1ab82ea2e4ffea1373335b3e88f4","94017628658035206820723763a2a698a4fd7be98fc2c541aad6aa0281ef090e","950243a133db44e93b764e03c8d06b99310686d010b52b67f4effa57f0d72e04","cca5df85920dd2bdaaa2abc152383c9a1391a3e1c4217382a9b0fce5a83d6e0b")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("15db49717a9e9c1e26f5b1745870b028e0133d430ec14d52884cec28ccd3c8ab","aa2d46665ea230e856689c614edcd9d932d9edad0083bf89c903299d148634a2","a28d0550524996ca63f26cb19f4b4d82019a1be24490343e9b916d2750162cda","8571a354b5cdd9ec3735b84fa207e72c7aea1ab82ea2e4ffea1373335b3e88f4","94017628658035206820723763a2a698a4fd7be98fc2c541aad6aa0281ef090e","950243a133db44e93b764e03c8d06b99310686d010b52b67f4effa57f0d72e04","cca5df85920dd2bdaaa2abc152383c9a1391a3e1c4217382a9b0fce5a83d6e0b")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("15db49717a9e9c1e26f5b1745870b028e0133d430ec14d52884cec28ccd3c8ab","aa2d46665ea230e856689c614edcd9d932d9edad0083bf89c903299d148634a2","a28d0550524996ca63f26cb19f4b4d82019a1be24490343e9b916d2750162cda","8571a354b5cdd9ec3735b84fa207e72c7aea1ab82ea2e4ffea1373335b3e88f4","94017628658035206820723763a2a698a4fd7be98fc2c541aad6aa0281ef090e","950243a133db44e93b764e03c8d06b99310686d010b52b67f4effa57f0d72e04","cca5df85920dd2bdaaa2abc152383c9a1391a3e1c4217382a9b0fce5a83d6e0b")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("15db49717a9e9c1e26f5b1745870b028e0133d430ec14d52884cec28ccd3c8ab","aa2d46665ea230e856689c614edcd9d932d9edad0083bf89c903299d148634a2","a28d0550524996ca63f26cb19f4b4d82019a1be24490343e9b916d2750162cda","8571a354b5cdd9ec3735b84fa207e72c7aea1ab82ea2e4ffea1373335b3e88f4","94017628658035206820723763a2a698a4fd7be98fc2c541aad6aa0281ef090e","950243a133db44e93b764e03c8d06b99310686d010b52b67f4effa57f0d72e04","cca5df85920dd2bdaaa2abc152383c9a1391a3e1c4217382a9b0fce5a83d6e0b")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("15db49717a9e9c1e26f5b1745870b028e0133d430ec14d52884cec28ccd3c8ab","aa2d46665ea230e856689c614edcd9d932d9edad0083bf89c903299d148634a2","a28d0550524996ca63f26cb19f4b4d82019a1be24490343e9b916d2750162cda","8571a354b5cdd9ec3735b84fa207e72c7aea1ab82ea2e4ffea1373335b3e88f4","94017628658035206820723763a2a698a4fd7be98fc2c541aad6aa0281ef090e","950243a133db44e93b764e03c8d06b99310686d010b52b67f4effa57f0d72e04","cca5df85920dd2bdaaa2abc152383c9a1391a3e1c4217382a9b0fce5a83d6e0b")
index=activity AND rg_functionality="Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("15db49717a9e9c1e26f5b1745870b028e0133d430ec14d52884cec28ccd3c8ab","aa2d46665ea230e856689c614edcd9d932d9edad0083bf89c903299d148634a2","a28d0550524996ca63f26cb19f4b4d82019a1be24490343e9b916d2750162cda","8571a354b5cdd9ec3735b84fa207e72c7aea1ab82ea2e4ffea1373335b3e88f4","94017628658035206820723763a2a698a4fd7be98fc2c541aad6aa0281ef090e","950243a133db44e93b764e03c8d06b99310686d010b52b67f4effa57f0d72e04","cca5df85920dd2bdaaa2abc152383c9a1391a3e1c4217382a9b0fce5a83d6e0b")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("15db49717a9e9c1e26f5b1745870b028e0133d430ec14d52884cec28ccd3c8ab","aa2d46665ea230e856689c614edcd9d932d9edad0083bf89c903299d148634a2","a28d0550524996ca63f26cb19f4b4d82019a1be24490343e9b916d2750162cda","8571a354b5cdd9ec3735b84fa207e72c7aea1ab82ea2e4ffea1373335b3e88f4","94017628658035206820723763a2a698a4fd7be98fc2c541aad6aa0281ef090e","950243a133db44e93b764e03c8d06b99310686d010b52b67f4effa57f0d72e04","cca5df85920dd2bdaaa2abc152383c9a1391a3e1c4217382a9b0fce5a83d6e0b")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("15db49717a9e9c1e26f5b1745870b028e0133d430ec14d52884cec28ccd3c8ab","aa2d46665ea230e856689c614edcd9d932d9edad0083bf89c903299d148634a2","a28d0550524996ca63f26cb19f4b4d82019a1be24490343e9b916d2750162cda","8571a354b5cdd9ec3735b84fa207e72c7aea1ab82ea2e4ffea1373335b3e88f4","94017628658035206820723763a2a698a4fd7be98fc2c541aad6aa0281ef090e","950243a133db44e93b764e03c8d06b99310686d010b52b67f4effa57f0d72e04","cca5df85920dd2bdaaa2abc152383c9a1391a3e1c4217382a9b0fce5a83d6e0b")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("15db49717a9e9c1e26f5b1745870b028e0133d430ec14d52884cec28ccd3c8ab","aa2d46665ea230e856689c614edcd9d932d9edad0083bf89c903299d148634a2","a28d0550524996ca63f26cb19f4b4d82019a1be24490343e9b916d2750162cda","8571a354b5cdd9ec3735b84fa207e72c7aea1ab82ea2e4ffea1373335b3e88f4","94017628658035206820723763a2a698a4fd7be98fc2c541aad6aa0281ef090e","950243a133db44e93b764e03c8d06b99310686d010b52b67f4effa57f0d72e04","cca5df85920dd2bdaaa2abc152383c9a1391a3e1c4217382a9b0fce5a83d6e0b")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("15db49717a9e9c1e26f5b1745870b028e0133d430ec14d52884cec28ccd3c8ab","aa2d46665ea230e856689c614edcd9d932d9edad0083bf89c903299d148634a2","a28d0550524996ca63f26cb19f4b4d82019a1be24490343e9b916d2750162cda","8571a354b5cdd9ec3735b84fa207e72c7aea1ab82ea2e4ffea1373335b3e88f4","94017628658035206820723763a2a698a4fd7be98fc2c541aad6aa0281ef090e","950243a133db44e93b764e03c8d06b99310686d010b52b67f4effa57f0d72e04","cca5df85920dd2bdaaa2abc152383c9a1391a3e1c4217382a9b0fce5a83d6e0b")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("15db49717a9e9c1e26f5b1745870b028e0133d430ec14d52884cec28ccd3c8ab","aa2d46665ea230e856689c614edcd9d932d9edad0083bf89c903299d148634a2","a28d0550524996ca63f26cb19f4b4d82019a1be24490343e9b916d2750162cda","8571a354b5cdd9ec3735b84fa207e72c7aea1ab82ea2e4ffea1373335b3e88f4","94017628658035206820723763a2a698a4fd7be98fc2c541aad6aa0281ef090e","950243a133db44e93b764e03c8d06b99310686d010b52b67f4effa57f0d72e04","cca5df85920dd2bdaaa2abc152383c9a1391a3e1c4217382a9b0fce5a83d6e0b")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("15db49717a9e9c1e26f5b1745870b028e0133d430ec14d52884cec28ccd3c8ab","aa2d46665ea230e856689c614edcd9d932d9edad0083bf89c903299d148634a2","a28d0550524996ca63f26cb19f4b4d82019a1be24490343e9b916d2750162cda","8571a354b5cdd9ec3735b84fa207e72c7aea1ab82ea2e4ffea1373335b3e88f4","94017628658035206820723763a2a698a4fd7be98fc2c541aad6aa0281ef090e","950243a133db44e93b764e03c8d06b99310686d010b52b67f4effa57f0d72e04","cca5df85920dd2bdaaa2abc152383c9a1391a3e1c4217382a9b0fce5a83d6e0b")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("15db49717a9e9c1e26f5b1745870b028e0133d430ec14d52884cec28ccd3c8ab","aa2d46665ea230e856689c614edcd9d932d9edad0083bf89c903299d148634a2","a28d0550524996ca63f26cb19f4b4d82019a1be24490343e9b916d2750162cda","8571a354b5cdd9ec3735b84fa207e72c7aea1ab82ea2e4ffea1373335b3e88f4","94017628658035206820723763a2a698a4fd7be98fc2c541aad6aa0281ef090e","950243a133db44e93b764e03c8d06b99310686d010b52b67f4effa57f0d72e04","cca5df85920dd2bdaaa2abc152383c9a1391a3e1c4217382a9b0fce5a83d6e0b")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring64 NOT NULL AND customstring64 IN ("15db49717a9e9c1e26f5b1745870b028e0133d430ec14d52884cec28ccd3c8ab","aa2d46665ea230e856689c614edcd9d932d9edad0083bf89c903299d148634a2","a28d0550524996ca63f26cb19f4b4d82019a1be24490343e9b916d2750162cda","8571a354b5cdd9ec3735b84fa207e72c7aea1ab82ea2e4ffea1373335b3e88f4","94017628658035206820723763a2a698a4fd7be98fc2c541aad6aa0281ef090e","950243a133db44e93b764e03c8d06b99310686d010b52b67f4effa57f0d72e04","cca5df85920dd2bdaaa2abc152383c9a1391a3e1c4217382a9b0fce5a83d6e0b")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("15db49717a9e9c1e26f5b1745870b028e0133d430ec14d52884cec28ccd3c8ab","aa2d46665ea230e856689c614edcd9d932d9edad0083bf89c903299d148634a2","a28d0550524996ca63f26cb19f4b4d82019a1be24490343e9b916d2750162cda","8571a354b5cdd9ec3735b84fa207e72c7aea1ab82ea2e4ffea1373335b3e88f4","94017628658035206820723763a2a698a4fd7be98fc2c541aad6aa0281ef090e","950243a133db44e93b764e03c8d06b99310686d010b52b67f4effa57f0d72e04","cca5df85920dd2bdaaa2abc152383c9a1391a3e1c4217382a9b0fce5a83d6e0b")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("15db49717a9e9c1e26f5b1745870b028e0133d430ec14d52884cec28ccd3c8ab","aa2d46665ea230e856689c614edcd9d932d9edad0083bf89c903299d148634a2","a28d0550524996ca63f26cb19f4b4d82019a1be24490343e9b916d2750162cda","8571a354b5cdd9ec3735b84fa207e72c7aea1ab82ea2e4ffea1373335b3e88f4","94017628658035206820723763a2a698a4fd7be98fc2c541aad6aa0281ef090e","950243a133db44e93b764e03c8d06b99310686d010b52b67f4effa57f0d72e04","cca5df85920dd2bdaaa2abc152383c9a1391a3e1c4217382a9b0fce5a83d6e0b")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("15db49717a9e9c1e26f5b1745870b028e0133d430ec14d52884cec28ccd3c8ab","aa2d46665ea230e856689c614edcd9d932d9edad0083bf89c903299d148634a2","a28d0550524996ca63f26cb19f4b4d82019a1be24490343e9b916d2750162cda","8571a354b5cdd9ec3735b84fa207e72c7aea1ab82ea2e4ffea1373335b3e88f4","94017628658035206820723763a2a698a4fd7be98fc2c541aad6aa0281ef090e","950243a133db44e93b764e03c8d06b99310686d010b52b67f4effa57f0d72e04","cca5df85920dd2bdaaa2abc152383c9a1391a3e1c4217382a9b0fce5a83d6e0b")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring64 NOT NULL AND customstring64 IN ("15db49717a9e9c1e26f5b1745870b028e0133d430ec14d52884cec28ccd3c8ab","aa2d46665ea230e856689c614edcd9d932d9edad0083bf89c903299d148634a2","a28d0550524996ca63f26cb19f4b4d82019a1be24490343e9b916d2750162cda","8571a354b5cdd9ec3735b84fa207e72c7aea1ab82ea2e4ffea1373335b3e88f4","94017628658035206820723763a2a698a4fd7be98fc2c541aad6aa0281ef090e","950243a133db44e93b764e03c8d06b99310686d010b52b67f4effa57f0d72e04","cca5df85920dd2bdaaa2abc152383c9a1391a3e1c4217382a9b0fce5a83d6e0b")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("15db49717a9e9c1e26f5b1745870b028e0133d430ec14d52884cec28ccd3c8ab","aa2d46665ea230e856689c614edcd9d932d9edad0083bf89c903299d148634a2","a28d0550524996ca63f26cb19f4b4d82019a1be24490343e9b916d2750162cda","8571a354b5cdd9ec3735b84fa207e72c7aea1ab82ea2e4ffea1373335b3e88f4","94017628658035206820723763a2a698a4fd7be98fc2c541aad6aa0281ef090e","950243a133db44e93b764e03c8d06b99310686d010b52b67f4effa57f0d72e04","cca5df85920dd2bdaaa2abc152383c9a1391a3e1c4217382a9b0fce5a83d6e0b")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("15db49717a9e9c1e26f5b1745870b028e0133d430ec14d52884cec28ccd3c8ab","aa2d46665ea230e856689c614edcd9d932d9edad0083bf89c903299d148634a2","a28d0550524996ca63f26cb19f4b4d82019a1be24490343e9b916d2750162cda","8571a354b5cdd9ec3735b84fa207e72c7aea1ab82ea2e4ffea1373335b3e88f4","94017628658035206820723763a2a698a4fd7be98fc2c541aad6aa0281ef090e","950243a133db44e93b764e03c8d06b99310686d010b52b67f4effa57f0d72e04","cca5df85920dd2bdaaa2abc152383c9a1391a3e1c4217382a9b0fce5a83d6e0b")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("15db49717a9e9c1e26f5b1745870b028e0133d430ec14d52884cec28ccd3c8ab","aa2d46665ea230e856689c614edcd9d932d9edad0083bf89c903299d148634a2","a28d0550524996ca63f26cb19f4b4d82019a1be24490343e9b916d2750162cda","8571a354b5cdd9ec3735b84fa207e72c7aea1ab82ea2e4ffea1373335b3e88f4","94017628658035206820723763a2a698a4fd7be98fc2c541aad6aa0281ef090e","950243a133db44e93b764e03c8d06b99310686d010b52b67f4effa57f0d72e04","cca5df85920dd2bdaaa2abc152383c9a1391a3e1c4217382a9b0fce5a83d6e0b")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring64 NOT NULL AND customstring64 IN ("15db49717a9e9c1e26f5b1745870b028e0133d430ec14d52884cec28ccd3c8ab","aa2d46665ea230e856689c614edcd9d932d9edad0083bf89c903299d148634a2","a28d0550524996ca63f26cb19f4b4d82019a1be24490343e9b916d2750162cda","8571a354b5cdd9ec3735b84fa207e72c7aea1ab82ea2e4ffea1373335b3e88f4","94017628658035206820723763a2a698a4fd7be98fc2c541aad6aa0281ef090e","950243a133db44e93b764e03c8d06b99310686d010b52b67f4effa57f0d72e04","cca5df85920dd2bdaaa2abc152383c9a1391a3e1c4217382a9b0fce5a83d6e0b")
index=activity AND rg_functionality="O365 General" AND filehash NOT NULL AND filehash IN ("15db49717a9e9c1e26f5b1745870b028e0133d430ec14d52884cec28ccd3c8ab","aa2d46665ea230e856689c614edcd9d932d9edad0083bf89c903299d148634a2","a28d0550524996ca63f26cb19f4b4d82019a1be24490343e9b916d2750162cda","8571a354b5cdd9ec3735b84fa207e72c7aea1ab82ea2e4ffea1373335b3e88f4","94017628658035206820723763a2a698a4fd7be98fc2c541aad6aa0281ef090e","950243a133db44e93b764e03c8d06b99310686d010b52b67f4effa57f0d72e04","cca5df85920dd2bdaaa2abc152383c9a1391a3e1c4217382a9b0fce5a83d6e0b")
index=activity AND rg_functionality="O365 General" AND oldfilehash NOT NULL AND oldfilehash IN ("15db49717a9e9c1e26f5b1745870b028e0133d430ec14d52884cec28ccd3c8ab","aa2d46665ea230e856689c614edcd9d932d9edad0083bf89c903299d148634a2","a28d0550524996ca63f26cb19f4b4d82019a1be24490343e9b916d2750162cda","8571a354b5cdd9ec3735b84fa207e72c7aea1ab82ea2e4ffea1373335b3e88f4","94017628658035206820723763a2a698a4fd7be98fc2c541aad6aa0281ef090e","950243a133db44e93b764e03c8d06b99310686d010b52b67f4effa57f0d72e04","cca5df85920dd2bdaaa2abc152383c9a1391a3e1c4217382a9b0fce5a83d6e0b")
index=activity AND rg_functionality="O365 General" AND customstring3 NOT NULL AND customstring3 IN ("15db49717a9e9c1e26f5b1745870b028e0133d430ec14d52884cec28ccd3c8ab","aa2d46665ea230e856689c614edcd9d932d9edad0083bf89c903299d148634a2","a28d0550524996ca63f26cb19f4b4d82019a1be24490343e9b916d2750162cda","8571a354b5cdd9ec3735b84fa207e72c7aea1ab82ea2e4ffea1373335b3e88f4","94017628658035206820723763a2a698a4fd7be98fc2c541aad6aa0281ef090e","950243a133db44e93b764e03c8d06b99310686d010b52b67f4effa57f0d72e04","cca5df85920dd2bdaaa2abc152383c9a1391a3e1c4217382a9b0fce5a83d6e0b")
index=activity AND rg_functionality="O365 General" AND customstring64 NOT NULL AND customstring64 IN ("15db49717a9e9c1e26f5b1745870b028e0133d430ec14d52884cec28ccd3c8ab","aa2d46665ea230e856689c614edcd9d932d9edad0083bf89c903299d148634a2","a28d0550524996ca63f26cb19f4b4d82019a1be24490343e9b916d2750162cda","8571a354b5cdd9ec3735b84fa207e72c7aea1ab82ea2e4ffea1373335b3e88f4","94017628658035206820723763a2a698a4fd7be98fc2c541aad6aa0281ef090e","950243a133db44e93b764e03c8d06b99310686d010b52b67f4effa57f0d72e04","cca5df85920dd2bdaaa2abc152383c9a1391a3e1c4217382a9b0fce5a83d6e0b")
