index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("1177fb1b6b4a6ac1cd75c0f0784bb87a3202c70fe748bf5bc7fd0dd0fd41169b","07ee16f72b1dd81e7cf79aa1396f44f3ed29d343dd8fa0c6aecf1bb3d36d4e34","f2503068aa274eb6c73dfd1a31c7e878f84f3fb60f3ae23f001bb143eb6f196f","96a1666152dfe5cc4113b855a059195227f55773d8ad46cc92fe5090010035f1","de05f6f97b475ed6464541665e59252869b5d531c63698a9ad70c3875954c92c","acf98f0c2b3823f9213b220fcd79237037d0d3f087a3faa4f10ea6d147a9f059","7701e4bf5074f0527c0126fff1dbd0e6368ddb7d0131bac1fba72b19511af127","4d365958397af1b7c2c62f62d21b35b948c03dd17f730a58b6145cd003a7922c","39e0199d3d501acc3377af56c4e79ec4c4f8aaa21ac1a449fe8da69c4c267dd7","f8ef5f403474624e61ef0b83adc9e15ea6ca47534f7316c4c43db6f064e21c76","655afdb9fc4ab05875c790c22e505b4eda3492323631ed3c951b4fe60806770a","2b807f42e32684768fa5e514ee0674836f3774ec83e73fc0be0afde34f8ee11c","f30aeb1877ddd30c0d2b79c78bffa7f990df56d37dd78ab0d5c563db02b1ab37","2526a840c91d03c804a8f73cc35a9a993f4dcddf12950566c419a8addf52fd39","a544293ad41861129c77aaaea1620b884982378721bed31c60702b3e3d3c1590","9b5869e4d37894571923607dce7c23a324ae2f93820384b99aefe619a7fa3fad","87982fe34bfcb26fd06714e0bb4c3341dfaa66b51e918fcf048554be60d29307","87d809543079ae5770b6cdc1849e7be55dec1a37c3f90ea63a5d5f5a2b3d4c32","3d5d95b4e51ce5b7597c3f2b8da50951bd8152493e3ea27f0b8f7ab32596a526","4ab0bc4c0841cf65f6c78356327337cdea436e1c1d008e8e0a5f5e400aaed39c","10e1dbb3c19c6a3b905434cae98fe0c6d4e68a8d9bcd316175160efd834a2d23","829a3a3525fae23ea0e56a0049b9ba56f9a061315d023940defb00661a74b767","8af9b0cdb301febc64ac05b8acb701d0f1b6f88cc22a4c83929078d04bfca657","594948597aae36cd9fcf30dec7ef1be70bc70ee618f0e33dd8268c12982da7c9","f83a0b46b9d424d338342b509d9e12b467d25f400db62dc57815db33b1b26feb")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("1177fb1b6b4a6ac1cd75c0f0784bb87a3202c70fe748bf5bc7fd0dd0fd41169b","07ee16f72b1dd81e7cf79aa1396f44f3ed29d343dd8fa0c6aecf1bb3d36d4e34","f2503068aa274eb6c73dfd1a31c7e878f84f3fb60f3ae23f001bb143eb6f196f","96a1666152dfe5cc4113b855a059195227f55773d8ad46cc92fe5090010035f1","de05f6f97b475ed6464541665e59252869b5d531c63698a9ad70c3875954c92c","acf98f0c2b3823f9213b220fcd79237037d0d3f087a3faa4f10ea6d147a9f059","7701e4bf5074f0527c0126fff1dbd0e6368ddb7d0131bac1fba72b19511af127","4d365958397af1b7c2c62f62d21b35b948c03dd17f730a58b6145cd003a7922c","39e0199d3d501acc3377af56c4e79ec4c4f8aaa21ac1a449fe8da69c4c267dd7","f8ef5f403474624e61ef0b83adc9e15ea6ca47534f7316c4c43db6f064e21c76","655afdb9fc4ab05875c790c22e505b4eda3492323631ed3c951b4fe60806770a","2b807f42e32684768fa5e514ee0674836f3774ec83e73fc0be0afde34f8ee11c","f30aeb1877ddd30c0d2b79c78bffa7f990df56d37dd78ab0d5c563db02b1ab37","2526a840c91d03c804a8f73cc35a9a993f4dcddf12950566c419a8addf52fd39","a544293ad41861129c77aaaea1620b884982378721bed31c60702b3e3d3c1590","9b5869e4d37894571923607dce7c23a324ae2f93820384b99aefe619a7fa3fad","87982fe34bfcb26fd06714e0bb4c3341dfaa66b51e918fcf048554be60d29307","87d809543079ae5770b6cdc1849e7be55dec1a37c3f90ea63a5d5f5a2b3d4c32","3d5d95b4e51ce5b7597c3f2b8da50951bd8152493e3ea27f0b8f7ab32596a526","4ab0bc4c0841cf65f6c78356327337cdea436e1c1d008e8e0a5f5e400aaed39c","10e1dbb3c19c6a3b905434cae98fe0c6d4e68a8d9bcd316175160efd834a2d23","829a3a3525fae23ea0e56a0049b9ba56f9a061315d023940defb00661a74b767","8af9b0cdb301febc64ac05b8acb701d0f1b6f88cc22a4c83929078d04bfca657","594948597aae36cd9fcf30dec7ef1be70bc70ee618f0e33dd8268c12982da7c9","f83a0b46b9d424d338342b509d9e12b467d25f400db62dc57815db33b1b26feb")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("1177fb1b6b4a6ac1cd75c0f0784bb87a3202c70fe748bf5bc7fd0dd0fd41169b","07ee16f72b1dd81e7cf79aa1396f44f3ed29d343dd8fa0c6aecf1bb3d36d4e34","f2503068aa274eb6c73dfd1a31c7e878f84f3fb60f3ae23f001bb143eb6f196f","96a1666152dfe5cc4113b855a059195227f55773d8ad46cc92fe5090010035f1","de05f6f97b475ed6464541665e59252869b5d531c63698a9ad70c3875954c92c","acf98f0c2b3823f9213b220fcd79237037d0d3f087a3faa4f10ea6d147a9f059","7701e4bf5074f0527c0126fff1dbd0e6368ddb7d0131bac1fba72b19511af127","4d365958397af1b7c2c62f62d21b35b948c03dd17f730a58b6145cd003a7922c","39e0199d3d501acc3377af56c4e79ec4c4f8aaa21ac1a449fe8da69c4c267dd7","f8ef5f403474624e61ef0b83adc9e15ea6ca47534f7316c4c43db6f064e21c76","655afdb9fc4ab05875c790c22e505b4eda3492323631ed3c951b4fe60806770a","2b807f42e32684768fa5e514ee0674836f3774ec83e73fc0be0afde34f8ee11c","f30aeb1877ddd30c0d2b79c78bffa7f990df56d37dd78ab0d5c563db02b1ab37","2526a840c91d03c804a8f73cc35a9a993f4dcddf12950566c419a8addf52fd39","a544293ad41861129c77aaaea1620b884982378721bed31c60702b3e3d3c1590","9b5869e4d37894571923607dce7c23a324ae2f93820384b99aefe619a7fa3fad","87982fe34bfcb26fd06714e0bb4c3341dfaa66b51e918fcf048554be60d29307","87d809543079ae5770b6cdc1849e7be55dec1a37c3f90ea63a5d5f5a2b3d4c32","3d5d95b4e51ce5b7597c3f2b8da50951bd8152493e3ea27f0b8f7ab32596a526","4ab0bc4c0841cf65f6c78356327337cdea436e1c1d008e8e0a5f5e400aaed39c","10e1dbb3c19c6a3b905434cae98fe0c6d4e68a8d9bcd316175160efd834a2d23","829a3a3525fae23ea0e56a0049b9ba56f9a061315d023940defb00661a74b767","8af9b0cdb301febc64ac05b8acb701d0f1b6f88cc22a4c83929078d04bfca657","594948597aae36cd9fcf30dec7ef1be70bc70ee618f0e33dd8268c12982da7c9","f83a0b46b9d424d338342b509d9e12b467d25f400db62dc57815db33b1b26feb")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring64 NOT NULL AND customstring64 IN ("1177fb1b6b4a6ac1cd75c0f0784bb87a3202c70fe748bf5bc7fd0dd0fd41169b","07ee16f72b1dd81e7cf79aa1396f44f3ed29d343dd8fa0c6aecf1bb3d36d4e34","f2503068aa274eb6c73dfd1a31c7e878f84f3fb60f3ae23f001bb143eb6f196f","96a1666152dfe5cc4113b855a059195227f55773d8ad46cc92fe5090010035f1","de05f6f97b475ed6464541665e59252869b5d531c63698a9ad70c3875954c92c","acf98f0c2b3823f9213b220fcd79237037d0d3f087a3faa4f10ea6d147a9f059","7701e4bf5074f0527c0126fff1dbd0e6368ddb7d0131bac1fba72b19511af127","4d365958397af1b7c2c62f62d21b35b948c03dd17f730a58b6145cd003a7922c","39e0199d3d501acc3377af56c4e79ec4c4f8aaa21ac1a449fe8da69c4c267dd7","f8ef5f403474624e61ef0b83adc9e15ea6ca47534f7316c4c43db6f064e21c76","655afdb9fc4ab05875c790c22e505b4eda3492323631ed3c951b4fe60806770a","2b807f42e32684768fa5e514ee0674836f3774ec83e73fc0be0afde34f8ee11c","f30aeb1877ddd30c0d2b79c78bffa7f990df56d37dd78ab0d5c563db02b1ab37","2526a840c91d03c804a8f73cc35a9a993f4dcddf12950566c419a8addf52fd39","a544293ad41861129c77aaaea1620b884982378721bed31c60702b3e3d3c1590","9b5869e4d37894571923607dce7c23a324ae2f93820384b99aefe619a7fa3fad","87982fe34bfcb26fd06714e0bb4c3341dfaa66b51e918fcf048554be60d29307","87d809543079ae5770b6cdc1849e7be55dec1a37c3f90ea63a5d5f5a2b3d4c32","3d5d95b4e51ce5b7597c3f2b8da50951bd8152493e3ea27f0b8f7ab32596a526","4ab0bc4c0841cf65f6c78356327337cdea436e1c1d008e8e0a5f5e400aaed39c","10e1dbb3c19c6a3b905434cae98fe0c6d4e68a8d9bcd316175160efd834a2d23","829a3a3525fae23ea0e56a0049b9ba56f9a061315d023940defb00661a74b767","8af9b0cdb301febc64ac05b8acb701d0f1b6f88cc22a4c83929078d04bfca657","594948597aae36cd9fcf30dec7ef1be70bc70ee618f0e33dd8268c12982da7c9","f83a0b46b9d424d338342b509d9e12b467d25f400db62dc57815db33b1b26feb")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("1177fb1b6b4a6ac1cd75c0f0784bb87a3202c70fe748bf5bc7fd0dd0fd41169b","07ee16f72b1dd81e7cf79aa1396f44f3ed29d343dd8fa0c6aecf1bb3d36d4e34","f2503068aa274eb6c73dfd1a31c7e878f84f3fb60f3ae23f001bb143eb6f196f","96a1666152dfe5cc4113b855a059195227f55773d8ad46cc92fe5090010035f1","de05f6f97b475ed6464541665e59252869b5d531c63698a9ad70c3875954c92c","acf98f0c2b3823f9213b220fcd79237037d0d3f087a3faa4f10ea6d147a9f059","7701e4bf5074f0527c0126fff1dbd0e6368ddb7d0131bac1fba72b19511af127","4d365958397af1b7c2c62f62d21b35b948c03dd17f730a58b6145cd003a7922c","39e0199d3d501acc3377af56c4e79ec4c4f8aaa21ac1a449fe8da69c4c267dd7","f8ef5f403474624e61ef0b83adc9e15ea6ca47534f7316c4c43db6f064e21c76","655afdb9fc4ab05875c790c22e505b4eda3492323631ed3c951b4fe60806770a","2b807f42e32684768fa5e514ee0674836f3774ec83e73fc0be0afde34f8ee11c","f30aeb1877ddd30c0d2b79c78bffa7f990df56d37dd78ab0d5c563db02b1ab37","2526a840c91d03c804a8f73cc35a9a993f4dcddf12950566c419a8addf52fd39","a544293ad41861129c77aaaea1620b884982378721bed31c60702b3e3d3c1590","9b5869e4d37894571923607dce7c23a324ae2f93820384b99aefe619a7fa3fad","87982fe34bfcb26fd06714e0bb4c3341dfaa66b51e918fcf048554be60d29307","87d809543079ae5770b6cdc1849e7be55dec1a37c3f90ea63a5d5f5a2b3d4c32","3d5d95b4e51ce5b7597c3f2b8da50951bd8152493e3ea27f0b8f7ab32596a526","4ab0bc4c0841cf65f6c78356327337cdea436e1c1d008e8e0a5f5e400aaed39c","10e1dbb3c19c6a3b905434cae98fe0c6d4e68a8d9bcd316175160efd834a2d23","829a3a3525fae23ea0e56a0049b9ba56f9a061315d023940defb00661a74b767","8af9b0cdb301febc64ac05b8acb701d0f1b6f88cc22a4c83929078d04bfca657","594948597aae36cd9fcf30dec7ef1be70bc70ee618f0e33dd8268c12982da7c9","f83a0b46b9d424d338342b509d9e12b467d25f400db62dc57815db33b1b26feb")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("1177fb1b6b4a6ac1cd75c0f0784bb87a3202c70fe748bf5bc7fd0dd0fd41169b","07ee16f72b1dd81e7cf79aa1396f44f3ed29d343dd8fa0c6aecf1bb3d36d4e34","f2503068aa274eb6c73dfd1a31c7e878f84f3fb60f3ae23f001bb143eb6f196f","96a1666152dfe5cc4113b855a059195227f55773d8ad46cc92fe5090010035f1","de05f6f97b475ed6464541665e59252869b5d531c63698a9ad70c3875954c92c","acf98f0c2b3823f9213b220fcd79237037d0d3f087a3faa4f10ea6d147a9f059","7701e4bf5074f0527c0126fff1dbd0e6368ddb7d0131bac1fba72b19511af127","4d365958397af1b7c2c62f62d21b35b948c03dd17f730a58b6145cd003a7922c","39e0199d3d501acc3377af56c4e79ec4c4f8aaa21ac1a449fe8da69c4c267dd7","f8ef5f403474624e61ef0b83adc9e15ea6ca47534f7316c4c43db6f064e21c76","655afdb9fc4ab05875c790c22e505b4eda3492323631ed3c951b4fe60806770a","2b807f42e32684768fa5e514ee0674836f3774ec83e73fc0be0afde34f8ee11c","f30aeb1877ddd30c0d2b79c78bffa7f990df56d37dd78ab0d5c563db02b1ab37","2526a840c91d03c804a8f73cc35a9a993f4dcddf12950566c419a8addf52fd39","a544293ad41861129c77aaaea1620b884982378721bed31c60702b3e3d3c1590","9b5869e4d37894571923607dce7c23a324ae2f93820384b99aefe619a7fa3fad","87982fe34bfcb26fd06714e0bb4c3341dfaa66b51e918fcf048554be60d29307","87d809543079ae5770b6cdc1849e7be55dec1a37c3f90ea63a5d5f5a2b3d4c32","3d5d95b4e51ce5b7597c3f2b8da50951bd8152493e3ea27f0b8f7ab32596a526","4ab0bc4c0841cf65f6c78356327337cdea436e1c1d008e8e0a5f5e400aaed39c","10e1dbb3c19c6a3b905434cae98fe0c6d4e68a8d9bcd316175160efd834a2d23","829a3a3525fae23ea0e56a0049b9ba56f9a061315d023940defb00661a74b767","8af9b0cdb301febc64ac05b8acb701d0f1b6f88cc22a4c83929078d04bfca657","594948597aae36cd9fcf30dec7ef1be70bc70ee618f0e33dd8268c12982da7c9","f83a0b46b9d424d338342b509d9e12b467d25f400db62dc57815db33b1b26feb")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("1177fb1b6b4a6ac1cd75c0f0784bb87a3202c70fe748bf5bc7fd0dd0fd41169b","07ee16f72b1dd81e7cf79aa1396f44f3ed29d343dd8fa0c6aecf1bb3d36d4e34","f2503068aa274eb6c73dfd1a31c7e878f84f3fb60f3ae23f001bb143eb6f196f","96a1666152dfe5cc4113b855a059195227f55773d8ad46cc92fe5090010035f1","de05f6f97b475ed6464541665e59252869b5d531c63698a9ad70c3875954c92c","acf98f0c2b3823f9213b220fcd79237037d0d3f087a3faa4f10ea6d147a9f059","7701e4bf5074f0527c0126fff1dbd0e6368ddb7d0131bac1fba72b19511af127","4d365958397af1b7c2c62f62d21b35b948c03dd17f730a58b6145cd003a7922c","39e0199d3d501acc3377af56c4e79ec4c4f8aaa21ac1a449fe8da69c4c267dd7","f8ef5f403474624e61ef0b83adc9e15ea6ca47534f7316c4c43db6f064e21c76","655afdb9fc4ab05875c790c22e505b4eda3492323631ed3c951b4fe60806770a","2b807f42e32684768fa5e514ee0674836f3774ec83e73fc0be0afde34f8ee11c","f30aeb1877ddd30c0d2b79c78bffa7f990df56d37dd78ab0d5c563db02b1ab37","2526a840c91d03c804a8f73cc35a9a993f4dcddf12950566c419a8addf52fd39","a544293ad41861129c77aaaea1620b884982378721bed31c60702b3e3d3c1590","9b5869e4d37894571923607dce7c23a324ae2f93820384b99aefe619a7fa3fad","87982fe34bfcb26fd06714e0bb4c3341dfaa66b51e918fcf048554be60d29307","87d809543079ae5770b6cdc1849e7be55dec1a37c3f90ea63a5d5f5a2b3d4c32","3d5d95b4e51ce5b7597c3f2b8da50951bd8152493e3ea27f0b8f7ab32596a526","4ab0bc4c0841cf65f6c78356327337cdea436e1c1d008e8e0a5f5e400aaed39c","10e1dbb3c19c6a3b905434cae98fe0c6d4e68a8d9bcd316175160efd834a2d23","829a3a3525fae23ea0e56a0049b9ba56f9a061315d023940defb00661a74b767","8af9b0cdb301febc64ac05b8acb701d0f1b6f88cc22a4c83929078d04bfca657","594948597aae36cd9fcf30dec7ef1be70bc70ee618f0e33dd8268c12982da7c9","f83a0b46b9d424d338342b509d9e12b467d25f400db62dc57815db33b1b26feb")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("1177fb1b6b4a6ac1cd75c0f0784bb87a3202c70fe748bf5bc7fd0dd0fd41169b","07ee16f72b1dd81e7cf79aa1396f44f3ed29d343dd8fa0c6aecf1bb3d36d4e34","f2503068aa274eb6c73dfd1a31c7e878f84f3fb60f3ae23f001bb143eb6f196f","96a1666152dfe5cc4113b855a059195227f55773d8ad46cc92fe5090010035f1","de05f6f97b475ed6464541665e59252869b5d531c63698a9ad70c3875954c92c","acf98f0c2b3823f9213b220fcd79237037d0d3f087a3faa4f10ea6d147a9f059","7701e4bf5074f0527c0126fff1dbd0e6368ddb7d0131bac1fba72b19511af127","4d365958397af1b7c2c62f62d21b35b948c03dd17f730a58b6145cd003a7922c","39e0199d3d501acc3377af56c4e79ec4c4f8aaa21ac1a449fe8da69c4c267dd7","f8ef5f403474624e61ef0b83adc9e15ea6ca47534f7316c4c43db6f064e21c76","655afdb9fc4ab05875c790c22e505b4eda3492323631ed3c951b4fe60806770a","2b807f42e32684768fa5e514ee0674836f3774ec83e73fc0be0afde34f8ee11c","f30aeb1877ddd30c0d2b79c78bffa7f990df56d37dd78ab0d5c563db02b1ab37","2526a840c91d03c804a8f73cc35a9a993f4dcddf12950566c419a8addf52fd39","a544293ad41861129c77aaaea1620b884982378721bed31c60702b3e3d3c1590","9b5869e4d37894571923607dce7c23a324ae2f93820384b99aefe619a7fa3fad","87982fe34bfcb26fd06714e0bb4c3341dfaa66b51e918fcf048554be60d29307","87d809543079ae5770b6cdc1849e7be55dec1a37c3f90ea63a5d5f5a2b3d4c32","3d5d95b4e51ce5b7597c3f2b8da50951bd8152493e3ea27f0b8f7ab32596a526","4ab0bc4c0841cf65f6c78356327337cdea436e1c1d008e8e0a5f5e400aaed39c","10e1dbb3c19c6a3b905434cae98fe0c6d4e68a8d9bcd316175160efd834a2d23","829a3a3525fae23ea0e56a0049b9ba56f9a061315d023940defb00661a74b767","8af9b0cdb301febc64ac05b8acb701d0f1b6f88cc22a4c83929078d04bfca657","594948597aae36cd9fcf30dec7ef1be70bc70ee618f0e33dd8268c12982da7c9","f83a0b46b9d424d338342b509d9e12b467d25f400db62dc57815db33b1b26feb")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("1177fb1b6b4a6ac1cd75c0f0784bb87a3202c70fe748bf5bc7fd0dd0fd41169b","07ee16f72b1dd81e7cf79aa1396f44f3ed29d343dd8fa0c6aecf1bb3d36d4e34","f2503068aa274eb6c73dfd1a31c7e878f84f3fb60f3ae23f001bb143eb6f196f","96a1666152dfe5cc4113b855a059195227f55773d8ad46cc92fe5090010035f1","de05f6f97b475ed6464541665e59252869b5d531c63698a9ad70c3875954c92c","acf98f0c2b3823f9213b220fcd79237037d0d3f087a3faa4f10ea6d147a9f059","7701e4bf5074f0527c0126fff1dbd0e6368ddb7d0131bac1fba72b19511af127","4d365958397af1b7c2c62f62d21b35b948c03dd17f730a58b6145cd003a7922c","39e0199d3d501acc3377af56c4e79ec4c4f8aaa21ac1a449fe8da69c4c267dd7","f8ef5f403474624e61ef0b83adc9e15ea6ca47534f7316c4c43db6f064e21c76","655afdb9fc4ab05875c790c22e505b4eda3492323631ed3c951b4fe60806770a","2b807f42e32684768fa5e514ee0674836f3774ec83e73fc0be0afde34f8ee11c","f30aeb1877ddd30c0d2b79c78bffa7f990df56d37dd78ab0d5c563db02b1ab37","2526a840c91d03c804a8f73cc35a9a993f4dcddf12950566c419a8addf52fd39","a544293ad41861129c77aaaea1620b884982378721bed31c60702b3e3d3c1590","9b5869e4d37894571923607dce7c23a324ae2f93820384b99aefe619a7fa3fad","87982fe34bfcb26fd06714e0bb4c3341dfaa66b51e918fcf048554be60d29307","87d809543079ae5770b6cdc1849e7be55dec1a37c3f90ea63a5d5f5a2b3d4c32","3d5d95b4e51ce5b7597c3f2b8da50951bd8152493e3ea27f0b8f7ab32596a526","4ab0bc4c0841cf65f6c78356327337cdea436e1c1d008e8e0a5f5e400aaed39c","10e1dbb3c19c6a3b905434cae98fe0c6d4e68a8d9bcd316175160efd834a2d23","829a3a3525fae23ea0e56a0049b9ba56f9a061315d023940defb00661a74b767","8af9b0cdb301febc64ac05b8acb701d0f1b6f88cc22a4c83929078d04bfca657","594948597aae36cd9fcf30dec7ef1be70bc70ee618f0e33dd8268c12982da7c9","f83a0b46b9d424d338342b509d9e12b467d25f400db62dc57815db33b1b26feb")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("1177fb1b6b4a6ac1cd75c0f0784bb87a3202c70fe748bf5bc7fd0dd0fd41169b","07ee16f72b1dd81e7cf79aa1396f44f3ed29d343dd8fa0c6aecf1bb3d36d4e34","f2503068aa274eb6c73dfd1a31c7e878f84f3fb60f3ae23f001bb143eb6f196f","96a1666152dfe5cc4113b855a059195227f55773d8ad46cc92fe5090010035f1","de05f6f97b475ed6464541665e59252869b5d531c63698a9ad70c3875954c92c","acf98f0c2b3823f9213b220fcd79237037d0d3f087a3faa4f10ea6d147a9f059","7701e4bf5074f0527c0126fff1dbd0e6368ddb7d0131bac1fba72b19511af127","4d365958397af1b7c2c62f62d21b35b948c03dd17f730a58b6145cd003a7922c","39e0199d3d501acc3377af56c4e79ec4c4f8aaa21ac1a449fe8da69c4c267dd7","f8ef5f403474624e61ef0b83adc9e15ea6ca47534f7316c4c43db6f064e21c76","655afdb9fc4ab05875c790c22e505b4eda3492323631ed3c951b4fe60806770a","2b807f42e32684768fa5e514ee0674836f3774ec83e73fc0be0afde34f8ee11c","f30aeb1877ddd30c0d2b79c78bffa7f990df56d37dd78ab0d5c563db02b1ab37","2526a840c91d03c804a8f73cc35a9a993f4dcddf12950566c419a8addf52fd39","a544293ad41861129c77aaaea1620b884982378721bed31c60702b3e3d3c1590","9b5869e4d37894571923607dce7c23a324ae2f93820384b99aefe619a7fa3fad","87982fe34bfcb26fd06714e0bb4c3341dfaa66b51e918fcf048554be60d29307","87d809543079ae5770b6cdc1849e7be55dec1a37c3f90ea63a5d5f5a2b3d4c32","3d5d95b4e51ce5b7597c3f2b8da50951bd8152493e3ea27f0b8f7ab32596a526","4ab0bc4c0841cf65f6c78356327337cdea436e1c1d008e8e0a5f5e400aaed39c","10e1dbb3c19c6a3b905434cae98fe0c6d4e68a8d9bcd316175160efd834a2d23","829a3a3525fae23ea0e56a0049b9ba56f9a061315d023940defb00661a74b767","8af9b0cdb301febc64ac05b8acb701d0f1b6f88cc22a4c83929078d04bfca657","594948597aae36cd9fcf30dec7ef1be70bc70ee618f0e33dd8268c12982da7c9","f83a0b46b9d424d338342b509d9e12b467d25f400db62dc57815db33b1b26feb")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("1177fb1b6b4a6ac1cd75c0f0784bb87a3202c70fe748bf5bc7fd0dd0fd41169b","07ee16f72b1dd81e7cf79aa1396f44f3ed29d343dd8fa0c6aecf1bb3d36d4e34","f2503068aa274eb6c73dfd1a31c7e878f84f3fb60f3ae23f001bb143eb6f196f","96a1666152dfe5cc4113b855a059195227f55773d8ad46cc92fe5090010035f1","de05f6f97b475ed6464541665e59252869b5d531c63698a9ad70c3875954c92c","acf98f0c2b3823f9213b220fcd79237037d0d3f087a3faa4f10ea6d147a9f059","7701e4bf5074f0527c0126fff1dbd0e6368ddb7d0131bac1fba72b19511af127","4d365958397af1b7c2c62f62d21b35b948c03dd17f730a58b6145cd003a7922c","39e0199d3d501acc3377af56c4e79ec4c4f8aaa21ac1a449fe8da69c4c267dd7","f8ef5f403474624e61ef0b83adc9e15ea6ca47534f7316c4c43db6f064e21c76","655afdb9fc4ab05875c790c22e505b4eda3492323631ed3c951b4fe60806770a","2b807f42e32684768fa5e514ee0674836f3774ec83e73fc0be0afde34f8ee11c","f30aeb1877ddd30c0d2b79c78bffa7f990df56d37dd78ab0d5c563db02b1ab37","2526a840c91d03c804a8f73cc35a9a993f4dcddf12950566c419a8addf52fd39","a544293ad41861129c77aaaea1620b884982378721bed31c60702b3e3d3c1590","9b5869e4d37894571923607dce7c23a324ae2f93820384b99aefe619a7fa3fad","87982fe34bfcb26fd06714e0bb4c3341dfaa66b51e918fcf048554be60d29307","87d809543079ae5770b6cdc1849e7be55dec1a37c3f90ea63a5d5f5a2b3d4c32","3d5d95b4e51ce5b7597c3f2b8da50951bd8152493e3ea27f0b8f7ab32596a526","4ab0bc4c0841cf65f6c78356327337cdea436e1c1d008e8e0a5f5e400aaed39c","10e1dbb3c19c6a3b905434cae98fe0c6d4e68a8d9bcd316175160efd834a2d23","829a3a3525fae23ea0e56a0049b9ba56f9a061315d023940defb00661a74b767","8af9b0cdb301febc64ac05b8acb701d0f1b6f88cc22a4c83929078d04bfca657","594948597aae36cd9fcf30dec7ef1be70bc70ee618f0e33dd8268c12982da7c9","f83a0b46b9d424d338342b509d9e12b467d25f400db62dc57815db33b1b26feb")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("1177fb1b6b4a6ac1cd75c0f0784bb87a3202c70fe748bf5bc7fd0dd0fd41169b","07ee16f72b1dd81e7cf79aa1396f44f3ed29d343dd8fa0c6aecf1bb3d36d4e34","f2503068aa274eb6c73dfd1a31c7e878f84f3fb60f3ae23f001bb143eb6f196f","96a1666152dfe5cc4113b855a059195227f55773d8ad46cc92fe5090010035f1","de05f6f97b475ed6464541665e59252869b5d531c63698a9ad70c3875954c92c","acf98f0c2b3823f9213b220fcd79237037d0d3f087a3faa4f10ea6d147a9f059","7701e4bf5074f0527c0126fff1dbd0e6368ddb7d0131bac1fba72b19511af127","4d365958397af1b7c2c62f62d21b35b948c03dd17f730a58b6145cd003a7922c","39e0199d3d501acc3377af56c4e79ec4c4f8aaa21ac1a449fe8da69c4c267dd7","f8ef5f403474624e61ef0b83adc9e15ea6ca47534f7316c4c43db6f064e21c76","655afdb9fc4ab05875c790c22e505b4eda3492323631ed3c951b4fe60806770a","2b807f42e32684768fa5e514ee0674836f3774ec83e73fc0be0afde34f8ee11c","f30aeb1877ddd30c0d2b79c78bffa7f990df56d37dd78ab0d5c563db02b1ab37","2526a840c91d03c804a8f73cc35a9a993f4dcddf12950566c419a8addf52fd39","a544293ad41861129c77aaaea1620b884982378721bed31c60702b3e3d3c1590","9b5869e4d37894571923607dce7c23a324ae2f93820384b99aefe619a7fa3fad","87982fe34bfcb26fd06714e0bb4c3341dfaa66b51e918fcf048554be60d29307","87d809543079ae5770b6cdc1849e7be55dec1a37c3f90ea63a5d5f5a2b3d4c32","3d5d95b4e51ce5b7597c3f2b8da50951bd8152493e3ea27f0b8f7ab32596a526","4ab0bc4c0841cf65f6c78356327337cdea436e1c1d008e8e0a5f5e400aaed39c","10e1dbb3c19c6a3b905434cae98fe0c6d4e68a8d9bcd316175160efd834a2d23","829a3a3525fae23ea0e56a0049b9ba56f9a061315d023940defb00661a74b767","8af9b0cdb301febc64ac05b8acb701d0f1b6f88cc22a4c83929078d04bfca657","594948597aae36cd9fcf30dec7ef1be70bc70ee618f0e33dd8268c12982da7c9","f83a0b46b9d424d338342b509d9e12b467d25f400db62dc57815db33b1b26feb")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("1177fb1b6b4a6ac1cd75c0f0784bb87a3202c70fe748bf5bc7fd0dd0fd41169b","07ee16f72b1dd81e7cf79aa1396f44f3ed29d343dd8fa0c6aecf1bb3d36d4e34","f2503068aa274eb6c73dfd1a31c7e878f84f3fb60f3ae23f001bb143eb6f196f","96a1666152dfe5cc4113b855a059195227f55773d8ad46cc92fe5090010035f1","de05f6f97b475ed6464541665e59252869b5d531c63698a9ad70c3875954c92c","acf98f0c2b3823f9213b220fcd79237037d0d3f087a3faa4f10ea6d147a9f059","7701e4bf5074f0527c0126fff1dbd0e6368ddb7d0131bac1fba72b19511af127","4d365958397af1b7c2c62f62d21b35b948c03dd17f730a58b6145cd003a7922c","39e0199d3d501acc3377af56c4e79ec4c4f8aaa21ac1a449fe8da69c4c267dd7","f8ef5f403474624e61ef0b83adc9e15ea6ca47534f7316c4c43db6f064e21c76","655afdb9fc4ab05875c790c22e505b4eda3492323631ed3c951b4fe60806770a","2b807f42e32684768fa5e514ee0674836f3774ec83e73fc0be0afde34f8ee11c","f30aeb1877ddd30c0d2b79c78bffa7f990df56d37dd78ab0d5c563db02b1ab37","2526a840c91d03c804a8f73cc35a9a993f4dcddf12950566c419a8addf52fd39","a544293ad41861129c77aaaea1620b884982378721bed31c60702b3e3d3c1590","9b5869e4d37894571923607dce7c23a324ae2f93820384b99aefe619a7fa3fad","87982fe34bfcb26fd06714e0bb4c3341dfaa66b51e918fcf048554be60d29307","87d809543079ae5770b6cdc1849e7be55dec1a37c3f90ea63a5d5f5a2b3d4c32","3d5d95b4e51ce5b7597c3f2b8da50951bd8152493e3ea27f0b8f7ab32596a526","4ab0bc4c0841cf65f6c78356327337cdea436e1c1d008e8e0a5f5e400aaed39c","10e1dbb3c19c6a3b905434cae98fe0c6d4e68a8d9bcd316175160efd834a2d23","829a3a3525fae23ea0e56a0049b9ba56f9a061315d023940defb00661a74b767","8af9b0cdb301febc64ac05b8acb701d0f1b6f88cc22a4c83929078d04bfca657","594948597aae36cd9fcf30dec7ef1be70bc70ee618f0e33dd8268c12982da7c9","f83a0b46b9d424d338342b509d9e12b467d25f400db62dc57815db33b1b26feb")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("1177fb1b6b4a6ac1cd75c0f0784bb87a3202c70fe748bf5bc7fd0dd0fd41169b","07ee16f72b1dd81e7cf79aa1396f44f3ed29d343dd8fa0c6aecf1bb3d36d4e34","f2503068aa274eb6c73dfd1a31c7e878f84f3fb60f3ae23f001bb143eb6f196f","96a1666152dfe5cc4113b855a059195227f55773d8ad46cc92fe5090010035f1","de05f6f97b475ed6464541665e59252869b5d531c63698a9ad70c3875954c92c","acf98f0c2b3823f9213b220fcd79237037d0d3f087a3faa4f10ea6d147a9f059","7701e4bf5074f0527c0126fff1dbd0e6368ddb7d0131bac1fba72b19511af127","4d365958397af1b7c2c62f62d21b35b948c03dd17f730a58b6145cd003a7922c","39e0199d3d501acc3377af56c4e79ec4c4f8aaa21ac1a449fe8da69c4c267dd7","f8ef5f403474624e61ef0b83adc9e15ea6ca47534f7316c4c43db6f064e21c76","655afdb9fc4ab05875c790c22e505b4eda3492323631ed3c951b4fe60806770a","2b807f42e32684768fa5e514ee0674836f3774ec83e73fc0be0afde34f8ee11c","f30aeb1877ddd30c0d2b79c78bffa7f990df56d37dd78ab0d5c563db02b1ab37","2526a840c91d03c804a8f73cc35a9a993f4dcddf12950566c419a8addf52fd39","a544293ad41861129c77aaaea1620b884982378721bed31c60702b3e3d3c1590","9b5869e4d37894571923607dce7c23a324ae2f93820384b99aefe619a7fa3fad","87982fe34bfcb26fd06714e0bb4c3341dfaa66b51e918fcf048554be60d29307","87d809543079ae5770b6cdc1849e7be55dec1a37c3f90ea63a5d5f5a2b3d4c32","3d5d95b4e51ce5b7597c3f2b8da50951bd8152493e3ea27f0b8f7ab32596a526","4ab0bc4c0841cf65f6c78356327337cdea436e1c1d008e8e0a5f5e400aaed39c","10e1dbb3c19c6a3b905434cae98fe0c6d4e68a8d9bcd316175160efd834a2d23","829a3a3525fae23ea0e56a0049b9ba56f9a061315d023940defb00661a74b767","8af9b0cdb301febc64ac05b8acb701d0f1b6f88cc22a4c83929078d04bfca657","594948597aae36cd9fcf30dec7ef1be70bc70ee618f0e33dd8268c12982da7c9","f83a0b46b9d424d338342b509d9e12b467d25f400db62dc57815db33b1b26feb")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("1177fb1b6b4a6ac1cd75c0f0784bb87a3202c70fe748bf5bc7fd0dd0fd41169b","07ee16f72b1dd81e7cf79aa1396f44f3ed29d343dd8fa0c6aecf1bb3d36d4e34","f2503068aa274eb6c73dfd1a31c7e878f84f3fb60f3ae23f001bb143eb6f196f","96a1666152dfe5cc4113b855a059195227f55773d8ad46cc92fe5090010035f1","de05f6f97b475ed6464541665e59252869b5d531c63698a9ad70c3875954c92c","acf98f0c2b3823f9213b220fcd79237037d0d3f087a3faa4f10ea6d147a9f059","7701e4bf5074f0527c0126fff1dbd0e6368ddb7d0131bac1fba72b19511af127","4d365958397af1b7c2c62f62d21b35b948c03dd17f730a58b6145cd003a7922c","39e0199d3d501acc3377af56c4e79ec4c4f8aaa21ac1a449fe8da69c4c267dd7","f8ef5f403474624e61ef0b83adc9e15ea6ca47534f7316c4c43db6f064e21c76","655afdb9fc4ab05875c790c22e505b4eda3492323631ed3c951b4fe60806770a","2b807f42e32684768fa5e514ee0674836f3774ec83e73fc0be0afde34f8ee11c","f30aeb1877ddd30c0d2b79c78bffa7f990df56d37dd78ab0d5c563db02b1ab37","2526a840c91d03c804a8f73cc35a9a993f4dcddf12950566c419a8addf52fd39","a544293ad41861129c77aaaea1620b884982378721bed31c60702b3e3d3c1590","9b5869e4d37894571923607dce7c23a324ae2f93820384b99aefe619a7fa3fad","87982fe34bfcb26fd06714e0bb4c3341dfaa66b51e918fcf048554be60d29307","87d809543079ae5770b6cdc1849e7be55dec1a37c3f90ea63a5d5f5a2b3d4c32","3d5d95b4e51ce5b7597c3f2b8da50951bd8152493e3ea27f0b8f7ab32596a526","4ab0bc4c0841cf65f6c78356327337cdea436e1c1d008e8e0a5f5e400aaed39c","10e1dbb3c19c6a3b905434cae98fe0c6d4e68a8d9bcd316175160efd834a2d23","829a3a3525fae23ea0e56a0049b9ba56f9a061315d023940defb00661a74b767","8af9b0cdb301febc64ac05b8acb701d0f1b6f88cc22a4c83929078d04bfca657","594948597aae36cd9fcf30dec7ef1be70bc70ee618f0e33dd8268c12982da7c9","f83a0b46b9d424d338342b509d9e12b467d25f400db62dc57815db33b1b26feb")
index=activity AND rg_functionality="Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("1177fb1b6b4a6ac1cd75c0f0784bb87a3202c70fe748bf5bc7fd0dd0fd41169b","07ee16f72b1dd81e7cf79aa1396f44f3ed29d343dd8fa0c6aecf1bb3d36d4e34","f2503068aa274eb6c73dfd1a31c7e878f84f3fb60f3ae23f001bb143eb6f196f","96a1666152dfe5cc4113b855a059195227f55773d8ad46cc92fe5090010035f1","de05f6f97b475ed6464541665e59252869b5d531c63698a9ad70c3875954c92c","acf98f0c2b3823f9213b220fcd79237037d0d3f087a3faa4f10ea6d147a9f059","7701e4bf5074f0527c0126fff1dbd0e6368ddb7d0131bac1fba72b19511af127","4d365958397af1b7c2c62f62d21b35b948c03dd17f730a58b6145cd003a7922c","39e0199d3d501acc3377af56c4e79ec4c4f8aaa21ac1a449fe8da69c4c267dd7","f8ef5f403474624e61ef0b83adc9e15ea6ca47534f7316c4c43db6f064e21c76","655afdb9fc4ab05875c790c22e505b4eda3492323631ed3c951b4fe60806770a","2b807f42e32684768fa5e514ee0674836f3774ec83e73fc0be0afde34f8ee11c","f30aeb1877ddd30c0d2b79c78bffa7f990df56d37dd78ab0d5c563db02b1ab37","2526a840c91d03c804a8f73cc35a9a993f4dcddf12950566c419a8addf52fd39","a544293ad41861129c77aaaea1620b884982378721bed31c60702b3e3d3c1590","9b5869e4d37894571923607dce7c23a324ae2f93820384b99aefe619a7fa3fad","87982fe34bfcb26fd06714e0bb4c3341dfaa66b51e918fcf048554be60d29307","87d809543079ae5770b6cdc1849e7be55dec1a37c3f90ea63a5d5f5a2b3d4c32","3d5d95b4e51ce5b7597c3f2b8da50951bd8152493e3ea27f0b8f7ab32596a526","4ab0bc4c0841cf65f6c78356327337cdea436e1c1d008e8e0a5f5e400aaed39c","10e1dbb3c19c6a3b905434cae98fe0c6d4e68a8d9bcd316175160efd834a2d23","829a3a3525fae23ea0e56a0049b9ba56f9a061315d023940defb00661a74b767","8af9b0cdb301febc64ac05b8acb701d0f1b6f88cc22a4c83929078d04bfca657","594948597aae36cd9fcf30dec7ef1be70bc70ee618f0e33dd8268c12982da7c9","f83a0b46b9d424d338342b509d9e12b467d25f400db62dc57815db33b1b26feb")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("1177fb1b6b4a6ac1cd75c0f0784bb87a3202c70fe748bf5bc7fd0dd0fd41169b","07ee16f72b1dd81e7cf79aa1396f44f3ed29d343dd8fa0c6aecf1bb3d36d4e34","f2503068aa274eb6c73dfd1a31c7e878f84f3fb60f3ae23f001bb143eb6f196f","96a1666152dfe5cc4113b855a059195227f55773d8ad46cc92fe5090010035f1","de05f6f97b475ed6464541665e59252869b5d531c63698a9ad70c3875954c92c","acf98f0c2b3823f9213b220fcd79237037d0d3f087a3faa4f10ea6d147a9f059","7701e4bf5074f0527c0126fff1dbd0e6368ddb7d0131bac1fba72b19511af127","4d365958397af1b7c2c62f62d21b35b948c03dd17f730a58b6145cd003a7922c","39e0199d3d501acc3377af56c4e79ec4c4f8aaa21ac1a449fe8da69c4c267dd7","f8ef5f403474624e61ef0b83adc9e15ea6ca47534f7316c4c43db6f064e21c76","655afdb9fc4ab05875c790c22e505b4eda3492323631ed3c951b4fe60806770a","2b807f42e32684768fa5e514ee0674836f3774ec83e73fc0be0afde34f8ee11c","f30aeb1877ddd30c0d2b79c78bffa7f990df56d37dd78ab0d5c563db02b1ab37","2526a840c91d03c804a8f73cc35a9a993f4dcddf12950566c419a8addf52fd39","a544293ad41861129c77aaaea1620b884982378721bed31c60702b3e3d3c1590","9b5869e4d37894571923607dce7c23a324ae2f93820384b99aefe619a7fa3fad","87982fe34bfcb26fd06714e0bb4c3341dfaa66b51e918fcf048554be60d29307","87d809543079ae5770b6cdc1849e7be55dec1a37c3f90ea63a5d5f5a2b3d4c32","3d5d95b4e51ce5b7597c3f2b8da50951bd8152493e3ea27f0b8f7ab32596a526","4ab0bc4c0841cf65f6c78356327337cdea436e1c1d008e8e0a5f5e400aaed39c","10e1dbb3c19c6a3b905434cae98fe0c6d4e68a8d9bcd316175160efd834a2d23","829a3a3525fae23ea0e56a0049b9ba56f9a061315d023940defb00661a74b767","8af9b0cdb301febc64ac05b8acb701d0f1b6f88cc22a4c83929078d04bfca657","594948597aae36cd9fcf30dec7ef1be70bc70ee618f0e33dd8268c12982da7c9","f83a0b46b9d424d338342b509d9e12b467d25f400db62dc57815db33b1b26feb")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("1177fb1b6b4a6ac1cd75c0f0784bb87a3202c70fe748bf5bc7fd0dd0fd41169b","07ee16f72b1dd81e7cf79aa1396f44f3ed29d343dd8fa0c6aecf1bb3d36d4e34","f2503068aa274eb6c73dfd1a31c7e878f84f3fb60f3ae23f001bb143eb6f196f","96a1666152dfe5cc4113b855a059195227f55773d8ad46cc92fe5090010035f1","de05f6f97b475ed6464541665e59252869b5d531c63698a9ad70c3875954c92c","acf98f0c2b3823f9213b220fcd79237037d0d3f087a3faa4f10ea6d147a9f059","7701e4bf5074f0527c0126fff1dbd0e6368ddb7d0131bac1fba72b19511af127","4d365958397af1b7c2c62f62d21b35b948c03dd17f730a58b6145cd003a7922c","39e0199d3d501acc3377af56c4e79ec4c4f8aaa21ac1a449fe8da69c4c267dd7","f8ef5f403474624e61ef0b83adc9e15ea6ca47534f7316c4c43db6f064e21c76","655afdb9fc4ab05875c790c22e505b4eda3492323631ed3c951b4fe60806770a","2b807f42e32684768fa5e514ee0674836f3774ec83e73fc0be0afde34f8ee11c","f30aeb1877ddd30c0d2b79c78bffa7f990df56d37dd78ab0d5c563db02b1ab37","2526a840c91d03c804a8f73cc35a9a993f4dcddf12950566c419a8addf52fd39","a544293ad41861129c77aaaea1620b884982378721bed31c60702b3e3d3c1590","9b5869e4d37894571923607dce7c23a324ae2f93820384b99aefe619a7fa3fad","87982fe34bfcb26fd06714e0bb4c3341dfaa66b51e918fcf048554be60d29307","87d809543079ae5770b6cdc1849e7be55dec1a37c3f90ea63a5d5f5a2b3d4c32","3d5d95b4e51ce5b7597c3f2b8da50951bd8152493e3ea27f0b8f7ab32596a526","4ab0bc4c0841cf65f6c78356327337cdea436e1c1d008e8e0a5f5e400aaed39c","10e1dbb3c19c6a3b905434cae98fe0c6d4e68a8d9bcd316175160efd834a2d23","829a3a3525fae23ea0e56a0049b9ba56f9a061315d023940defb00661a74b767","8af9b0cdb301febc64ac05b8acb701d0f1b6f88cc22a4c83929078d04bfca657","594948597aae36cd9fcf30dec7ef1be70bc70ee618f0e33dd8268c12982da7c9","f83a0b46b9d424d338342b509d9e12b467d25f400db62dc57815db33b1b26feb")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("1177fb1b6b4a6ac1cd75c0f0784bb87a3202c70fe748bf5bc7fd0dd0fd41169b","07ee16f72b1dd81e7cf79aa1396f44f3ed29d343dd8fa0c6aecf1bb3d36d4e34","f2503068aa274eb6c73dfd1a31c7e878f84f3fb60f3ae23f001bb143eb6f196f","96a1666152dfe5cc4113b855a059195227f55773d8ad46cc92fe5090010035f1","de05f6f97b475ed6464541665e59252869b5d531c63698a9ad70c3875954c92c","acf98f0c2b3823f9213b220fcd79237037d0d3f087a3faa4f10ea6d147a9f059","7701e4bf5074f0527c0126fff1dbd0e6368ddb7d0131bac1fba72b19511af127","4d365958397af1b7c2c62f62d21b35b948c03dd17f730a58b6145cd003a7922c","39e0199d3d501acc3377af56c4e79ec4c4f8aaa21ac1a449fe8da69c4c267dd7","f8ef5f403474624e61ef0b83adc9e15ea6ca47534f7316c4c43db6f064e21c76","655afdb9fc4ab05875c790c22e505b4eda3492323631ed3c951b4fe60806770a","2b807f42e32684768fa5e514ee0674836f3774ec83e73fc0be0afde34f8ee11c","f30aeb1877ddd30c0d2b79c78bffa7f990df56d37dd78ab0d5c563db02b1ab37","2526a840c91d03c804a8f73cc35a9a993f4dcddf12950566c419a8addf52fd39","a544293ad41861129c77aaaea1620b884982378721bed31c60702b3e3d3c1590","9b5869e4d37894571923607dce7c23a324ae2f93820384b99aefe619a7fa3fad","87982fe34bfcb26fd06714e0bb4c3341dfaa66b51e918fcf048554be60d29307","87d809543079ae5770b6cdc1849e7be55dec1a37c3f90ea63a5d5f5a2b3d4c32","3d5d95b4e51ce5b7597c3f2b8da50951bd8152493e3ea27f0b8f7ab32596a526","4ab0bc4c0841cf65f6c78356327337cdea436e1c1d008e8e0a5f5e400aaed39c","10e1dbb3c19c6a3b905434cae98fe0c6d4e68a8d9bcd316175160efd834a2d23","829a3a3525fae23ea0e56a0049b9ba56f9a061315d023940defb00661a74b767","8af9b0cdb301febc64ac05b8acb701d0f1b6f88cc22a4c83929078d04bfca657","594948597aae36cd9fcf30dec7ef1be70bc70ee618f0e33dd8268c12982da7c9","f83a0b46b9d424d338342b509d9e12b467d25f400db62dc57815db33b1b26feb")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("1177fb1b6b4a6ac1cd75c0f0784bb87a3202c70fe748bf5bc7fd0dd0fd41169b","07ee16f72b1dd81e7cf79aa1396f44f3ed29d343dd8fa0c6aecf1bb3d36d4e34","f2503068aa274eb6c73dfd1a31c7e878f84f3fb60f3ae23f001bb143eb6f196f","96a1666152dfe5cc4113b855a059195227f55773d8ad46cc92fe5090010035f1","de05f6f97b475ed6464541665e59252869b5d531c63698a9ad70c3875954c92c","acf98f0c2b3823f9213b220fcd79237037d0d3f087a3faa4f10ea6d147a9f059","7701e4bf5074f0527c0126fff1dbd0e6368ddb7d0131bac1fba72b19511af127","4d365958397af1b7c2c62f62d21b35b948c03dd17f730a58b6145cd003a7922c","39e0199d3d501acc3377af56c4e79ec4c4f8aaa21ac1a449fe8da69c4c267dd7","f8ef5f403474624e61ef0b83adc9e15ea6ca47534f7316c4c43db6f064e21c76","655afdb9fc4ab05875c790c22e505b4eda3492323631ed3c951b4fe60806770a","2b807f42e32684768fa5e514ee0674836f3774ec83e73fc0be0afde34f8ee11c","f30aeb1877ddd30c0d2b79c78bffa7f990df56d37dd78ab0d5c563db02b1ab37","2526a840c91d03c804a8f73cc35a9a993f4dcddf12950566c419a8addf52fd39","a544293ad41861129c77aaaea1620b884982378721bed31c60702b3e3d3c1590","9b5869e4d37894571923607dce7c23a324ae2f93820384b99aefe619a7fa3fad","87982fe34bfcb26fd06714e0bb4c3341dfaa66b51e918fcf048554be60d29307","87d809543079ae5770b6cdc1849e7be55dec1a37c3f90ea63a5d5f5a2b3d4c32","3d5d95b4e51ce5b7597c3f2b8da50951bd8152493e3ea27f0b8f7ab32596a526","4ab0bc4c0841cf65f6c78356327337cdea436e1c1d008e8e0a5f5e400aaed39c","10e1dbb3c19c6a3b905434cae98fe0c6d4e68a8d9bcd316175160efd834a2d23","829a3a3525fae23ea0e56a0049b9ba56f9a061315d023940defb00661a74b767","8af9b0cdb301febc64ac05b8acb701d0f1b6f88cc22a4c83929078d04bfca657","594948597aae36cd9fcf30dec7ef1be70bc70ee618f0e33dd8268c12982da7c9","f83a0b46b9d424d338342b509d9e12b467d25f400db62dc57815db33b1b26feb")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("1177fb1b6b4a6ac1cd75c0f0784bb87a3202c70fe748bf5bc7fd0dd0fd41169b","07ee16f72b1dd81e7cf79aa1396f44f3ed29d343dd8fa0c6aecf1bb3d36d4e34","f2503068aa274eb6c73dfd1a31c7e878f84f3fb60f3ae23f001bb143eb6f196f","96a1666152dfe5cc4113b855a059195227f55773d8ad46cc92fe5090010035f1","de05f6f97b475ed6464541665e59252869b5d531c63698a9ad70c3875954c92c","acf98f0c2b3823f9213b220fcd79237037d0d3f087a3faa4f10ea6d147a9f059","7701e4bf5074f0527c0126fff1dbd0e6368ddb7d0131bac1fba72b19511af127","4d365958397af1b7c2c62f62d21b35b948c03dd17f730a58b6145cd003a7922c","39e0199d3d501acc3377af56c4e79ec4c4f8aaa21ac1a449fe8da69c4c267dd7","f8ef5f403474624e61ef0b83adc9e15ea6ca47534f7316c4c43db6f064e21c76","655afdb9fc4ab05875c790c22e505b4eda3492323631ed3c951b4fe60806770a","2b807f42e32684768fa5e514ee0674836f3774ec83e73fc0be0afde34f8ee11c","f30aeb1877ddd30c0d2b79c78bffa7f990df56d37dd78ab0d5c563db02b1ab37","2526a840c91d03c804a8f73cc35a9a993f4dcddf12950566c419a8addf52fd39","a544293ad41861129c77aaaea1620b884982378721bed31c60702b3e3d3c1590","9b5869e4d37894571923607dce7c23a324ae2f93820384b99aefe619a7fa3fad","87982fe34bfcb26fd06714e0bb4c3341dfaa66b51e918fcf048554be60d29307","87d809543079ae5770b6cdc1849e7be55dec1a37c3f90ea63a5d5f5a2b3d4c32","3d5d95b4e51ce5b7597c3f2b8da50951bd8152493e3ea27f0b8f7ab32596a526","4ab0bc4c0841cf65f6c78356327337cdea436e1c1d008e8e0a5f5e400aaed39c","10e1dbb3c19c6a3b905434cae98fe0c6d4e68a8d9bcd316175160efd834a2d23","829a3a3525fae23ea0e56a0049b9ba56f9a061315d023940defb00661a74b767","8af9b0cdb301febc64ac05b8acb701d0f1b6f88cc22a4c83929078d04bfca657","594948597aae36cd9fcf30dec7ef1be70bc70ee618f0e33dd8268c12982da7c9","f83a0b46b9d424d338342b509d9e12b467d25f400db62dc57815db33b1b26feb")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("1177fb1b6b4a6ac1cd75c0f0784bb87a3202c70fe748bf5bc7fd0dd0fd41169b","07ee16f72b1dd81e7cf79aa1396f44f3ed29d343dd8fa0c6aecf1bb3d36d4e34","f2503068aa274eb6c73dfd1a31c7e878f84f3fb60f3ae23f001bb143eb6f196f","96a1666152dfe5cc4113b855a059195227f55773d8ad46cc92fe5090010035f1","de05f6f97b475ed6464541665e59252869b5d531c63698a9ad70c3875954c92c","acf98f0c2b3823f9213b220fcd79237037d0d3f087a3faa4f10ea6d147a9f059","7701e4bf5074f0527c0126fff1dbd0e6368ddb7d0131bac1fba72b19511af127","4d365958397af1b7c2c62f62d21b35b948c03dd17f730a58b6145cd003a7922c","39e0199d3d501acc3377af56c4e79ec4c4f8aaa21ac1a449fe8da69c4c267dd7","f8ef5f403474624e61ef0b83adc9e15ea6ca47534f7316c4c43db6f064e21c76","655afdb9fc4ab05875c790c22e505b4eda3492323631ed3c951b4fe60806770a","2b807f42e32684768fa5e514ee0674836f3774ec83e73fc0be0afde34f8ee11c","f30aeb1877ddd30c0d2b79c78bffa7f990df56d37dd78ab0d5c563db02b1ab37","2526a840c91d03c804a8f73cc35a9a993f4dcddf12950566c419a8addf52fd39","a544293ad41861129c77aaaea1620b884982378721bed31c60702b3e3d3c1590","9b5869e4d37894571923607dce7c23a324ae2f93820384b99aefe619a7fa3fad","87982fe34bfcb26fd06714e0bb4c3341dfaa66b51e918fcf048554be60d29307","87d809543079ae5770b6cdc1849e7be55dec1a37c3f90ea63a5d5f5a2b3d4c32","3d5d95b4e51ce5b7597c3f2b8da50951bd8152493e3ea27f0b8f7ab32596a526","4ab0bc4c0841cf65f6c78356327337cdea436e1c1d008e8e0a5f5e400aaed39c","10e1dbb3c19c6a3b905434cae98fe0c6d4e68a8d9bcd316175160efd834a2d23","829a3a3525fae23ea0e56a0049b9ba56f9a061315d023940defb00661a74b767","8af9b0cdb301febc64ac05b8acb701d0f1b6f88cc22a4c83929078d04bfca657","594948597aae36cd9fcf30dec7ef1be70bc70ee618f0e33dd8268c12982da7c9","f83a0b46b9d424d338342b509d9e12b467d25f400db62dc57815db33b1b26feb")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("1177fb1b6b4a6ac1cd75c0f0784bb87a3202c70fe748bf5bc7fd0dd0fd41169b","07ee16f72b1dd81e7cf79aa1396f44f3ed29d343dd8fa0c6aecf1bb3d36d4e34","f2503068aa274eb6c73dfd1a31c7e878f84f3fb60f3ae23f001bb143eb6f196f","96a1666152dfe5cc4113b855a059195227f55773d8ad46cc92fe5090010035f1","de05f6f97b475ed6464541665e59252869b5d531c63698a9ad70c3875954c92c","acf98f0c2b3823f9213b220fcd79237037d0d3f087a3faa4f10ea6d147a9f059","7701e4bf5074f0527c0126fff1dbd0e6368ddb7d0131bac1fba72b19511af127","4d365958397af1b7c2c62f62d21b35b948c03dd17f730a58b6145cd003a7922c","39e0199d3d501acc3377af56c4e79ec4c4f8aaa21ac1a449fe8da69c4c267dd7","f8ef5f403474624e61ef0b83adc9e15ea6ca47534f7316c4c43db6f064e21c76","655afdb9fc4ab05875c790c22e505b4eda3492323631ed3c951b4fe60806770a","2b807f42e32684768fa5e514ee0674836f3774ec83e73fc0be0afde34f8ee11c","f30aeb1877ddd30c0d2b79c78bffa7f990df56d37dd78ab0d5c563db02b1ab37","2526a840c91d03c804a8f73cc35a9a993f4dcddf12950566c419a8addf52fd39","a544293ad41861129c77aaaea1620b884982378721bed31c60702b3e3d3c1590","9b5869e4d37894571923607dce7c23a324ae2f93820384b99aefe619a7fa3fad","87982fe34bfcb26fd06714e0bb4c3341dfaa66b51e918fcf048554be60d29307","87d809543079ae5770b6cdc1849e7be55dec1a37c3f90ea63a5d5f5a2b3d4c32","3d5d95b4e51ce5b7597c3f2b8da50951bd8152493e3ea27f0b8f7ab32596a526","4ab0bc4c0841cf65f6c78356327337cdea436e1c1d008e8e0a5f5e400aaed39c","10e1dbb3c19c6a3b905434cae98fe0c6d4e68a8d9bcd316175160efd834a2d23","829a3a3525fae23ea0e56a0049b9ba56f9a061315d023940defb00661a74b767","8af9b0cdb301febc64ac05b8acb701d0f1b6f88cc22a4c83929078d04bfca657","594948597aae36cd9fcf30dec7ef1be70bc70ee618f0e33dd8268c12982da7c9","f83a0b46b9d424d338342b509d9e12b467d25f400db62dc57815db33b1b26feb")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring64 NOT NULL AND customstring64 IN ("1177fb1b6b4a6ac1cd75c0f0784bb87a3202c70fe748bf5bc7fd0dd0fd41169b","07ee16f72b1dd81e7cf79aa1396f44f3ed29d343dd8fa0c6aecf1bb3d36d4e34","f2503068aa274eb6c73dfd1a31c7e878f84f3fb60f3ae23f001bb143eb6f196f","96a1666152dfe5cc4113b855a059195227f55773d8ad46cc92fe5090010035f1","de05f6f97b475ed6464541665e59252869b5d531c63698a9ad70c3875954c92c","acf98f0c2b3823f9213b220fcd79237037d0d3f087a3faa4f10ea6d147a9f059","7701e4bf5074f0527c0126fff1dbd0e6368ddb7d0131bac1fba72b19511af127","4d365958397af1b7c2c62f62d21b35b948c03dd17f730a58b6145cd003a7922c","39e0199d3d501acc3377af56c4e79ec4c4f8aaa21ac1a449fe8da69c4c267dd7","f8ef5f403474624e61ef0b83adc9e15ea6ca47534f7316c4c43db6f064e21c76","655afdb9fc4ab05875c790c22e505b4eda3492323631ed3c951b4fe60806770a","2b807f42e32684768fa5e514ee0674836f3774ec83e73fc0be0afde34f8ee11c","f30aeb1877ddd30c0d2b79c78bffa7f990df56d37dd78ab0d5c563db02b1ab37","2526a840c91d03c804a8f73cc35a9a993f4dcddf12950566c419a8addf52fd39","a544293ad41861129c77aaaea1620b884982378721bed31c60702b3e3d3c1590","9b5869e4d37894571923607dce7c23a324ae2f93820384b99aefe619a7fa3fad","87982fe34bfcb26fd06714e0bb4c3341dfaa66b51e918fcf048554be60d29307","87d809543079ae5770b6cdc1849e7be55dec1a37c3f90ea63a5d5f5a2b3d4c32","3d5d95b4e51ce5b7597c3f2b8da50951bd8152493e3ea27f0b8f7ab32596a526","4ab0bc4c0841cf65f6c78356327337cdea436e1c1d008e8e0a5f5e400aaed39c","10e1dbb3c19c6a3b905434cae98fe0c6d4e68a8d9bcd316175160efd834a2d23","829a3a3525fae23ea0e56a0049b9ba56f9a061315d023940defb00661a74b767","8af9b0cdb301febc64ac05b8acb701d0f1b6f88cc22a4c83929078d04bfca657","594948597aae36cd9fcf30dec7ef1be70bc70ee618f0e33dd8268c12982da7c9","f83a0b46b9d424d338342b509d9e12b467d25f400db62dc57815db33b1b26feb")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("1177fb1b6b4a6ac1cd75c0f0784bb87a3202c70fe748bf5bc7fd0dd0fd41169b","07ee16f72b1dd81e7cf79aa1396f44f3ed29d343dd8fa0c6aecf1bb3d36d4e34","f2503068aa274eb6c73dfd1a31c7e878f84f3fb60f3ae23f001bb143eb6f196f","96a1666152dfe5cc4113b855a059195227f55773d8ad46cc92fe5090010035f1","de05f6f97b475ed6464541665e59252869b5d531c63698a9ad70c3875954c92c","acf98f0c2b3823f9213b220fcd79237037d0d3f087a3faa4f10ea6d147a9f059","7701e4bf5074f0527c0126fff1dbd0e6368ddb7d0131bac1fba72b19511af127","4d365958397af1b7c2c62f62d21b35b948c03dd17f730a58b6145cd003a7922c","39e0199d3d501acc3377af56c4e79ec4c4f8aaa21ac1a449fe8da69c4c267dd7","f8ef5f403474624e61ef0b83adc9e15ea6ca47534f7316c4c43db6f064e21c76","655afdb9fc4ab05875c790c22e505b4eda3492323631ed3c951b4fe60806770a","2b807f42e32684768fa5e514ee0674836f3774ec83e73fc0be0afde34f8ee11c","f30aeb1877ddd30c0d2b79c78bffa7f990df56d37dd78ab0d5c563db02b1ab37","2526a840c91d03c804a8f73cc35a9a993f4dcddf12950566c419a8addf52fd39","a544293ad41861129c77aaaea1620b884982378721bed31c60702b3e3d3c1590","9b5869e4d37894571923607dce7c23a324ae2f93820384b99aefe619a7fa3fad","87982fe34bfcb26fd06714e0bb4c3341dfaa66b51e918fcf048554be60d29307","87d809543079ae5770b6cdc1849e7be55dec1a37c3f90ea63a5d5f5a2b3d4c32","3d5d95b4e51ce5b7597c3f2b8da50951bd8152493e3ea27f0b8f7ab32596a526","4ab0bc4c0841cf65f6c78356327337cdea436e1c1d008e8e0a5f5e400aaed39c","10e1dbb3c19c6a3b905434cae98fe0c6d4e68a8d9bcd316175160efd834a2d23","829a3a3525fae23ea0e56a0049b9ba56f9a061315d023940defb00661a74b767","8af9b0cdb301febc64ac05b8acb701d0f1b6f88cc22a4c83929078d04bfca657","594948597aae36cd9fcf30dec7ef1be70bc70ee618f0e33dd8268c12982da7c9","f83a0b46b9d424d338342b509d9e12b467d25f400db62dc57815db33b1b26feb")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("1177fb1b6b4a6ac1cd75c0f0784bb87a3202c70fe748bf5bc7fd0dd0fd41169b","07ee16f72b1dd81e7cf79aa1396f44f3ed29d343dd8fa0c6aecf1bb3d36d4e34","f2503068aa274eb6c73dfd1a31c7e878f84f3fb60f3ae23f001bb143eb6f196f","96a1666152dfe5cc4113b855a059195227f55773d8ad46cc92fe5090010035f1","de05f6f97b475ed6464541665e59252869b5d531c63698a9ad70c3875954c92c","acf98f0c2b3823f9213b220fcd79237037d0d3f087a3faa4f10ea6d147a9f059","7701e4bf5074f0527c0126fff1dbd0e6368ddb7d0131bac1fba72b19511af127","4d365958397af1b7c2c62f62d21b35b948c03dd17f730a58b6145cd003a7922c","39e0199d3d501acc3377af56c4e79ec4c4f8aaa21ac1a449fe8da69c4c267dd7","f8ef5f403474624e61ef0b83adc9e15ea6ca47534f7316c4c43db6f064e21c76","655afdb9fc4ab05875c790c22e505b4eda3492323631ed3c951b4fe60806770a","2b807f42e32684768fa5e514ee0674836f3774ec83e73fc0be0afde34f8ee11c","f30aeb1877ddd30c0d2b79c78bffa7f990df56d37dd78ab0d5c563db02b1ab37","2526a840c91d03c804a8f73cc35a9a993f4dcddf12950566c419a8addf52fd39","a544293ad41861129c77aaaea1620b884982378721bed31c60702b3e3d3c1590","9b5869e4d37894571923607dce7c23a324ae2f93820384b99aefe619a7fa3fad","87982fe34bfcb26fd06714e0bb4c3341dfaa66b51e918fcf048554be60d29307","87d809543079ae5770b6cdc1849e7be55dec1a37c3f90ea63a5d5f5a2b3d4c32","3d5d95b4e51ce5b7597c3f2b8da50951bd8152493e3ea27f0b8f7ab32596a526","4ab0bc4c0841cf65f6c78356327337cdea436e1c1d008e8e0a5f5e400aaed39c","10e1dbb3c19c6a3b905434cae98fe0c6d4e68a8d9bcd316175160efd834a2d23","829a3a3525fae23ea0e56a0049b9ba56f9a061315d023940defb00661a74b767","8af9b0cdb301febc64ac05b8acb701d0f1b6f88cc22a4c83929078d04bfca657","594948597aae36cd9fcf30dec7ef1be70bc70ee618f0e33dd8268c12982da7c9","f83a0b46b9d424d338342b509d9e12b467d25f400db62dc57815db33b1b26feb")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("1177fb1b6b4a6ac1cd75c0f0784bb87a3202c70fe748bf5bc7fd0dd0fd41169b","07ee16f72b1dd81e7cf79aa1396f44f3ed29d343dd8fa0c6aecf1bb3d36d4e34","f2503068aa274eb6c73dfd1a31c7e878f84f3fb60f3ae23f001bb143eb6f196f","96a1666152dfe5cc4113b855a059195227f55773d8ad46cc92fe5090010035f1","de05f6f97b475ed6464541665e59252869b5d531c63698a9ad70c3875954c92c","acf98f0c2b3823f9213b220fcd79237037d0d3f087a3faa4f10ea6d147a9f059","7701e4bf5074f0527c0126fff1dbd0e6368ddb7d0131bac1fba72b19511af127","4d365958397af1b7c2c62f62d21b35b948c03dd17f730a58b6145cd003a7922c","39e0199d3d501acc3377af56c4e79ec4c4f8aaa21ac1a449fe8da69c4c267dd7","f8ef5f403474624e61ef0b83adc9e15ea6ca47534f7316c4c43db6f064e21c76","655afdb9fc4ab05875c790c22e505b4eda3492323631ed3c951b4fe60806770a","2b807f42e32684768fa5e514ee0674836f3774ec83e73fc0be0afde34f8ee11c","f30aeb1877ddd30c0d2b79c78bffa7f990df56d37dd78ab0d5c563db02b1ab37","2526a840c91d03c804a8f73cc35a9a993f4dcddf12950566c419a8addf52fd39","a544293ad41861129c77aaaea1620b884982378721bed31c60702b3e3d3c1590","9b5869e4d37894571923607dce7c23a324ae2f93820384b99aefe619a7fa3fad","87982fe34bfcb26fd06714e0bb4c3341dfaa66b51e918fcf048554be60d29307","87d809543079ae5770b6cdc1849e7be55dec1a37c3f90ea63a5d5f5a2b3d4c32","3d5d95b4e51ce5b7597c3f2b8da50951bd8152493e3ea27f0b8f7ab32596a526","4ab0bc4c0841cf65f6c78356327337cdea436e1c1d008e8e0a5f5e400aaed39c","10e1dbb3c19c6a3b905434cae98fe0c6d4e68a8d9bcd316175160efd834a2d23","829a3a3525fae23ea0e56a0049b9ba56f9a061315d023940defb00661a74b767","8af9b0cdb301febc64ac05b8acb701d0f1b6f88cc22a4c83929078d04bfca657","594948597aae36cd9fcf30dec7ef1be70bc70ee618f0e33dd8268c12982da7c9","f83a0b46b9d424d338342b509d9e12b467d25f400db62dc57815db33b1b26feb")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring64 NOT NULL AND customstring64 IN ("1177fb1b6b4a6ac1cd75c0f0784bb87a3202c70fe748bf5bc7fd0dd0fd41169b","07ee16f72b1dd81e7cf79aa1396f44f3ed29d343dd8fa0c6aecf1bb3d36d4e34","f2503068aa274eb6c73dfd1a31c7e878f84f3fb60f3ae23f001bb143eb6f196f","96a1666152dfe5cc4113b855a059195227f55773d8ad46cc92fe5090010035f1","de05f6f97b475ed6464541665e59252869b5d531c63698a9ad70c3875954c92c","acf98f0c2b3823f9213b220fcd79237037d0d3f087a3faa4f10ea6d147a9f059","7701e4bf5074f0527c0126fff1dbd0e6368ddb7d0131bac1fba72b19511af127","4d365958397af1b7c2c62f62d21b35b948c03dd17f730a58b6145cd003a7922c","39e0199d3d501acc3377af56c4e79ec4c4f8aaa21ac1a449fe8da69c4c267dd7","f8ef5f403474624e61ef0b83adc9e15ea6ca47534f7316c4c43db6f064e21c76","655afdb9fc4ab05875c790c22e505b4eda3492323631ed3c951b4fe60806770a","2b807f42e32684768fa5e514ee0674836f3774ec83e73fc0be0afde34f8ee11c","f30aeb1877ddd30c0d2b79c78bffa7f990df56d37dd78ab0d5c563db02b1ab37","2526a840c91d03c804a8f73cc35a9a993f4dcddf12950566c419a8addf52fd39","a544293ad41861129c77aaaea1620b884982378721bed31c60702b3e3d3c1590","9b5869e4d37894571923607dce7c23a324ae2f93820384b99aefe619a7fa3fad","87982fe34bfcb26fd06714e0bb4c3341dfaa66b51e918fcf048554be60d29307","87d809543079ae5770b6cdc1849e7be55dec1a37c3f90ea63a5d5f5a2b3d4c32","3d5d95b4e51ce5b7597c3f2b8da50951bd8152493e3ea27f0b8f7ab32596a526","4ab0bc4c0841cf65f6c78356327337cdea436e1c1d008e8e0a5f5e400aaed39c","10e1dbb3c19c6a3b905434cae98fe0c6d4e68a8d9bcd316175160efd834a2d23","829a3a3525fae23ea0e56a0049b9ba56f9a061315d023940defb00661a74b767","8af9b0cdb301febc64ac05b8acb701d0f1b6f88cc22a4c83929078d04bfca657","594948597aae36cd9fcf30dec7ef1be70bc70ee618f0e33dd8268c12982da7c9","f83a0b46b9d424d338342b509d9e12b467d25f400db62dc57815db33b1b26feb")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("1177fb1b6b4a6ac1cd75c0f0784bb87a3202c70fe748bf5bc7fd0dd0fd41169b","07ee16f72b1dd81e7cf79aa1396f44f3ed29d343dd8fa0c6aecf1bb3d36d4e34","f2503068aa274eb6c73dfd1a31c7e878f84f3fb60f3ae23f001bb143eb6f196f","96a1666152dfe5cc4113b855a059195227f55773d8ad46cc92fe5090010035f1","de05f6f97b475ed6464541665e59252869b5d531c63698a9ad70c3875954c92c","acf98f0c2b3823f9213b220fcd79237037d0d3f087a3faa4f10ea6d147a9f059","7701e4bf5074f0527c0126fff1dbd0e6368ddb7d0131bac1fba72b19511af127","4d365958397af1b7c2c62f62d21b35b948c03dd17f730a58b6145cd003a7922c","39e0199d3d501acc3377af56c4e79ec4c4f8aaa21ac1a449fe8da69c4c267dd7","f8ef5f403474624e61ef0b83adc9e15ea6ca47534f7316c4c43db6f064e21c76","655afdb9fc4ab05875c790c22e505b4eda3492323631ed3c951b4fe60806770a","2b807f42e32684768fa5e514ee0674836f3774ec83e73fc0be0afde34f8ee11c","f30aeb1877ddd30c0d2b79c78bffa7f990df56d37dd78ab0d5c563db02b1ab37","2526a840c91d03c804a8f73cc35a9a993f4dcddf12950566c419a8addf52fd39","a544293ad41861129c77aaaea1620b884982378721bed31c60702b3e3d3c1590","9b5869e4d37894571923607dce7c23a324ae2f93820384b99aefe619a7fa3fad","87982fe34bfcb26fd06714e0bb4c3341dfaa66b51e918fcf048554be60d29307","87d809543079ae5770b6cdc1849e7be55dec1a37c3f90ea63a5d5f5a2b3d4c32","3d5d95b4e51ce5b7597c3f2b8da50951bd8152493e3ea27f0b8f7ab32596a526","4ab0bc4c0841cf65f6c78356327337cdea436e1c1d008e8e0a5f5e400aaed39c","10e1dbb3c19c6a3b905434cae98fe0c6d4e68a8d9bcd316175160efd834a2d23","829a3a3525fae23ea0e56a0049b9ba56f9a061315d023940defb00661a74b767","8af9b0cdb301febc64ac05b8acb701d0f1b6f88cc22a4c83929078d04bfca657","594948597aae36cd9fcf30dec7ef1be70bc70ee618f0e33dd8268c12982da7c9","f83a0b46b9d424d338342b509d9e12b467d25f400db62dc57815db33b1b26feb")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("1177fb1b6b4a6ac1cd75c0f0784bb87a3202c70fe748bf5bc7fd0dd0fd41169b","07ee16f72b1dd81e7cf79aa1396f44f3ed29d343dd8fa0c6aecf1bb3d36d4e34","f2503068aa274eb6c73dfd1a31c7e878f84f3fb60f3ae23f001bb143eb6f196f","96a1666152dfe5cc4113b855a059195227f55773d8ad46cc92fe5090010035f1","de05f6f97b475ed6464541665e59252869b5d531c63698a9ad70c3875954c92c","acf98f0c2b3823f9213b220fcd79237037d0d3f087a3faa4f10ea6d147a9f059","7701e4bf5074f0527c0126fff1dbd0e6368ddb7d0131bac1fba72b19511af127","4d365958397af1b7c2c62f62d21b35b948c03dd17f730a58b6145cd003a7922c","39e0199d3d501acc3377af56c4e79ec4c4f8aaa21ac1a449fe8da69c4c267dd7","f8ef5f403474624e61ef0b83adc9e15ea6ca47534f7316c4c43db6f064e21c76","655afdb9fc4ab05875c790c22e505b4eda3492323631ed3c951b4fe60806770a","2b807f42e32684768fa5e514ee0674836f3774ec83e73fc0be0afde34f8ee11c","f30aeb1877ddd30c0d2b79c78bffa7f990df56d37dd78ab0d5c563db02b1ab37","2526a840c91d03c804a8f73cc35a9a993f4dcddf12950566c419a8addf52fd39","a544293ad41861129c77aaaea1620b884982378721bed31c60702b3e3d3c1590","9b5869e4d37894571923607dce7c23a324ae2f93820384b99aefe619a7fa3fad","87982fe34bfcb26fd06714e0bb4c3341dfaa66b51e918fcf048554be60d29307","87d809543079ae5770b6cdc1849e7be55dec1a37c3f90ea63a5d5f5a2b3d4c32","3d5d95b4e51ce5b7597c3f2b8da50951bd8152493e3ea27f0b8f7ab32596a526","4ab0bc4c0841cf65f6c78356327337cdea436e1c1d008e8e0a5f5e400aaed39c","10e1dbb3c19c6a3b905434cae98fe0c6d4e68a8d9bcd316175160efd834a2d23","829a3a3525fae23ea0e56a0049b9ba56f9a061315d023940defb00661a74b767","8af9b0cdb301febc64ac05b8acb701d0f1b6f88cc22a4c83929078d04bfca657","594948597aae36cd9fcf30dec7ef1be70bc70ee618f0e33dd8268c12982da7c9","f83a0b46b9d424d338342b509d9e12b467d25f400db62dc57815db33b1b26feb")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("1177fb1b6b4a6ac1cd75c0f0784bb87a3202c70fe748bf5bc7fd0dd0fd41169b","07ee16f72b1dd81e7cf79aa1396f44f3ed29d343dd8fa0c6aecf1bb3d36d4e34","f2503068aa274eb6c73dfd1a31c7e878f84f3fb60f3ae23f001bb143eb6f196f","96a1666152dfe5cc4113b855a059195227f55773d8ad46cc92fe5090010035f1","de05f6f97b475ed6464541665e59252869b5d531c63698a9ad70c3875954c92c","acf98f0c2b3823f9213b220fcd79237037d0d3f087a3faa4f10ea6d147a9f059","7701e4bf5074f0527c0126fff1dbd0e6368ddb7d0131bac1fba72b19511af127","4d365958397af1b7c2c62f62d21b35b948c03dd17f730a58b6145cd003a7922c","39e0199d3d501acc3377af56c4e79ec4c4f8aaa21ac1a449fe8da69c4c267dd7","f8ef5f403474624e61ef0b83adc9e15ea6ca47534f7316c4c43db6f064e21c76","655afdb9fc4ab05875c790c22e505b4eda3492323631ed3c951b4fe60806770a","2b807f42e32684768fa5e514ee0674836f3774ec83e73fc0be0afde34f8ee11c","f30aeb1877ddd30c0d2b79c78bffa7f990df56d37dd78ab0d5c563db02b1ab37","2526a840c91d03c804a8f73cc35a9a993f4dcddf12950566c419a8addf52fd39","a544293ad41861129c77aaaea1620b884982378721bed31c60702b3e3d3c1590","9b5869e4d37894571923607dce7c23a324ae2f93820384b99aefe619a7fa3fad","87982fe34bfcb26fd06714e0bb4c3341dfaa66b51e918fcf048554be60d29307","87d809543079ae5770b6cdc1849e7be55dec1a37c3f90ea63a5d5f5a2b3d4c32","3d5d95b4e51ce5b7597c3f2b8da50951bd8152493e3ea27f0b8f7ab32596a526","4ab0bc4c0841cf65f6c78356327337cdea436e1c1d008e8e0a5f5e400aaed39c","10e1dbb3c19c6a3b905434cae98fe0c6d4e68a8d9bcd316175160efd834a2d23","829a3a3525fae23ea0e56a0049b9ba56f9a061315d023940defb00661a74b767","8af9b0cdb301febc64ac05b8acb701d0f1b6f88cc22a4c83929078d04bfca657","594948597aae36cd9fcf30dec7ef1be70bc70ee618f0e33dd8268c12982da7c9","f83a0b46b9d424d338342b509d9e12b467d25f400db62dc57815db33b1b26feb")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring64 NOT NULL AND customstring64 IN ("1177fb1b6b4a6ac1cd75c0f0784bb87a3202c70fe748bf5bc7fd0dd0fd41169b","07ee16f72b1dd81e7cf79aa1396f44f3ed29d343dd8fa0c6aecf1bb3d36d4e34","f2503068aa274eb6c73dfd1a31c7e878f84f3fb60f3ae23f001bb143eb6f196f","96a1666152dfe5cc4113b855a059195227f55773d8ad46cc92fe5090010035f1","de05f6f97b475ed6464541665e59252869b5d531c63698a9ad70c3875954c92c","acf98f0c2b3823f9213b220fcd79237037d0d3f087a3faa4f10ea6d147a9f059","7701e4bf5074f0527c0126fff1dbd0e6368ddb7d0131bac1fba72b19511af127","4d365958397af1b7c2c62f62d21b35b948c03dd17f730a58b6145cd003a7922c","39e0199d3d501acc3377af56c4e79ec4c4f8aaa21ac1a449fe8da69c4c267dd7","f8ef5f403474624e61ef0b83adc9e15ea6ca47534f7316c4c43db6f064e21c76","655afdb9fc4ab05875c790c22e505b4eda3492323631ed3c951b4fe60806770a","2b807f42e32684768fa5e514ee0674836f3774ec83e73fc0be0afde34f8ee11c","f30aeb1877ddd30c0d2b79c78bffa7f990df56d37dd78ab0d5c563db02b1ab37","2526a840c91d03c804a8f73cc35a9a993f4dcddf12950566c419a8addf52fd39","a544293ad41861129c77aaaea1620b884982378721bed31c60702b3e3d3c1590","9b5869e4d37894571923607dce7c23a324ae2f93820384b99aefe619a7fa3fad","87982fe34bfcb26fd06714e0bb4c3341dfaa66b51e918fcf048554be60d29307","87d809543079ae5770b6cdc1849e7be55dec1a37c3f90ea63a5d5f5a2b3d4c32","3d5d95b4e51ce5b7597c3f2b8da50951bd8152493e3ea27f0b8f7ab32596a526","4ab0bc4c0841cf65f6c78356327337cdea436e1c1d008e8e0a5f5e400aaed39c","10e1dbb3c19c6a3b905434cae98fe0c6d4e68a8d9bcd316175160efd834a2d23","829a3a3525fae23ea0e56a0049b9ba56f9a061315d023940defb00661a74b767","8af9b0cdb301febc64ac05b8acb701d0f1b6f88cc22a4c83929078d04bfca657","594948597aae36cd9fcf30dec7ef1be70bc70ee618f0e33dd8268c12982da7c9","f83a0b46b9d424d338342b509d9e12b467d25f400db62dc57815db33b1b26feb")
index=activity AND rg_functionality="Endpoint Management Systems" AND requesturl NOT NULL AND requesturl IN ("https://borcano.org/connect")
index=activity AND rg_functionality="Endpoint Management Systems" AND Message NOT NULL AND Message IN ("https://borcano.org/connect")
index=activity AND rg_functionality="Endpoint Management Systems" AND Requestcontext NOT NULL AND Requestcontext IN ("https://borcano.org/connect")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("https://borcano.org/connect")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND requesturl NOT NULL AND requesturl IN ("https://borcano.org/connect")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND Message NOT NULL AND Message IN ("https://borcano.org/connect")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND Requestcontext NOT NULL AND Requestcontext IN ("https://borcano.org/connect")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("https://borcano.org/connect")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND requesturl NOT NULL AND requesturl IN ("https://borcano.org/connect")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND Message NOT NULL AND Message IN ("https://borcano.org/connect")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND Requestcontext NOT NULL AND Requestcontext IN ("https://borcano.org/connect")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("https://borcano.org/connect")
index=activity AND rg_functionality="Email / Email Security" AND requesturl NOT NULL AND requesturl IN ("https://borcano.org/connect")
index=activity AND rg_functionality="Email / Email Security" AND Message NOT NULL AND Message IN ("https://borcano.org/connect")
index=activity AND rg_functionality="Email / Email Security" AND Requestcontext NOT NULL AND Requestcontext IN ("https://borcano.org/connect")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("https://borcano.org/connect")
index=activity AND rg_functionality="Cloud Email / Email Security" AND requesturl NOT NULL AND requesturl IN ("https://borcano.org/connect")
index=activity AND rg_functionality="Cloud Email / Email Security" AND Message NOT NULL AND Message IN ("https://borcano.org/connect")
index=activity AND rg_functionality="Cloud Email / Email Security" AND Requestcontext NOT NULL AND Requestcontext IN ("https://borcano.org/connect")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("https://borcano.org/connect")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND requesturl NOT NULL AND requesturl IN ("https://borcano.org/connect")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND Message NOT NULL AND Message IN ("https://borcano.org/connect")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND Requestcontext NOT NULL AND Requestcontext IN ("https://borcano.org/connect")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("https://borcano.org/connect")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND requesturl NOT NULL AND requesturl IN ("https://borcano.org/connect")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND Message NOT NULL AND Message IN ("https://borcano.org/connect")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND Requestcontext NOT NULL AND Requestcontext IN ("https://borcano.org/connect")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("https://borcano.org/connect")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND requesturl NOT NULL AND requesturl IN ("https://borcano.org/connect")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND Message NOT NULL AND Message IN ("https://borcano.org/connect")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND Requestcontext NOT NULL AND Requestcontext IN ("https://borcano.org/connect")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("https://borcano.org/connect")
index=activity AND rg_functionality="Web Proxy" AND requesturl NOT NULL AND requesturl IN ("https://borcano.org/connect")
index=activity AND rg_functionality="Web Proxy" AND Message NOT NULL AND Message IN ("https://borcano.org/connect")
index=activity AND rg_functionality="Web Proxy" AND Requestcontext NOT NULL AND Requestcontext IN ("https://borcano.org/connect")
index=activity AND rg_functionality="Web Proxy" AND customstring3 NOT NULL AND customstring3 IN ("https://borcano.org/connect")
index=activity AND rg_functionality="Next Generation Firewall" AND requesturl NOT NULL AND requesturl IN ("https://borcano.org/connect")
index=activity AND rg_functionality="Next Generation Firewall" AND Message NOT NULL AND Message IN ("https://borcano.org/connect")
index=activity AND rg_functionality="Next Generation Firewall" AND Requestcontext NOT NULL AND Requestcontext IN ("https://borcano.org/connect")
index=activity AND rg_functionality="Next Generation Firewall" AND customstring3 NOT NULL AND customstring3 IN ("https://borcano.org/connect")
index=activity AND rg_functionality="Flow" AND requesturl NOT NULL AND requesturl IN ("https://borcano.org/connect")
index=activity AND rg_functionality="Flow" AND Message NOT NULL AND Message IN ("https://borcano.org/connect")
index=activity AND rg_functionality="Flow" AND Requestcontext NOT NULL AND Requestcontext IN ("https://borcano.org/connect")
index=activity AND rg_functionality="Flow" AND customstring3 NOT NULL AND customstring3 IN ("https://borcano.org/connect")
index=activity AND rg_functionality="Web Server" AND requesturl NOT NULL AND requesturl IN ("https://borcano.org/connect")
index=activity AND rg_functionality="Web Server" AND Message NOT NULL AND Message IN ("https://borcano.org/connect")
index=activity AND rg_functionality="Web Server" AND Requestcontext NOT NULL AND Requestcontext IN ("https://borcano.org/connect")
index=activity AND rg_functionality="Web Server" AND customstring3 NOT NULL AND customstring3 IN ("https://borcano.org/connect")
index=activity AND rg_functionality="Email / Email Security" AND requesturl NOT NULL AND requesturl IN ("https://borcano.org/connect")
index=activity AND rg_functionality="Email / Email Security" AND Message NOT NULL AND Message IN ("https://borcano.org/connect")
index=activity AND rg_functionality="Email / Email Security" AND Requestcontext NOT NULL AND Requestcontext IN ("https://borcano.org/connect")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("https://borcano.org/connect")
index=activity AND rg_functionality="Cloud Email / Email Security" AND requesturl NOT NULL AND requesturl IN ("https://borcano.org/connect")
index=activity AND rg_functionality="Cloud Email / Email Security" AND Message NOT NULL AND Message IN ("https://borcano.org/connect")
index=activity AND rg_functionality="Cloud Email / Email Security" AND Requestcontext NOT NULL AND Requestcontext IN ("https://borcano.org/connect")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("https://borcano.org/connect")
index=activity AND rg_functionality="Web Application Firewall" AND requesturl NOT NULL AND requesturl IN ("https://borcano.org/connect")
index=activity AND rg_functionality="Web Application Firewall" AND Message NOT NULL AND Message IN ("https://borcano.org/connect")
index=activity AND rg_functionality="Web Application Firewall" AND Requestcontext NOT NULL AND Requestcontext IN ("https://borcano.org/connect")
index=activity AND rg_functionality="Web Application Firewall" AND customstring3 NOT NULL AND customstring3 IN ("https://borcano.org/connect")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND requesturl NOT NULL AND requesturl IN ("https://borcano.org/connect")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND Message NOT NULL AND Message IN ("https://borcano.org/connect")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND Requestcontext NOT NULL AND Requestcontext IN ("https://borcano.org/connect")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("https://borcano.org/connect")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND requesturl NOT NULL AND requesturl IN ("https://borcano.org/connect")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND Message NOT NULL AND Message IN ("https://borcano.org/connect")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND Requestcontext NOT NULL AND Requestcontext IN ("https://borcano.org/connect")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND customstring3 NOT NULL AND customstring3 IN ("https://borcano.org/connect")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND requesturl NOT NULL AND requesturl IN ("https://borcano.org/connect")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND Message NOT NULL AND Message IN ("https://borcano.org/connect")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND Requestcontext NOT NULL AND Requestcontext IN ("https://borcano.org/connect")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND customstring3 NOT NULL AND customstring3 IN ("https://borcano.org/connect")
index=activity AND rg_functionality="Cloud Application Security Broker" AND requesturl NOT NULL AND requesturl IN ("https://borcano.org/connect")
index=activity AND rg_functionality="Cloud Application Security Broker" AND Message NOT NULL AND Message IN ("https://borcano.org/connect")
index=activity AND rg_functionality="Cloud Application Security Broker" AND Requestcontext NOT NULL AND Requestcontext IN ("https://borcano.org/connect")
index=activity AND rg_functionality="Cloud Application Security Broker" AND customstring3 NOT NULL AND customstring3 IN ("https://borcano.org/connect")
index=activity AND rg_functionality="Source Code Repository" AND requesturl NOT NULL AND requesturl IN ("https://borcano.org/connect")
index=activity AND rg_functionality="Source Code Repository" AND Message NOT NULL AND Message IN ("https://borcano.org/connect")
index=activity AND rg_functionality="Source Code Repository" AND Requestcontext NOT NULL AND Requestcontext IN ("https://borcano.org/connect")
index=activity AND rg_functionality="Source Code Repository" AND customstring3 NOT NULL AND customstring3 IN ("https://borcano.org/connect")
index=activity AND rg_functionality="Authentication / VPN" AND requesturl NOT NULL AND requesturl IN ("https://borcano.org/connect")
index=activity AND rg_functionality="Authentication / VPN" AND Message NOT NULL AND Message IN ("https://borcano.org/connect")
index=activity AND rg_functionality="Authentication / VPN" AND Requestcontext NOT NULL AND Requestcontext IN ("https://borcano.org/connect")
index=activity AND rg_functionality="Authentication / VPN" AND customstring3 NOT NULL AND customstring3 IN ("https://borcano.org/connect")
index=activity AND rg_functionality="Cloud Content Management System" AND requesturl NOT NULL AND requesturl IN ("https://borcano.org/connect")
index=activity AND rg_functionality="Cloud Content Management System" AND Message NOT NULL AND Message IN ("https://borcano.org/connect")
index=activity AND rg_functionality="Cloud Content Management System" AND Requestcontext NOT NULL AND Requestcontext IN ("https://borcano.org/connect")
index=activity AND rg_functionality="Cloud Content Management System" AND customstring3 NOT NULL AND customstring3 IN ("https://borcano.org/connect")
index=activity AND rg_functionality="Cloud Services / Applications" AND requesturl NOT NULL AND requesturl IN ("https://borcano.org/connect")
index=activity AND rg_functionality="Cloud Services / Applications" AND Message NOT NULL AND Message IN ("https://borcano.org/connect")
index=activity AND rg_functionality="Cloud Services / Applications" AND Requestcontext NOT NULL AND Requestcontext IN ("https://borcano.org/connect")
index=activity AND rg_functionality="Cloud Services / Applications" AND customstring3 NOT NULL AND customstring3 IN ("https://borcano.org/connect")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND requesturl NOT NULL AND requesturl IN ("https://borcano.org/connect")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND Message NOT NULL AND Message IN ("https://borcano.org/connect")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND Requestcontext NOT NULL AND Requestcontext IN ("https://borcano.org/connect")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("https://borcano.org/connect")
index=activity AND rg_functionality="Web Application Firewall" AND requesturl NOT NULL AND requesturl IN ("https://borcano.org/connect")
index=activity AND rg_functionality="Web Application Firewall" AND Message NOT NULL AND Message IN ("https://borcano.org/connect")
index=activity AND rg_functionality="Web Application Firewall" AND Requestcontext NOT NULL AND Requestcontext IN ("https://borcano.org/connect")
index=activity AND rg_functionality="Web Application Firewall" AND customstring3 NOT NULL AND customstring3 IN ("https://borcano.org/connect")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND requesturl NOT NULL AND requesturl IN ("https://borcano.org/connect")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND Message NOT NULL AND Message IN ("https://borcano.org/connect")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND Requestcontext NOT NULL AND Requestcontext IN ("https://borcano.org/connect")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND customstring3 NOT NULL AND customstring3 IN ("https://borcano.org/connect")
