index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("9d52af33c05ea80f9bc47404b02ace4e16203dd81aef9021924885a6bff1d3c1","15649e4d246fe6d03dc75ecb4cabe5d1f8723519ed8dd3176e1a97325e827daf","24480dbe306597da1ba393b6e30d542673066f98826cc07ac4b9033137f37dbf","f6ee01303cf1d68015eee49f7dc7f26151a04ae642a47e49c70806931ce652d3","edcf76600cd11ef7d6a5c319087041abc604e571239fe2dae4bca83688821a3a","e23d5cb32a2d62314a8b26a205b634ee968f5a0500c190bc6edb55ec70285eb5","9f2434d5f8d042323cc7964520d99bda661bb23ce505cb03c8a07758bc9397a6","8ca7304846c69300237a8577fbeec2720ea9a4bd09cb7fe484a8d5efc79ad073","bba75dc056ef7f9c4ade39b32174c5980233fc1551c41aca9487019191764bac","ca2c02f592d72cafc218f4edd1ea771f8d1458cb95c2c76c3e384e63cefd1fb6","6feb5361fd3abd3a7a733c30bfcc2b58fc774ac6aa91a468ce2e31dcffc9d4de","2c9f0f324e9cca0481162cdc21ee9b60a7541941a33af99113d08bbd859d7473")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("9d52af33c05ea80f9bc47404b02ace4e16203dd81aef9021924885a6bff1d3c1","15649e4d246fe6d03dc75ecb4cabe5d1f8723519ed8dd3176e1a97325e827daf","24480dbe306597da1ba393b6e30d542673066f98826cc07ac4b9033137f37dbf","f6ee01303cf1d68015eee49f7dc7f26151a04ae642a47e49c70806931ce652d3","edcf76600cd11ef7d6a5c319087041abc604e571239fe2dae4bca83688821a3a","e23d5cb32a2d62314a8b26a205b634ee968f5a0500c190bc6edb55ec70285eb5","9f2434d5f8d042323cc7964520d99bda661bb23ce505cb03c8a07758bc9397a6","8ca7304846c69300237a8577fbeec2720ea9a4bd09cb7fe484a8d5efc79ad073","bba75dc056ef7f9c4ade39b32174c5980233fc1551c41aca9487019191764bac","ca2c02f592d72cafc218f4edd1ea771f8d1458cb95c2c76c3e384e63cefd1fb6","6feb5361fd3abd3a7a733c30bfcc2b58fc774ac6aa91a468ce2e31dcffc9d4de","2c9f0f324e9cca0481162cdc21ee9b60a7541941a33af99113d08bbd859d7473")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("9d52af33c05ea80f9bc47404b02ace4e16203dd81aef9021924885a6bff1d3c1","15649e4d246fe6d03dc75ecb4cabe5d1f8723519ed8dd3176e1a97325e827daf","24480dbe306597da1ba393b6e30d542673066f98826cc07ac4b9033137f37dbf","f6ee01303cf1d68015eee49f7dc7f26151a04ae642a47e49c70806931ce652d3","edcf76600cd11ef7d6a5c319087041abc604e571239fe2dae4bca83688821a3a","e23d5cb32a2d62314a8b26a205b634ee968f5a0500c190bc6edb55ec70285eb5","9f2434d5f8d042323cc7964520d99bda661bb23ce505cb03c8a07758bc9397a6","8ca7304846c69300237a8577fbeec2720ea9a4bd09cb7fe484a8d5efc79ad073","bba75dc056ef7f9c4ade39b32174c5980233fc1551c41aca9487019191764bac","ca2c02f592d72cafc218f4edd1ea771f8d1458cb95c2c76c3e384e63cefd1fb6","6feb5361fd3abd3a7a733c30bfcc2b58fc774ac6aa91a468ce2e31dcffc9d4de","2c9f0f324e9cca0481162cdc21ee9b60a7541941a33af99113d08bbd859d7473")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring64 NOT NULL AND customstring64 IN ("9d52af33c05ea80f9bc47404b02ace4e16203dd81aef9021924885a6bff1d3c1","15649e4d246fe6d03dc75ecb4cabe5d1f8723519ed8dd3176e1a97325e827daf","24480dbe306597da1ba393b6e30d542673066f98826cc07ac4b9033137f37dbf","f6ee01303cf1d68015eee49f7dc7f26151a04ae642a47e49c70806931ce652d3","edcf76600cd11ef7d6a5c319087041abc604e571239fe2dae4bca83688821a3a","e23d5cb32a2d62314a8b26a205b634ee968f5a0500c190bc6edb55ec70285eb5","9f2434d5f8d042323cc7964520d99bda661bb23ce505cb03c8a07758bc9397a6","8ca7304846c69300237a8577fbeec2720ea9a4bd09cb7fe484a8d5efc79ad073","bba75dc056ef7f9c4ade39b32174c5980233fc1551c41aca9487019191764bac","ca2c02f592d72cafc218f4edd1ea771f8d1458cb95c2c76c3e384e63cefd1fb6","6feb5361fd3abd3a7a733c30bfcc2b58fc774ac6aa91a468ce2e31dcffc9d4de","2c9f0f324e9cca0481162cdc21ee9b60a7541941a33af99113d08bbd859d7473")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("9d52af33c05ea80f9bc47404b02ace4e16203dd81aef9021924885a6bff1d3c1","15649e4d246fe6d03dc75ecb4cabe5d1f8723519ed8dd3176e1a97325e827daf","24480dbe306597da1ba393b6e30d542673066f98826cc07ac4b9033137f37dbf","f6ee01303cf1d68015eee49f7dc7f26151a04ae642a47e49c70806931ce652d3","edcf76600cd11ef7d6a5c319087041abc604e571239fe2dae4bca83688821a3a","e23d5cb32a2d62314a8b26a205b634ee968f5a0500c190bc6edb55ec70285eb5","9f2434d5f8d042323cc7964520d99bda661bb23ce505cb03c8a07758bc9397a6","8ca7304846c69300237a8577fbeec2720ea9a4bd09cb7fe484a8d5efc79ad073","bba75dc056ef7f9c4ade39b32174c5980233fc1551c41aca9487019191764bac","ca2c02f592d72cafc218f4edd1ea771f8d1458cb95c2c76c3e384e63cefd1fb6","6feb5361fd3abd3a7a733c30bfcc2b58fc774ac6aa91a468ce2e31dcffc9d4de","2c9f0f324e9cca0481162cdc21ee9b60a7541941a33af99113d08bbd859d7473")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("9d52af33c05ea80f9bc47404b02ace4e16203dd81aef9021924885a6bff1d3c1","15649e4d246fe6d03dc75ecb4cabe5d1f8723519ed8dd3176e1a97325e827daf","24480dbe306597da1ba393b6e30d542673066f98826cc07ac4b9033137f37dbf","f6ee01303cf1d68015eee49f7dc7f26151a04ae642a47e49c70806931ce652d3","edcf76600cd11ef7d6a5c319087041abc604e571239fe2dae4bca83688821a3a","e23d5cb32a2d62314a8b26a205b634ee968f5a0500c190bc6edb55ec70285eb5","9f2434d5f8d042323cc7964520d99bda661bb23ce505cb03c8a07758bc9397a6","8ca7304846c69300237a8577fbeec2720ea9a4bd09cb7fe484a8d5efc79ad073","bba75dc056ef7f9c4ade39b32174c5980233fc1551c41aca9487019191764bac","ca2c02f592d72cafc218f4edd1ea771f8d1458cb95c2c76c3e384e63cefd1fb6","6feb5361fd3abd3a7a733c30bfcc2b58fc774ac6aa91a468ce2e31dcffc9d4de","2c9f0f324e9cca0481162cdc21ee9b60a7541941a33af99113d08bbd859d7473")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("9d52af33c05ea80f9bc47404b02ace4e16203dd81aef9021924885a6bff1d3c1","15649e4d246fe6d03dc75ecb4cabe5d1f8723519ed8dd3176e1a97325e827daf","24480dbe306597da1ba393b6e30d542673066f98826cc07ac4b9033137f37dbf","f6ee01303cf1d68015eee49f7dc7f26151a04ae642a47e49c70806931ce652d3","edcf76600cd11ef7d6a5c319087041abc604e571239fe2dae4bca83688821a3a","e23d5cb32a2d62314a8b26a205b634ee968f5a0500c190bc6edb55ec70285eb5","9f2434d5f8d042323cc7964520d99bda661bb23ce505cb03c8a07758bc9397a6","8ca7304846c69300237a8577fbeec2720ea9a4bd09cb7fe484a8d5efc79ad073","bba75dc056ef7f9c4ade39b32174c5980233fc1551c41aca9487019191764bac","ca2c02f592d72cafc218f4edd1ea771f8d1458cb95c2c76c3e384e63cefd1fb6","6feb5361fd3abd3a7a733c30bfcc2b58fc774ac6aa91a468ce2e31dcffc9d4de","2c9f0f324e9cca0481162cdc21ee9b60a7541941a33af99113d08bbd859d7473")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("9d52af33c05ea80f9bc47404b02ace4e16203dd81aef9021924885a6bff1d3c1","15649e4d246fe6d03dc75ecb4cabe5d1f8723519ed8dd3176e1a97325e827daf","24480dbe306597da1ba393b6e30d542673066f98826cc07ac4b9033137f37dbf","f6ee01303cf1d68015eee49f7dc7f26151a04ae642a47e49c70806931ce652d3","edcf76600cd11ef7d6a5c319087041abc604e571239fe2dae4bca83688821a3a","e23d5cb32a2d62314a8b26a205b634ee968f5a0500c190bc6edb55ec70285eb5","9f2434d5f8d042323cc7964520d99bda661bb23ce505cb03c8a07758bc9397a6","8ca7304846c69300237a8577fbeec2720ea9a4bd09cb7fe484a8d5efc79ad073","bba75dc056ef7f9c4ade39b32174c5980233fc1551c41aca9487019191764bac","ca2c02f592d72cafc218f4edd1ea771f8d1458cb95c2c76c3e384e63cefd1fb6","6feb5361fd3abd3a7a733c30bfcc2b58fc774ac6aa91a468ce2e31dcffc9d4de","2c9f0f324e9cca0481162cdc21ee9b60a7541941a33af99113d08bbd859d7473")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("9d52af33c05ea80f9bc47404b02ace4e16203dd81aef9021924885a6bff1d3c1","15649e4d246fe6d03dc75ecb4cabe5d1f8723519ed8dd3176e1a97325e827daf","24480dbe306597da1ba393b6e30d542673066f98826cc07ac4b9033137f37dbf","f6ee01303cf1d68015eee49f7dc7f26151a04ae642a47e49c70806931ce652d3","edcf76600cd11ef7d6a5c319087041abc604e571239fe2dae4bca83688821a3a","e23d5cb32a2d62314a8b26a205b634ee968f5a0500c190bc6edb55ec70285eb5","9f2434d5f8d042323cc7964520d99bda661bb23ce505cb03c8a07758bc9397a6","8ca7304846c69300237a8577fbeec2720ea9a4bd09cb7fe484a8d5efc79ad073","bba75dc056ef7f9c4ade39b32174c5980233fc1551c41aca9487019191764bac","ca2c02f592d72cafc218f4edd1ea771f8d1458cb95c2c76c3e384e63cefd1fb6","6feb5361fd3abd3a7a733c30bfcc2b58fc774ac6aa91a468ce2e31dcffc9d4de","2c9f0f324e9cca0481162cdc21ee9b60a7541941a33af99113d08bbd859d7473")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("9d52af33c05ea80f9bc47404b02ace4e16203dd81aef9021924885a6bff1d3c1","15649e4d246fe6d03dc75ecb4cabe5d1f8723519ed8dd3176e1a97325e827daf","24480dbe306597da1ba393b6e30d542673066f98826cc07ac4b9033137f37dbf","f6ee01303cf1d68015eee49f7dc7f26151a04ae642a47e49c70806931ce652d3","edcf76600cd11ef7d6a5c319087041abc604e571239fe2dae4bca83688821a3a","e23d5cb32a2d62314a8b26a205b634ee968f5a0500c190bc6edb55ec70285eb5","9f2434d5f8d042323cc7964520d99bda661bb23ce505cb03c8a07758bc9397a6","8ca7304846c69300237a8577fbeec2720ea9a4bd09cb7fe484a8d5efc79ad073","bba75dc056ef7f9c4ade39b32174c5980233fc1551c41aca9487019191764bac","ca2c02f592d72cafc218f4edd1ea771f8d1458cb95c2c76c3e384e63cefd1fb6","6feb5361fd3abd3a7a733c30bfcc2b58fc774ac6aa91a468ce2e31dcffc9d4de","2c9f0f324e9cca0481162cdc21ee9b60a7541941a33af99113d08bbd859d7473")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("9d52af33c05ea80f9bc47404b02ace4e16203dd81aef9021924885a6bff1d3c1","15649e4d246fe6d03dc75ecb4cabe5d1f8723519ed8dd3176e1a97325e827daf","24480dbe306597da1ba393b6e30d542673066f98826cc07ac4b9033137f37dbf","f6ee01303cf1d68015eee49f7dc7f26151a04ae642a47e49c70806931ce652d3","edcf76600cd11ef7d6a5c319087041abc604e571239fe2dae4bca83688821a3a","e23d5cb32a2d62314a8b26a205b634ee968f5a0500c190bc6edb55ec70285eb5","9f2434d5f8d042323cc7964520d99bda661bb23ce505cb03c8a07758bc9397a6","8ca7304846c69300237a8577fbeec2720ea9a4bd09cb7fe484a8d5efc79ad073","bba75dc056ef7f9c4ade39b32174c5980233fc1551c41aca9487019191764bac","ca2c02f592d72cafc218f4edd1ea771f8d1458cb95c2c76c3e384e63cefd1fb6","6feb5361fd3abd3a7a733c30bfcc2b58fc774ac6aa91a468ce2e31dcffc9d4de","2c9f0f324e9cca0481162cdc21ee9b60a7541941a33af99113d08bbd859d7473")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("9d52af33c05ea80f9bc47404b02ace4e16203dd81aef9021924885a6bff1d3c1","15649e4d246fe6d03dc75ecb4cabe5d1f8723519ed8dd3176e1a97325e827daf","24480dbe306597da1ba393b6e30d542673066f98826cc07ac4b9033137f37dbf","f6ee01303cf1d68015eee49f7dc7f26151a04ae642a47e49c70806931ce652d3","edcf76600cd11ef7d6a5c319087041abc604e571239fe2dae4bca83688821a3a","e23d5cb32a2d62314a8b26a205b634ee968f5a0500c190bc6edb55ec70285eb5","9f2434d5f8d042323cc7964520d99bda661bb23ce505cb03c8a07758bc9397a6","8ca7304846c69300237a8577fbeec2720ea9a4bd09cb7fe484a8d5efc79ad073","bba75dc056ef7f9c4ade39b32174c5980233fc1551c41aca9487019191764bac","ca2c02f592d72cafc218f4edd1ea771f8d1458cb95c2c76c3e384e63cefd1fb6","6feb5361fd3abd3a7a733c30bfcc2b58fc774ac6aa91a468ce2e31dcffc9d4de","2c9f0f324e9cca0481162cdc21ee9b60a7541941a33af99113d08bbd859d7473")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("9d52af33c05ea80f9bc47404b02ace4e16203dd81aef9021924885a6bff1d3c1","15649e4d246fe6d03dc75ecb4cabe5d1f8723519ed8dd3176e1a97325e827daf","24480dbe306597da1ba393b6e30d542673066f98826cc07ac4b9033137f37dbf","f6ee01303cf1d68015eee49f7dc7f26151a04ae642a47e49c70806931ce652d3","edcf76600cd11ef7d6a5c319087041abc604e571239fe2dae4bca83688821a3a","e23d5cb32a2d62314a8b26a205b634ee968f5a0500c190bc6edb55ec70285eb5","9f2434d5f8d042323cc7964520d99bda661bb23ce505cb03c8a07758bc9397a6","8ca7304846c69300237a8577fbeec2720ea9a4bd09cb7fe484a8d5efc79ad073","bba75dc056ef7f9c4ade39b32174c5980233fc1551c41aca9487019191764bac","ca2c02f592d72cafc218f4edd1ea771f8d1458cb95c2c76c3e384e63cefd1fb6","6feb5361fd3abd3a7a733c30bfcc2b58fc774ac6aa91a468ce2e31dcffc9d4de","2c9f0f324e9cca0481162cdc21ee9b60a7541941a33af99113d08bbd859d7473")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("9d52af33c05ea80f9bc47404b02ace4e16203dd81aef9021924885a6bff1d3c1","15649e4d246fe6d03dc75ecb4cabe5d1f8723519ed8dd3176e1a97325e827daf","24480dbe306597da1ba393b6e30d542673066f98826cc07ac4b9033137f37dbf","f6ee01303cf1d68015eee49f7dc7f26151a04ae642a47e49c70806931ce652d3","edcf76600cd11ef7d6a5c319087041abc604e571239fe2dae4bca83688821a3a","e23d5cb32a2d62314a8b26a205b634ee968f5a0500c190bc6edb55ec70285eb5","9f2434d5f8d042323cc7964520d99bda661bb23ce505cb03c8a07758bc9397a6","8ca7304846c69300237a8577fbeec2720ea9a4bd09cb7fe484a8d5efc79ad073","bba75dc056ef7f9c4ade39b32174c5980233fc1551c41aca9487019191764bac","ca2c02f592d72cafc218f4edd1ea771f8d1458cb95c2c76c3e384e63cefd1fb6","6feb5361fd3abd3a7a733c30bfcc2b58fc774ac6aa91a468ce2e31dcffc9d4de","2c9f0f324e9cca0481162cdc21ee9b60a7541941a33af99113d08bbd859d7473")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("9d52af33c05ea80f9bc47404b02ace4e16203dd81aef9021924885a6bff1d3c1","15649e4d246fe6d03dc75ecb4cabe5d1f8723519ed8dd3176e1a97325e827daf","24480dbe306597da1ba393b6e30d542673066f98826cc07ac4b9033137f37dbf","f6ee01303cf1d68015eee49f7dc7f26151a04ae642a47e49c70806931ce652d3","edcf76600cd11ef7d6a5c319087041abc604e571239fe2dae4bca83688821a3a","e23d5cb32a2d62314a8b26a205b634ee968f5a0500c190bc6edb55ec70285eb5","9f2434d5f8d042323cc7964520d99bda661bb23ce505cb03c8a07758bc9397a6","8ca7304846c69300237a8577fbeec2720ea9a4bd09cb7fe484a8d5efc79ad073","bba75dc056ef7f9c4ade39b32174c5980233fc1551c41aca9487019191764bac","ca2c02f592d72cafc218f4edd1ea771f8d1458cb95c2c76c3e384e63cefd1fb6","6feb5361fd3abd3a7a733c30bfcc2b58fc774ac6aa91a468ce2e31dcffc9d4de","2c9f0f324e9cca0481162cdc21ee9b60a7541941a33af99113d08bbd859d7473")
index=activity AND rg_functionality="Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("9d52af33c05ea80f9bc47404b02ace4e16203dd81aef9021924885a6bff1d3c1","15649e4d246fe6d03dc75ecb4cabe5d1f8723519ed8dd3176e1a97325e827daf","24480dbe306597da1ba393b6e30d542673066f98826cc07ac4b9033137f37dbf","f6ee01303cf1d68015eee49f7dc7f26151a04ae642a47e49c70806931ce652d3","edcf76600cd11ef7d6a5c319087041abc604e571239fe2dae4bca83688821a3a","e23d5cb32a2d62314a8b26a205b634ee968f5a0500c190bc6edb55ec70285eb5","9f2434d5f8d042323cc7964520d99bda661bb23ce505cb03c8a07758bc9397a6","8ca7304846c69300237a8577fbeec2720ea9a4bd09cb7fe484a8d5efc79ad073","bba75dc056ef7f9c4ade39b32174c5980233fc1551c41aca9487019191764bac","ca2c02f592d72cafc218f4edd1ea771f8d1458cb95c2c76c3e384e63cefd1fb6","6feb5361fd3abd3a7a733c30bfcc2b58fc774ac6aa91a468ce2e31dcffc9d4de","2c9f0f324e9cca0481162cdc21ee9b60a7541941a33af99113d08bbd859d7473")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("9d52af33c05ea80f9bc47404b02ace4e16203dd81aef9021924885a6bff1d3c1","15649e4d246fe6d03dc75ecb4cabe5d1f8723519ed8dd3176e1a97325e827daf","24480dbe306597da1ba393b6e30d542673066f98826cc07ac4b9033137f37dbf","f6ee01303cf1d68015eee49f7dc7f26151a04ae642a47e49c70806931ce652d3","edcf76600cd11ef7d6a5c319087041abc604e571239fe2dae4bca83688821a3a","e23d5cb32a2d62314a8b26a205b634ee968f5a0500c190bc6edb55ec70285eb5","9f2434d5f8d042323cc7964520d99bda661bb23ce505cb03c8a07758bc9397a6","8ca7304846c69300237a8577fbeec2720ea9a4bd09cb7fe484a8d5efc79ad073","bba75dc056ef7f9c4ade39b32174c5980233fc1551c41aca9487019191764bac","ca2c02f592d72cafc218f4edd1ea771f8d1458cb95c2c76c3e384e63cefd1fb6","6feb5361fd3abd3a7a733c30bfcc2b58fc774ac6aa91a468ce2e31dcffc9d4de","2c9f0f324e9cca0481162cdc21ee9b60a7541941a33af99113d08bbd859d7473")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("9d52af33c05ea80f9bc47404b02ace4e16203dd81aef9021924885a6bff1d3c1","15649e4d246fe6d03dc75ecb4cabe5d1f8723519ed8dd3176e1a97325e827daf","24480dbe306597da1ba393b6e30d542673066f98826cc07ac4b9033137f37dbf","f6ee01303cf1d68015eee49f7dc7f26151a04ae642a47e49c70806931ce652d3","edcf76600cd11ef7d6a5c319087041abc604e571239fe2dae4bca83688821a3a","e23d5cb32a2d62314a8b26a205b634ee968f5a0500c190bc6edb55ec70285eb5","9f2434d5f8d042323cc7964520d99bda661bb23ce505cb03c8a07758bc9397a6","8ca7304846c69300237a8577fbeec2720ea9a4bd09cb7fe484a8d5efc79ad073","bba75dc056ef7f9c4ade39b32174c5980233fc1551c41aca9487019191764bac","ca2c02f592d72cafc218f4edd1ea771f8d1458cb95c2c76c3e384e63cefd1fb6","6feb5361fd3abd3a7a733c30bfcc2b58fc774ac6aa91a468ce2e31dcffc9d4de","2c9f0f324e9cca0481162cdc21ee9b60a7541941a33af99113d08bbd859d7473")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("9d52af33c05ea80f9bc47404b02ace4e16203dd81aef9021924885a6bff1d3c1","15649e4d246fe6d03dc75ecb4cabe5d1f8723519ed8dd3176e1a97325e827daf","24480dbe306597da1ba393b6e30d542673066f98826cc07ac4b9033137f37dbf","f6ee01303cf1d68015eee49f7dc7f26151a04ae642a47e49c70806931ce652d3","edcf76600cd11ef7d6a5c319087041abc604e571239fe2dae4bca83688821a3a","e23d5cb32a2d62314a8b26a205b634ee968f5a0500c190bc6edb55ec70285eb5","9f2434d5f8d042323cc7964520d99bda661bb23ce505cb03c8a07758bc9397a6","8ca7304846c69300237a8577fbeec2720ea9a4bd09cb7fe484a8d5efc79ad073","bba75dc056ef7f9c4ade39b32174c5980233fc1551c41aca9487019191764bac","ca2c02f592d72cafc218f4edd1ea771f8d1458cb95c2c76c3e384e63cefd1fb6","6feb5361fd3abd3a7a733c30bfcc2b58fc774ac6aa91a468ce2e31dcffc9d4de","2c9f0f324e9cca0481162cdc21ee9b60a7541941a33af99113d08bbd859d7473")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("9d52af33c05ea80f9bc47404b02ace4e16203dd81aef9021924885a6bff1d3c1","15649e4d246fe6d03dc75ecb4cabe5d1f8723519ed8dd3176e1a97325e827daf","24480dbe306597da1ba393b6e30d542673066f98826cc07ac4b9033137f37dbf","f6ee01303cf1d68015eee49f7dc7f26151a04ae642a47e49c70806931ce652d3","edcf76600cd11ef7d6a5c319087041abc604e571239fe2dae4bca83688821a3a","e23d5cb32a2d62314a8b26a205b634ee968f5a0500c190bc6edb55ec70285eb5","9f2434d5f8d042323cc7964520d99bda661bb23ce505cb03c8a07758bc9397a6","8ca7304846c69300237a8577fbeec2720ea9a4bd09cb7fe484a8d5efc79ad073","bba75dc056ef7f9c4ade39b32174c5980233fc1551c41aca9487019191764bac","ca2c02f592d72cafc218f4edd1ea771f8d1458cb95c2c76c3e384e63cefd1fb6","6feb5361fd3abd3a7a733c30bfcc2b58fc774ac6aa91a468ce2e31dcffc9d4de","2c9f0f324e9cca0481162cdc21ee9b60a7541941a33af99113d08bbd859d7473")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("9d52af33c05ea80f9bc47404b02ace4e16203dd81aef9021924885a6bff1d3c1","15649e4d246fe6d03dc75ecb4cabe5d1f8723519ed8dd3176e1a97325e827daf","24480dbe306597da1ba393b6e30d542673066f98826cc07ac4b9033137f37dbf","f6ee01303cf1d68015eee49f7dc7f26151a04ae642a47e49c70806931ce652d3","edcf76600cd11ef7d6a5c319087041abc604e571239fe2dae4bca83688821a3a","e23d5cb32a2d62314a8b26a205b634ee968f5a0500c190bc6edb55ec70285eb5","9f2434d5f8d042323cc7964520d99bda661bb23ce505cb03c8a07758bc9397a6","8ca7304846c69300237a8577fbeec2720ea9a4bd09cb7fe484a8d5efc79ad073","bba75dc056ef7f9c4ade39b32174c5980233fc1551c41aca9487019191764bac","ca2c02f592d72cafc218f4edd1ea771f8d1458cb95c2c76c3e384e63cefd1fb6","6feb5361fd3abd3a7a733c30bfcc2b58fc774ac6aa91a468ce2e31dcffc9d4de","2c9f0f324e9cca0481162cdc21ee9b60a7541941a33af99113d08bbd859d7473")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("9d52af33c05ea80f9bc47404b02ace4e16203dd81aef9021924885a6bff1d3c1","15649e4d246fe6d03dc75ecb4cabe5d1f8723519ed8dd3176e1a97325e827daf","24480dbe306597da1ba393b6e30d542673066f98826cc07ac4b9033137f37dbf","f6ee01303cf1d68015eee49f7dc7f26151a04ae642a47e49c70806931ce652d3","edcf76600cd11ef7d6a5c319087041abc604e571239fe2dae4bca83688821a3a","e23d5cb32a2d62314a8b26a205b634ee968f5a0500c190bc6edb55ec70285eb5","9f2434d5f8d042323cc7964520d99bda661bb23ce505cb03c8a07758bc9397a6","8ca7304846c69300237a8577fbeec2720ea9a4bd09cb7fe484a8d5efc79ad073","bba75dc056ef7f9c4ade39b32174c5980233fc1551c41aca9487019191764bac","ca2c02f592d72cafc218f4edd1ea771f8d1458cb95c2c76c3e384e63cefd1fb6","6feb5361fd3abd3a7a733c30bfcc2b58fc774ac6aa91a468ce2e31dcffc9d4de","2c9f0f324e9cca0481162cdc21ee9b60a7541941a33af99113d08bbd859d7473")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("9d52af33c05ea80f9bc47404b02ace4e16203dd81aef9021924885a6bff1d3c1","15649e4d246fe6d03dc75ecb4cabe5d1f8723519ed8dd3176e1a97325e827daf","24480dbe306597da1ba393b6e30d542673066f98826cc07ac4b9033137f37dbf","f6ee01303cf1d68015eee49f7dc7f26151a04ae642a47e49c70806931ce652d3","edcf76600cd11ef7d6a5c319087041abc604e571239fe2dae4bca83688821a3a","e23d5cb32a2d62314a8b26a205b634ee968f5a0500c190bc6edb55ec70285eb5","9f2434d5f8d042323cc7964520d99bda661bb23ce505cb03c8a07758bc9397a6","8ca7304846c69300237a8577fbeec2720ea9a4bd09cb7fe484a8d5efc79ad073","bba75dc056ef7f9c4ade39b32174c5980233fc1551c41aca9487019191764bac","ca2c02f592d72cafc218f4edd1ea771f8d1458cb95c2c76c3e384e63cefd1fb6","6feb5361fd3abd3a7a733c30bfcc2b58fc774ac6aa91a468ce2e31dcffc9d4de","2c9f0f324e9cca0481162cdc21ee9b60a7541941a33af99113d08bbd859d7473")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring64 NOT NULL AND customstring64 IN ("9d52af33c05ea80f9bc47404b02ace4e16203dd81aef9021924885a6bff1d3c1","15649e4d246fe6d03dc75ecb4cabe5d1f8723519ed8dd3176e1a97325e827daf","24480dbe306597da1ba393b6e30d542673066f98826cc07ac4b9033137f37dbf","f6ee01303cf1d68015eee49f7dc7f26151a04ae642a47e49c70806931ce652d3","edcf76600cd11ef7d6a5c319087041abc604e571239fe2dae4bca83688821a3a","e23d5cb32a2d62314a8b26a205b634ee968f5a0500c190bc6edb55ec70285eb5","9f2434d5f8d042323cc7964520d99bda661bb23ce505cb03c8a07758bc9397a6","8ca7304846c69300237a8577fbeec2720ea9a4bd09cb7fe484a8d5efc79ad073","bba75dc056ef7f9c4ade39b32174c5980233fc1551c41aca9487019191764bac","ca2c02f592d72cafc218f4edd1ea771f8d1458cb95c2c76c3e384e63cefd1fb6","6feb5361fd3abd3a7a733c30bfcc2b58fc774ac6aa91a468ce2e31dcffc9d4de","2c9f0f324e9cca0481162cdc21ee9b60a7541941a33af99113d08bbd859d7473")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("9d52af33c05ea80f9bc47404b02ace4e16203dd81aef9021924885a6bff1d3c1","15649e4d246fe6d03dc75ecb4cabe5d1f8723519ed8dd3176e1a97325e827daf","24480dbe306597da1ba393b6e30d542673066f98826cc07ac4b9033137f37dbf","f6ee01303cf1d68015eee49f7dc7f26151a04ae642a47e49c70806931ce652d3","edcf76600cd11ef7d6a5c319087041abc604e571239fe2dae4bca83688821a3a","e23d5cb32a2d62314a8b26a205b634ee968f5a0500c190bc6edb55ec70285eb5","9f2434d5f8d042323cc7964520d99bda661bb23ce505cb03c8a07758bc9397a6","8ca7304846c69300237a8577fbeec2720ea9a4bd09cb7fe484a8d5efc79ad073","bba75dc056ef7f9c4ade39b32174c5980233fc1551c41aca9487019191764bac","ca2c02f592d72cafc218f4edd1ea771f8d1458cb95c2c76c3e384e63cefd1fb6","6feb5361fd3abd3a7a733c30bfcc2b58fc774ac6aa91a468ce2e31dcffc9d4de","2c9f0f324e9cca0481162cdc21ee9b60a7541941a33af99113d08bbd859d7473")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("9d52af33c05ea80f9bc47404b02ace4e16203dd81aef9021924885a6bff1d3c1","15649e4d246fe6d03dc75ecb4cabe5d1f8723519ed8dd3176e1a97325e827daf","24480dbe306597da1ba393b6e30d542673066f98826cc07ac4b9033137f37dbf","f6ee01303cf1d68015eee49f7dc7f26151a04ae642a47e49c70806931ce652d3","edcf76600cd11ef7d6a5c319087041abc604e571239fe2dae4bca83688821a3a","e23d5cb32a2d62314a8b26a205b634ee968f5a0500c190bc6edb55ec70285eb5","9f2434d5f8d042323cc7964520d99bda661bb23ce505cb03c8a07758bc9397a6","8ca7304846c69300237a8577fbeec2720ea9a4bd09cb7fe484a8d5efc79ad073","bba75dc056ef7f9c4ade39b32174c5980233fc1551c41aca9487019191764bac","ca2c02f592d72cafc218f4edd1ea771f8d1458cb95c2c76c3e384e63cefd1fb6","6feb5361fd3abd3a7a733c30bfcc2b58fc774ac6aa91a468ce2e31dcffc9d4de","2c9f0f324e9cca0481162cdc21ee9b60a7541941a33af99113d08bbd859d7473")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("9d52af33c05ea80f9bc47404b02ace4e16203dd81aef9021924885a6bff1d3c1","15649e4d246fe6d03dc75ecb4cabe5d1f8723519ed8dd3176e1a97325e827daf","24480dbe306597da1ba393b6e30d542673066f98826cc07ac4b9033137f37dbf","f6ee01303cf1d68015eee49f7dc7f26151a04ae642a47e49c70806931ce652d3","edcf76600cd11ef7d6a5c319087041abc604e571239fe2dae4bca83688821a3a","e23d5cb32a2d62314a8b26a205b634ee968f5a0500c190bc6edb55ec70285eb5","9f2434d5f8d042323cc7964520d99bda661bb23ce505cb03c8a07758bc9397a6","8ca7304846c69300237a8577fbeec2720ea9a4bd09cb7fe484a8d5efc79ad073","bba75dc056ef7f9c4ade39b32174c5980233fc1551c41aca9487019191764bac","ca2c02f592d72cafc218f4edd1ea771f8d1458cb95c2c76c3e384e63cefd1fb6","6feb5361fd3abd3a7a733c30bfcc2b58fc774ac6aa91a468ce2e31dcffc9d4de","2c9f0f324e9cca0481162cdc21ee9b60a7541941a33af99113d08bbd859d7473")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring64 NOT NULL AND customstring64 IN ("9d52af33c05ea80f9bc47404b02ace4e16203dd81aef9021924885a6bff1d3c1","15649e4d246fe6d03dc75ecb4cabe5d1f8723519ed8dd3176e1a97325e827daf","24480dbe306597da1ba393b6e30d542673066f98826cc07ac4b9033137f37dbf","f6ee01303cf1d68015eee49f7dc7f26151a04ae642a47e49c70806931ce652d3","edcf76600cd11ef7d6a5c319087041abc604e571239fe2dae4bca83688821a3a","e23d5cb32a2d62314a8b26a205b634ee968f5a0500c190bc6edb55ec70285eb5","9f2434d5f8d042323cc7964520d99bda661bb23ce505cb03c8a07758bc9397a6","8ca7304846c69300237a8577fbeec2720ea9a4bd09cb7fe484a8d5efc79ad073","bba75dc056ef7f9c4ade39b32174c5980233fc1551c41aca9487019191764bac","ca2c02f592d72cafc218f4edd1ea771f8d1458cb95c2c76c3e384e63cefd1fb6","6feb5361fd3abd3a7a733c30bfcc2b58fc774ac6aa91a468ce2e31dcffc9d4de","2c9f0f324e9cca0481162cdc21ee9b60a7541941a33af99113d08bbd859d7473")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("9d52af33c05ea80f9bc47404b02ace4e16203dd81aef9021924885a6bff1d3c1","15649e4d246fe6d03dc75ecb4cabe5d1f8723519ed8dd3176e1a97325e827daf","24480dbe306597da1ba393b6e30d542673066f98826cc07ac4b9033137f37dbf","f6ee01303cf1d68015eee49f7dc7f26151a04ae642a47e49c70806931ce652d3","edcf76600cd11ef7d6a5c319087041abc604e571239fe2dae4bca83688821a3a","e23d5cb32a2d62314a8b26a205b634ee968f5a0500c190bc6edb55ec70285eb5","9f2434d5f8d042323cc7964520d99bda661bb23ce505cb03c8a07758bc9397a6","8ca7304846c69300237a8577fbeec2720ea9a4bd09cb7fe484a8d5efc79ad073","bba75dc056ef7f9c4ade39b32174c5980233fc1551c41aca9487019191764bac","ca2c02f592d72cafc218f4edd1ea771f8d1458cb95c2c76c3e384e63cefd1fb6","6feb5361fd3abd3a7a733c30bfcc2b58fc774ac6aa91a468ce2e31dcffc9d4de","2c9f0f324e9cca0481162cdc21ee9b60a7541941a33af99113d08bbd859d7473")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("9d52af33c05ea80f9bc47404b02ace4e16203dd81aef9021924885a6bff1d3c1","15649e4d246fe6d03dc75ecb4cabe5d1f8723519ed8dd3176e1a97325e827daf","24480dbe306597da1ba393b6e30d542673066f98826cc07ac4b9033137f37dbf","f6ee01303cf1d68015eee49f7dc7f26151a04ae642a47e49c70806931ce652d3","edcf76600cd11ef7d6a5c319087041abc604e571239fe2dae4bca83688821a3a","e23d5cb32a2d62314a8b26a205b634ee968f5a0500c190bc6edb55ec70285eb5","9f2434d5f8d042323cc7964520d99bda661bb23ce505cb03c8a07758bc9397a6","8ca7304846c69300237a8577fbeec2720ea9a4bd09cb7fe484a8d5efc79ad073","bba75dc056ef7f9c4ade39b32174c5980233fc1551c41aca9487019191764bac","ca2c02f592d72cafc218f4edd1ea771f8d1458cb95c2c76c3e384e63cefd1fb6","6feb5361fd3abd3a7a733c30bfcc2b58fc774ac6aa91a468ce2e31dcffc9d4de","2c9f0f324e9cca0481162cdc21ee9b60a7541941a33af99113d08bbd859d7473")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("9d52af33c05ea80f9bc47404b02ace4e16203dd81aef9021924885a6bff1d3c1","15649e4d246fe6d03dc75ecb4cabe5d1f8723519ed8dd3176e1a97325e827daf","24480dbe306597da1ba393b6e30d542673066f98826cc07ac4b9033137f37dbf","f6ee01303cf1d68015eee49f7dc7f26151a04ae642a47e49c70806931ce652d3","edcf76600cd11ef7d6a5c319087041abc604e571239fe2dae4bca83688821a3a","e23d5cb32a2d62314a8b26a205b634ee968f5a0500c190bc6edb55ec70285eb5","9f2434d5f8d042323cc7964520d99bda661bb23ce505cb03c8a07758bc9397a6","8ca7304846c69300237a8577fbeec2720ea9a4bd09cb7fe484a8d5efc79ad073","bba75dc056ef7f9c4ade39b32174c5980233fc1551c41aca9487019191764bac","ca2c02f592d72cafc218f4edd1ea771f8d1458cb95c2c76c3e384e63cefd1fb6","6feb5361fd3abd3a7a733c30bfcc2b58fc774ac6aa91a468ce2e31dcffc9d4de","2c9f0f324e9cca0481162cdc21ee9b60a7541941a33af99113d08bbd859d7473")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring64 NOT NULL AND customstring64 IN ("9d52af33c05ea80f9bc47404b02ace4e16203dd81aef9021924885a6bff1d3c1","15649e4d246fe6d03dc75ecb4cabe5d1f8723519ed8dd3176e1a97325e827daf","24480dbe306597da1ba393b6e30d542673066f98826cc07ac4b9033137f37dbf","f6ee01303cf1d68015eee49f7dc7f26151a04ae642a47e49c70806931ce652d3","edcf76600cd11ef7d6a5c319087041abc604e571239fe2dae4bca83688821a3a","e23d5cb32a2d62314a8b26a205b634ee968f5a0500c190bc6edb55ec70285eb5","9f2434d5f8d042323cc7964520d99bda661bb23ce505cb03c8a07758bc9397a6","8ca7304846c69300237a8577fbeec2720ea9a4bd09cb7fe484a8d5efc79ad073","bba75dc056ef7f9c4ade39b32174c5980233fc1551c41aca9487019191764bac","ca2c02f592d72cafc218f4edd1ea771f8d1458cb95c2c76c3e384e63cefd1fb6","6feb5361fd3abd3a7a733c30bfcc2b58fc774ac6aa91a468ce2e31dcffc9d4de","2c9f0f324e9cca0481162cdc21ee9b60a7541941a33af99113d08bbd859d7473")
index=activity AND rg_functionality="O365 General" AND filehash NOT NULL AND filehash IN ("9d52af33c05ea80f9bc47404b02ace4e16203dd81aef9021924885a6bff1d3c1","15649e4d246fe6d03dc75ecb4cabe5d1f8723519ed8dd3176e1a97325e827daf","24480dbe306597da1ba393b6e30d542673066f98826cc07ac4b9033137f37dbf","f6ee01303cf1d68015eee49f7dc7f26151a04ae642a47e49c70806931ce652d3","edcf76600cd11ef7d6a5c319087041abc604e571239fe2dae4bca83688821a3a","e23d5cb32a2d62314a8b26a205b634ee968f5a0500c190bc6edb55ec70285eb5","9f2434d5f8d042323cc7964520d99bda661bb23ce505cb03c8a07758bc9397a6","8ca7304846c69300237a8577fbeec2720ea9a4bd09cb7fe484a8d5efc79ad073","bba75dc056ef7f9c4ade39b32174c5980233fc1551c41aca9487019191764bac","ca2c02f592d72cafc218f4edd1ea771f8d1458cb95c2c76c3e384e63cefd1fb6","6feb5361fd3abd3a7a733c30bfcc2b58fc774ac6aa91a468ce2e31dcffc9d4de","2c9f0f324e9cca0481162cdc21ee9b60a7541941a33af99113d08bbd859d7473")
index=activity AND rg_functionality="O365 General" AND oldfilehash NOT NULL AND oldfilehash IN ("9d52af33c05ea80f9bc47404b02ace4e16203dd81aef9021924885a6bff1d3c1","15649e4d246fe6d03dc75ecb4cabe5d1f8723519ed8dd3176e1a97325e827daf","24480dbe306597da1ba393b6e30d542673066f98826cc07ac4b9033137f37dbf","f6ee01303cf1d68015eee49f7dc7f26151a04ae642a47e49c70806931ce652d3","edcf76600cd11ef7d6a5c319087041abc604e571239fe2dae4bca83688821a3a","e23d5cb32a2d62314a8b26a205b634ee968f5a0500c190bc6edb55ec70285eb5","9f2434d5f8d042323cc7964520d99bda661bb23ce505cb03c8a07758bc9397a6","8ca7304846c69300237a8577fbeec2720ea9a4bd09cb7fe484a8d5efc79ad073","bba75dc056ef7f9c4ade39b32174c5980233fc1551c41aca9487019191764bac","ca2c02f592d72cafc218f4edd1ea771f8d1458cb95c2c76c3e384e63cefd1fb6","6feb5361fd3abd3a7a733c30bfcc2b58fc774ac6aa91a468ce2e31dcffc9d4de","2c9f0f324e9cca0481162cdc21ee9b60a7541941a33af99113d08bbd859d7473")
index=activity AND rg_functionality="O365 General" AND customstring3 NOT NULL AND customstring3 IN ("9d52af33c05ea80f9bc47404b02ace4e16203dd81aef9021924885a6bff1d3c1","15649e4d246fe6d03dc75ecb4cabe5d1f8723519ed8dd3176e1a97325e827daf","24480dbe306597da1ba393b6e30d542673066f98826cc07ac4b9033137f37dbf","f6ee01303cf1d68015eee49f7dc7f26151a04ae642a47e49c70806931ce652d3","edcf76600cd11ef7d6a5c319087041abc604e571239fe2dae4bca83688821a3a","e23d5cb32a2d62314a8b26a205b634ee968f5a0500c190bc6edb55ec70285eb5","9f2434d5f8d042323cc7964520d99bda661bb23ce505cb03c8a07758bc9397a6","8ca7304846c69300237a8577fbeec2720ea9a4bd09cb7fe484a8d5efc79ad073","bba75dc056ef7f9c4ade39b32174c5980233fc1551c41aca9487019191764bac","ca2c02f592d72cafc218f4edd1ea771f8d1458cb95c2c76c3e384e63cefd1fb6","6feb5361fd3abd3a7a733c30bfcc2b58fc774ac6aa91a468ce2e31dcffc9d4de","2c9f0f324e9cca0481162cdc21ee9b60a7541941a33af99113d08bbd859d7473")
index=activity AND rg_functionality="O365 General" AND customstring64 NOT NULL AND customstring64 IN ("9d52af33c05ea80f9bc47404b02ace4e16203dd81aef9021924885a6bff1d3c1","15649e4d246fe6d03dc75ecb4cabe5d1f8723519ed8dd3176e1a97325e827daf","24480dbe306597da1ba393b6e30d542673066f98826cc07ac4b9033137f37dbf","f6ee01303cf1d68015eee49f7dc7f26151a04ae642a47e49c70806931ce652d3","edcf76600cd11ef7d6a5c319087041abc604e571239fe2dae4bca83688821a3a","e23d5cb32a2d62314a8b26a205b634ee968f5a0500c190bc6edb55ec70285eb5","9f2434d5f8d042323cc7964520d99bda661bb23ce505cb03c8a07758bc9397a6","8ca7304846c69300237a8577fbeec2720ea9a4bd09cb7fe484a8d5efc79ad073","bba75dc056ef7f9c4ade39b32174c5980233fc1551c41aca9487019191764bac","ca2c02f592d72cafc218f4edd1ea771f8d1458cb95c2c76c3e384e63cefd1fb6","6feb5361fd3abd3a7a733c30bfcc2b58fc774ac6aa91a468ce2e31dcffc9d4de","2c9f0f324e9cca0481162cdc21ee9b60a7541941a33af99113d08bbd859d7473")
