index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("23c4049121a9649682b3b901eaac0cc52c308756","9022f78087e1679035e09160d59d679dc3ac345d","be52275b0c2086735dac478dc4f09fd16031669a","c879a8eb6630b0cd7537b068f4e9af2c9ca08a62","25a593b9517d6c325598eab46833003c40f9491a","a9bbea73504139ce91a0ec20fef303c68a131cd4","334a88e288ae18c6e3fd7fb2d1ad9548497d52ce","4aeeae023766153a91b83d02b1b24da20c0dd135","3cac6ff7cddcb8f82409c79c85d976300fc60861","55eeaa904bc6518a2715cc77648e6c5187416a46","ff7b2c3938306261881c42e78d0df51d9bcdd574","089439168d3c75b4da94ab801f1c46ad6b9e1fdc","a5c36b8022751cfeb4a88a21153847df3870c7c0","ad3dbec2b621807fa9a2f1b2f575d7077e494626","4dc0ebfa52adf9b9eb4fa8f0a359c21a14e183fb","d102a34b3f0efb57f1d9f04eff26b256875a3aa1","2b9b740fb5fe0549810500476f567002683df71d","4fa2b2ab3e24ee9d130cfeda63c7ae1ccbc393dc","495a4b4757f3b1eec7fdaa9d0b2930071565f2b1","f31920d636224356e8c7a182c2b9b37e42a09181","9dc3d272652851428f5cc44f2fd9458bff1d6a78","4dd22a08a5b103e1f2238aed7f7ce66c5a542533","02065bbdb3209e0522db3225600b8e79f8a10293","81622512757f897206a84b29ee866fb933fa3d48","151dc47b213aaec3751ffd1427737c65757ab410","492cbe143f795888d8e5006ac595f65f4565ed6e","0e282dc84d6cfd447fece7d3ecc622523b143aa8","49cd96df4c85cdd7461701340c0bb4d05a5049d8","207b7cf5db59d70d4789cb91194c732bcd1cfb4b")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("23c4049121a9649682b3b901eaac0cc52c308756","9022f78087e1679035e09160d59d679dc3ac345d","be52275b0c2086735dac478dc4f09fd16031669a","c879a8eb6630b0cd7537b068f4e9af2c9ca08a62","25a593b9517d6c325598eab46833003c40f9491a","a9bbea73504139ce91a0ec20fef303c68a131cd4","334a88e288ae18c6e3fd7fb2d1ad9548497d52ce","4aeeae023766153a91b83d02b1b24da20c0dd135","3cac6ff7cddcb8f82409c79c85d976300fc60861","55eeaa904bc6518a2715cc77648e6c5187416a46","ff7b2c3938306261881c42e78d0df51d9bcdd574","089439168d3c75b4da94ab801f1c46ad6b9e1fdc","a5c36b8022751cfeb4a88a21153847df3870c7c0","ad3dbec2b621807fa9a2f1b2f575d7077e494626","4dc0ebfa52adf9b9eb4fa8f0a359c21a14e183fb","d102a34b3f0efb57f1d9f04eff26b256875a3aa1","2b9b740fb5fe0549810500476f567002683df71d","4fa2b2ab3e24ee9d130cfeda63c7ae1ccbc393dc","495a4b4757f3b1eec7fdaa9d0b2930071565f2b1","f31920d636224356e8c7a182c2b9b37e42a09181","9dc3d272652851428f5cc44f2fd9458bff1d6a78","4dd22a08a5b103e1f2238aed7f7ce66c5a542533","02065bbdb3209e0522db3225600b8e79f8a10293","81622512757f897206a84b29ee866fb933fa3d48","151dc47b213aaec3751ffd1427737c65757ab410","492cbe143f795888d8e5006ac595f65f4565ed6e","0e282dc84d6cfd447fece7d3ecc622523b143aa8","49cd96df4c85cdd7461701340c0bb4d05a5049d8","207b7cf5db59d70d4789cb91194c732bcd1cfb4b")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("23c4049121a9649682b3b901eaac0cc52c308756","9022f78087e1679035e09160d59d679dc3ac345d","be52275b0c2086735dac478dc4f09fd16031669a","c879a8eb6630b0cd7537b068f4e9af2c9ca08a62","25a593b9517d6c325598eab46833003c40f9491a","a9bbea73504139ce91a0ec20fef303c68a131cd4","334a88e288ae18c6e3fd7fb2d1ad9548497d52ce","4aeeae023766153a91b83d02b1b24da20c0dd135","3cac6ff7cddcb8f82409c79c85d976300fc60861","55eeaa904bc6518a2715cc77648e6c5187416a46","ff7b2c3938306261881c42e78d0df51d9bcdd574","089439168d3c75b4da94ab801f1c46ad6b9e1fdc","a5c36b8022751cfeb4a88a21153847df3870c7c0","ad3dbec2b621807fa9a2f1b2f575d7077e494626","4dc0ebfa52adf9b9eb4fa8f0a359c21a14e183fb","d102a34b3f0efb57f1d9f04eff26b256875a3aa1","2b9b740fb5fe0549810500476f567002683df71d","4fa2b2ab3e24ee9d130cfeda63c7ae1ccbc393dc","495a4b4757f3b1eec7fdaa9d0b2930071565f2b1","f31920d636224356e8c7a182c2b9b37e42a09181","9dc3d272652851428f5cc44f2fd9458bff1d6a78","4dd22a08a5b103e1f2238aed7f7ce66c5a542533","02065bbdb3209e0522db3225600b8e79f8a10293","81622512757f897206a84b29ee866fb933fa3d48","151dc47b213aaec3751ffd1427737c65757ab410","492cbe143f795888d8e5006ac595f65f4565ed6e","0e282dc84d6cfd447fece7d3ecc622523b143aa8","49cd96df4c85cdd7461701340c0bb4d05a5049d8","207b7cf5db59d70d4789cb91194c732bcd1cfb4b")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring64 NOT NULL AND customstring64 IN ("23c4049121a9649682b3b901eaac0cc52c308756","9022f78087e1679035e09160d59d679dc3ac345d","be52275b0c2086735dac478dc4f09fd16031669a","c879a8eb6630b0cd7537b068f4e9af2c9ca08a62","25a593b9517d6c325598eab46833003c40f9491a","a9bbea73504139ce91a0ec20fef303c68a131cd4","334a88e288ae18c6e3fd7fb2d1ad9548497d52ce","4aeeae023766153a91b83d02b1b24da20c0dd135","3cac6ff7cddcb8f82409c79c85d976300fc60861","55eeaa904bc6518a2715cc77648e6c5187416a46","ff7b2c3938306261881c42e78d0df51d9bcdd574","089439168d3c75b4da94ab801f1c46ad6b9e1fdc","a5c36b8022751cfeb4a88a21153847df3870c7c0","ad3dbec2b621807fa9a2f1b2f575d7077e494626","4dc0ebfa52adf9b9eb4fa8f0a359c21a14e183fb","d102a34b3f0efb57f1d9f04eff26b256875a3aa1","2b9b740fb5fe0549810500476f567002683df71d","4fa2b2ab3e24ee9d130cfeda63c7ae1ccbc393dc","495a4b4757f3b1eec7fdaa9d0b2930071565f2b1","f31920d636224356e8c7a182c2b9b37e42a09181","9dc3d272652851428f5cc44f2fd9458bff1d6a78","4dd22a08a5b103e1f2238aed7f7ce66c5a542533","02065bbdb3209e0522db3225600b8e79f8a10293","81622512757f897206a84b29ee866fb933fa3d48","151dc47b213aaec3751ffd1427737c65757ab410","492cbe143f795888d8e5006ac595f65f4565ed6e","0e282dc84d6cfd447fece7d3ecc622523b143aa8","49cd96df4c85cdd7461701340c0bb4d05a5049d8","207b7cf5db59d70d4789cb91194c732bcd1cfb4b")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("23c4049121a9649682b3b901eaac0cc52c308756","9022f78087e1679035e09160d59d679dc3ac345d","be52275b0c2086735dac478dc4f09fd16031669a","c879a8eb6630b0cd7537b068f4e9af2c9ca08a62","25a593b9517d6c325598eab46833003c40f9491a","a9bbea73504139ce91a0ec20fef303c68a131cd4","334a88e288ae18c6e3fd7fb2d1ad9548497d52ce","4aeeae023766153a91b83d02b1b24da20c0dd135","3cac6ff7cddcb8f82409c79c85d976300fc60861","55eeaa904bc6518a2715cc77648e6c5187416a46","ff7b2c3938306261881c42e78d0df51d9bcdd574","089439168d3c75b4da94ab801f1c46ad6b9e1fdc","a5c36b8022751cfeb4a88a21153847df3870c7c0","ad3dbec2b621807fa9a2f1b2f575d7077e494626","4dc0ebfa52adf9b9eb4fa8f0a359c21a14e183fb","d102a34b3f0efb57f1d9f04eff26b256875a3aa1","2b9b740fb5fe0549810500476f567002683df71d","4fa2b2ab3e24ee9d130cfeda63c7ae1ccbc393dc","495a4b4757f3b1eec7fdaa9d0b2930071565f2b1","f31920d636224356e8c7a182c2b9b37e42a09181","9dc3d272652851428f5cc44f2fd9458bff1d6a78","4dd22a08a5b103e1f2238aed7f7ce66c5a542533","02065bbdb3209e0522db3225600b8e79f8a10293","81622512757f897206a84b29ee866fb933fa3d48","151dc47b213aaec3751ffd1427737c65757ab410","492cbe143f795888d8e5006ac595f65f4565ed6e","0e282dc84d6cfd447fece7d3ecc622523b143aa8","49cd96df4c85cdd7461701340c0bb4d05a5049d8","207b7cf5db59d70d4789cb91194c732bcd1cfb4b")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("23c4049121a9649682b3b901eaac0cc52c308756","9022f78087e1679035e09160d59d679dc3ac345d","be52275b0c2086735dac478dc4f09fd16031669a","c879a8eb6630b0cd7537b068f4e9af2c9ca08a62","25a593b9517d6c325598eab46833003c40f9491a","a9bbea73504139ce91a0ec20fef303c68a131cd4","334a88e288ae18c6e3fd7fb2d1ad9548497d52ce","4aeeae023766153a91b83d02b1b24da20c0dd135","3cac6ff7cddcb8f82409c79c85d976300fc60861","55eeaa904bc6518a2715cc77648e6c5187416a46","ff7b2c3938306261881c42e78d0df51d9bcdd574","089439168d3c75b4da94ab801f1c46ad6b9e1fdc","a5c36b8022751cfeb4a88a21153847df3870c7c0","ad3dbec2b621807fa9a2f1b2f575d7077e494626","4dc0ebfa52adf9b9eb4fa8f0a359c21a14e183fb","d102a34b3f0efb57f1d9f04eff26b256875a3aa1","2b9b740fb5fe0549810500476f567002683df71d","4fa2b2ab3e24ee9d130cfeda63c7ae1ccbc393dc","495a4b4757f3b1eec7fdaa9d0b2930071565f2b1","f31920d636224356e8c7a182c2b9b37e42a09181","9dc3d272652851428f5cc44f2fd9458bff1d6a78","4dd22a08a5b103e1f2238aed7f7ce66c5a542533","02065bbdb3209e0522db3225600b8e79f8a10293","81622512757f897206a84b29ee866fb933fa3d48","151dc47b213aaec3751ffd1427737c65757ab410","492cbe143f795888d8e5006ac595f65f4565ed6e","0e282dc84d6cfd447fece7d3ecc622523b143aa8","49cd96df4c85cdd7461701340c0bb4d05a5049d8","207b7cf5db59d70d4789cb91194c732bcd1cfb4b")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("23c4049121a9649682b3b901eaac0cc52c308756","9022f78087e1679035e09160d59d679dc3ac345d","be52275b0c2086735dac478dc4f09fd16031669a","c879a8eb6630b0cd7537b068f4e9af2c9ca08a62","25a593b9517d6c325598eab46833003c40f9491a","a9bbea73504139ce91a0ec20fef303c68a131cd4","334a88e288ae18c6e3fd7fb2d1ad9548497d52ce","4aeeae023766153a91b83d02b1b24da20c0dd135","3cac6ff7cddcb8f82409c79c85d976300fc60861","55eeaa904bc6518a2715cc77648e6c5187416a46","ff7b2c3938306261881c42e78d0df51d9bcdd574","089439168d3c75b4da94ab801f1c46ad6b9e1fdc","a5c36b8022751cfeb4a88a21153847df3870c7c0","ad3dbec2b621807fa9a2f1b2f575d7077e494626","4dc0ebfa52adf9b9eb4fa8f0a359c21a14e183fb","d102a34b3f0efb57f1d9f04eff26b256875a3aa1","2b9b740fb5fe0549810500476f567002683df71d","4fa2b2ab3e24ee9d130cfeda63c7ae1ccbc393dc","495a4b4757f3b1eec7fdaa9d0b2930071565f2b1","f31920d636224356e8c7a182c2b9b37e42a09181","9dc3d272652851428f5cc44f2fd9458bff1d6a78","4dd22a08a5b103e1f2238aed7f7ce66c5a542533","02065bbdb3209e0522db3225600b8e79f8a10293","81622512757f897206a84b29ee866fb933fa3d48","151dc47b213aaec3751ffd1427737c65757ab410","492cbe143f795888d8e5006ac595f65f4565ed6e","0e282dc84d6cfd447fece7d3ecc622523b143aa8","49cd96df4c85cdd7461701340c0bb4d05a5049d8","207b7cf5db59d70d4789cb91194c732bcd1cfb4b")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("23c4049121a9649682b3b901eaac0cc52c308756","9022f78087e1679035e09160d59d679dc3ac345d","be52275b0c2086735dac478dc4f09fd16031669a","c879a8eb6630b0cd7537b068f4e9af2c9ca08a62","25a593b9517d6c325598eab46833003c40f9491a","a9bbea73504139ce91a0ec20fef303c68a131cd4","334a88e288ae18c6e3fd7fb2d1ad9548497d52ce","4aeeae023766153a91b83d02b1b24da20c0dd135","3cac6ff7cddcb8f82409c79c85d976300fc60861","55eeaa904bc6518a2715cc77648e6c5187416a46","ff7b2c3938306261881c42e78d0df51d9bcdd574","089439168d3c75b4da94ab801f1c46ad6b9e1fdc","a5c36b8022751cfeb4a88a21153847df3870c7c0","ad3dbec2b621807fa9a2f1b2f575d7077e494626","4dc0ebfa52adf9b9eb4fa8f0a359c21a14e183fb","d102a34b3f0efb57f1d9f04eff26b256875a3aa1","2b9b740fb5fe0549810500476f567002683df71d","4fa2b2ab3e24ee9d130cfeda63c7ae1ccbc393dc","495a4b4757f3b1eec7fdaa9d0b2930071565f2b1","f31920d636224356e8c7a182c2b9b37e42a09181","9dc3d272652851428f5cc44f2fd9458bff1d6a78","4dd22a08a5b103e1f2238aed7f7ce66c5a542533","02065bbdb3209e0522db3225600b8e79f8a10293","81622512757f897206a84b29ee866fb933fa3d48","151dc47b213aaec3751ffd1427737c65757ab410","492cbe143f795888d8e5006ac595f65f4565ed6e","0e282dc84d6cfd447fece7d3ecc622523b143aa8","49cd96df4c85cdd7461701340c0bb4d05a5049d8","207b7cf5db59d70d4789cb91194c732bcd1cfb4b")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("23c4049121a9649682b3b901eaac0cc52c308756","9022f78087e1679035e09160d59d679dc3ac345d","be52275b0c2086735dac478dc4f09fd16031669a","c879a8eb6630b0cd7537b068f4e9af2c9ca08a62","25a593b9517d6c325598eab46833003c40f9491a","a9bbea73504139ce91a0ec20fef303c68a131cd4","334a88e288ae18c6e3fd7fb2d1ad9548497d52ce","4aeeae023766153a91b83d02b1b24da20c0dd135","3cac6ff7cddcb8f82409c79c85d976300fc60861","55eeaa904bc6518a2715cc77648e6c5187416a46","ff7b2c3938306261881c42e78d0df51d9bcdd574","089439168d3c75b4da94ab801f1c46ad6b9e1fdc","a5c36b8022751cfeb4a88a21153847df3870c7c0","ad3dbec2b621807fa9a2f1b2f575d7077e494626","4dc0ebfa52adf9b9eb4fa8f0a359c21a14e183fb","d102a34b3f0efb57f1d9f04eff26b256875a3aa1","2b9b740fb5fe0549810500476f567002683df71d","4fa2b2ab3e24ee9d130cfeda63c7ae1ccbc393dc","495a4b4757f3b1eec7fdaa9d0b2930071565f2b1","f31920d636224356e8c7a182c2b9b37e42a09181","9dc3d272652851428f5cc44f2fd9458bff1d6a78","4dd22a08a5b103e1f2238aed7f7ce66c5a542533","02065bbdb3209e0522db3225600b8e79f8a10293","81622512757f897206a84b29ee866fb933fa3d48","151dc47b213aaec3751ffd1427737c65757ab410","492cbe143f795888d8e5006ac595f65f4565ed6e","0e282dc84d6cfd447fece7d3ecc622523b143aa8","49cd96df4c85cdd7461701340c0bb4d05a5049d8","207b7cf5db59d70d4789cb91194c732bcd1cfb4b")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("23c4049121a9649682b3b901eaac0cc52c308756","9022f78087e1679035e09160d59d679dc3ac345d","be52275b0c2086735dac478dc4f09fd16031669a","c879a8eb6630b0cd7537b068f4e9af2c9ca08a62","25a593b9517d6c325598eab46833003c40f9491a","a9bbea73504139ce91a0ec20fef303c68a131cd4","334a88e288ae18c6e3fd7fb2d1ad9548497d52ce","4aeeae023766153a91b83d02b1b24da20c0dd135","3cac6ff7cddcb8f82409c79c85d976300fc60861","55eeaa904bc6518a2715cc77648e6c5187416a46","ff7b2c3938306261881c42e78d0df51d9bcdd574","089439168d3c75b4da94ab801f1c46ad6b9e1fdc","a5c36b8022751cfeb4a88a21153847df3870c7c0","ad3dbec2b621807fa9a2f1b2f575d7077e494626","4dc0ebfa52adf9b9eb4fa8f0a359c21a14e183fb","d102a34b3f0efb57f1d9f04eff26b256875a3aa1","2b9b740fb5fe0549810500476f567002683df71d","4fa2b2ab3e24ee9d130cfeda63c7ae1ccbc393dc","495a4b4757f3b1eec7fdaa9d0b2930071565f2b1","f31920d636224356e8c7a182c2b9b37e42a09181","9dc3d272652851428f5cc44f2fd9458bff1d6a78","4dd22a08a5b103e1f2238aed7f7ce66c5a542533","02065bbdb3209e0522db3225600b8e79f8a10293","81622512757f897206a84b29ee866fb933fa3d48","151dc47b213aaec3751ffd1427737c65757ab410","492cbe143f795888d8e5006ac595f65f4565ed6e","0e282dc84d6cfd447fece7d3ecc622523b143aa8","49cd96df4c85cdd7461701340c0bb4d05a5049d8","207b7cf5db59d70d4789cb91194c732bcd1cfb4b")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("23c4049121a9649682b3b901eaac0cc52c308756","9022f78087e1679035e09160d59d679dc3ac345d","be52275b0c2086735dac478dc4f09fd16031669a","c879a8eb6630b0cd7537b068f4e9af2c9ca08a62","25a593b9517d6c325598eab46833003c40f9491a","a9bbea73504139ce91a0ec20fef303c68a131cd4","334a88e288ae18c6e3fd7fb2d1ad9548497d52ce","4aeeae023766153a91b83d02b1b24da20c0dd135","3cac6ff7cddcb8f82409c79c85d976300fc60861","55eeaa904bc6518a2715cc77648e6c5187416a46","ff7b2c3938306261881c42e78d0df51d9bcdd574","089439168d3c75b4da94ab801f1c46ad6b9e1fdc","a5c36b8022751cfeb4a88a21153847df3870c7c0","ad3dbec2b621807fa9a2f1b2f575d7077e494626","4dc0ebfa52adf9b9eb4fa8f0a359c21a14e183fb","d102a34b3f0efb57f1d9f04eff26b256875a3aa1","2b9b740fb5fe0549810500476f567002683df71d","4fa2b2ab3e24ee9d130cfeda63c7ae1ccbc393dc","495a4b4757f3b1eec7fdaa9d0b2930071565f2b1","f31920d636224356e8c7a182c2b9b37e42a09181","9dc3d272652851428f5cc44f2fd9458bff1d6a78","4dd22a08a5b103e1f2238aed7f7ce66c5a542533","02065bbdb3209e0522db3225600b8e79f8a10293","81622512757f897206a84b29ee866fb933fa3d48","151dc47b213aaec3751ffd1427737c65757ab410","492cbe143f795888d8e5006ac595f65f4565ed6e","0e282dc84d6cfd447fece7d3ecc622523b143aa8","49cd96df4c85cdd7461701340c0bb4d05a5049d8","207b7cf5db59d70d4789cb91194c732bcd1cfb4b")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("23c4049121a9649682b3b901eaac0cc52c308756","9022f78087e1679035e09160d59d679dc3ac345d","be52275b0c2086735dac478dc4f09fd16031669a","c879a8eb6630b0cd7537b068f4e9af2c9ca08a62","25a593b9517d6c325598eab46833003c40f9491a","a9bbea73504139ce91a0ec20fef303c68a131cd4","334a88e288ae18c6e3fd7fb2d1ad9548497d52ce","4aeeae023766153a91b83d02b1b24da20c0dd135","3cac6ff7cddcb8f82409c79c85d976300fc60861","55eeaa904bc6518a2715cc77648e6c5187416a46","ff7b2c3938306261881c42e78d0df51d9bcdd574","089439168d3c75b4da94ab801f1c46ad6b9e1fdc","a5c36b8022751cfeb4a88a21153847df3870c7c0","ad3dbec2b621807fa9a2f1b2f575d7077e494626","4dc0ebfa52adf9b9eb4fa8f0a359c21a14e183fb","d102a34b3f0efb57f1d9f04eff26b256875a3aa1","2b9b740fb5fe0549810500476f567002683df71d","4fa2b2ab3e24ee9d130cfeda63c7ae1ccbc393dc","495a4b4757f3b1eec7fdaa9d0b2930071565f2b1","f31920d636224356e8c7a182c2b9b37e42a09181","9dc3d272652851428f5cc44f2fd9458bff1d6a78","4dd22a08a5b103e1f2238aed7f7ce66c5a542533","02065bbdb3209e0522db3225600b8e79f8a10293","81622512757f897206a84b29ee866fb933fa3d48","151dc47b213aaec3751ffd1427737c65757ab410","492cbe143f795888d8e5006ac595f65f4565ed6e","0e282dc84d6cfd447fece7d3ecc622523b143aa8","49cd96df4c85cdd7461701340c0bb4d05a5049d8","207b7cf5db59d70d4789cb91194c732bcd1cfb4b")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("23c4049121a9649682b3b901eaac0cc52c308756","9022f78087e1679035e09160d59d679dc3ac345d","be52275b0c2086735dac478dc4f09fd16031669a","c879a8eb6630b0cd7537b068f4e9af2c9ca08a62","25a593b9517d6c325598eab46833003c40f9491a","a9bbea73504139ce91a0ec20fef303c68a131cd4","334a88e288ae18c6e3fd7fb2d1ad9548497d52ce","4aeeae023766153a91b83d02b1b24da20c0dd135","3cac6ff7cddcb8f82409c79c85d976300fc60861","55eeaa904bc6518a2715cc77648e6c5187416a46","ff7b2c3938306261881c42e78d0df51d9bcdd574","089439168d3c75b4da94ab801f1c46ad6b9e1fdc","a5c36b8022751cfeb4a88a21153847df3870c7c0","ad3dbec2b621807fa9a2f1b2f575d7077e494626","4dc0ebfa52adf9b9eb4fa8f0a359c21a14e183fb","d102a34b3f0efb57f1d9f04eff26b256875a3aa1","2b9b740fb5fe0549810500476f567002683df71d","4fa2b2ab3e24ee9d130cfeda63c7ae1ccbc393dc","495a4b4757f3b1eec7fdaa9d0b2930071565f2b1","f31920d636224356e8c7a182c2b9b37e42a09181","9dc3d272652851428f5cc44f2fd9458bff1d6a78","4dd22a08a5b103e1f2238aed7f7ce66c5a542533","02065bbdb3209e0522db3225600b8e79f8a10293","81622512757f897206a84b29ee866fb933fa3d48","151dc47b213aaec3751ffd1427737c65757ab410","492cbe143f795888d8e5006ac595f65f4565ed6e","0e282dc84d6cfd447fece7d3ecc622523b143aa8","49cd96df4c85cdd7461701340c0bb4d05a5049d8","207b7cf5db59d70d4789cb91194c732bcd1cfb4b")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("23c4049121a9649682b3b901eaac0cc52c308756","9022f78087e1679035e09160d59d679dc3ac345d","be52275b0c2086735dac478dc4f09fd16031669a","c879a8eb6630b0cd7537b068f4e9af2c9ca08a62","25a593b9517d6c325598eab46833003c40f9491a","a9bbea73504139ce91a0ec20fef303c68a131cd4","334a88e288ae18c6e3fd7fb2d1ad9548497d52ce","4aeeae023766153a91b83d02b1b24da20c0dd135","3cac6ff7cddcb8f82409c79c85d976300fc60861","55eeaa904bc6518a2715cc77648e6c5187416a46","ff7b2c3938306261881c42e78d0df51d9bcdd574","089439168d3c75b4da94ab801f1c46ad6b9e1fdc","a5c36b8022751cfeb4a88a21153847df3870c7c0","ad3dbec2b621807fa9a2f1b2f575d7077e494626","4dc0ebfa52adf9b9eb4fa8f0a359c21a14e183fb","d102a34b3f0efb57f1d9f04eff26b256875a3aa1","2b9b740fb5fe0549810500476f567002683df71d","4fa2b2ab3e24ee9d130cfeda63c7ae1ccbc393dc","495a4b4757f3b1eec7fdaa9d0b2930071565f2b1","f31920d636224356e8c7a182c2b9b37e42a09181","9dc3d272652851428f5cc44f2fd9458bff1d6a78","4dd22a08a5b103e1f2238aed7f7ce66c5a542533","02065bbdb3209e0522db3225600b8e79f8a10293","81622512757f897206a84b29ee866fb933fa3d48","151dc47b213aaec3751ffd1427737c65757ab410","492cbe143f795888d8e5006ac595f65f4565ed6e","0e282dc84d6cfd447fece7d3ecc622523b143aa8","49cd96df4c85cdd7461701340c0bb4d05a5049d8","207b7cf5db59d70d4789cb91194c732bcd1cfb4b")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("23c4049121a9649682b3b901eaac0cc52c308756","9022f78087e1679035e09160d59d679dc3ac345d","be52275b0c2086735dac478dc4f09fd16031669a","c879a8eb6630b0cd7537b068f4e9af2c9ca08a62","25a593b9517d6c325598eab46833003c40f9491a","a9bbea73504139ce91a0ec20fef303c68a131cd4","334a88e288ae18c6e3fd7fb2d1ad9548497d52ce","4aeeae023766153a91b83d02b1b24da20c0dd135","3cac6ff7cddcb8f82409c79c85d976300fc60861","55eeaa904bc6518a2715cc77648e6c5187416a46","ff7b2c3938306261881c42e78d0df51d9bcdd574","089439168d3c75b4da94ab801f1c46ad6b9e1fdc","a5c36b8022751cfeb4a88a21153847df3870c7c0","ad3dbec2b621807fa9a2f1b2f575d7077e494626","4dc0ebfa52adf9b9eb4fa8f0a359c21a14e183fb","d102a34b3f0efb57f1d9f04eff26b256875a3aa1","2b9b740fb5fe0549810500476f567002683df71d","4fa2b2ab3e24ee9d130cfeda63c7ae1ccbc393dc","495a4b4757f3b1eec7fdaa9d0b2930071565f2b1","f31920d636224356e8c7a182c2b9b37e42a09181","9dc3d272652851428f5cc44f2fd9458bff1d6a78","4dd22a08a5b103e1f2238aed7f7ce66c5a542533","02065bbdb3209e0522db3225600b8e79f8a10293","81622512757f897206a84b29ee866fb933fa3d48","151dc47b213aaec3751ffd1427737c65757ab410","492cbe143f795888d8e5006ac595f65f4565ed6e","0e282dc84d6cfd447fece7d3ecc622523b143aa8","49cd96df4c85cdd7461701340c0bb4d05a5049d8","207b7cf5db59d70d4789cb91194c732bcd1cfb4b")
index=activity AND rg_functionality="Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("23c4049121a9649682b3b901eaac0cc52c308756","9022f78087e1679035e09160d59d679dc3ac345d","be52275b0c2086735dac478dc4f09fd16031669a","c879a8eb6630b0cd7537b068f4e9af2c9ca08a62","25a593b9517d6c325598eab46833003c40f9491a","a9bbea73504139ce91a0ec20fef303c68a131cd4","334a88e288ae18c6e3fd7fb2d1ad9548497d52ce","4aeeae023766153a91b83d02b1b24da20c0dd135","3cac6ff7cddcb8f82409c79c85d976300fc60861","55eeaa904bc6518a2715cc77648e6c5187416a46","ff7b2c3938306261881c42e78d0df51d9bcdd574","089439168d3c75b4da94ab801f1c46ad6b9e1fdc","a5c36b8022751cfeb4a88a21153847df3870c7c0","ad3dbec2b621807fa9a2f1b2f575d7077e494626","4dc0ebfa52adf9b9eb4fa8f0a359c21a14e183fb","d102a34b3f0efb57f1d9f04eff26b256875a3aa1","2b9b740fb5fe0549810500476f567002683df71d","4fa2b2ab3e24ee9d130cfeda63c7ae1ccbc393dc","495a4b4757f3b1eec7fdaa9d0b2930071565f2b1","f31920d636224356e8c7a182c2b9b37e42a09181","9dc3d272652851428f5cc44f2fd9458bff1d6a78","4dd22a08a5b103e1f2238aed7f7ce66c5a542533","02065bbdb3209e0522db3225600b8e79f8a10293","81622512757f897206a84b29ee866fb933fa3d48","151dc47b213aaec3751ffd1427737c65757ab410","492cbe143f795888d8e5006ac595f65f4565ed6e","0e282dc84d6cfd447fece7d3ecc622523b143aa8","49cd96df4c85cdd7461701340c0bb4d05a5049d8","207b7cf5db59d70d4789cb91194c732bcd1cfb4b")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("23c4049121a9649682b3b901eaac0cc52c308756","9022f78087e1679035e09160d59d679dc3ac345d","be52275b0c2086735dac478dc4f09fd16031669a","c879a8eb6630b0cd7537b068f4e9af2c9ca08a62","25a593b9517d6c325598eab46833003c40f9491a","a9bbea73504139ce91a0ec20fef303c68a131cd4","334a88e288ae18c6e3fd7fb2d1ad9548497d52ce","4aeeae023766153a91b83d02b1b24da20c0dd135","3cac6ff7cddcb8f82409c79c85d976300fc60861","55eeaa904bc6518a2715cc77648e6c5187416a46","ff7b2c3938306261881c42e78d0df51d9bcdd574","089439168d3c75b4da94ab801f1c46ad6b9e1fdc","a5c36b8022751cfeb4a88a21153847df3870c7c0","ad3dbec2b621807fa9a2f1b2f575d7077e494626","4dc0ebfa52adf9b9eb4fa8f0a359c21a14e183fb","d102a34b3f0efb57f1d9f04eff26b256875a3aa1","2b9b740fb5fe0549810500476f567002683df71d","4fa2b2ab3e24ee9d130cfeda63c7ae1ccbc393dc","495a4b4757f3b1eec7fdaa9d0b2930071565f2b1","f31920d636224356e8c7a182c2b9b37e42a09181","9dc3d272652851428f5cc44f2fd9458bff1d6a78","4dd22a08a5b103e1f2238aed7f7ce66c5a542533","02065bbdb3209e0522db3225600b8e79f8a10293","81622512757f897206a84b29ee866fb933fa3d48","151dc47b213aaec3751ffd1427737c65757ab410","492cbe143f795888d8e5006ac595f65f4565ed6e","0e282dc84d6cfd447fece7d3ecc622523b143aa8","49cd96df4c85cdd7461701340c0bb4d05a5049d8","207b7cf5db59d70d4789cb91194c732bcd1cfb4b")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("23c4049121a9649682b3b901eaac0cc52c308756","9022f78087e1679035e09160d59d679dc3ac345d","be52275b0c2086735dac478dc4f09fd16031669a","c879a8eb6630b0cd7537b068f4e9af2c9ca08a62","25a593b9517d6c325598eab46833003c40f9491a","a9bbea73504139ce91a0ec20fef303c68a131cd4","334a88e288ae18c6e3fd7fb2d1ad9548497d52ce","4aeeae023766153a91b83d02b1b24da20c0dd135","3cac6ff7cddcb8f82409c79c85d976300fc60861","55eeaa904bc6518a2715cc77648e6c5187416a46","ff7b2c3938306261881c42e78d0df51d9bcdd574","089439168d3c75b4da94ab801f1c46ad6b9e1fdc","a5c36b8022751cfeb4a88a21153847df3870c7c0","ad3dbec2b621807fa9a2f1b2f575d7077e494626","4dc0ebfa52adf9b9eb4fa8f0a359c21a14e183fb","d102a34b3f0efb57f1d9f04eff26b256875a3aa1","2b9b740fb5fe0549810500476f567002683df71d","4fa2b2ab3e24ee9d130cfeda63c7ae1ccbc393dc","495a4b4757f3b1eec7fdaa9d0b2930071565f2b1","f31920d636224356e8c7a182c2b9b37e42a09181","9dc3d272652851428f5cc44f2fd9458bff1d6a78","4dd22a08a5b103e1f2238aed7f7ce66c5a542533","02065bbdb3209e0522db3225600b8e79f8a10293","81622512757f897206a84b29ee866fb933fa3d48","151dc47b213aaec3751ffd1427737c65757ab410","492cbe143f795888d8e5006ac595f65f4565ed6e","0e282dc84d6cfd447fece7d3ecc622523b143aa8","49cd96df4c85cdd7461701340c0bb4d05a5049d8","207b7cf5db59d70d4789cb91194c732bcd1cfb4b")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("23c4049121a9649682b3b901eaac0cc52c308756","9022f78087e1679035e09160d59d679dc3ac345d","be52275b0c2086735dac478dc4f09fd16031669a","c879a8eb6630b0cd7537b068f4e9af2c9ca08a62","25a593b9517d6c325598eab46833003c40f9491a","a9bbea73504139ce91a0ec20fef303c68a131cd4","334a88e288ae18c6e3fd7fb2d1ad9548497d52ce","4aeeae023766153a91b83d02b1b24da20c0dd135","3cac6ff7cddcb8f82409c79c85d976300fc60861","55eeaa904bc6518a2715cc77648e6c5187416a46","ff7b2c3938306261881c42e78d0df51d9bcdd574","089439168d3c75b4da94ab801f1c46ad6b9e1fdc","a5c36b8022751cfeb4a88a21153847df3870c7c0","ad3dbec2b621807fa9a2f1b2f575d7077e494626","4dc0ebfa52adf9b9eb4fa8f0a359c21a14e183fb","d102a34b3f0efb57f1d9f04eff26b256875a3aa1","2b9b740fb5fe0549810500476f567002683df71d","4fa2b2ab3e24ee9d130cfeda63c7ae1ccbc393dc","495a4b4757f3b1eec7fdaa9d0b2930071565f2b1","f31920d636224356e8c7a182c2b9b37e42a09181","9dc3d272652851428f5cc44f2fd9458bff1d6a78","4dd22a08a5b103e1f2238aed7f7ce66c5a542533","02065bbdb3209e0522db3225600b8e79f8a10293","81622512757f897206a84b29ee866fb933fa3d48","151dc47b213aaec3751ffd1427737c65757ab410","492cbe143f795888d8e5006ac595f65f4565ed6e","0e282dc84d6cfd447fece7d3ecc622523b143aa8","49cd96df4c85cdd7461701340c0bb4d05a5049d8","207b7cf5db59d70d4789cb91194c732bcd1cfb4b")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("23c4049121a9649682b3b901eaac0cc52c308756","9022f78087e1679035e09160d59d679dc3ac345d","be52275b0c2086735dac478dc4f09fd16031669a","c879a8eb6630b0cd7537b068f4e9af2c9ca08a62","25a593b9517d6c325598eab46833003c40f9491a","a9bbea73504139ce91a0ec20fef303c68a131cd4","334a88e288ae18c6e3fd7fb2d1ad9548497d52ce","4aeeae023766153a91b83d02b1b24da20c0dd135","3cac6ff7cddcb8f82409c79c85d976300fc60861","55eeaa904bc6518a2715cc77648e6c5187416a46","ff7b2c3938306261881c42e78d0df51d9bcdd574","089439168d3c75b4da94ab801f1c46ad6b9e1fdc","a5c36b8022751cfeb4a88a21153847df3870c7c0","ad3dbec2b621807fa9a2f1b2f575d7077e494626","4dc0ebfa52adf9b9eb4fa8f0a359c21a14e183fb","d102a34b3f0efb57f1d9f04eff26b256875a3aa1","2b9b740fb5fe0549810500476f567002683df71d","4fa2b2ab3e24ee9d130cfeda63c7ae1ccbc393dc","495a4b4757f3b1eec7fdaa9d0b2930071565f2b1","f31920d636224356e8c7a182c2b9b37e42a09181","9dc3d272652851428f5cc44f2fd9458bff1d6a78","4dd22a08a5b103e1f2238aed7f7ce66c5a542533","02065bbdb3209e0522db3225600b8e79f8a10293","81622512757f897206a84b29ee866fb933fa3d48","151dc47b213aaec3751ffd1427737c65757ab410","492cbe143f795888d8e5006ac595f65f4565ed6e","0e282dc84d6cfd447fece7d3ecc622523b143aa8","49cd96df4c85cdd7461701340c0bb4d05a5049d8","207b7cf5db59d70d4789cb91194c732bcd1cfb4b")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("23c4049121a9649682b3b901eaac0cc52c308756","9022f78087e1679035e09160d59d679dc3ac345d","be52275b0c2086735dac478dc4f09fd16031669a","c879a8eb6630b0cd7537b068f4e9af2c9ca08a62","25a593b9517d6c325598eab46833003c40f9491a","a9bbea73504139ce91a0ec20fef303c68a131cd4","334a88e288ae18c6e3fd7fb2d1ad9548497d52ce","4aeeae023766153a91b83d02b1b24da20c0dd135","3cac6ff7cddcb8f82409c79c85d976300fc60861","55eeaa904bc6518a2715cc77648e6c5187416a46","ff7b2c3938306261881c42e78d0df51d9bcdd574","089439168d3c75b4da94ab801f1c46ad6b9e1fdc","a5c36b8022751cfeb4a88a21153847df3870c7c0","ad3dbec2b621807fa9a2f1b2f575d7077e494626","4dc0ebfa52adf9b9eb4fa8f0a359c21a14e183fb","d102a34b3f0efb57f1d9f04eff26b256875a3aa1","2b9b740fb5fe0549810500476f567002683df71d","4fa2b2ab3e24ee9d130cfeda63c7ae1ccbc393dc","495a4b4757f3b1eec7fdaa9d0b2930071565f2b1","f31920d636224356e8c7a182c2b9b37e42a09181","9dc3d272652851428f5cc44f2fd9458bff1d6a78","4dd22a08a5b103e1f2238aed7f7ce66c5a542533","02065bbdb3209e0522db3225600b8e79f8a10293","81622512757f897206a84b29ee866fb933fa3d48","151dc47b213aaec3751ffd1427737c65757ab410","492cbe143f795888d8e5006ac595f65f4565ed6e","0e282dc84d6cfd447fece7d3ecc622523b143aa8","49cd96df4c85cdd7461701340c0bb4d05a5049d8","207b7cf5db59d70d4789cb91194c732bcd1cfb4b")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("23c4049121a9649682b3b901eaac0cc52c308756","9022f78087e1679035e09160d59d679dc3ac345d","be52275b0c2086735dac478dc4f09fd16031669a","c879a8eb6630b0cd7537b068f4e9af2c9ca08a62","25a593b9517d6c325598eab46833003c40f9491a","a9bbea73504139ce91a0ec20fef303c68a131cd4","334a88e288ae18c6e3fd7fb2d1ad9548497d52ce","4aeeae023766153a91b83d02b1b24da20c0dd135","3cac6ff7cddcb8f82409c79c85d976300fc60861","55eeaa904bc6518a2715cc77648e6c5187416a46","ff7b2c3938306261881c42e78d0df51d9bcdd574","089439168d3c75b4da94ab801f1c46ad6b9e1fdc","a5c36b8022751cfeb4a88a21153847df3870c7c0","ad3dbec2b621807fa9a2f1b2f575d7077e494626","4dc0ebfa52adf9b9eb4fa8f0a359c21a14e183fb","d102a34b3f0efb57f1d9f04eff26b256875a3aa1","2b9b740fb5fe0549810500476f567002683df71d","4fa2b2ab3e24ee9d130cfeda63c7ae1ccbc393dc","495a4b4757f3b1eec7fdaa9d0b2930071565f2b1","f31920d636224356e8c7a182c2b9b37e42a09181","9dc3d272652851428f5cc44f2fd9458bff1d6a78","4dd22a08a5b103e1f2238aed7f7ce66c5a542533","02065bbdb3209e0522db3225600b8e79f8a10293","81622512757f897206a84b29ee866fb933fa3d48","151dc47b213aaec3751ffd1427737c65757ab410","492cbe143f795888d8e5006ac595f65f4565ed6e","0e282dc84d6cfd447fece7d3ecc622523b143aa8","49cd96df4c85cdd7461701340c0bb4d05a5049d8","207b7cf5db59d70d4789cb91194c732bcd1cfb4b")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("23c4049121a9649682b3b901eaac0cc52c308756","9022f78087e1679035e09160d59d679dc3ac345d","be52275b0c2086735dac478dc4f09fd16031669a","c879a8eb6630b0cd7537b068f4e9af2c9ca08a62","25a593b9517d6c325598eab46833003c40f9491a","a9bbea73504139ce91a0ec20fef303c68a131cd4","334a88e288ae18c6e3fd7fb2d1ad9548497d52ce","4aeeae023766153a91b83d02b1b24da20c0dd135","3cac6ff7cddcb8f82409c79c85d976300fc60861","55eeaa904bc6518a2715cc77648e6c5187416a46","ff7b2c3938306261881c42e78d0df51d9bcdd574","089439168d3c75b4da94ab801f1c46ad6b9e1fdc","a5c36b8022751cfeb4a88a21153847df3870c7c0","ad3dbec2b621807fa9a2f1b2f575d7077e494626","4dc0ebfa52adf9b9eb4fa8f0a359c21a14e183fb","d102a34b3f0efb57f1d9f04eff26b256875a3aa1","2b9b740fb5fe0549810500476f567002683df71d","4fa2b2ab3e24ee9d130cfeda63c7ae1ccbc393dc","495a4b4757f3b1eec7fdaa9d0b2930071565f2b1","f31920d636224356e8c7a182c2b9b37e42a09181","9dc3d272652851428f5cc44f2fd9458bff1d6a78","4dd22a08a5b103e1f2238aed7f7ce66c5a542533","02065bbdb3209e0522db3225600b8e79f8a10293","81622512757f897206a84b29ee866fb933fa3d48","151dc47b213aaec3751ffd1427737c65757ab410","492cbe143f795888d8e5006ac595f65f4565ed6e","0e282dc84d6cfd447fece7d3ecc622523b143aa8","49cd96df4c85cdd7461701340c0bb4d05a5049d8","207b7cf5db59d70d4789cb91194c732bcd1cfb4b")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring64 NOT NULL AND customstring64 IN ("23c4049121a9649682b3b901eaac0cc52c308756","9022f78087e1679035e09160d59d679dc3ac345d","be52275b0c2086735dac478dc4f09fd16031669a","c879a8eb6630b0cd7537b068f4e9af2c9ca08a62","25a593b9517d6c325598eab46833003c40f9491a","a9bbea73504139ce91a0ec20fef303c68a131cd4","334a88e288ae18c6e3fd7fb2d1ad9548497d52ce","4aeeae023766153a91b83d02b1b24da20c0dd135","3cac6ff7cddcb8f82409c79c85d976300fc60861","55eeaa904bc6518a2715cc77648e6c5187416a46","ff7b2c3938306261881c42e78d0df51d9bcdd574","089439168d3c75b4da94ab801f1c46ad6b9e1fdc","a5c36b8022751cfeb4a88a21153847df3870c7c0","ad3dbec2b621807fa9a2f1b2f575d7077e494626","4dc0ebfa52adf9b9eb4fa8f0a359c21a14e183fb","d102a34b3f0efb57f1d9f04eff26b256875a3aa1","2b9b740fb5fe0549810500476f567002683df71d","4fa2b2ab3e24ee9d130cfeda63c7ae1ccbc393dc","495a4b4757f3b1eec7fdaa9d0b2930071565f2b1","f31920d636224356e8c7a182c2b9b37e42a09181","9dc3d272652851428f5cc44f2fd9458bff1d6a78","4dd22a08a5b103e1f2238aed7f7ce66c5a542533","02065bbdb3209e0522db3225600b8e79f8a10293","81622512757f897206a84b29ee866fb933fa3d48","151dc47b213aaec3751ffd1427737c65757ab410","492cbe143f795888d8e5006ac595f65f4565ed6e","0e282dc84d6cfd447fece7d3ecc622523b143aa8","49cd96df4c85cdd7461701340c0bb4d05a5049d8","207b7cf5db59d70d4789cb91194c732bcd1cfb4b")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("23c4049121a9649682b3b901eaac0cc52c308756","9022f78087e1679035e09160d59d679dc3ac345d","be52275b0c2086735dac478dc4f09fd16031669a","c879a8eb6630b0cd7537b068f4e9af2c9ca08a62","25a593b9517d6c325598eab46833003c40f9491a","a9bbea73504139ce91a0ec20fef303c68a131cd4","334a88e288ae18c6e3fd7fb2d1ad9548497d52ce","4aeeae023766153a91b83d02b1b24da20c0dd135","3cac6ff7cddcb8f82409c79c85d976300fc60861","55eeaa904bc6518a2715cc77648e6c5187416a46","ff7b2c3938306261881c42e78d0df51d9bcdd574","089439168d3c75b4da94ab801f1c46ad6b9e1fdc","a5c36b8022751cfeb4a88a21153847df3870c7c0","ad3dbec2b621807fa9a2f1b2f575d7077e494626","4dc0ebfa52adf9b9eb4fa8f0a359c21a14e183fb","d102a34b3f0efb57f1d9f04eff26b256875a3aa1","2b9b740fb5fe0549810500476f567002683df71d","4fa2b2ab3e24ee9d130cfeda63c7ae1ccbc393dc","495a4b4757f3b1eec7fdaa9d0b2930071565f2b1","f31920d636224356e8c7a182c2b9b37e42a09181","9dc3d272652851428f5cc44f2fd9458bff1d6a78","4dd22a08a5b103e1f2238aed7f7ce66c5a542533","02065bbdb3209e0522db3225600b8e79f8a10293","81622512757f897206a84b29ee866fb933fa3d48","151dc47b213aaec3751ffd1427737c65757ab410","492cbe143f795888d8e5006ac595f65f4565ed6e","0e282dc84d6cfd447fece7d3ecc622523b143aa8","49cd96df4c85cdd7461701340c0bb4d05a5049d8","207b7cf5db59d70d4789cb91194c732bcd1cfb4b")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("23c4049121a9649682b3b901eaac0cc52c308756","9022f78087e1679035e09160d59d679dc3ac345d","be52275b0c2086735dac478dc4f09fd16031669a","c879a8eb6630b0cd7537b068f4e9af2c9ca08a62","25a593b9517d6c325598eab46833003c40f9491a","a9bbea73504139ce91a0ec20fef303c68a131cd4","334a88e288ae18c6e3fd7fb2d1ad9548497d52ce","4aeeae023766153a91b83d02b1b24da20c0dd135","3cac6ff7cddcb8f82409c79c85d976300fc60861","55eeaa904bc6518a2715cc77648e6c5187416a46","ff7b2c3938306261881c42e78d0df51d9bcdd574","089439168d3c75b4da94ab801f1c46ad6b9e1fdc","a5c36b8022751cfeb4a88a21153847df3870c7c0","ad3dbec2b621807fa9a2f1b2f575d7077e494626","4dc0ebfa52adf9b9eb4fa8f0a359c21a14e183fb","d102a34b3f0efb57f1d9f04eff26b256875a3aa1","2b9b740fb5fe0549810500476f567002683df71d","4fa2b2ab3e24ee9d130cfeda63c7ae1ccbc393dc","495a4b4757f3b1eec7fdaa9d0b2930071565f2b1","f31920d636224356e8c7a182c2b9b37e42a09181","9dc3d272652851428f5cc44f2fd9458bff1d6a78","4dd22a08a5b103e1f2238aed7f7ce66c5a542533","02065bbdb3209e0522db3225600b8e79f8a10293","81622512757f897206a84b29ee866fb933fa3d48","151dc47b213aaec3751ffd1427737c65757ab410","492cbe143f795888d8e5006ac595f65f4565ed6e","0e282dc84d6cfd447fece7d3ecc622523b143aa8","49cd96df4c85cdd7461701340c0bb4d05a5049d8","207b7cf5db59d70d4789cb91194c732bcd1cfb4b")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("23c4049121a9649682b3b901eaac0cc52c308756","9022f78087e1679035e09160d59d679dc3ac345d","be52275b0c2086735dac478dc4f09fd16031669a","c879a8eb6630b0cd7537b068f4e9af2c9ca08a62","25a593b9517d6c325598eab46833003c40f9491a","a9bbea73504139ce91a0ec20fef303c68a131cd4","334a88e288ae18c6e3fd7fb2d1ad9548497d52ce","4aeeae023766153a91b83d02b1b24da20c0dd135","3cac6ff7cddcb8f82409c79c85d976300fc60861","55eeaa904bc6518a2715cc77648e6c5187416a46","ff7b2c3938306261881c42e78d0df51d9bcdd574","089439168d3c75b4da94ab801f1c46ad6b9e1fdc","a5c36b8022751cfeb4a88a21153847df3870c7c0","ad3dbec2b621807fa9a2f1b2f575d7077e494626","4dc0ebfa52adf9b9eb4fa8f0a359c21a14e183fb","d102a34b3f0efb57f1d9f04eff26b256875a3aa1","2b9b740fb5fe0549810500476f567002683df71d","4fa2b2ab3e24ee9d130cfeda63c7ae1ccbc393dc","495a4b4757f3b1eec7fdaa9d0b2930071565f2b1","f31920d636224356e8c7a182c2b9b37e42a09181","9dc3d272652851428f5cc44f2fd9458bff1d6a78","4dd22a08a5b103e1f2238aed7f7ce66c5a542533","02065bbdb3209e0522db3225600b8e79f8a10293","81622512757f897206a84b29ee866fb933fa3d48","151dc47b213aaec3751ffd1427737c65757ab410","492cbe143f795888d8e5006ac595f65f4565ed6e","0e282dc84d6cfd447fece7d3ecc622523b143aa8","49cd96df4c85cdd7461701340c0bb4d05a5049d8","207b7cf5db59d70d4789cb91194c732bcd1cfb4b")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring64 NOT NULL AND customstring64 IN ("23c4049121a9649682b3b901eaac0cc52c308756","9022f78087e1679035e09160d59d679dc3ac345d","be52275b0c2086735dac478dc4f09fd16031669a","c879a8eb6630b0cd7537b068f4e9af2c9ca08a62","25a593b9517d6c325598eab46833003c40f9491a","a9bbea73504139ce91a0ec20fef303c68a131cd4","334a88e288ae18c6e3fd7fb2d1ad9548497d52ce","4aeeae023766153a91b83d02b1b24da20c0dd135","3cac6ff7cddcb8f82409c79c85d976300fc60861","55eeaa904bc6518a2715cc77648e6c5187416a46","ff7b2c3938306261881c42e78d0df51d9bcdd574","089439168d3c75b4da94ab801f1c46ad6b9e1fdc","a5c36b8022751cfeb4a88a21153847df3870c7c0","ad3dbec2b621807fa9a2f1b2f575d7077e494626","4dc0ebfa52adf9b9eb4fa8f0a359c21a14e183fb","d102a34b3f0efb57f1d9f04eff26b256875a3aa1","2b9b740fb5fe0549810500476f567002683df71d","4fa2b2ab3e24ee9d130cfeda63c7ae1ccbc393dc","495a4b4757f3b1eec7fdaa9d0b2930071565f2b1","f31920d636224356e8c7a182c2b9b37e42a09181","9dc3d272652851428f5cc44f2fd9458bff1d6a78","4dd22a08a5b103e1f2238aed7f7ce66c5a542533","02065bbdb3209e0522db3225600b8e79f8a10293","81622512757f897206a84b29ee866fb933fa3d48","151dc47b213aaec3751ffd1427737c65757ab410","492cbe143f795888d8e5006ac595f65f4565ed6e","0e282dc84d6cfd447fece7d3ecc622523b143aa8","49cd96df4c85cdd7461701340c0bb4d05a5049d8","207b7cf5db59d70d4789cb91194c732bcd1cfb4b")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("23c4049121a9649682b3b901eaac0cc52c308756","9022f78087e1679035e09160d59d679dc3ac345d","be52275b0c2086735dac478dc4f09fd16031669a","c879a8eb6630b0cd7537b068f4e9af2c9ca08a62","25a593b9517d6c325598eab46833003c40f9491a","a9bbea73504139ce91a0ec20fef303c68a131cd4","334a88e288ae18c6e3fd7fb2d1ad9548497d52ce","4aeeae023766153a91b83d02b1b24da20c0dd135","3cac6ff7cddcb8f82409c79c85d976300fc60861","55eeaa904bc6518a2715cc77648e6c5187416a46","ff7b2c3938306261881c42e78d0df51d9bcdd574","089439168d3c75b4da94ab801f1c46ad6b9e1fdc","a5c36b8022751cfeb4a88a21153847df3870c7c0","ad3dbec2b621807fa9a2f1b2f575d7077e494626","4dc0ebfa52adf9b9eb4fa8f0a359c21a14e183fb","d102a34b3f0efb57f1d9f04eff26b256875a3aa1","2b9b740fb5fe0549810500476f567002683df71d","4fa2b2ab3e24ee9d130cfeda63c7ae1ccbc393dc","495a4b4757f3b1eec7fdaa9d0b2930071565f2b1","f31920d636224356e8c7a182c2b9b37e42a09181","9dc3d272652851428f5cc44f2fd9458bff1d6a78","4dd22a08a5b103e1f2238aed7f7ce66c5a542533","02065bbdb3209e0522db3225600b8e79f8a10293","81622512757f897206a84b29ee866fb933fa3d48","151dc47b213aaec3751ffd1427737c65757ab410","492cbe143f795888d8e5006ac595f65f4565ed6e","0e282dc84d6cfd447fece7d3ecc622523b143aa8","49cd96df4c85cdd7461701340c0bb4d05a5049d8","207b7cf5db59d70d4789cb91194c732bcd1cfb4b")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("23c4049121a9649682b3b901eaac0cc52c308756","9022f78087e1679035e09160d59d679dc3ac345d","be52275b0c2086735dac478dc4f09fd16031669a","c879a8eb6630b0cd7537b068f4e9af2c9ca08a62","25a593b9517d6c325598eab46833003c40f9491a","a9bbea73504139ce91a0ec20fef303c68a131cd4","334a88e288ae18c6e3fd7fb2d1ad9548497d52ce","4aeeae023766153a91b83d02b1b24da20c0dd135","3cac6ff7cddcb8f82409c79c85d976300fc60861","55eeaa904bc6518a2715cc77648e6c5187416a46","ff7b2c3938306261881c42e78d0df51d9bcdd574","089439168d3c75b4da94ab801f1c46ad6b9e1fdc","a5c36b8022751cfeb4a88a21153847df3870c7c0","ad3dbec2b621807fa9a2f1b2f575d7077e494626","4dc0ebfa52adf9b9eb4fa8f0a359c21a14e183fb","d102a34b3f0efb57f1d9f04eff26b256875a3aa1","2b9b740fb5fe0549810500476f567002683df71d","4fa2b2ab3e24ee9d130cfeda63c7ae1ccbc393dc","495a4b4757f3b1eec7fdaa9d0b2930071565f2b1","f31920d636224356e8c7a182c2b9b37e42a09181","9dc3d272652851428f5cc44f2fd9458bff1d6a78","4dd22a08a5b103e1f2238aed7f7ce66c5a542533","02065bbdb3209e0522db3225600b8e79f8a10293","81622512757f897206a84b29ee866fb933fa3d48","151dc47b213aaec3751ffd1427737c65757ab410","492cbe143f795888d8e5006ac595f65f4565ed6e","0e282dc84d6cfd447fece7d3ecc622523b143aa8","49cd96df4c85cdd7461701340c0bb4d05a5049d8","207b7cf5db59d70d4789cb91194c732bcd1cfb4b")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("23c4049121a9649682b3b901eaac0cc52c308756","9022f78087e1679035e09160d59d679dc3ac345d","be52275b0c2086735dac478dc4f09fd16031669a","c879a8eb6630b0cd7537b068f4e9af2c9ca08a62","25a593b9517d6c325598eab46833003c40f9491a","a9bbea73504139ce91a0ec20fef303c68a131cd4","334a88e288ae18c6e3fd7fb2d1ad9548497d52ce","4aeeae023766153a91b83d02b1b24da20c0dd135","3cac6ff7cddcb8f82409c79c85d976300fc60861","55eeaa904bc6518a2715cc77648e6c5187416a46","ff7b2c3938306261881c42e78d0df51d9bcdd574","089439168d3c75b4da94ab801f1c46ad6b9e1fdc","a5c36b8022751cfeb4a88a21153847df3870c7c0","ad3dbec2b621807fa9a2f1b2f575d7077e494626","4dc0ebfa52adf9b9eb4fa8f0a359c21a14e183fb","d102a34b3f0efb57f1d9f04eff26b256875a3aa1","2b9b740fb5fe0549810500476f567002683df71d","4fa2b2ab3e24ee9d130cfeda63c7ae1ccbc393dc","495a4b4757f3b1eec7fdaa9d0b2930071565f2b1","f31920d636224356e8c7a182c2b9b37e42a09181","9dc3d272652851428f5cc44f2fd9458bff1d6a78","4dd22a08a5b103e1f2238aed7f7ce66c5a542533","02065bbdb3209e0522db3225600b8e79f8a10293","81622512757f897206a84b29ee866fb933fa3d48","151dc47b213aaec3751ffd1427737c65757ab410","492cbe143f795888d8e5006ac595f65f4565ed6e","0e282dc84d6cfd447fece7d3ecc622523b143aa8","49cd96df4c85cdd7461701340c0bb4d05a5049d8","207b7cf5db59d70d4789cb91194c732bcd1cfb4b")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring64 NOT NULL AND customstring64 IN ("23c4049121a9649682b3b901eaac0cc52c308756","9022f78087e1679035e09160d59d679dc3ac345d","be52275b0c2086735dac478dc4f09fd16031669a","c879a8eb6630b0cd7537b068f4e9af2c9ca08a62","25a593b9517d6c325598eab46833003c40f9491a","a9bbea73504139ce91a0ec20fef303c68a131cd4","334a88e288ae18c6e3fd7fb2d1ad9548497d52ce","4aeeae023766153a91b83d02b1b24da20c0dd135","3cac6ff7cddcb8f82409c79c85d976300fc60861","55eeaa904bc6518a2715cc77648e6c5187416a46","ff7b2c3938306261881c42e78d0df51d9bcdd574","089439168d3c75b4da94ab801f1c46ad6b9e1fdc","a5c36b8022751cfeb4a88a21153847df3870c7c0","ad3dbec2b621807fa9a2f1b2f575d7077e494626","4dc0ebfa52adf9b9eb4fa8f0a359c21a14e183fb","d102a34b3f0efb57f1d9f04eff26b256875a3aa1","2b9b740fb5fe0549810500476f567002683df71d","4fa2b2ab3e24ee9d130cfeda63c7ae1ccbc393dc","495a4b4757f3b1eec7fdaa9d0b2930071565f2b1","f31920d636224356e8c7a182c2b9b37e42a09181","9dc3d272652851428f5cc44f2fd9458bff1d6a78","4dd22a08a5b103e1f2238aed7f7ce66c5a542533","02065bbdb3209e0522db3225600b8e79f8a10293","81622512757f897206a84b29ee866fb933fa3d48","151dc47b213aaec3751ffd1427737c65757ab410","492cbe143f795888d8e5006ac595f65f4565ed6e","0e282dc84d6cfd447fece7d3ecc622523b143aa8","49cd96df4c85cdd7461701340c0bb4d05a5049d8","207b7cf5db59d70d4789cb91194c732bcd1cfb4b")
index=activity AND rg_functionality="O365 General" AND filehash NOT NULL AND filehash IN ("23c4049121a9649682b3b901eaac0cc52c308756","9022f78087e1679035e09160d59d679dc3ac345d","be52275b0c2086735dac478dc4f09fd16031669a","c879a8eb6630b0cd7537b068f4e9af2c9ca08a62","25a593b9517d6c325598eab46833003c40f9491a","a9bbea73504139ce91a0ec20fef303c68a131cd4","334a88e288ae18c6e3fd7fb2d1ad9548497d52ce","4aeeae023766153a91b83d02b1b24da20c0dd135","3cac6ff7cddcb8f82409c79c85d976300fc60861","55eeaa904bc6518a2715cc77648e6c5187416a46","ff7b2c3938306261881c42e78d0df51d9bcdd574","089439168d3c75b4da94ab801f1c46ad6b9e1fdc","a5c36b8022751cfeb4a88a21153847df3870c7c0","ad3dbec2b621807fa9a2f1b2f575d7077e494626","4dc0ebfa52adf9b9eb4fa8f0a359c21a14e183fb","d102a34b3f0efb57f1d9f04eff26b256875a3aa1","2b9b740fb5fe0549810500476f567002683df71d","4fa2b2ab3e24ee9d130cfeda63c7ae1ccbc393dc","495a4b4757f3b1eec7fdaa9d0b2930071565f2b1","f31920d636224356e8c7a182c2b9b37e42a09181","9dc3d272652851428f5cc44f2fd9458bff1d6a78","4dd22a08a5b103e1f2238aed7f7ce66c5a542533","02065bbdb3209e0522db3225600b8e79f8a10293","81622512757f897206a84b29ee866fb933fa3d48","151dc47b213aaec3751ffd1427737c65757ab410","492cbe143f795888d8e5006ac595f65f4565ed6e","0e282dc84d6cfd447fece7d3ecc622523b143aa8","49cd96df4c85cdd7461701340c0bb4d05a5049d8","207b7cf5db59d70d4789cb91194c732bcd1cfb4b")
index=activity AND rg_functionality="O365 General" AND oldfilehash NOT NULL AND oldfilehash IN ("23c4049121a9649682b3b901eaac0cc52c308756","9022f78087e1679035e09160d59d679dc3ac345d","be52275b0c2086735dac478dc4f09fd16031669a","c879a8eb6630b0cd7537b068f4e9af2c9ca08a62","25a593b9517d6c325598eab46833003c40f9491a","a9bbea73504139ce91a0ec20fef303c68a131cd4","334a88e288ae18c6e3fd7fb2d1ad9548497d52ce","4aeeae023766153a91b83d02b1b24da20c0dd135","3cac6ff7cddcb8f82409c79c85d976300fc60861","55eeaa904bc6518a2715cc77648e6c5187416a46","ff7b2c3938306261881c42e78d0df51d9bcdd574","089439168d3c75b4da94ab801f1c46ad6b9e1fdc","a5c36b8022751cfeb4a88a21153847df3870c7c0","ad3dbec2b621807fa9a2f1b2f575d7077e494626","4dc0ebfa52adf9b9eb4fa8f0a359c21a14e183fb","d102a34b3f0efb57f1d9f04eff26b256875a3aa1","2b9b740fb5fe0549810500476f567002683df71d","4fa2b2ab3e24ee9d130cfeda63c7ae1ccbc393dc","495a4b4757f3b1eec7fdaa9d0b2930071565f2b1","f31920d636224356e8c7a182c2b9b37e42a09181","9dc3d272652851428f5cc44f2fd9458bff1d6a78","4dd22a08a5b103e1f2238aed7f7ce66c5a542533","02065bbdb3209e0522db3225600b8e79f8a10293","81622512757f897206a84b29ee866fb933fa3d48","151dc47b213aaec3751ffd1427737c65757ab410","492cbe143f795888d8e5006ac595f65f4565ed6e","0e282dc84d6cfd447fece7d3ecc622523b143aa8","49cd96df4c85cdd7461701340c0bb4d05a5049d8","207b7cf5db59d70d4789cb91194c732bcd1cfb4b")
index=activity AND rg_functionality="O365 General" AND customstring3 NOT NULL AND customstring3 IN ("23c4049121a9649682b3b901eaac0cc52c308756","9022f78087e1679035e09160d59d679dc3ac345d","be52275b0c2086735dac478dc4f09fd16031669a","c879a8eb6630b0cd7537b068f4e9af2c9ca08a62","25a593b9517d6c325598eab46833003c40f9491a","a9bbea73504139ce91a0ec20fef303c68a131cd4","334a88e288ae18c6e3fd7fb2d1ad9548497d52ce","4aeeae023766153a91b83d02b1b24da20c0dd135","3cac6ff7cddcb8f82409c79c85d976300fc60861","55eeaa904bc6518a2715cc77648e6c5187416a46","ff7b2c3938306261881c42e78d0df51d9bcdd574","089439168d3c75b4da94ab801f1c46ad6b9e1fdc","a5c36b8022751cfeb4a88a21153847df3870c7c0","ad3dbec2b621807fa9a2f1b2f575d7077e494626","4dc0ebfa52adf9b9eb4fa8f0a359c21a14e183fb","d102a34b3f0efb57f1d9f04eff26b256875a3aa1","2b9b740fb5fe0549810500476f567002683df71d","4fa2b2ab3e24ee9d130cfeda63c7ae1ccbc393dc","495a4b4757f3b1eec7fdaa9d0b2930071565f2b1","f31920d636224356e8c7a182c2b9b37e42a09181","9dc3d272652851428f5cc44f2fd9458bff1d6a78","4dd22a08a5b103e1f2238aed7f7ce66c5a542533","02065bbdb3209e0522db3225600b8e79f8a10293","81622512757f897206a84b29ee866fb933fa3d48","151dc47b213aaec3751ffd1427737c65757ab410","492cbe143f795888d8e5006ac595f65f4565ed6e","0e282dc84d6cfd447fece7d3ecc622523b143aa8","49cd96df4c85cdd7461701340c0bb4d05a5049d8","207b7cf5db59d70d4789cb91194c732bcd1cfb4b")
index=activity AND rg_functionality="O365 General" AND customstring64 NOT NULL AND customstring64 IN ("23c4049121a9649682b3b901eaac0cc52c308756","9022f78087e1679035e09160d59d679dc3ac345d","be52275b0c2086735dac478dc4f09fd16031669a","c879a8eb6630b0cd7537b068f4e9af2c9ca08a62","25a593b9517d6c325598eab46833003c40f9491a","a9bbea73504139ce91a0ec20fef303c68a131cd4","334a88e288ae18c6e3fd7fb2d1ad9548497d52ce","4aeeae023766153a91b83d02b1b24da20c0dd135","3cac6ff7cddcb8f82409c79c85d976300fc60861","55eeaa904bc6518a2715cc77648e6c5187416a46","ff7b2c3938306261881c42e78d0df51d9bcdd574","089439168d3c75b4da94ab801f1c46ad6b9e1fdc","a5c36b8022751cfeb4a88a21153847df3870c7c0","ad3dbec2b621807fa9a2f1b2f575d7077e494626","4dc0ebfa52adf9b9eb4fa8f0a359c21a14e183fb","d102a34b3f0efb57f1d9f04eff26b256875a3aa1","2b9b740fb5fe0549810500476f567002683df71d","4fa2b2ab3e24ee9d130cfeda63c7ae1ccbc393dc","495a4b4757f3b1eec7fdaa9d0b2930071565f2b1","f31920d636224356e8c7a182c2b9b37e42a09181","9dc3d272652851428f5cc44f2fd9458bff1d6a78","4dd22a08a5b103e1f2238aed7f7ce66c5a542533","02065bbdb3209e0522db3225600b8e79f8a10293","81622512757f897206a84b29ee866fb933fa3d48","151dc47b213aaec3751ffd1427737c65757ab410","492cbe143f795888d8e5006ac595f65f4565ed6e","0e282dc84d6cfd447fece7d3ecc622523b143aa8","49cd96df4c85cdd7461701340c0bb4d05a5049d8","207b7cf5db59d70d4789cb91194c732bcd1cfb4b")
