index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("678bf948fc12a42bab7d7378e13ac4f0","d4c69fb043ea523b7c692131647ae56f","3a0b7bd43f515ccd450f0f8342fa2e13","ede0dd1e42217dd10b62175b22dd85b4","de84e4cb4fadb0a72818a56f9db8eac1","7fcd8b4fa9fe428f64cfc4042df51546","8b53df7248cb62cba75414eb1922ffb567e9a054","66a0542ed5f1e5d5a954bac161925b5d384eecc2","3acc0e651c6ad0e2faeb93b929495ad8d0b6d637","5c23969eb4808071bcb2a21c3df15086e4bc576b","9ca5cad4f19c973bdfa6a50e945158d3d9c18a3b","d9d8414e4fe2bafce56b9d6c98d0069cd44c4e84","daf56f9a7514364c54cee70f342df68dec167bb06bed51ce272fd5a1b58276d1","a5f71bd8e345dc0d43d98589d47c420b16e9fbb8a0022086d08d7b24193407a2","61387c5cdea91f65a7c15c174904b91d116b94e26ffa11e79657aec5b795bbf7","2fd40cda28806cc5aee53c76098f41dcadfc228e7c43bc84f8d3f6291314be3f","32346828910654ff02b71f8425474b2f041a09176ce8dcff4dab58f2755005c1","9ad6db8623ea007af4594b53ce61ee0101274d5b8e8c29a974993f310ca5c06f")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("678bf948fc12a42bab7d7378e13ac4f0","d4c69fb043ea523b7c692131647ae56f","3a0b7bd43f515ccd450f0f8342fa2e13","ede0dd1e42217dd10b62175b22dd85b4","de84e4cb4fadb0a72818a56f9db8eac1","7fcd8b4fa9fe428f64cfc4042df51546","8b53df7248cb62cba75414eb1922ffb567e9a054","66a0542ed5f1e5d5a954bac161925b5d384eecc2","3acc0e651c6ad0e2faeb93b929495ad8d0b6d637","5c23969eb4808071bcb2a21c3df15086e4bc576b","9ca5cad4f19c973bdfa6a50e945158d3d9c18a3b","d9d8414e4fe2bafce56b9d6c98d0069cd44c4e84","daf56f9a7514364c54cee70f342df68dec167bb06bed51ce272fd5a1b58276d1","a5f71bd8e345dc0d43d98589d47c420b16e9fbb8a0022086d08d7b24193407a2","61387c5cdea91f65a7c15c174904b91d116b94e26ffa11e79657aec5b795bbf7","2fd40cda28806cc5aee53c76098f41dcadfc228e7c43bc84f8d3f6291314be3f","32346828910654ff02b71f8425474b2f041a09176ce8dcff4dab58f2755005c1","9ad6db8623ea007af4594b53ce61ee0101274d5b8e8c29a974993f310ca5c06f")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("678bf948fc12a42bab7d7378e13ac4f0","d4c69fb043ea523b7c692131647ae56f","3a0b7bd43f515ccd450f0f8342fa2e13","ede0dd1e42217dd10b62175b22dd85b4","de84e4cb4fadb0a72818a56f9db8eac1","7fcd8b4fa9fe428f64cfc4042df51546","8b53df7248cb62cba75414eb1922ffb567e9a054","66a0542ed5f1e5d5a954bac161925b5d384eecc2","3acc0e651c6ad0e2faeb93b929495ad8d0b6d637","5c23969eb4808071bcb2a21c3df15086e4bc576b","9ca5cad4f19c973bdfa6a50e945158d3d9c18a3b","d9d8414e4fe2bafce56b9d6c98d0069cd44c4e84","daf56f9a7514364c54cee70f342df68dec167bb06bed51ce272fd5a1b58276d1","a5f71bd8e345dc0d43d98589d47c420b16e9fbb8a0022086d08d7b24193407a2","61387c5cdea91f65a7c15c174904b91d116b94e26ffa11e79657aec5b795bbf7","2fd40cda28806cc5aee53c76098f41dcadfc228e7c43bc84f8d3f6291314be3f","32346828910654ff02b71f8425474b2f041a09176ce8dcff4dab58f2755005c1","9ad6db8623ea007af4594b53ce61ee0101274d5b8e8c29a974993f310ca5c06f")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring64 NOT NULL AND customstring64 IN ("678bf948fc12a42bab7d7378e13ac4f0","d4c69fb043ea523b7c692131647ae56f","3a0b7bd43f515ccd450f0f8342fa2e13","ede0dd1e42217dd10b62175b22dd85b4","de84e4cb4fadb0a72818a56f9db8eac1","7fcd8b4fa9fe428f64cfc4042df51546","8b53df7248cb62cba75414eb1922ffb567e9a054","66a0542ed5f1e5d5a954bac161925b5d384eecc2","3acc0e651c6ad0e2faeb93b929495ad8d0b6d637","5c23969eb4808071bcb2a21c3df15086e4bc576b","9ca5cad4f19c973bdfa6a50e945158d3d9c18a3b","d9d8414e4fe2bafce56b9d6c98d0069cd44c4e84","daf56f9a7514364c54cee70f342df68dec167bb06bed51ce272fd5a1b58276d1","a5f71bd8e345dc0d43d98589d47c420b16e9fbb8a0022086d08d7b24193407a2","61387c5cdea91f65a7c15c174904b91d116b94e26ffa11e79657aec5b795bbf7","2fd40cda28806cc5aee53c76098f41dcadfc228e7c43bc84f8d3f6291314be3f","32346828910654ff02b71f8425474b2f041a09176ce8dcff4dab58f2755005c1","9ad6db8623ea007af4594b53ce61ee0101274d5b8e8c29a974993f310ca5c06f")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("678bf948fc12a42bab7d7378e13ac4f0","d4c69fb043ea523b7c692131647ae56f","3a0b7bd43f515ccd450f0f8342fa2e13","ede0dd1e42217dd10b62175b22dd85b4","de84e4cb4fadb0a72818a56f9db8eac1","7fcd8b4fa9fe428f64cfc4042df51546","8b53df7248cb62cba75414eb1922ffb567e9a054","66a0542ed5f1e5d5a954bac161925b5d384eecc2","3acc0e651c6ad0e2faeb93b929495ad8d0b6d637","5c23969eb4808071bcb2a21c3df15086e4bc576b","9ca5cad4f19c973bdfa6a50e945158d3d9c18a3b","d9d8414e4fe2bafce56b9d6c98d0069cd44c4e84","daf56f9a7514364c54cee70f342df68dec167bb06bed51ce272fd5a1b58276d1","a5f71bd8e345dc0d43d98589d47c420b16e9fbb8a0022086d08d7b24193407a2","61387c5cdea91f65a7c15c174904b91d116b94e26ffa11e79657aec5b795bbf7","2fd40cda28806cc5aee53c76098f41dcadfc228e7c43bc84f8d3f6291314be3f","32346828910654ff02b71f8425474b2f041a09176ce8dcff4dab58f2755005c1","9ad6db8623ea007af4594b53ce61ee0101274d5b8e8c29a974993f310ca5c06f")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("678bf948fc12a42bab7d7378e13ac4f0","d4c69fb043ea523b7c692131647ae56f","3a0b7bd43f515ccd450f0f8342fa2e13","ede0dd1e42217dd10b62175b22dd85b4","de84e4cb4fadb0a72818a56f9db8eac1","7fcd8b4fa9fe428f64cfc4042df51546","8b53df7248cb62cba75414eb1922ffb567e9a054","66a0542ed5f1e5d5a954bac161925b5d384eecc2","3acc0e651c6ad0e2faeb93b929495ad8d0b6d637","5c23969eb4808071bcb2a21c3df15086e4bc576b","9ca5cad4f19c973bdfa6a50e945158d3d9c18a3b","d9d8414e4fe2bafce56b9d6c98d0069cd44c4e84","daf56f9a7514364c54cee70f342df68dec167bb06bed51ce272fd5a1b58276d1","a5f71bd8e345dc0d43d98589d47c420b16e9fbb8a0022086d08d7b24193407a2","61387c5cdea91f65a7c15c174904b91d116b94e26ffa11e79657aec5b795bbf7","2fd40cda28806cc5aee53c76098f41dcadfc228e7c43bc84f8d3f6291314be3f","32346828910654ff02b71f8425474b2f041a09176ce8dcff4dab58f2755005c1","9ad6db8623ea007af4594b53ce61ee0101274d5b8e8c29a974993f310ca5c06f")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("678bf948fc12a42bab7d7378e13ac4f0","d4c69fb043ea523b7c692131647ae56f","3a0b7bd43f515ccd450f0f8342fa2e13","ede0dd1e42217dd10b62175b22dd85b4","de84e4cb4fadb0a72818a56f9db8eac1","7fcd8b4fa9fe428f64cfc4042df51546","8b53df7248cb62cba75414eb1922ffb567e9a054","66a0542ed5f1e5d5a954bac161925b5d384eecc2","3acc0e651c6ad0e2faeb93b929495ad8d0b6d637","5c23969eb4808071bcb2a21c3df15086e4bc576b","9ca5cad4f19c973bdfa6a50e945158d3d9c18a3b","d9d8414e4fe2bafce56b9d6c98d0069cd44c4e84","daf56f9a7514364c54cee70f342df68dec167bb06bed51ce272fd5a1b58276d1","a5f71bd8e345dc0d43d98589d47c420b16e9fbb8a0022086d08d7b24193407a2","61387c5cdea91f65a7c15c174904b91d116b94e26ffa11e79657aec5b795bbf7","2fd40cda28806cc5aee53c76098f41dcadfc228e7c43bc84f8d3f6291314be3f","32346828910654ff02b71f8425474b2f041a09176ce8dcff4dab58f2755005c1","9ad6db8623ea007af4594b53ce61ee0101274d5b8e8c29a974993f310ca5c06f")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("678bf948fc12a42bab7d7378e13ac4f0","d4c69fb043ea523b7c692131647ae56f","3a0b7bd43f515ccd450f0f8342fa2e13","ede0dd1e42217dd10b62175b22dd85b4","de84e4cb4fadb0a72818a56f9db8eac1","7fcd8b4fa9fe428f64cfc4042df51546","8b53df7248cb62cba75414eb1922ffb567e9a054","66a0542ed5f1e5d5a954bac161925b5d384eecc2","3acc0e651c6ad0e2faeb93b929495ad8d0b6d637","5c23969eb4808071bcb2a21c3df15086e4bc576b","9ca5cad4f19c973bdfa6a50e945158d3d9c18a3b","d9d8414e4fe2bafce56b9d6c98d0069cd44c4e84","daf56f9a7514364c54cee70f342df68dec167bb06bed51ce272fd5a1b58276d1","a5f71bd8e345dc0d43d98589d47c420b16e9fbb8a0022086d08d7b24193407a2","61387c5cdea91f65a7c15c174904b91d116b94e26ffa11e79657aec5b795bbf7","2fd40cda28806cc5aee53c76098f41dcadfc228e7c43bc84f8d3f6291314be3f","32346828910654ff02b71f8425474b2f041a09176ce8dcff4dab58f2755005c1","9ad6db8623ea007af4594b53ce61ee0101274d5b8e8c29a974993f310ca5c06f")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("678bf948fc12a42bab7d7378e13ac4f0","d4c69fb043ea523b7c692131647ae56f","3a0b7bd43f515ccd450f0f8342fa2e13","ede0dd1e42217dd10b62175b22dd85b4","de84e4cb4fadb0a72818a56f9db8eac1","7fcd8b4fa9fe428f64cfc4042df51546","8b53df7248cb62cba75414eb1922ffb567e9a054","66a0542ed5f1e5d5a954bac161925b5d384eecc2","3acc0e651c6ad0e2faeb93b929495ad8d0b6d637","5c23969eb4808071bcb2a21c3df15086e4bc576b","9ca5cad4f19c973bdfa6a50e945158d3d9c18a3b","d9d8414e4fe2bafce56b9d6c98d0069cd44c4e84","daf56f9a7514364c54cee70f342df68dec167bb06bed51ce272fd5a1b58276d1","a5f71bd8e345dc0d43d98589d47c420b16e9fbb8a0022086d08d7b24193407a2","61387c5cdea91f65a7c15c174904b91d116b94e26ffa11e79657aec5b795bbf7","2fd40cda28806cc5aee53c76098f41dcadfc228e7c43bc84f8d3f6291314be3f","32346828910654ff02b71f8425474b2f041a09176ce8dcff4dab58f2755005c1","9ad6db8623ea007af4594b53ce61ee0101274d5b8e8c29a974993f310ca5c06f")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("678bf948fc12a42bab7d7378e13ac4f0","d4c69fb043ea523b7c692131647ae56f","3a0b7bd43f515ccd450f0f8342fa2e13","ede0dd1e42217dd10b62175b22dd85b4","de84e4cb4fadb0a72818a56f9db8eac1","7fcd8b4fa9fe428f64cfc4042df51546","8b53df7248cb62cba75414eb1922ffb567e9a054","66a0542ed5f1e5d5a954bac161925b5d384eecc2","3acc0e651c6ad0e2faeb93b929495ad8d0b6d637","5c23969eb4808071bcb2a21c3df15086e4bc576b","9ca5cad4f19c973bdfa6a50e945158d3d9c18a3b","d9d8414e4fe2bafce56b9d6c98d0069cd44c4e84","daf56f9a7514364c54cee70f342df68dec167bb06bed51ce272fd5a1b58276d1","a5f71bd8e345dc0d43d98589d47c420b16e9fbb8a0022086d08d7b24193407a2","61387c5cdea91f65a7c15c174904b91d116b94e26ffa11e79657aec5b795bbf7","2fd40cda28806cc5aee53c76098f41dcadfc228e7c43bc84f8d3f6291314be3f","32346828910654ff02b71f8425474b2f041a09176ce8dcff4dab58f2755005c1","9ad6db8623ea007af4594b53ce61ee0101274d5b8e8c29a974993f310ca5c06f")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("678bf948fc12a42bab7d7378e13ac4f0","d4c69fb043ea523b7c692131647ae56f","3a0b7bd43f515ccd450f0f8342fa2e13","ede0dd1e42217dd10b62175b22dd85b4","de84e4cb4fadb0a72818a56f9db8eac1","7fcd8b4fa9fe428f64cfc4042df51546","8b53df7248cb62cba75414eb1922ffb567e9a054","66a0542ed5f1e5d5a954bac161925b5d384eecc2","3acc0e651c6ad0e2faeb93b929495ad8d0b6d637","5c23969eb4808071bcb2a21c3df15086e4bc576b","9ca5cad4f19c973bdfa6a50e945158d3d9c18a3b","d9d8414e4fe2bafce56b9d6c98d0069cd44c4e84","daf56f9a7514364c54cee70f342df68dec167bb06bed51ce272fd5a1b58276d1","a5f71bd8e345dc0d43d98589d47c420b16e9fbb8a0022086d08d7b24193407a2","61387c5cdea91f65a7c15c174904b91d116b94e26ffa11e79657aec5b795bbf7","2fd40cda28806cc5aee53c76098f41dcadfc228e7c43bc84f8d3f6291314be3f","32346828910654ff02b71f8425474b2f041a09176ce8dcff4dab58f2755005c1","9ad6db8623ea007af4594b53ce61ee0101274d5b8e8c29a974993f310ca5c06f")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("678bf948fc12a42bab7d7378e13ac4f0","d4c69fb043ea523b7c692131647ae56f","3a0b7bd43f515ccd450f0f8342fa2e13","ede0dd1e42217dd10b62175b22dd85b4","de84e4cb4fadb0a72818a56f9db8eac1","7fcd8b4fa9fe428f64cfc4042df51546","8b53df7248cb62cba75414eb1922ffb567e9a054","66a0542ed5f1e5d5a954bac161925b5d384eecc2","3acc0e651c6ad0e2faeb93b929495ad8d0b6d637","5c23969eb4808071bcb2a21c3df15086e4bc576b","9ca5cad4f19c973bdfa6a50e945158d3d9c18a3b","d9d8414e4fe2bafce56b9d6c98d0069cd44c4e84","daf56f9a7514364c54cee70f342df68dec167bb06bed51ce272fd5a1b58276d1","a5f71bd8e345dc0d43d98589d47c420b16e9fbb8a0022086d08d7b24193407a2","61387c5cdea91f65a7c15c174904b91d116b94e26ffa11e79657aec5b795bbf7","2fd40cda28806cc5aee53c76098f41dcadfc228e7c43bc84f8d3f6291314be3f","32346828910654ff02b71f8425474b2f041a09176ce8dcff4dab58f2755005c1","9ad6db8623ea007af4594b53ce61ee0101274d5b8e8c29a974993f310ca5c06f")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("678bf948fc12a42bab7d7378e13ac4f0","d4c69fb043ea523b7c692131647ae56f","3a0b7bd43f515ccd450f0f8342fa2e13","ede0dd1e42217dd10b62175b22dd85b4","de84e4cb4fadb0a72818a56f9db8eac1","7fcd8b4fa9fe428f64cfc4042df51546","8b53df7248cb62cba75414eb1922ffb567e9a054","66a0542ed5f1e5d5a954bac161925b5d384eecc2","3acc0e651c6ad0e2faeb93b929495ad8d0b6d637","5c23969eb4808071bcb2a21c3df15086e4bc576b","9ca5cad4f19c973bdfa6a50e945158d3d9c18a3b","d9d8414e4fe2bafce56b9d6c98d0069cd44c4e84","daf56f9a7514364c54cee70f342df68dec167bb06bed51ce272fd5a1b58276d1","a5f71bd8e345dc0d43d98589d47c420b16e9fbb8a0022086d08d7b24193407a2","61387c5cdea91f65a7c15c174904b91d116b94e26ffa11e79657aec5b795bbf7","2fd40cda28806cc5aee53c76098f41dcadfc228e7c43bc84f8d3f6291314be3f","32346828910654ff02b71f8425474b2f041a09176ce8dcff4dab58f2755005c1","9ad6db8623ea007af4594b53ce61ee0101274d5b8e8c29a974993f310ca5c06f")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("678bf948fc12a42bab7d7378e13ac4f0","d4c69fb043ea523b7c692131647ae56f","3a0b7bd43f515ccd450f0f8342fa2e13","ede0dd1e42217dd10b62175b22dd85b4","de84e4cb4fadb0a72818a56f9db8eac1","7fcd8b4fa9fe428f64cfc4042df51546","8b53df7248cb62cba75414eb1922ffb567e9a054","66a0542ed5f1e5d5a954bac161925b5d384eecc2","3acc0e651c6ad0e2faeb93b929495ad8d0b6d637","5c23969eb4808071bcb2a21c3df15086e4bc576b","9ca5cad4f19c973bdfa6a50e945158d3d9c18a3b","d9d8414e4fe2bafce56b9d6c98d0069cd44c4e84","daf56f9a7514364c54cee70f342df68dec167bb06bed51ce272fd5a1b58276d1","a5f71bd8e345dc0d43d98589d47c420b16e9fbb8a0022086d08d7b24193407a2","61387c5cdea91f65a7c15c174904b91d116b94e26ffa11e79657aec5b795bbf7","2fd40cda28806cc5aee53c76098f41dcadfc228e7c43bc84f8d3f6291314be3f","32346828910654ff02b71f8425474b2f041a09176ce8dcff4dab58f2755005c1","9ad6db8623ea007af4594b53ce61ee0101274d5b8e8c29a974993f310ca5c06f")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("678bf948fc12a42bab7d7378e13ac4f0","d4c69fb043ea523b7c692131647ae56f","3a0b7bd43f515ccd450f0f8342fa2e13","ede0dd1e42217dd10b62175b22dd85b4","de84e4cb4fadb0a72818a56f9db8eac1","7fcd8b4fa9fe428f64cfc4042df51546","8b53df7248cb62cba75414eb1922ffb567e9a054","66a0542ed5f1e5d5a954bac161925b5d384eecc2","3acc0e651c6ad0e2faeb93b929495ad8d0b6d637","5c23969eb4808071bcb2a21c3df15086e4bc576b","9ca5cad4f19c973bdfa6a50e945158d3d9c18a3b","d9d8414e4fe2bafce56b9d6c98d0069cd44c4e84","daf56f9a7514364c54cee70f342df68dec167bb06bed51ce272fd5a1b58276d1","a5f71bd8e345dc0d43d98589d47c420b16e9fbb8a0022086d08d7b24193407a2","61387c5cdea91f65a7c15c174904b91d116b94e26ffa11e79657aec5b795bbf7","2fd40cda28806cc5aee53c76098f41dcadfc228e7c43bc84f8d3f6291314be3f","32346828910654ff02b71f8425474b2f041a09176ce8dcff4dab58f2755005c1","9ad6db8623ea007af4594b53ce61ee0101274d5b8e8c29a974993f310ca5c06f")
index=activity AND rg_functionality="Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("678bf948fc12a42bab7d7378e13ac4f0","d4c69fb043ea523b7c692131647ae56f","3a0b7bd43f515ccd450f0f8342fa2e13","ede0dd1e42217dd10b62175b22dd85b4","de84e4cb4fadb0a72818a56f9db8eac1","7fcd8b4fa9fe428f64cfc4042df51546","8b53df7248cb62cba75414eb1922ffb567e9a054","66a0542ed5f1e5d5a954bac161925b5d384eecc2","3acc0e651c6ad0e2faeb93b929495ad8d0b6d637","5c23969eb4808071bcb2a21c3df15086e4bc576b","9ca5cad4f19c973bdfa6a50e945158d3d9c18a3b","d9d8414e4fe2bafce56b9d6c98d0069cd44c4e84","daf56f9a7514364c54cee70f342df68dec167bb06bed51ce272fd5a1b58276d1","a5f71bd8e345dc0d43d98589d47c420b16e9fbb8a0022086d08d7b24193407a2","61387c5cdea91f65a7c15c174904b91d116b94e26ffa11e79657aec5b795bbf7","2fd40cda28806cc5aee53c76098f41dcadfc228e7c43bc84f8d3f6291314be3f","32346828910654ff02b71f8425474b2f041a09176ce8dcff4dab58f2755005c1","9ad6db8623ea007af4594b53ce61ee0101274d5b8e8c29a974993f310ca5c06f")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("678bf948fc12a42bab7d7378e13ac4f0","d4c69fb043ea523b7c692131647ae56f","3a0b7bd43f515ccd450f0f8342fa2e13","ede0dd1e42217dd10b62175b22dd85b4","de84e4cb4fadb0a72818a56f9db8eac1","7fcd8b4fa9fe428f64cfc4042df51546","8b53df7248cb62cba75414eb1922ffb567e9a054","66a0542ed5f1e5d5a954bac161925b5d384eecc2","3acc0e651c6ad0e2faeb93b929495ad8d0b6d637","5c23969eb4808071bcb2a21c3df15086e4bc576b","9ca5cad4f19c973bdfa6a50e945158d3d9c18a3b","d9d8414e4fe2bafce56b9d6c98d0069cd44c4e84","daf56f9a7514364c54cee70f342df68dec167bb06bed51ce272fd5a1b58276d1","a5f71bd8e345dc0d43d98589d47c420b16e9fbb8a0022086d08d7b24193407a2","61387c5cdea91f65a7c15c174904b91d116b94e26ffa11e79657aec5b795bbf7","2fd40cda28806cc5aee53c76098f41dcadfc228e7c43bc84f8d3f6291314be3f","32346828910654ff02b71f8425474b2f041a09176ce8dcff4dab58f2755005c1","9ad6db8623ea007af4594b53ce61ee0101274d5b8e8c29a974993f310ca5c06f")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("678bf948fc12a42bab7d7378e13ac4f0","d4c69fb043ea523b7c692131647ae56f","3a0b7bd43f515ccd450f0f8342fa2e13","ede0dd1e42217dd10b62175b22dd85b4","de84e4cb4fadb0a72818a56f9db8eac1","7fcd8b4fa9fe428f64cfc4042df51546","8b53df7248cb62cba75414eb1922ffb567e9a054","66a0542ed5f1e5d5a954bac161925b5d384eecc2","3acc0e651c6ad0e2faeb93b929495ad8d0b6d637","5c23969eb4808071bcb2a21c3df15086e4bc576b","9ca5cad4f19c973bdfa6a50e945158d3d9c18a3b","d9d8414e4fe2bafce56b9d6c98d0069cd44c4e84","daf56f9a7514364c54cee70f342df68dec167bb06bed51ce272fd5a1b58276d1","a5f71bd8e345dc0d43d98589d47c420b16e9fbb8a0022086d08d7b24193407a2","61387c5cdea91f65a7c15c174904b91d116b94e26ffa11e79657aec5b795bbf7","2fd40cda28806cc5aee53c76098f41dcadfc228e7c43bc84f8d3f6291314be3f","32346828910654ff02b71f8425474b2f041a09176ce8dcff4dab58f2755005c1","9ad6db8623ea007af4594b53ce61ee0101274d5b8e8c29a974993f310ca5c06f")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("678bf948fc12a42bab7d7378e13ac4f0","d4c69fb043ea523b7c692131647ae56f","3a0b7bd43f515ccd450f0f8342fa2e13","ede0dd1e42217dd10b62175b22dd85b4","de84e4cb4fadb0a72818a56f9db8eac1","7fcd8b4fa9fe428f64cfc4042df51546","8b53df7248cb62cba75414eb1922ffb567e9a054","66a0542ed5f1e5d5a954bac161925b5d384eecc2","3acc0e651c6ad0e2faeb93b929495ad8d0b6d637","5c23969eb4808071bcb2a21c3df15086e4bc576b","9ca5cad4f19c973bdfa6a50e945158d3d9c18a3b","d9d8414e4fe2bafce56b9d6c98d0069cd44c4e84","daf56f9a7514364c54cee70f342df68dec167bb06bed51ce272fd5a1b58276d1","a5f71bd8e345dc0d43d98589d47c420b16e9fbb8a0022086d08d7b24193407a2","61387c5cdea91f65a7c15c174904b91d116b94e26ffa11e79657aec5b795bbf7","2fd40cda28806cc5aee53c76098f41dcadfc228e7c43bc84f8d3f6291314be3f","32346828910654ff02b71f8425474b2f041a09176ce8dcff4dab58f2755005c1","9ad6db8623ea007af4594b53ce61ee0101274d5b8e8c29a974993f310ca5c06f")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("678bf948fc12a42bab7d7378e13ac4f0","d4c69fb043ea523b7c692131647ae56f","3a0b7bd43f515ccd450f0f8342fa2e13","ede0dd1e42217dd10b62175b22dd85b4","de84e4cb4fadb0a72818a56f9db8eac1","7fcd8b4fa9fe428f64cfc4042df51546","8b53df7248cb62cba75414eb1922ffb567e9a054","66a0542ed5f1e5d5a954bac161925b5d384eecc2","3acc0e651c6ad0e2faeb93b929495ad8d0b6d637","5c23969eb4808071bcb2a21c3df15086e4bc576b","9ca5cad4f19c973bdfa6a50e945158d3d9c18a3b","d9d8414e4fe2bafce56b9d6c98d0069cd44c4e84","daf56f9a7514364c54cee70f342df68dec167bb06bed51ce272fd5a1b58276d1","a5f71bd8e345dc0d43d98589d47c420b16e9fbb8a0022086d08d7b24193407a2","61387c5cdea91f65a7c15c174904b91d116b94e26ffa11e79657aec5b795bbf7","2fd40cda28806cc5aee53c76098f41dcadfc228e7c43bc84f8d3f6291314be3f","32346828910654ff02b71f8425474b2f041a09176ce8dcff4dab58f2755005c1","9ad6db8623ea007af4594b53ce61ee0101274d5b8e8c29a974993f310ca5c06f")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("678bf948fc12a42bab7d7378e13ac4f0","d4c69fb043ea523b7c692131647ae56f","3a0b7bd43f515ccd450f0f8342fa2e13","ede0dd1e42217dd10b62175b22dd85b4","de84e4cb4fadb0a72818a56f9db8eac1","7fcd8b4fa9fe428f64cfc4042df51546","8b53df7248cb62cba75414eb1922ffb567e9a054","66a0542ed5f1e5d5a954bac161925b5d384eecc2","3acc0e651c6ad0e2faeb93b929495ad8d0b6d637","5c23969eb4808071bcb2a21c3df15086e4bc576b","9ca5cad4f19c973bdfa6a50e945158d3d9c18a3b","d9d8414e4fe2bafce56b9d6c98d0069cd44c4e84","daf56f9a7514364c54cee70f342df68dec167bb06bed51ce272fd5a1b58276d1","a5f71bd8e345dc0d43d98589d47c420b16e9fbb8a0022086d08d7b24193407a2","61387c5cdea91f65a7c15c174904b91d116b94e26ffa11e79657aec5b795bbf7","2fd40cda28806cc5aee53c76098f41dcadfc228e7c43bc84f8d3f6291314be3f","32346828910654ff02b71f8425474b2f041a09176ce8dcff4dab58f2755005c1","9ad6db8623ea007af4594b53ce61ee0101274d5b8e8c29a974993f310ca5c06f")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("678bf948fc12a42bab7d7378e13ac4f0","d4c69fb043ea523b7c692131647ae56f","3a0b7bd43f515ccd450f0f8342fa2e13","ede0dd1e42217dd10b62175b22dd85b4","de84e4cb4fadb0a72818a56f9db8eac1","7fcd8b4fa9fe428f64cfc4042df51546","8b53df7248cb62cba75414eb1922ffb567e9a054","66a0542ed5f1e5d5a954bac161925b5d384eecc2","3acc0e651c6ad0e2faeb93b929495ad8d0b6d637","5c23969eb4808071bcb2a21c3df15086e4bc576b","9ca5cad4f19c973bdfa6a50e945158d3d9c18a3b","d9d8414e4fe2bafce56b9d6c98d0069cd44c4e84","daf56f9a7514364c54cee70f342df68dec167bb06bed51ce272fd5a1b58276d1","a5f71bd8e345dc0d43d98589d47c420b16e9fbb8a0022086d08d7b24193407a2","61387c5cdea91f65a7c15c174904b91d116b94e26ffa11e79657aec5b795bbf7","2fd40cda28806cc5aee53c76098f41dcadfc228e7c43bc84f8d3f6291314be3f","32346828910654ff02b71f8425474b2f041a09176ce8dcff4dab58f2755005c1","9ad6db8623ea007af4594b53ce61ee0101274d5b8e8c29a974993f310ca5c06f")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("678bf948fc12a42bab7d7378e13ac4f0","d4c69fb043ea523b7c692131647ae56f","3a0b7bd43f515ccd450f0f8342fa2e13","ede0dd1e42217dd10b62175b22dd85b4","de84e4cb4fadb0a72818a56f9db8eac1","7fcd8b4fa9fe428f64cfc4042df51546","8b53df7248cb62cba75414eb1922ffb567e9a054","66a0542ed5f1e5d5a954bac161925b5d384eecc2","3acc0e651c6ad0e2faeb93b929495ad8d0b6d637","5c23969eb4808071bcb2a21c3df15086e4bc576b","9ca5cad4f19c973bdfa6a50e945158d3d9c18a3b","d9d8414e4fe2bafce56b9d6c98d0069cd44c4e84","daf56f9a7514364c54cee70f342df68dec167bb06bed51ce272fd5a1b58276d1","a5f71bd8e345dc0d43d98589d47c420b16e9fbb8a0022086d08d7b24193407a2","61387c5cdea91f65a7c15c174904b91d116b94e26ffa11e79657aec5b795bbf7","2fd40cda28806cc5aee53c76098f41dcadfc228e7c43bc84f8d3f6291314be3f","32346828910654ff02b71f8425474b2f041a09176ce8dcff4dab58f2755005c1","9ad6db8623ea007af4594b53ce61ee0101274d5b8e8c29a974993f310ca5c06f")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring64 NOT NULL AND customstring64 IN ("678bf948fc12a42bab7d7378e13ac4f0","d4c69fb043ea523b7c692131647ae56f","3a0b7bd43f515ccd450f0f8342fa2e13","ede0dd1e42217dd10b62175b22dd85b4","de84e4cb4fadb0a72818a56f9db8eac1","7fcd8b4fa9fe428f64cfc4042df51546","8b53df7248cb62cba75414eb1922ffb567e9a054","66a0542ed5f1e5d5a954bac161925b5d384eecc2","3acc0e651c6ad0e2faeb93b929495ad8d0b6d637","5c23969eb4808071bcb2a21c3df15086e4bc576b","9ca5cad4f19c973bdfa6a50e945158d3d9c18a3b","d9d8414e4fe2bafce56b9d6c98d0069cd44c4e84","daf56f9a7514364c54cee70f342df68dec167bb06bed51ce272fd5a1b58276d1","a5f71bd8e345dc0d43d98589d47c420b16e9fbb8a0022086d08d7b24193407a2","61387c5cdea91f65a7c15c174904b91d116b94e26ffa11e79657aec5b795bbf7","2fd40cda28806cc5aee53c76098f41dcadfc228e7c43bc84f8d3f6291314be3f","32346828910654ff02b71f8425474b2f041a09176ce8dcff4dab58f2755005c1","9ad6db8623ea007af4594b53ce61ee0101274d5b8e8c29a974993f310ca5c06f")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("678bf948fc12a42bab7d7378e13ac4f0","d4c69fb043ea523b7c692131647ae56f","3a0b7bd43f515ccd450f0f8342fa2e13","ede0dd1e42217dd10b62175b22dd85b4","de84e4cb4fadb0a72818a56f9db8eac1","7fcd8b4fa9fe428f64cfc4042df51546","8b53df7248cb62cba75414eb1922ffb567e9a054","66a0542ed5f1e5d5a954bac161925b5d384eecc2","3acc0e651c6ad0e2faeb93b929495ad8d0b6d637","5c23969eb4808071bcb2a21c3df15086e4bc576b","9ca5cad4f19c973bdfa6a50e945158d3d9c18a3b","d9d8414e4fe2bafce56b9d6c98d0069cd44c4e84","daf56f9a7514364c54cee70f342df68dec167bb06bed51ce272fd5a1b58276d1","a5f71bd8e345dc0d43d98589d47c420b16e9fbb8a0022086d08d7b24193407a2","61387c5cdea91f65a7c15c174904b91d116b94e26ffa11e79657aec5b795bbf7","2fd40cda28806cc5aee53c76098f41dcadfc228e7c43bc84f8d3f6291314be3f","32346828910654ff02b71f8425474b2f041a09176ce8dcff4dab58f2755005c1","9ad6db8623ea007af4594b53ce61ee0101274d5b8e8c29a974993f310ca5c06f")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("678bf948fc12a42bab7d7378e13ac4f0","d4c69fb043ea523b7c692131647ae56f","3a0b7bd43f515ccd450f0f8342fa2e13","ede0dd1e42217dd10b62175b22dd85b4","de84e4cb4fadb0a72818a56f9db8eac1","7fcd8b4fa9fe428f64cfc4042df51546","8b53df7248cb62cba75414eb1922ffb567e9a054","66a0542ed5f1e5d5a954bac161925b5d384eecc2","3acc0e651c6ad0e2faeb93b929495ad8d0b6d637","5c23969eb4808071bcb2a21c3df15086e4bc576b","9ca5cad4f19c973bdfa6a50e945158d3d9c18a3b","d9d8414e4fe2bafce56b9d6c98d0069cd44c4e84","daf56f9a7514364c54cee70f342df68dec167bb06bed51ce272fd5a1b58276d1","a5f71bd8e345dc0d43d98589d47c420b16e9fbb8a0022086d08d7b24193407a2","61387c5cdea91f65a7c15c174904b91d116b94e26ffa11e79657aec5b795bbf7","2fd40cda28806cc5aee53c76098f41dcadfc228e7c43bc84f8d3f6291314be3f","32346828910654ff02b71f8425474b2f041a09176ce8dcff4dab58f2755005c1","9ad6db8623ea007af4594b53ce61ee0101274d5b8e8c29a974993f310ca5c06f")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("678bf948fc12a42bab7d7378e13ac4f0","d4c69fb043ea523b7c692131647ae56f","3a0b7bd43f515ccd450f0f8342fa2e13","ede0dd1e42217dd10b62175b22dd85b4","de84e4cb4fadb0a72818a56f9db8eac1","7fcd8b4fa9fe428f64cfc4042df51546","8b53df7248cb62cba75414eb1922ffb567e9a054","66a0542ed5f1e5d5a954bac161925b5d384eecc2","3acc0e651c6ad0e2faeb93b929495ad8d0b6d637","5c23969eb4808071bcb2a21c3df15086e4bc576b","9ca5cad4f19c973bdfa6a50e945158d3d9c18a3b","d9d8414e4fe2bafce56b9d6c98d0069cd44c4e84","daf56f9a7514364c54cee70f342df68dec167bb06bed51ce272fd5a1b58276d1","a5f71bd8e345dc0d43d98589d47c420b16e9fbb8a0022086d08d7b24193407a2","61387c5cdea91f65a7c15c174904b91d116b94e26ffa11e79657aec5b795bbf7","2fd40cda28806cc5aee53c76098f41dcadfc228e7c43bc84f8d3f6291314be3f","32346828910654ff02b71f8425474b2f041a09176ce8dcff4dab58f2755005c1","9ad6db8623ea007af4594b53ce61ee0101274d5b8e8c29a974993f310ca5c06f")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring64 NOT NULL AND customstring64 IN ("678bf948fc12a42bab7d7378e13ac4f0","d4c69fb043ea523b7c692131647ae56f","3a0b7bd43f515ccd450f0f8342fa2e13","ede0dd1e42217dd10b62175b22dd85b4","de84e4cb4fadb0a72818a56f9db8eac1","7fcd8b4fa9fe428f64cfc4042df51546","8b53df7248cb62cba75414eb1922ffb567e9a054","66a0542ed5f1e5d5a954bac161925b5d384eecc2","3acc0e651c6ad0e2faeb93b929495ad8d0b6d637","5c23969eb4808071bcb2a21c3df15086e4bc576b","9ca5cad4f19c973bdfa6a50e945158d3d9c18a3b","d9d8414e4fe2bafce56b9d6c98d0069cd44c4e84","daf56f9a7514364c54cee70f342df68dec167bb06bed51ce272fd5a1b58276d1","a5f71bd8e345dc0d43d98589d47c420b16e9fbb8a0022086d08d7b24193407a2","61387c5cdea91f65a7c15c174904b91d116b94e26ffa11e79657aec5b795bbf7","2fd40cda28806cc5aee53c76098f41dcadfc228e7c43bc84f8d3f6291314be3f","32346828910654ff02b71f8425474b2f041a09176ce8dcff4dab58f2755005c1","9ad6db8623ea007af4594b53ce61ee0101274d5b8e8c29a974993f310ca5c06f")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("678bf948fc12a42bab7d7378e13ac4f0","d4c69fb043ea523b7c692131647ae56f","3a0b7bd43f515ccd450f0f8342fa2e13","ede0dd1e42217dd10b62175b22dd85b4","de84e4cb4fadb0a72818a56f9db8eac1","7fcd8b4fa9fe428f64cfc4042df51546","8b53df7248cb62cba75414eb1922ffb567e9a054","66a0542ed5f1e5d5a954bac161925b5d384eecc2","3acc0e651c6ad0e2faeb93b929495ad8d0b6d637","5c23969eb4808071bcb2a21c3df15086e4bc576b","9ca5cad4f19c973bdfa6a50e945158d3d9c18a3b","d9d8414e4fe2bafce56b9d6c98d0069cd44c4e84","daf56f9a7514364c54cee70f342df68dec167bb06bed51ce272fd5a1b58276d1","a5f71bd8e345dc0d43d98589d47c420b16e9fbb8a0022086d08d7b24193407a2","61387c5cdea91f65a7c15c174904b91d116b94e26ffa11e79657aec5b795bbf7","2fd40cda28806cc5aee53c76098f41dcadfc228e7c43bc84f8d3f6291314be3f","32346828910654ff02b71f8425474b2f041a09176ce8dcff4dab58f2755005c1","9ad6db8623ea007af4594b53ce61ee0101274d5b8e8c29a974993f310ca5c06f")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("678bf948fc12a42bab7d7378e13ac4f0","d4c69fb043ea523b7c692131647ae56f","3a0b7bd43f515ccd450f0f8342fa2e13","ede0dd1e42217dd10b62175b22dd85b4","de84e4cb4fadb0a72818a56f9db8eac1","7fcd8b4fa9fe428f64cfc4042df51546","8b53df7248cb62cba75414eb1922ffb567e9a054","66a0542ed5f1e5d5a954bac161925b5d384eecc2","3acc0e651c6ad0e2faeb93b929495ad8d0b6d637","5c23969eb4808071bcb2a21c3df15086e4bc576b","9ca5cad4f19c973bdfa6a50e945158d3d9c18a3b","d9d8414e4fe2bafce56b9d6c98d0069cd44c4e84","daf56f9a7514364c54cee70f342df68dec167bb06bed51ce272fd5a1b58276d1","a5f71bd8e345dc0d43d98589d47c420b16e9fbb8a0022086d08d7b24193407a2","61387c5cdea91f65a7c15c174904b91d116b94e26ffa11e79657aec5b795bbf7","2fd40cda28806cc5aee53c76098f41dcadfc228e7c43bc84f8d3f6291314be3f","32346828910654ff02b71f8425474b2f041a09176ce8dcff4dab58f2755005c1","9ad6db8623ea007af4594b53ce61ee0101274d5b8e8c29a974993f310ca5c06f")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("678bf948fc12a42bab7d7378e13ac4f0","d4c69fb043ea523b7c692131647ae56f","3a0b7bd43f515ccd450f0f8342fa2e13","ede0dd1e42217dd10b62175b22dd85b4","de84e4cb4fadb0a72818a56f9db8eac1","7fcd8b4fa9fe428f64cfc4042df51546","8b53df7248cb62cba75414eb1922ffb567e9a054","66a0542ed5f1e5d5a954bac161925b5d384eecc2","3acc0e651c6ad0e2faeb93b929495ad8d0b6d637","5c23969eb4808071bcb2a21c3df15086e4bc576b","9ca5cad4f19c973bdfa6a50e945158d3d9c18a3b","d9d8414e4fe2bafce56b9d6c98d0069cd44c4e84","daf56f9a7514364c54cee70f342df68dec167bb06bed51ce272fd5a1b58276d1","a5f71bd8e345dc0d43d98589d47c420b16e9fbb8a0022086d08d7b24193407a2","61387c5cdea91f65a7c15c174904b91d116b94e26ffa11e79657aec5b795bbf7","2fd40cda28806cc5aee53c76098f41dcadfc228e7c43bc84f8d3f6291314be3f","32346828910654ff02b71f8425474b2f041a09176ce8dcff4dab58f2755005c1","9ad6db8623ea007af4594b53ce61ee0101274d5b8e8c29a974993f310ca5c06f")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring64 NOT NULL AND customstring64 IN ("678bf948fc12a42bab7d7378e13ac4f0","d4c69fb043ea523b7c692131647ae56f","3a0b7bd43f515ccd450f0f8342fa2e13","ede0dd1e42217dd10b62175b22dd85b4","de84e4cb4fadb0a72818a56f9db8eac1","7fcd8b4fa9fe428f64cfc4042df51546","8b53df7248cb62cba75414eb1922ffb567e9a054","66a0542ed5f1e5d5a954bac161925b5d384eecc2","3acc0e651c6ad0e2faeb93b929495ad8d0b6d637","5c23969eb4808071bcb2a21c3df15086e4bc576b","9ca5cad4f19c973bdfa6a50e945158d3d9c18a3b","d9d8414e4fe2bafce56b9d6c98d0069cd44c4e84","daf56f9a7514364c54cee70f342df68dec167bb06bed51ce272fd5a1b58276d1","a5f71bd8e345dc0d43d98589d47c420b16e9fbb8a0022086d08d7b24193407a2","61387c5cdea91f65a7c15c174904b91d116b94e26ffa11e79657aec5b795bbf7","2fd40cda28806cc5aee53c76098f41dcadfc228e7c43bc84f8d3f6291314be3f","32346828910654ff02b71f8425474b2f041a09176ce8dcff4dab58f2755005c1","9ad6db8623ea007af4594b53ce61ee0101274d5b8e8c29a974993f310ca5c06f")
index=activity AND rg_functionality="Endpoint Management Systems" AND requesturl NOT NULL AND requesturl IN ("https://retailer-indicators-resume-key.trycloudflare.com/toto.zip","https://retailer-indicators-resume-key.trycloudflare.com/update.bat","https://dl.dropboxusercontent.com/scl/fi/6emtkcbmpn18s95s0tpm6/vrm0193920034.zip")
index=activity AND rg_functionality="Endpoint Management Systems" AND Message NOT NULL AND Message IN ("https://retailer-indicators-resume-key.trycloudflare.com/toto.zip","https://retailer-indicators-resume-key.trycloudflare.com/update.bat","https://dl.dropboxusercontent.com/scl/fi/6emtkcbmpn18s95s0tpm6/vrm0193920034.zip")
index=activity AND rg_functionality="Endpoint Management Systems" AND Requestcontext NOT NULL AND Requestcontext IN ("https://retailer-indicators-resume-key.trycloudflare.com/toto.zip","https://retailer-indicators-resume-key.trycloudflare.com/update.bat","https://dl.dropboxusercontent.com/scl/fi/6emtkcbmpn18s95s0tpm6/vrm0193920034.zip")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("https://retailer-indicators-resume-key.trycloudflare.com/toto.zip","https://retailer-indicators-resume-key.trycloudflare.com/update.bat","https://dl.dropboxusercontent.com/scl/fi/6emtkcbmpn18s95s0tpm6/vrm0193920034.zip")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND requesturl NOT NULL AND requesturl IN ("https://retailer-indicators-resume-key.trycloudflare.com/toto.zip","https://retailer-indicators-resume-key.trycloudflare.com/update.bat","https://dl.dropboxusercontent.com/scl/fi/6emtkcbmpn18s95s0tpm6/vrm0193920034.zip")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND Message NOT NULL AND Message IN ("https://retailer-indicators-resume-key.trycloudflare.com/toto.zip","https://retailer-indicators-resume-key.trycloudflare.com/update.bat","https://dl.dropboxusercontent.com/scl/fi/6emtkcbmpn18s95s0tpm6/vrm0193920034.zip")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND Requestcontext NOT NULL AND Requestcontext IN ("https://retailer-indicators-resume-key.trycloudflare.com/toto.zip","https://retailer-indicators-resume-key.trycloudflare.com/update.bat","https://dl.dropboxusercontent.com/scl/fi/6emtkcbmpn18s95s0tpm6/vrm0193920034.zip")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("https://retailer-indicators-resume-key.trycloudflare.com/toto.zip","https://retailer-indicators-resume-key.trycloudflare.com/update.bat","https://dl.dropboxusercontent.com/scl/fi/6emtkcbmpn18s95s0tpm6/vrm0193920034.zip")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND requesturl NOT NULL AND requesturl IN ("https://retailer-indicators-resume-key.trycloudflare.com/toto.zip","https://retailer-indicators-resume-key.trycloudflare.com/update.bat","https://dl.dropboxusercontent.com/scl/fi/6emtkcbmpn18s95s0tpm6/vrm0193920034.zip")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND Message NOT NULL AND Message IN ("https://retailer-indicators-resume-key.trycloudflare.com/toto.zip","https://retailer-indicators-resume-key.trycloudflare.com/update.bat","https://dl.dropboxusercontent.com/scl/fi/6emtkcbmpn18s95s0tpm6/vrm0193920034.zip")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND Requestcontext NOT NULL AND Requestcontext IN ("https://retailer-indicators-resume-key.trycloudflare.com/toto.zip","https://retailer-indicators-resume-key.trycloudflare.com/update.bat","https://dl.dropboxusercontent.com/scl/fi/6emtkcbmpn18s95s0tpm6/vrm0193920034.zip")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("https://retailer-indicators-resume-key.trycloudflare.com/toto.zip","https://retailer-indicators-resume-key.trycloudflare.com/update.bat","https://dl.dropboxusercontent.com/scl/fi/6emtkcbmpn18s95s0tpm6/vrm0193920034.zip")
index=activity AND rg_functionality="Email / Email Security" AND requesturl NOT NULL AND requesturl IN ("https://retailer-indicators-resume-key.trycloudflare.com/toto.zip","https://retailer-indicators-resume-key.trycloudflare.com/update.bat","https://dl.dropboxusercontent.com/scl/fi/6emtkcbmpn18s95s0tpm6/vrm0193920034.zip")
index=activity AND rg_functionality="Email / Email Security" AND Message NOT NULL AND Message IN ("https://retailer-indicators-resume-key.trycloudflare.com/toto.zip","https://retailer-indicators-resume-key.trycloudflare.com/update.bat","https://dl.dropboxusercontent.com/scl/fi/6emtkcbmpn18s95s0tpm6/vrm0193920034.zip")
index=activity AND rg_functionality="Email / Email Security" AND Requestcontext NOT NULL AND Requestcontext IN ("https://retailer-indicators-resume-key.trycloudflare.com/toto.zip","https://retailer-indicators-resume-key.trycloudflare.com/update.bat","https://dl.dropboxusercontent.com/scl/fi/6emtkcbmpn18s95s0tpm6/vrm0193920034.zip")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("https://retailer-indicators-resume-key.trycloudflare.com/toto.zip","https://retailer-indicators-resume-key.trycloudflare.com/update.bat","https://dl.dropboxusercontent.com/scl/fi/6emtkcbmpn18s95s0tpm6/vrm0193920034.zip")
index=activity AND rg_functionality="Cloud Email / Email Security" AND requesturl NOT NULL AND requesturl IN ("https://retailer-indicators-resume-key.trycloudflare.com/toto.zip","https://retailer-indicators-resume-key.trycloudflare.com/update.bat","https://dl.dropboxusercontent.com/scl/fi/6emtkcbmpn18s95s0tpm6/vrm0193920034.zip")
index=activity AND rg_functionality="Cloud Email / Email Security" AND Message NOT NULL AND Message IN ("https://retailer-indicators-resume-key.trycloudflare.com/toto.zip","https://retailer-indicators-resume-key.trycloudflare.com/update.bat","https://dl.dropboxusercontent.com/scl/fi/6emtkcbmpn18s95s0tpm6/vrm0193920034.zip")
index=activity AND rg_functionality="Cloud Email / Email Security" AND Requestcontext NOT NULL AND Requestcontext IN ("https://retailer-indicators-resume-key.trycloudflare.com/toto.zip","https://retailer-indicators-resume-key.trycloudflare.com/update.bat","https://dl.dropboxusercontent.com/scl/fi/6emtkcbmpn18s95s0tpm6/vrm0193920034.zip")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("https://retailer-indicators-resume-key.trycloudflare.com/toto.zip","https://retailer-indicators-resume-key.trycloudflare.com/update.bat","https://dl.dropboxusercontent.com/scl/fi/6emtkcbmpn18s95s0tpm6/vrm0193920034.zip")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND requesturl NOT NULL AND requesturl IN ("https://retailer-indicators-resume-key.trycloudflare.com/toto.zip","https://retailer-indicators-resume-key.trycloudflare.com/update.bat","https://dl.dropboxusercontent.com/scl/fi/6emtkcbmpn18s95s0tpm6/vrm0193920034.zip")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND Message NOT NULL AND Message IN ("https://retailer-indicators-resume-key.trycloudflare.com/toto.zip","https://retailer-indicators-resume-key.trycloudflare.com/update.bat","https://dl.dropboxusercontent.com/scl/fi/6emtkcbmpn18s95s0tpm6/vrm0193920034.zip")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND Requestcontext NOT NULL AND Requestcontext IN ("https://retailer-indicators-resume-key.trycloudflare.com/toto.zip","https://retailer-indicators-resume-key.trycloudflare.com/update.bat","https://dl.dropboxusercontent.com/scl/fi/6emtkcbmpn18s95s0tpm6/vrm0193920034.zip")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("https://retailer-indicators-resume-key.trycloudflare.com/toto.zip","https://retailer-indicators-resume-key.trycloudflare.com/update.bat","https://dl.dropboxusercontent.com/scl/fi/6emtkcbmpn18s95s0tpm6/vrm0193920034.zip")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND requesturl NOT NULL AND requesturl IN ("https://retailer-indicators-resume-key.trycloudflare.com/toto.zip","https://retailer-indicators-resume-key.trycloudflare.com/update.bat","https://dl.dropboxusercontent.com/scl/fi/6emtkcbmpn18s95s0tpm6/vrm0193920034.zip")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND Message NOT NULL AND Message IN ("https://retailer-indicators-resume-key.trycloudflare.com/toto.zip","https://retailer-indicators-resume-key.trycloudflare.com/update.bat","https://dl.dropboxusercontent.com/scl/fi/6emtkcbmpn18s95s0tpm6/vrm0193920034.zip")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND Requestcontext NOT NULL AND Requestcontext IN ("https://retailer-indicators-resume-key.trycloudflare.com/toto.zip","https://retailer-indicators-resume-key.trycloudflare.com/update.bat","https://dl.dropboxusercontent.com/scl/fi/6emtkcbmpn18s95s0tpm6/vrm0193920034.zip")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("https://retailer-indicators-resume-key.trycloudflare.com/toto.zip","https://retailer-indicators-resume-key.trycloudflare.com/update.bat","https://dl.dropboxusercontent.com/scl/fi/6emtkcbmpn18s95s0tpm6/vrm0193920034.zip")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND requesturl NOT NULL AND requesturl IN ("https://retailer-indicators-resume-key.trycloudflare.com/toto.zip","https://retailer-indicators-resume-key.trycloudflare.com/update.bat","https://dl.dropboxusercontent.com/scl/fi/6emtkcbmpn18s95s0tpm6/vrm0193920034.zip")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND Message NOT NULL AND Message IN ("https://retailer-indicators-resume-key.trycloudflare.com/toto.zip","https://retailer-indicators-resume-key.trycloudflare.com/update.bat","https://dl.dropboxusercontent.com/scl/fi/6emtkcbmpn18s95s0tpm6/vrm0193920034.zip")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND Requestcontext NOT NULL AND Requestcontext IN ("https://retailer-indicators-resume-key.trycloudflare.com/toto.zip","https://retailer-indicators-resume-key.trycloudflare.com/update.bat","https://dl.dropboxusercontent.com/scl/fi/6emtkcbmpn18s95s0tpm6/vrm0193920034.zip")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("https://retailer-indicators-resume-key.trycloudflare.com/toto.zip","https://retailer-indicators-resume-key.trycloudflare.com/update.bat","https://dl.dropboxusercontent.com/scl/fi/6emtkcbmpn18s95s0tpm6/vrm0193920034.zip")
index=activity AND rg_functionality="Web Proxy" AND requesturl NOT NULL AND requesturl IN ("https://retailer-indicators-resume-key.trycloudflare.com/toto.zip","https://retailer-indicators-resume-key.trycloudflare.com/update.bat","https://dl.dropboxusercontent.com/scl/fi/6emtkcbmpn18s95s0tpm6/vrm0193920034.zip")
index=activity AND rg_functionality="Web Proxy" AND Message NOT NULL AND Message IN ("https://retailer-indicators-resume-key.trycloudflare.com/toto.zip","https://retailer-indicators-resume-key.trycloudflare.com/update.bat","https://dl.dropboxusercontent.com/scl/fi/6emtkcbmpn18s95s0tpm6/vrm0193920034.zip")
index=activity AND rg_functionality="Web Proxy" AND Requestcontext NOT NULL AND Requestcontext IN ("https://retailer-indicators-resume-key.trycloudflare.com/toto.zip","https://retailer-indicators-resume-key.trycloudflare.com/update.bat","https://dl.dropboxusercontent.com/scl/fi/6emtkcbmpn18s95s0tpm6/vrm0193920034.zip")
index=activity AND rg_functionality="Web Proxy" AND customstring3 NOT NULL AND customstring3 IN ("https://retailer-indicators-resume-key.trycloudflare.com/toto.zip","https://retailer-indicators-resume-key.trycloudflare.com/update.bat","https://dl.dropboxusercontent.com/scl/fi/6emtkcbmpn18s95s0tpm6/vrm0193920034.zip")
index=activity AND rg_functionality="Next Generation Firewall" AND requesturl NOT NULL AND requesturl IN ("https://retailer-indicators-resume-key.trycloudflare.com/toto.zip","https://retailer-indicators-resume-key.trycloudflare.com/update.bat","https://dl.dropboxusercontent.com/scl/fi/6emtkcbmpn18s95s0tpm6/vrm0193920034.zip")
index=activity AND rg_functionality="Next Generation Firewall" AND Message NOT NULL AND Message IN ("https://retailer-indicators-resume-key.trycloudflare.com/toto.zip","https://retailer-indicators-resume-key.trycloudflare.com/update.bat","https://dl.dropboxusercontent.com/scl/fi/6emtkcbmpn18s95s0tpm6/vrm0193920034.zip")
index=activity AND rg_functionality="Next Generation Firewall" AND Requestcontext NOT NULL AND Requestcontext IN ("https://retailer-indicators-resume-key.trycloudflare.com/toto.zip","https://retailer-indicators-resume-key.trycloudflare.com/update.bat","https://dl.dropboxusercontent.com/scl/fi/6emtkcbmpn18s95s0tpm6/vrm0193920034.zip")
index=activity AND rg_functionality="Next Generation Firewall" AND customstring3 NOT NULL AND customstring3 IN ("https://retailer-indicators-resume-key.trycloudflare.com/toto.zip","https://retailer-indicators-resume-key.trycloudflare.com/update.bat","https://dl.dropboxusercontent.com/scl/fi/6emtkcbmpn18s95s0tpm6/vrm0193920034.zip")
index=activity AND rg_functionality="Flow" AND requesturl NOT NULL AND requesturl IN ("https://retailer-indicators-resume-key.trycloudflare.com/toto.zip","https://retailer-indicators-resume-key.trycloudflare.com/update.bat","https://dl.dropboxusercontent.com/scl/fi/6emtkcbmpn18s95s0tpm6/vrm0193920034.zip")
index=activity AND rg_functionality="Flow" AND Message NOT NULL AND Message IN ("https://retailer-indicators-resume-key.trycloudflare.com/toto.zip","https://retailer-indicators-resume-key.trycloudflare.com/update.bat","https://dl.dropboxusercontent.com/scl/fi/6emtkcbmpn18s95s0tpm6/vrm0193920034.zip")
index=activity AND rg_functionality="Flow" AND Requestcontext NOT NULL AND Requestcontext IN ("https://retailer-indicators-resume-key.trycloudflare.com/toto.zip","https://retailer-indicators-resume-key.trycloudflare.com/update.bat","https://dl.dropboxusercontent.com/scl/fi/6emtkcbmpn18s95s0tpm6/vrm0193920034.zip")
index=activity AND rg_functionality="Flow" AND customstring3 NOT NULL AND customstring3 IN ("https://retailer-indicators-resume-key.trycloudflare.com/toto.zip","https://retailer-indicators-resume-key.trycloudflare.com/update.bat","https://dl.dropboxusercontent.com/scl/fi/6emtkcbmpn18s95s0tpm6/vrm0193920034.zip")
index=activity AND rg_functionality="Web Server" AND requesturl NOT NULL AND requesturl IN ("https://retailer-indicators-resume-key.trycloudflare.com/toto.zip","https://retailer-indicators-resume-key.trycloudflare.com/update.bat","https://dl.dropboxusercontent.com/scl/fi/6emtkcbmpn18s95s0tpm6/vrm0193920034.zip")
index=activity AND rg_functionality="Web Server" AND Message NOT NULL AND Message IN ("https://retailer-indicators-resume-key.trycloudflare.com/toto.zip","https://retailer-indicators-resume-key.trycloudflare.com/update.bat","https://dl.dropboxusercontent.com/scl/fi/6emtkcbmpn18s95s0tpm6/vrm0193920034.zip")
index=activity AND rg_functionality="Web Server" AND Requestcontext NOT NULL AND Requestcontext IN ("https://retailer-indicators-resume-key.trycloudflare.com/toto.zip","https://retailer-indicators-resume-key.trycloudflare.com/update.bat","https://dl.dropboxusercontent.com/scl/fi/6emtkcbmpn18s95s0tpm6/vrm0193920034.zip")
index=activity AND rg_functionality="Web Server" AND customstring3 NOT NULL AND customstring3 IN ("https://retailer-indicators-resume-key.trycloudflare.com/toto.zip","https://retailer-indicators-resume-key.trycloudflare.com/update.bat","https://dl.dropboxusercontent.com/scl/fi/6emtkcbmpn18s95s0tpm6/vrm0193920034.zip")
index=activity AND rg_functionality="Email / Email Security" AND requesturl NOT NULL AND requesturl IN ("https://retailer-indicators-resume-key.trycloudflare.com/toto.zip","https://retailer-indicators-resume-key.trycloudflare.com/update.bat","https://dl.dropboxusercontent.com/scl/fi/6emtkcbmpn18s95s0tpm6/vrm0193920034.zip")
index=activity AND rg_functionality="Email / Email Security" AND Message NOT NULL AND Message IN ("https://retailer-indicators-resume-key.trycloudflare.com/toto.zip","https://retailer-indicators-resume-key.trycloudflare.com/update.bat","https://dl.dropboxusercontent.com/scl/fi/6emtkcbmpn18s95s0tpm6/vrm0193920034.zip")
index=activity AND rg_functionality="Email / Email Security" AND Requestcontext NOT NULL AND Requestcontext IN ("https://retailer-indicators-resume-key.trycloudflare.com/toto.zip","https://retailer-indicators-resume-key.trycloudflare.com/update.bat","https://dl.dropboxusercontent.com/scl/fi/6emtkcbmpn18s95s0tpm6/vrm0193920034.zip")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("https://retailer-indicators-resume-key.trycloudflare.com/toto.zip","https://retailer-indicators-resume-key.trycloudflare.com/update.bat","https://dl.dropboxusercontent.com/scl/fi/6emtkcbmpn18s95s0tpm6/vrm0193920034.zip")
index=activity AND rg_functionality="Cloud Email / Email Security" AND requesturl NOT NULL AND requesturl IN ("https://retailer-indicators-resume-key.trycloudflare.com/toto.zip","https://retailer-indicators-resume-key.trycloudflare.com/update.bat","https://dl.dropboxusercontent.com/scl/fi/6emtkcbmpn18s95s0tpm6/vrm0193920034.zip")
index=activity AND rg_functionality="Cloud Email / Email Security" AND Message NOT NULL AND Message IN ("https://retailer-indicators-resume-key.trycloudflare.com/toto.zip","https://retailer-indicators-resume-key.trycloudflare.com/update.bat","https://dl.dropboxusercontent.com/scl/fi/6emtkcbmpn18s95s0tpm6/vrm0193920034.zip")
index=activity AND rg_functionality="Cloud Email / Email Security" AND Requestcontext NOT NULL AND Requestcontext IN ("https://retailer-indicators-resume-key.trycloudflare.com/toto.zip","https://retailer-indicators-resume-key.trycloudflare.com/update.bat","https://dl.dropboxusercontent.com/scl/fi/6emtkcbmpn18s95s0tpm6/vrm0193920034.zip")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("https://retailer-indicators-resume-key.trycloudflare.com/toto.zip","https://retailer-indicators-resume-key.trycloudflare.com/update.bat","https://dl.dropboxusercontent.com/scl/fi/6emtkcbmpn18s95s0tpm6/vrm0193920034.zip")
index=activity AND rg_functionality="Web Application Firewall" AND requesturl NOT NULL AND requesturl IN ("https://retailer-indicators-resume-key.trycloudflare.com/toto.zip","https://retailer-indicators-resume-key.trycloudflare.com/update.bat","https://dl.dropboxusercontent.com/scl/fi/6emtkcbmpn18s95s0tpm6/vrm0193920034.zip")
index=activity AND rg_functionality="Web Application Firewall" AND Message NOT NULL AND Message IN ("https://retailer-indicators-resume-key.trycloudflare.com/toto.zip","https://retailer-indicators-resume-key.trycloudflare.com/update.bat","https://dl.dropboxusercontent.com/scl/fi/6emtkcbmpn18s95s0tpm6/vrm0193920034.zip")
index=activity AND rg_functionality="Web Application Firewall" AND Requestcontext NOT NULL AND Requestcontext IN ("https://retailer-indicators-resume-key.trycloudflare.com/toto.zip","https://retailer-indicators-resume-key.trycloudflare.com/update.bat","https://dl.dropboxusercontent.com/scl/fi/6emtkcbmpn18s95s0tpm6/vrm0193920034.zip")
index=activity AND rg_functionality="Web Application Firewall" AND customstring3 NOT NULL AND customstring3 IN ("https://retailer-indicators-resume-key.trycloudflare.com/toto.zip","https://retailer-indicators-resume-key.trycloudflare.com/update.bat","https://dl.dropboxusercontent.com/scl/fi/6emtkcbmpn18s95s0tpm6/vrm0193920034.zip")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND requesturl NOT NULL AND requesturl IN ("https://retailer-indicators-resume-key.trycloudflare.com/toto.zip","https://retailer-indicators-resume-key.trycloudflare.com/update.bat","https://dl.dropboxusercontent.com/scl/fi/6emtkcbmpn18s95s0tpm6/vrm0193920034.zip")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND Message NOT NULL AND Message IN ("https://retailer-indicators-resume-key.trycloudflare.com/toto.zip","https://retailer-indicators-resume-key.trycloudflare.com/update.bat","https://dl.dropboxusercontent.com/scl/fi/6emtkcbmpn18s95s0tpm6/vrm0193920034.zip")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND Requestcontext NOT NULL AND Requestcontext IN ("https://retailer-indicators-resume-key.trycloudflare.com/toto.zip","https://retailer-indicators-resume-key.trycloudflare.com/update.bat","https://dl.dropboxusercontent.com/scl/fi/6emtkcbmpn18s95s0tpm6/vrm0193920034.zip")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("https://retailer-indicators-resume-key.trycloudflare.com/toto.zip","https://retailer-indicators-resume-key.trycloudflare.com/update.bat","https://dl.dropboxusercontent.com/scl/fi/6emtkcbmpn18s95s0tpm6/vrm0193920034.zip")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND requesturl NOT NULL AND requesturl IN ("https://retailer-indicators-resume-key.trycloudflare.com/toto.zip","https://retailer-indicators-resume-key.trycloudflare.com/update.bat","https://dl.dropboxusercontent.com/scl/fi/6emtkcbmpn18s95s0tpm6/vrm0193920034.zip")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND Message NOT NULL AND Message IN ("https://retailer-indicators-resume-key.trycloudflare.com/toto.zip","https://retailer-indicators-resume-key.trycloudflare.com/update.bat","https://dl.dropboxusercontent.com/scl/fi/6emtkcbmpn18s95s0tpm6/vrm0193920034.zip")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND Requestcontext NOT NULL AND Requestcontext IN ("https://retailer-indicators-resume-key.trycloudflare.com/toto.zip","https://retailer-indicators-resume-key.trycloudflare.com/update.bat","https://dl.dropboxusercontent.com/scl/fi/6emtkcbmpn18s95s0tpm6/vrm0193920034.zip")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND customstring3 NOT NULL AND customstring3 IN ("https://retailer-indicators-resume-key.trycloudflare.com/toto.zip","https://retailer-indicators-resume-key.trycloudflare.com/update.bat","https://dl.dropboxusercontent.com/scl/fi/6emtkcbmpn18s95s0tpm6/vrm0193920034.zip")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND requesturl NOT NULL AND requesturl IN ("https://retailer-indicators-resume-key.trycloudflare.com/toto.zip","https://retailer-indicators-resume-key.trycloudflare.com/update.bat","https://dl.dropboxusercontent.com/scl/fi/6emtkcbmpn18s95s0tpm6/vrm0193920034.zip")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND Message NOT NULL AND Message IN ("https://retailer-indicators-resume-key.trycloudflare.com/toto.zip","https://retailer-indicators-resume-key.trycloudflare.com/update.bat","https://dl.dropboxusercontent.com/scl/fi/6emtkcbmpn18s95s0tpm6/vrm0193920034.zip")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND Requestcontext NOT NULL AND Requestcontext IN ("https://retailer-indicators-resume-key.trycloudflare.com/toto.zip","https://retailer-indicators-resume-key.trycloudflare.com/update.bat","https://dl.dropboxusercontent.com/scl/fi/6emtkcbmpn18s95s0tpm6/vrm0193920034.zip")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND customstring3 NOT NULL AND customstring3 IN ("https://retailer-indicators-resume-key.trycloudflare.com/toto.zip","https://retailer-indicators-resume-key.trycloudflare.com/update.bat","https://dl.dropboxusercontent.com/scl/fi/6emtkcbmpn18s95s0tpm6/vrm0193920034.zip")
index=activity AND rg_functionality="Cloud Application Security Broker" AND requesturl NOT NULL AND requesturl IN ("https://retailer-indicators-resume-key.trycloudflare.com/toto.zip","https://retailer-indicators-resume-key.trycloudflare.com/update.bat","https://dl.dropboxusercontent.com/scl/fi/6emtkcbmpn18s95s0tpm6/vrm0193920034.zip")
index=activity AND rg_functionality="Cloud Application Security Broker" AND Message NOT NULL AND Message IN ("https://retailer-indicators-resume-key.trycloudflare.com/toto.zip","https://retailer-indicators-resume-key.trycloudflare.com/update.bat","https://dl.dropboxusercontent.com/scl/fi/6emtkcbmpn18s95s0tpm6/vrm0193920034.zip")
index=activity AND rg_functionality="Cloud Application Security Broker" AND Requestcontext NOT NULL AND Requestcontext IN ("https://retailer-indicators-resume-key.trycloudflare.com/toto.zip","https://retailer-indicators-resume-key.trycloudflare.com/update.bat","https://dl.dropboxusercontent.com/scl/fi/6emtkcbmpn18s95s0tpm6/vrm0193920034.zip")
index=activity AND rg_functionality="Cloud Application Security Broker" AND customstring3 NOT NULL AND customstring3 IN ("https://retailer-indicators-resume-key.trycloudflare.com/toto.zip","https://retailer-indicators-resume-key.trycloudflare.com/update.bat","https://dl.dropboxusercontent.com/scl/fi/6emtkcbmpn18s95s0tpm6/vrm0193920034.zip")
index=activity AND rg_functionality="Source Code Repository" AND requesturl NOT NULL AND requesturl IN ("https://retailer-indicators-resume-key.trycloudflare.com/toto.zip","https://retailer-indicators-resume-key.trycloudflare.com/update.bat","https://dl.dropboxusercontent.com/scl/fi/6emtkcbmpn18s95s0tpm6/vrm0193920034.zip")
index=activity AND rg_functionality="Source Code Repository" AND Message NOT NULL AND Message IN ("https://retailer-indicators-resume-key.trycloudflare.com/toto.zip","https://retailer-indicators-resume-key.trycloudflare.com/update.bat","https://dl.dropboxusercontent.com/scl/fi/6emtkcbmpn18s95s0tpm6/vrm0193920034.zip")
index=activity AND rg_functionality="Source Code Repository" AND Requestcontext NOT NULL AND Requestcontext IN ("https://retailer-indicators-resume-key.trycloudflare.com/toto.zip","https://retailer-indicators-resume-key.trycloudflare.com/update.bat","https://dl.dropboxusercontent.com/scl/fi/6emtkcbmpn18s95s0tpm6/vrm0193920034.zip")
index=activity AND rg_functionality="Source Code Repository" AND customstring3 NOT NULL AND customstring3 IN ("https://retailer-indicators-resume-key.trycloudflare.com/toto.zip","https://retailer-indicators-resume-key.trycloudflare.com/update.bat","https://dl.dropboxusercontent.com/scl/fi/6emtkcbmpn18s95s0tpm6/vrm0193920034.zip")
index=activity AND rg_functionality="Authentication / VPN" AND requesturl NOT NULL AND requesturl IN ("https://retailer-indicators-resume-key.trycloudflare.com/toto.zip","https://retailer-indicators-resume-key.trycloudflare.com/update.bat","https://dl.dropboxusercontent.com/scl/fi/6emtkcbmpn18s95s0tpm6/vrm0193920034.zip")
index=activity AND rg_functionality="Authentication / VPN" AND Message NOT NULL AND Message IN ("https://retailer-indicators-resume-key.trycloudflare.com/toto.zip","https://retailer-indicators-resume-key.trycloudflare.com/update.bat","https://dl.dropboxusercontent.com/scl/fi/6emtkcbmpn18s95s0tpm6/vrm0193920034.zip")
index=activity AND rg_functionality="Authentication / VPN" AND Requestcontext NOT NULL AND Requestcontext IN ("https://retailer-indicators-resume-key.trycloudflare.com/toto.zip","https://retailer-indicators-resume-key.trycloudflare.com/update.bat","https://dl.dropboxusercontent.com/scl/fi/6emtkcbmpn18s95s0tpm6/vrm0193920034.zip")
index=activity AND rg_functionality="Authentication / VPN" AND customstring3 NOT NULL AND customstring3 IN ("https://retailer-indicators-resume-key.trycloudflare.com/toto.zip","https://retailer-indicators-resume-key.trycloudflare.com/update.bat","https://dl.dropboxusercontent.com/scl/fi/6emtkcbmpn18s95s0tpm6/vrm0193920034.zip")
index=activity AND rg_functionality="Cloud Content Management System" AND requesturl NOT NULL AND requesturl IN ("https://retailer-indicators-resume-key.trycloudflare.com/toto.zip","https://retailer-indicators-resume-key.trycloudflare.com/update.bat","https://dl.dropboxusercontent.com/scl/fi/6emtkcbmpn18s95s0tpm6/vrm0193920034.zip")
index=activity AND rg_functionality="Cloud Content Management System" AND Message NOT NULL AND Message IN ("https://retailer-indicators-resume-key.trycloudflare.com/toto.zip","https://retailer-indicators-resume-key.trycloudflare.com/update.bat","https://dl.dropboxusercontent.com/scl/fi/6emtkcbmpn18s95s0tpm6/vrm0193920034.zip")
index=activity AND rg_functionality="Cloud Content Management System" AND Requestcontext NOT NULL AND Requestcontext IN ("https://retailer-indicators-resume-key.trycloudflare.com/toto.zip","https://retailer-indicators-resume-key.trycloudflare.com/update.bat","https://dl.dropboxusercontent.com/scl/fi/6emtkcbmpn18s95s0tpm6/vrm0193920034.zip")
index=activity AND rg_functionality="Cloud Content Management System" AND customstring3 NOT NULL AND customstring3 IN ("https://retailer-indicators-resume-key.trycloudflare.com/toto.zip","https://retailer-indicators-resume-key.trycloudflare.com/update.bat","https://dl.dropboxusercontent.com/scl/fi/6emtkcbmpn18s95s0tpm6/vrm0193920034.zip")
index=activity AND rg_functionality="Cloud Services / Applications" AND requesturl NOT NULL AND requesturl IN ("https://retailer-indicators-resume-key.trycloudflare.com/toto.zip","https://retailer-indicators-resume-key.trycloudflare.com/update.bat","https://dl.dropboxusercontent.com/scl/fi/6emtkcbmpn18s95s0tpm6/vrm0193920034.zip")
index=activity AND rg_functionality="Cloud Services / Applications" AND Message NOT NULL AND Message IN ("https://retailer-indicators-resume-key.trycloudflare.com/toto.zip","https://retailer-indicators-resume-key.trycloudflare.com/update.bat","https://dl.dropboxusercontent.com/scl/fi/6emtkcbmpn18s95s0tpm6/vrm0193920034.zip")
index=activity AND rg_functionality="Cloud Services / Applications" AND Requestcontext NOT NULL AND Requestcontext IN ("https://retailer-indicators-resume-key.trycloudflare.com/toto.zip","https://retailer-indicators-resume-key.trycloudflare.com/update.bat","https://dl.dropboxusercontent.com/scl/fi/6emtkcbmpn18s95s0tpm6/vrm0193920034.zip")
index=activity AND rg_functionality="Cloud Services / Applications" AND customstring3 NOT NULL AND customstring3 IN ("https://retailer-indicators-resume-key.trycloudflare.com/toto.zip","https://retailer-indicators-resume-key.trycloudflare.com/update.bat","https://dl.dropboxusercontent.com/scl/fi/6emtkcbmpn18s95s0tpm6/vrm0193920034.zip")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND requesturl NOT NULL AND requesturl IN ("https://retailer-indicators-resume-key.trycloudflare.com/toto.zip","https://retailer-indicators-resume-key.trycloudflare.com/update.bat","https://dl.dropboxusercontent.com/scl/fi/6emtkcbmpn18s95s0tpm6/vrm0193920034.zip")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND Message NOT NULL AND Message IN ("https://retailer-indicators-resume-key.trycloudflare.com/toto.zip","https://retailer-indicators-resume-key.trycloudflare.com/update.bat","https://dl.dropboxusercontent.com/scl/fi/6emtkcbmpn18s95s0tpm6/vrm0193920034.zip")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND Requestcontext NOT NULL AND Requestcontext IN ("https://retailer-indicators-resume-key.trycloudflare.com/toto.zip","https://retailer-indicators-resume-key.trycloudflare.com/update.bat","https://dl.dropboxusercontent.com/scl/fi/6emtkcbmpn18s95s0tpm6/vrm0193920034.zip")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("https://retailer-indicators-resume-key.trycloudflare.com/toto.zip","https://retailer-indicators-resume-key.trycloudflare.com/update.bat","https://dl.dropboxusercontent.com/scl/fi/6emtkcbmpn18s95s0tpm6/vrm0193920034.zip")
index=activity AND rg_functionality="Web Application Firewall" AND requesturl NOT NULL AND requesturl IN ("https://retailer-indicators-resume-key.trycloudflare.com/toto.zip","https://retailer-indicators-resume-key.trycloudflare.com/update.bat","https://dl.dropboxusercontent.com/scl/fi/6emtkcbmpn18s95s0tpm6/vrm0193920034.zip")
index=activity AND rg_functionality="Web Application Firewall" AND Message NOT NULL AND Message IN ("https://retailer-indicators-resume-key.trycloudflare.com/toto.zip","https://retailer-indicators-resume-key.trycloudflare.com/update.bat","https://dl.dropboxusercontent.com/scl/fi/6emtkcbmpn18s95s0tpm6/vrm0193920034.zip")
index=activity AND rg_functionality="Web Application Firewall" AND Requestcontext NOT NULL AND Requestcontext IN ("https://retailer-indicators-resume-key.trycloudflare.com/toto.zip","https://retailer-indicators-resume-key.trycloudflare.com/update.bat","https://dl.dropboxusercontent.com/scl/fi/6emtkcbmpn18s95s0tpm6/vrm0193920034.zip")
index=activity AND rg_functionality="Web Application Firewall" AND customstring3 NOT NULL AND customstring3 IN ("https://retailer-indicators-resume-key.trycloudflare.com/toto.zip","https://retailer-indicators-resume-key.trycloudflare.com/update.bat","https://dl.dropboxusercontent.com/scl/fi/6emtkcbmpn18s95s0tpm6/vrm0193920034.zip")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND requesturl NOT NULL AND requesturl IN ("https://retailer-indicators-resume-key.trycloudflare.com/toto.zip","https://retailer-indicators-resume-key.trycloudflare.com/update.bat","https://dl.dropboxusercontent.com/scl/fi/6emtkcbmpn18s95s0tpm6/vrm0193920034.zip")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND Message NOT NULL AND Message IN ("https://retailer-indicators-resume-key.trycloudflare.com/toto.zip","https://retailer-indicators-resume-key.trycloudflare.com/update.bat","https://dl.dropboxusercontent.com/scl/fi/6emtkcbmpn18s95s0tpm6/vrm0193920034.zip")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND Requestcontext NOT NULL AND Requestcontext IN ("https://retailer-indicators-resume-key.trycloudflare.com/toto.zip","https://retailer-indicators-resume-key.trycloudflare.com/update.bat","https://dl.dropboxusercontent.com/scl/fi/6emtkcbmpn18s95s0tpm6/vrm0193920034.zip")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND customstring3 NOT NULL AND customstring3 IN ("https://retailer-indicators-resume-key.trycloudflare.com/toto.zip","https://retailer-indicators-resume-key.trycloudflare.com/update.bat","https://dl.dropboxusercontent.com/scl/fi/6emtkcbmpn18s95s0tpm6/vrm0193920034.zip")
