index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("763df8b2db7f2f2fa0c8adb8c1cc05ff15b59e6a9756cbe9fc4a1c12329b62af","0860e09e529fc6ccbbffebafedc27497fbbcaff57b5376fb4cc732c331d1f591","18129626041b90558607eec67616ba6d2b1ea28a280c7ba5b2bd30ebb1e2438b","5a387ee6d0dcbbf2cd97379c68d8e3398d01a920873ddd45ff21dbfccb19e2ee","0059121d725a818e453e29492e78762d0a87087fcb11e484cf5ad663c1eba2bc")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("763df8b2db7f2f2fa0c8adb8c1cc05ff15b59e6a9756cbe9fc4a1c12329b62af","0860e09e529fc6ccbbffebafedc27497fbbcaff57b5376fb4cc732c331d1f591","18129626041b90558607eec67616ba6d2b1ea28a280c7ba5b2bd30ebb1e2438b","5a387ee6d0dcbbf2cd97379c68d8e3398d01a920873ddd45ff21dbfccb19e2ee","0059121d725a818e453e29492e78762d0a87087fcb11e484cf5ad663c1eba2bc")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("763df8b2db7f2f2fa0c8adb8c1cc05ff15b59e6a9756cbe9fc4a1c12329b62af","0860e09e529fc6ccbbffebafedc27497fbbcaff57b5376fb4cc732c331d1f591","18129626041b90558607eec67616ba6d2b1ea28a280c7ba5b2bd30ebb1e2438b","5a387ee6d0dcbbf2cd97379c68d8e3398d01a920873ddd45ff21dbfccb19e2ee","0059121d725a818e453e29492e78762d0a87087fcb11e484cf5ad663c1eba2bc")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring64 NOT NULL AND customstring64 IN ("763df8b2db7f2f2fa0c8adb8c1cc05ff15b59e6a9756cbe9fc4a1c12329b62af","0860e09e529fc6ccbbffebafedc27497fbbcaff57b5376fb4cc732c331d1f591","18129626041b90558607eec67616ba6d2b1ea28a280c7ba5b2bd30ebb1e2438b","5a387ee6d0dcbbf2cd97379c68d8e3398d01a920873ddd45ff21dbfccb19e2ee","0059121d725a818e453e29492e78762d0a87087fcb11e484cf5ad663c1eba2bc")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("763df8b2db7f2f2fa0c8adb8c1cc05ff15b59e6a9756cbe9fc4a1c12329b62af","0860e09e529fc6ccbbffebafedc27497fbbcaff57b5376fb4cc732c331d1f591","18129626041b90558607eec67616ba6d2b1ea28a280c7ba5b2bd30ebb1e2438b","5a387ee6d0dcbbf2cd97379c68d8e3398d01a920873ddd45ff21dbfccb19e2ee","0059121d725a818e453e29492e78762d0a87087fcb11e484cf5ad663c1eba2bc")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("763df8b2db7f2f2fa0c8adb8c1cc05ff15b59e6a9756cbe9fc4a1c12329b62af","0860e09e529fc6ccbbffebafedc27497fbbcaff57b5376fb4cc732c331d1f591","18129626041b90558607eec67616ba6d2b1ea28a280c7ba5b2bd30ebb1e2438b","5a387ee6d0dcbbf2cd97379c68d8e3398d01a920873ddd45ff21dbfccb19e2ee","0059121d725a818e453e29492e78762d0a87087fcb11e484cf5ad663c1eba2bc")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("763df8b2db7f2f2fa0c8adb8c1cc05ff15b59e6a9756cbe9fc4a1c12329b62af","0860e09e529fc6ccbbffebafedc27497fbbcaff57b5376fb4cc732c331d1f591","18129626041b90558607eec67616ba6d2b1ea28a280c7ba5b2bd30ebb1e2438b","5a387ee6d0dcbbf2cd97379c68d8e3398d01a920873ddd45ff21dbfccb19e2ee","0059121d725a818e453e29492e78762d0a87087fcb11e484cf5ad663c1eba2bc")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("763df8b2db7f2f2fa0c8adb8c1cc05ff15b59e6a9756cbe9fc4a1c12329b62af","0860e09e529fc6ccbbffebafedc27497fbbcaff57b5376fb4cc732c331d1f591","18129626041b90558607eec67616ba6d2b1ea28a280c7ba5b2bd30ebb1e2438b","5a387ee6d0dcbbf2cd97379c68d8e3398d01a920873ddd45ff21dbfccb19e2ee","0059121d725a818e453e29492e78762d0a87087fcb11e484cf5ad663c1eba2bc")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("763df8b2db7f2f2fa0c8adb8c1cc05ff15b59e6a9756cbe9fc4a1c12329b62af","0860e09e529fc6ccbbffebafedc27497fbbcaff57b5376fb4cc732c331d1f591","18129626041b90558607eec67616ba6d2b1ea28a280c7ba5b2bd30ebb1e2438b","5a387ee6d0dcbbf2cd97379c68d8e3398d01a920873ddd45ff21dbfccb19e2ee","0059121d725a818e453e29492e78762d0a87087fcb11e484cf5ad663c1eba2bc")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("763df8b2db7f2f2fa0c8adb8c1cc05ff15b59e6a9756cbe9fc4a1c12329b62af","0860e09e529fc6ccbbffebafedc27497fbbcaff57b5376fb4cc732c331d1f591","18129626041b90558607eec67616ba6d2b1ea28a280c7ba5b2bd30ebb1e2438b","5a387ee6d0dcbbf2cd97379c68d8e3398d01a920873ddd45ff21dbfccb19e2ee","0059121d725a818e453e29492e78762d0a87087fcb11e484cf5ad663c1eba2bc")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("763df8b2db7f2f2fa0c8adb8c1cc05ff15b59e6a9756cbe9fc4a1c12329b62af","0860e09e529fc6ccbbffebafedc27497fbbcaff57b5376fb4cc732c331d1f591","18129626041b90558607eec67616ba6d2b1ea28a280c7ba5b2bd30ebb1e2438b","5a387ee6d0dcbbf2cd97379c68d8e3398d01a920873ddd45ff21dbfccb19e2ee","0059121d725a818e453e29492e78762d0a87087fcb11e484cf5ad663c1eba2bc")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("763df8b2db7f2f2fa0c8adb8c1cc05ff15b59e6a9756cbe9fc4a1c12329b62af","0860e09e529fc6ccbbffebafedc27497fbbcaff57b5376fb4cc732c331d1f591","18129626041b90558607eec67616ba6d2b1ea28a280c7ba5b2bd30ebb1e2438b","5a387ee6d0dcbbf2cd97379c68d8e3398d01a920873ddd45ff21dbfccb19e2ee","0059121d725a818e453e29492e78762d0a87087fcb11e484cf5ad663c1eba2bc")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("763df8b2db7f2f2fa0c8adb8c1cc05ff15b59e6a9756cbe9fc4a1c12329b62af","0860e09e529fc6ccbbffebafedc27497fbbcaff57b5376fb4cc732c331d1f591","18129626041b90558607eec67616ba6d2b1ea28a280c7ba5b2bd30ebb1e2438b","5a387ee6d0dcbbf2cd97379c68d8e3398d01a920873ddd45ff21dbfccb19e2ee","0059121d725a818e453e29492e78762d0a87087fcb11e484cf5ad663c1eba2bc")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("763df8b2db7f2f2fa0c8adb8c1cc05ff15b59e6a9756cbe9fc4a1c12329b62af","0860e09e529fc6ccbbffebafedc27497fbbcaff57b5376fb4cc732c331d1f591","18129626041b90558607eec67616ba6d2b1ea28a280c7ba5b2bd30ebb1e2438b","5a387ee6d0dcbbf2cd97379c68d8e3398d01a920873ddd45ff21dbfccb19e2ee","0059121d725a818e453e29492e78762d0a87087fcb11e484cf5ad663c1eba2bc")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("763df8b2db7f2f2fa0c8adb8c1cc05ff15b59e6a9756cbe9fc4a1c12329b62af","0860e09e529fc6ccbbffebafedc27497fbbcaff57b5376fb4cc732c331d1f591","18129626041b90558607eec67616ba6d2b1ea28a280c7ba5b2bd30ebb1e2438b","5a387ee6d0dcbbf2cd97379c68d8e3398d01a920873ddd45ff21dbfccb19e2ee","0059121d725a818e453e29492e78762d0a87087fcb11e484cf5ad663c1eba2bc")
index=activity AND rg_functionality="Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("763df8b2db7f2f2fa0c8adb8c1cc05ff15b59e6a9756cbe9fc4a1c12329b62af","0860e09e529fc6ccbbffebafedc27497fbbcaff57b5376fb4cc732c331d1f591","18129626041b90558607eec67616ba6d2b1ea28a280c7ba5b2bd30ebb1e2438b","5a387ee6d0dcbbf2cd97379c68d8e3398d01a920873ddd45ff21dbfccb19e2ee","0059121d725a818e453e29492e78762d0a87087fcb11e484cf5ad663c1eba2bc")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("763df8b2db7f2f2fa0c8adb8c1cc05ff15b59e6a9756cbe9fc4a1c12329b62af","0860e09e529fc6ccbbffebafedc27497fbbcaff57b5376fb4cc732c331d1f591","18129626041b90558607eec67616ba6d2b1ea28a280c7ba5b2bd30ebb1e2438b","5a387ee6d0dcbbf2cd97379c68d8e3398d01a920873ddd45ff21dbfccb19e2ee","0059121d725a818e453e29492e78762d0a87087fcb11e484cf5ad663c1eba2bc")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("763df8b2db7f2f2fa0c8adb8c1cc05ff15b59e6a9756cbe9fc4a1c12329b62af","0860e09e529fc6ccbbffebafedc27497fbbcaff57b5376fb4cc732c331d1f591","18129626041b90558607eec67616ba6d2b1ea28a280c7ba5b2bd30ebb1e2438b","5a387ee6d0dcbbf2cd97379c68d8e3398d01a920873ddd45ff21dbfccb19e2ee","0059121d725a818e453e29492e78762d0a87087fcb11e484cf5ad663c1eba2bc")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("763df8b2db7f2f2fa0c8adb8c1cc05ff15b59e6a9756cbe9fc4a1c12329b62af","0860e09e529fc6ccbbffebafedc27497fbbcaff57b5376fb4cc732c331d1f591","18129626041b90558607eec67616ba6d2b1ea28a280c7ba5b2bd30ebb1e2438b","5a387ee6d0dcbbf2cd97379c68d8e3398d01a920873ddd45ff21dbfccb19e2ee","0059121d725a818e453e29492e78762d0a87087fcb11e484cf5ad663c1eba2bc")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("763df8b2db7f2f2fa0c8adb8c1cc05ff15b59e6a9756cbe9fc4a1c12329b62af","0860e09e529fc6ccbbffebafedc27497fbbcaff57b5376fb4cc732c331d1f591","18129626041b90558607eec67616ba6d2b1ea28a280c7ba5b2bd30ebb1e2438b","5a387ee6d0dcbbf2cd97379c68d8e3398d01a920873ddd45ff21dbfccb19e2ee","0059121d725a818e453e29492e78762d0a87087fcb11e484cf5ad663c1eba2bc")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("763df8b2db7f2f2fa0c8adb8c1cc05ff15b59e6a9756cbe9fc4a1c12329b62af","0860e09e529fc6ccbbffebafedc27497fbbcaff57b5376fb4cc732c331d1f591","18129626041b90558607eec67616ba6d2b1ea28a280c7ba5b2bd30ebb1e2438b","5a387ee6d0dcbbf2cd97379c68d8e3398d01a920873ddd45ff21dbfccb19e2ee","0059121d725a818e453e29492e78762d0a87087fcb11e484cf5ad663c1eba2bc")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("763df8b2db7f2f2fa0c8adb8c1cc05ff15b59e6a9756cbe9fc4a1c12329b62af","0860e09e529fc6ccbbffebafedc27497fbbcaff57b5376fb4cc732c331d1f591","18129626041b90558607eec67616ba6d2b1ea28a280c7ba5b2bd30ebb1e2438b","5a387ee6d0dcbbf2cd97379c68d8e3398d01a920873ddd45ff21dbfccb19e2ee","0059121d725a818e453e29492e78762d0a87087fcb11e484cf5ad663c1eba2bc")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("763df8b2db7f2f2fa0c8adb8c1cc05ff15b59e6a9756cbe9fc4a1c12329b62af","0860e09e529fc6ccbbffebafedc27497fbbcaff57b5376fb4cc732c331d1f591","18129626041b90558607eec67616ba6d2b1ea28a280c7ba5b2bd30ebb1e2438b","5a387ee6d0dcbbf2cd97379c68d8e3398d01a920873ddd45ff21dbfccb19e2ee","0059121d725a818e453e29492e78762d0a87087fcb11e484cf5ad663c1eba2bc")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring64 NOT NULL AND customstring64 IN ("763df8b2db7f2f2fa0c8adb8c1cc05ff15b59e6a9756cbe9fc4a1c12329b62af","0860e09e529fc6ccbbffebafedc27497fbbcaff57b5376fb4cc732c331d1f591","18129626041b90558607eec67616ba6d2b1ea28a280c7ba5b2bd30ebb1e2438b","5a387ee6d0dcbbf2cd97379c68d8e3398d01a920873ddd45ff21dbfccb19e2ee","0059121d725a818e453e29492e78762d0a87087fcb11e484cf5ad663c1eba2bc")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("763df8b2db7f2f2fa0c8adb8c1cc05ff15b59e6a9756cbe9fc4a1c12329b62af","0860e09e529fc6ccbbffebafedc27497fbbcaff57b5376fb4cc732c331d1f591","18129626041b90558607eec67616ba6d2b1ea28a280c7ba5b2bd30ebb1e2438b","5a387ee6d0dcbbf2cd97379c68d8e3398d01a920873ddd45ff21dbfccb19e2ee","0059121d725a818e453e29492e78762d0a87087fcb11e484cf5ad663c1eba2bc")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("763df8b2db7f2f2fa0c8adb8c1cc05ff15b59e6a9756cbe9fc4a1c12329b62af","0860e09e529fc6ccbbffebafedc27497fbbcaff57b5376fb4cc732c331d1f591","18129626041b90558607eec67616ba6d2b1ea28a280c7ba5b2bd30ebb1e2438b","5a387ee6d0dcbbf2cd97379c68d8e3398d01a920873ddd45ff21dbfccb19e2ee","0059121d725a818e453e29492e78762d0a87087fcb11e484cf5ad663c1eba2bc")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("763df8b2db7f2f2fa0c8adb8c1cc05ff15b59e6a9756cbe9fc4a1c12329b62af","0860e09e529fc6ccbbffebafedc27497fbbcaff57b5376fb4cc732c331d1f591","18129626041b90558607eec67616ba6d2b1ea28a280c7ba5b2bd30ebb1e2438b","5a387ee6d0dcbbf2cd97379c68d8e3398d01a920873ddd45ff21dbfccb19e2ee","0059121d725a818e453e29492e78762d0a87087fcb11e484cf5ad663c1eba2bc")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring64 NOT NULL AND customstring64 IN ("763df8b2db7f2f2fa0c8adb8c1cc05ff15b59e6a9756cbe9fc4a1c12329b62af","0860e09e529fc6ccbbffebafedc27497fbbcaff57b5376fb4cc732c331d1f591","18129626041b90558607eec67616ba6d2b1ea28a280c7ba5b2bd30ebb1e2438b","5a387ee6d0dcbbf2cd97379c68d8e3398d01a920873ddd45ff21dbfccb19e2ee","0059121d725a818e453e29492e78762d0a87087fcb11e484cf5ad663c1eba2bc")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("763df8b2db7f2f2fa0c8adb8c1cc05ff15b59e6a9756cbe9fc4a1c12329b62af","0860e09e529fc6ccbbffebafedc27497fbbcaff57b5376fb4cc732c331d1f591","18129626041b90558607eec67616ba6d2b1ea28a280c7ba5b2bd30ebb1e2438b","5a387ee6d0dcbbf2cd97379c68d8e3398d01a920873ddd45ff21dbfccb19e2ee","0059121d725a818e453e29492e78762d0a87087fcb11e484cf5ad663c1eba2bc")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("763df8b2db7f2f2fa0c8adb8c1cc05ff15b59e6a9756cbe9fc4a1c12329b62af","0860e09e529fc6ccbbffebafedc27497fbbcaff57b5376fb4cc732c331d1f591","18129626041b90558607eec67616ba6d2b1ea28a280c7ba5b2bd30ebb1e2438b","5a387ee6d0dcbbf2cd97379c68d8e3398d01a920873ddd45ff21dbfccb19e2ee","0059121d725a818e453e29492e78762d0a87087fcb11e484cf5ad663c1eba2bc")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("763df8b2db7f2f2fa0c8adb8c1cc05ff15b59e6a9756cbe9fc4a1c12329b62af","0860e09e529fc6ccbbffebafedc27497fbbcaff57b5376fb4cc732c331d1f591","18129626041b90558607eec67616ba6d2b1ea28a280c7ba5b2bd30ebb1e2438b","5a387ee6d0dcbbf2cd97379c68d8e3398d01a920873ddd45ff21dbfccb19e2ee","0059121d725a818e453e29492e78762d0a87087fcb11e484cf5ad663c1eba2bc")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring64 NOT NULL AND customstring64 IN ("763df8b2db7f2f2fa0c8adb8c1cc05ff15b59e6a9756cbe9fc4a1c12329b62af","0860e09e529fc6ccbbffebafedc27497fbbcaff57b5376fb4cc732c331d1f591","18129626041b90558607eec67616ba6d2b1ea28a280c7ba5b2bd30ebb1e2438b","5a387ee6d0dcbbf2cd97379c68d8e3398d01a920873ddd45ff21dbfccb19e2ee","0059121d725a818e453e29492e78762d0a87087fcb11e484cf5ad663c1eba2bc")
