QuestionQ16Verified/Event SearchCopy linkReport a problemAsk AstroTutorSave questionWhich query returns every process execution for the file EXCEL.EXE?A#event_simpleName=ProcessRollup2 ImageFileName=EXCEL.EXEB#event_simpleName=ProcessRollup2 CommandLine=EXCEL.EXE*C#event_simpleName=ProcessRollup2 FileName=EXCEL.EXEShow AnswerAnswerExplanationFor ProcessRollup2 telemetry, FileName is the executable filename field. Filtering it for EXCEL.EXE identifies process execution records for that executable. ImageFileName can contain a full path, and CommandLine is invocation text rather than a dependable executable-name field.Learn moreCrowdStrike LogScale FLTR core integration documentationShow comments0Show commentsCommunity DiscussionNo comments yet. Be the first to start the discussion!
Community Discussion