CCFH-202B: CrowdStrike Certified Falcon Hunter

By CrowdStrike · Question Mode

QuestionQ25

VerifiedSearch and Investigation Tools

Which CQL function is recommended for exporting a few fields from a large number of events (>100,000) to a CSV file?

Explanation

The select() function retains specified fields from each event without aggregating them, making it suitable for exporting a few fields from a very large event set to CSV.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!