CCFH-202B: CrowdStrike Certified Falcon Hunter

By CrowdStrike · Question Mode

QuestionQ36

VerifiedEvent Search

Which function would you add to a groupBy() operation to display, in one record, all associated domain names with which an executable communicated?

Explanation

collect() gathers field values from multiple events into one event and can be used as the aggregate function in groupBy(). It can therefore return all domain-name values associated with an executable in a single grouped record.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!