CCFH-202B: CrowdStrike Certified Falcon Hunter

By CrowdStrike · Question Mode

QuestionQ43

VerifiedEvent Search

You are tasked with writing a query that uses a groupBy statement to make data clustering easier to understand. You need to group the SHA256 value and count the unique endpoints seen.

Which query will accomplish this task?

Explanation

groupBy groups events by SHA256HashData, and count(aid, distinct=true, as=uniqueEndpoints) counts distinct endpoint IDs in each group, storing the result as uniqueEndpoints.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!