CCFH-202B: CrowdStrike Certified Falcon Hunter

By CrowdStrike · Question Mode

QuestionQ57

VerifiedEvent Search

You are conducting an advanced search across all detections from the past 90 days in your environment and want to group detections by the FileName and CommandLine parameters for easier viewing.

Which query groups the detections correctly?

Explanation

groupBy groups events by one or more specified fields and can run aggregate functions such as collect for every group. Grouping by FileName and CommandLine, while collecting ComputerName and setting limit=max, produces the required grouped detection view. The filter must use the correctly spelled Event_ExternalApiEvent event type.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!