CCFH-202B: CrowdStrike Certified Falcon Hunter

By CrowdStrike · Question Mode

QuestionQ58

VerifiedEvent Search

You have written a complex query in Advanced Event Search that returns millions of events, making it hard to threat hunt for specific file metadata.

Which option would reduce query time and remove values that are not relevant?

Explanation

Filtering irrelevant events early reduces the number of events that subsequent query operations must process and removes those unwanted events from the result set. LogScale query guidance specifically recommends filtering first for quicker processing and lower resource use.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!