CCFH-202B: CrowdStrike Certified Falcon Hunter

By CrowdStrike · Question Mode

QuestionQ70

VerifiedEvent Search

While conducting a threat hunt in your environment, you decide to identify infrequent occurrences of user-agent strings from the last 30 days.

Which CQL query will highlight those results?

Explanation

Grouping events by UserAgentString and applying count() produces an occurrence count for each distinct user-agent value. Sorting that count in ascending order and limiting the output to 10 surfaces the rarest user-agent strings, while collect() preserves the related computer, user, and local IPv4-address details.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!