CCFH-202B: CrowdStrike Certified Falcon Hunter

By CrowdStrike · Question Mode

QuestionQ76

VerifiedSearch and Investigation Tools

You have been tasked with writing a query to rename the RemoteAddressIP4 field to SourceIP.

What is the correct syntax using the rename() function?

Explanation

For a single field, rename() accepts the source field as its first argument and uses the as parameter to set the new field name. Therefore, rename(RemoteAddressIP4, as=SourceIP) renames RemoteAddressIP4 to SourceIP.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!