CCSE: CrowdStrike Certified SIEM Engineer

groupBy([ComputerName, UserName, CommandLine]) groups events by the unique combination of all three fields and returns a count for each group. CQL’s default aggregate for groupBy() is count(as=_count), so specifying function=count() explicitly or relying on the default produces the same per-combination frequency.