Which of the following is the proper method to quantify search results, enabling a hunter to quickly sort and identify outliers?

Question

Options

• AUsing the "| stats count by" command at the end of a search string in Event Search
• BUsing the "|stats count" command at the end of a search string in Event Search
• CUsing the "|eval" command at the end of a search string in Event Search
• DExporting Event Search results to a spreadsheet and aggregating the results

• A
  88% (59)
• B
  1% (1)
• C
  7% (5)
• D
  3% (2)

Explanation

This is the proper method to quantify search results, enabling a hunter to quickly sort and identify outliers. The stats command is used to calculate summary statistics on the results of a search or subsearch, such as count, sum, average, etc. The count by option is used to count the number of events for each distinct value of a field or fields and display them in a table. This can help find rare or common values that could indicate anomalies or deviations from normal behavior.

No community discussion yet for this question.