What is the purpose of the rename command in this query? event_simpleName=ProcessRollup2 [search event_simpleName=ProcessRollup2 FileName=excel.exe | rename TargetProcessId_decimal AS…

Question

Options

• AIt runs a sub-search to locate all detections where excel.exe was blocked
• BIt renames a field to drive the main search in order to locate all children processes of excel.exe
• CIt joins all combinations of parent / children processes involving excel.exe
• DIt renames a field to drive the main search in order to locate all parent processes of excel.exe

• A
  4% (2)
• B
  73% (37)
• C
  8% (4)
• D
  16% (8)

Explanation

You've hit your limit · resets 12:50am (America/New_York)

No community discussion yet for this question.