Câu 28: CCFH-202: CrowdStrike Certified Falcon Hunter

What is the purpose of the rename command in this query?event_simpleName=ProcessRollup2 [search event_simpleName=ProcessRollup2 FileName=excel.exe | rename TargetProcessId_decimal AS ParentProcessId_decimal | fields aid ParentProcessId_decimal] | stats count by FileName CommandLine

1. A. It runs a sub-search to locate all detections where excel.exe was blocked
2. B. It renames a field to drive the main search in order to locate all children processes of excel.exe — đáp án hiện tại
3. C. It joins all combinations of parent / children processes involving excel.exe
4. D. It renames a field to drive the main search in order to locate all parent processes of excel.exe