What command will eliminate duplicates from a query?
During an investigation you find out that files are being written to disc by a malicious process. While many are displayed in the detections as context items, you want to see all files written to your host by this process.What Splunk search would work for this scenario?
When looking at a detection's details, you can pivot to an Event Search. What is the purpose of this Event Search?
What part of the Investigate module should you use when you want to write custom queries to analyze, explore, or hunt for suspicious or malicious activity in your environment?
