Find processes that only ran a few of times on a specific host
CQL · Falcon Next-Gen SIEMCopy query
#event_simpleName=ProcessRollup2 OR #event_simpleName=SyntheticProcessRollup2
| aid=?aid
| groupBy([SHA256HashData, ImageFileName], limit=max)
| _count <5
| sort(_count, limit=1000)processes_specific_host.yml
CrowdStrike
Hunting
Endpoint
Insight
2025-08-06
2025-08-28
