max

Cortex XDR XQL comp max aggregate returns the maximum value seen for the field in the result set.

Synopsis

comp max(<
field
>) [as <
alias
>] by <
field_1
>,<
field_2
>

Description

The
max
aggregation is a comp function that returns the maximum value of an integer field, for all records that contain matching values for the fields identified in the
by
clause.

Examples

Return the maximum value of the
action_total_download
field for all records that have matching values for their
actor_process_image_path
and
actor_process_command_line
values:
dataset = xdr_data | fields actor_process_image_path as Process_Path, actor_process_command_line as Process_CMD, action_total_download as Download | filter Download > 0 | comp max(Download) as max_download by Process_Path, Process_CMD

Recommended For You