CrowdStrike LogScale

#type=process | groupBy([user])

Falcon LogScale (Humio) query that groups process events by user, to see which identities execute what in the environment.

Run it in Falcon LogScale when you have CrowdStrike sensor telemetry (or other sources) in the platform and want the execution overview by user: the query filters process events (#type=process) and groups them by user — the result is the ranking of identities and their activity. It's the way to answer 'what is this account executing?' across the environment, and the basis for detecting service accounts running user binaries or identities with unusual activity. LogScale uses its own language (similar to grep + functions): the groupBy is the stats count by of Splunk.

Don't use it without knowing your event schema: #type=process assumes the event type from the parser — if your ingestion doesn't tag process events that way, the query returns empty. The groupBy([user]) groups by the user field; if the field is named differently (UserName, UserName_orig), you need to adapt it. And watch out for volume: aggregations over wide ranges in LogScale are fast (it uses columnar format), but queries with many grouping fields or complex regex filters get expensive — narrow with timewindow and prior filters. For detail, use the same query with | tail() or with expanded fields.