< 2dor> I think you d want to use `group by` Maybe something osquery #general

<@UACHWGCLE> I think you'd want to use `group by`....

zwass

05/01/2018, 5:38 PM

@2dor I think you'd want to use

group by

. Maybe something like

select * from windows_events group by eventid having count(eventid) > 5