select COUNT as c from windows events where eventid == lt id osquery #general

select COUNT(*) as c from windows_events where eve...

b

b0l

05/01/2018, 5:14 PM

select COUNT(*) as c from windows_events where eventid == <id> AND c > 5 ?