// Illustrative hunt; not executed in a live Sentinel or Falcon tenant.
// Falcon EDR. REQUIRED time picker: last 1 hour; one sensor AID, at most 100 groups.
// Supplied RST/GTIG marker leads only, not a family verdict or comprehensive file scan.
#event_simpleName=ProcessRollup2 aid="REPLACE_WITH_FALCON_AID"
| CommandLine=/ArtexProbe|artex-probe-|[\\\/]artx[0-9a-z]*(?:[\\\/]|$)/i
| groupBy([aid, ComputerName, FileName], function=[count(as=Executions), collect([CommandLine, ParentBaseFileName, TargetProcessId], limit=10)], limit=100)
| head(limit=100)