An analyst is investigating a comptroller mailbox-rule creation followed by the first outbound BEC-style send. How should transaction be bounded?
Select an answer to reveal the explanation.
Short Explanation
The story starts when the mailbox rule appears and ends at the first shady outbound. startswith and endswith put those bookends on the transaction. An unbounded 90-day blob is not an investigation.
Full Explanation
transaction supports startswith and endswith conditions that bound the grouped session to a meaningful investigative window. For a civic BEC path, that window is mailbox-rule creation through the first outbound send. Unbounded transactions and dropping the grouping field produce unusable blobs. tstats does not replace start and end transaction bounds.