During an ad-hoc hunt, the analyst has civic failed-logon counts per user and wants low, med, and high buckets. Which eval form classifies those results?
Select an answer to reveal the explanation.
Short Explanation
Think of a parking-ticket sorter: a few failures in the low bin, a pile in the high bin. eval with case or if is that sorter for the hunt table. A formal risk notable is not required to label a scratch investigation.
Full Explanation
Conditional eval using case or if classifies numeric or string results into buckets during an ad-hoc hunt. That lets an analyst build a risk-like view of civic failed-logon counts without creating production RBA content. rex and transaction are the wrong commands for that classification. The blueprint expects eval conditionals for this analysis step.