An Enterprise EDR administrator sees the process in the graphic on the Investigate page but does not see an alert for this process:

How can the administrator generate an alert for future hits against this watchlist?

What information does the Alert Details panel provide on the Alert Triage page in Endpoint Standard?

Which statement should be used when constructing queries in Carbon Black Audit and Remediation, Live Query?

Refer to the exhibit:

Which two logic statements correctly explain filtering within the UI? (Choose two.)

An administrator ran the following query.
SELECT name, VERSION, install_location, install_source, publisher, install_date, uninstall_string FROM programs WHERE publisher = "Microsoft Corporation"; The administrator notices a lot of installed programs are not returned.
How can the administrator alter the query to see all results?