There are two modes of Enterprise Searches: host mode and grid mode. Each reports results differently.
Host mode
Host mode searches display results of a search by unique host. This is the default mode.
A list of the hosts containing one or more matches to the search query is returned. Host mode searches are used primarily to find things that you assume to be rare in your enterprise. For example, you might use a host mode search to determine if any of your endpoints have an MD5 executable running.
Grid mode
Grid mode, also known as Group By mode, groups search results by one or more selected fields, summarizing results by the specified fields and presenting them in a grid. Grid mode is activated when you specify the Group By token as the final token in your search expression. Adding the Group By token to any search changes the search from a host mode search to a grid mode search.
Group By mode is used to find unique value combinations present in any of your endpoints. For example, you might run a Group By search to find a known bad IP address and identify all of the ports that the IP is using for communication (IP Address equals 192.168.1.1 AND Group By Port).
Grid mode results are presented in a grid.
You can access the list of hosts included in each group by clicking on the host count associated with a specific grid line. The Hosts page appears, displaying just those hosts.
Note
When specified as a search token in the search bar, Group By must be the last token string specified for the search.