Forum Discussion
Silver ICyber Kill Chain: Delivery
Hello,
I was wondering if anybody else is experiencing the same issue as me as I feel what I am entering is correct but not getting any search results? This is for Q4. I also find it quite problematic because if what I am entering is correct and I'm not getting any search results, this would result in me thinking that my commands are wrong. I have also reset the lab to no avail.
Your query is very nearly there but, after you've initially filtered out the POST requests, try applying a search for "*.exe" as a secondary filter i.e.
index="botsv1" etc...
| search="*.exe"
4 Replies
- barney
Bronze III
Your query is very nearly there but, after you've initially filtered out the POST requests, try applying a search for "*.exe" as a secondary filter i.e.
index="botsv1" etc...
| search="*.exe"- Dark_Knight666
barney - Many thanks for your advice, but now I'm getting the below 😫
- barney
My bad, sorry - search doesn't require the = symbol
- netcat
Silver III
From my point of view: Just don't mix ", “ and ”. I didn't try to enter your query with the double quotes you used, but using only ". That works.
