Forum Discussion

mathias's avatar
mathias
Bronze II
27 days ago

Cyber Kill Chain: Reconnaissance

I'm stucked at question 7 (At what time did the attacker first start conducting their reconnaissance efforts? (Provide your answer in the format H:MM:SS or HH:MM:SS). The answer I get is 21:37:36 as ...
immersive labs
neeemu's avatar
neeemu
Icon for Advocate rankAdvocate
25 days ago

Hi mathias​ Just looking at your SPL, I believe the sort command defaults to descending (newest first). You're trying to find the first event that matches so require the oldest.

Try changing to "| sort +_time" instead