Forum Discussion
Incident Response Introduction to Detection Engineering: Ep.5 – Custom Alerting
Task 3 -
Note: It may take a couple of minutes for the token to appear in the index.
I'm struggling with the python that it's been taking too long to create a custom_alert_index to autimatically complete it. it's in Task 3 and I need the good code for the task to be completed and the token as well.
2 Replies
In cell two, there are several placeholders that you will need to modify, they are:
- LOOK_BACK_MINUTES: set this to 240
- INSERT_JSON_QUERY: queries you use to find instances of lateral movement
- VARIABLE1/2: used for extracting information from your query results
- WAIT_TIME_SECONDS: how long the program should sleep before checking for new events
Once you have detected all lateral movement occurrences, this task will be completed, and a token will be written to the custom_alert_index.
If you figure this one out, please let me know. I've been stuck on this one for multiple days and no luck. I am able to detect the lateral movements associated with the commands psexec, cmd.exe, and sc. But for some reason I am not getting the token after waiting more than 15 minutes and resetting the lab.
