Forum Discussion

f_alharthi94's avatar
f_alharthi94
Icon for Bronze I rankBronze I
10 months ago
Solved

Introduction to Detection Engineering: Ep.5 – Custom Alerting

I've spent too much time trying to figure this out.  
defensive cyber
help & support
  • GusC's avatar
    GusC
    8 months ago

    fwiw I had to do this a few times before it worked - Patience is key. 

    Once the data view is setup and you have working code, it can take 5-10 minutes for the events to show, then the token appears once all are present, if token isn't apparent then just put token in the search bar and it'll be there if you have captured all events. keep refreshing etc. 

     

Cicada3301's avatar
Cicada3301
Icon for Bronze I rankBronze I
5 months ago

Hi GusC,

Thanks for the elements! How many events are waited? I saw 2 after ~ 10 minutes then a third one appeared after 15 minutes saying to restart lab as I missed few events... don't know why. 

GusC's avatar
GusC
Icon for Bronze III rankBronze III
5 months ago

Hello - I got 18 results back after waiting a while. 

pm me on ajithoth@googlemail.com if you want.....

 

 

 

  • Cicada3301's avatar
    Cicada3301
    Icon for Bronze I rankBronze I
    5 months ago

    Thanks Gus, I finally achieved the lab. It was 40 results on my side.