Introduction to Detection Engineering: Ep.5 – Custom Alerting

Question

Struggling to get the token for this one.Got the Python script working (I think?) - it's generating alerts into Elastic, without replaying duplicates. But I get the select LatMov events - then wait and wait - before eventually getting;@timestamp&lt;actual timestamp here&gt; alert_messageNot all instances of lateral movement detected. Please restart the lab to try again._id7qvVgpMBEQ2Wr4UXppEV_indexcustom_alert_index_score -Sometimes I don't even get that, just a handful of events then the Lab expires.Is there any more detailed guidance on this lab? Feels like the guidance was written at 4:59pm on Friday, if you know what I mean 😂Also a bit confused, the guidance says play around with the sleep() function, as it describes the "WAIT_TIME_MINUTES" - fairly sure it's actually seconds? Unless IL have written their own custom 'time' module?

azurepineapple · Accepted Answer

Nvm, I couldn't let this one go. Ended up trying it a couple more times, and just left the lab running in the bg - upteenth times a charm, token generated 🙃