Sentinel Blue team ops

Q12 - I can see 2 issues with your query.

• On line 2 the "2" needs to be outside the () but within [] of its own. 
• You don't need line 4

Q11 - You have the time range set to "Last 24 Hours" the lab requires you to have it set to "Last 7 Days"

Hope that helps 🙂