Forum Discussion

ColeS's avatar
ColeS
Icon for Bronze II rankBronze II
30 days ago

Threat Research: Cobalt Strike C2 – SIEM Analysis - Question 4

Hello, I'm trying to solve Question 4 of the "Threat Research: Cobalt Strike C2 – SIEM Analysis" lab, I've solved every other question EXCEPT that one.  "What's the earliest @timestamp for the retu...
help & support
  • ColeS's avatar
    ColeS
    26 days ago

    Hey folks, I consulted with a colleague who finished the lab and got the answer with their advice. Format of the answer is HH.MM.SS (periods instead of colons), and they used event.created field instead of @timestamp. Also gotta check timezones ;)

    The wording of the question is a bit misleading here, may want to address that?

ColeS's avatar
ColeS
Icon for Bronze II rankBronze II
26 days ago

Hey folks, I consulted with a colleague who finished the lab and got the answer with their advice. Format of the answer is HH.MM.SS (periods instead of colons), and they used event.created field instead of @timestamp. Also gotta check timezones ;)

The wording of the question is a bit misleading here, may want to address that?

  • BenMcCarthy's avatar
    BenMcCarthy
    Icon for Immerser rankImmerser
    26 days ago

    Hi ColeS,

    Thank you for sending your feedback! We have updated the task to ask for the event, created just as you pointed out! I have also chatted with the QA teams to ensure we are triple-checking for this type of error! I hope you enjoyed the lab, though :) 

    • ColeS's avatar
      ColeS
      Icon for Bronze II rankBronze II
      26 days ago

      Was fun, thank you!

  • CyberSharpe's avatar
    CyberSharpe
    Icon for Bronze III rankBronze III
    25 days ago

    Had the same issue. HH.MM.SS I was going insane with it. However once I did the . . . . it auto adjusted my time to an hour before UTC time.

  • KieranRowley's avatar
    KieranRowley
    Icon for Community Manager rankCommunity Manager
    26 days ago

    Thank you for the feedback ColeS I will pass it along to the lab author