Forum Discussion

ColeS's avatar
ColeS
Icon for Bronze II rankBronze II
2 years ago
Solved

Threat Research: Cobalt Strike C2 – SIEM Analysis - Question 4

Hello, I'm trying to solve Question 4 of the "Threat Research: Cobalt Strike C2 – SIEM Analysis" lab, I've solved every other question EXCEPT that one.  "What's the earliest @timestamp for the retu...
help & support
  • ColeS's avatar
    ColeS
    2 years ago

    Hey folks, I consulted with a colleague who finished the lab and got the answer with their advice. Format of the answer is HH.MM.SS (periods instead of colons), and they used event.created field instead of @timestamp. Also gotta check timezones ;)

    The wording of the question is a bit misleading here, may want to address that?

ColeS's avatar
ColeS
Icon for Bronze II rankBronze II
2 years ago

Hey folks, I consulted with a colleague who finished the lab and got the answer with their advice. Format of the answer is HH.MM.SS (periods instead of colons), and they used event.created field instead of @timestamp. Also gotta check timezones ;)

The wording of the question is a bit misleading here, may want to address that?

BenMcCarthy's avatar
BenMcCarthy
Icon for Immerser rankImmerser
2 years ago

Hi ColeS,

Thank you for sending your feedback! We have updated the task to ask for the event, created just as you pointed out! I have also chatted with the QA teams to ensure we are triple-checking for this type of error! I hope you enjoyed the lab, though :) 

  • ColeS's avatar
    ColeS
    Icon for Bronze II rankBronze II
    2 years ago

    Was fun, thank you!