Forum Discussion
Bronze IIThreat Research: Cobalt Strike C2 – SIEM Analysis - Question 4
Hey folks, I consulted with a colleague who finished the lab and got the answer with their advice. Format of the answer is HH.MM.SS (periods instead of colons), and they used event.created field instead of @timestamp. Also gotta check timezones ;)
The wording of the question is a bit misleading here, may want to address that?
Bronze IIHey folks, I consulted with a colleague who finished the lab and got the answer with their advice. Format of the answer is HH.MM.SS (periods instead of colons), and they used event.created field instead of @timestamp. Also gotta check timezones ;)
The wording of the question is a bit misleading here, may want to address that?
Silver IHad the same issue. HH.MM.SS I was going insane with it. However once I did the . . . . it auto adjusted my time to an hour before UTC time.
