Trick or Treat on Specter Street: Ghost of the SOC

Hi, I am being very blind here but i am struggling so a hint would be great. I am at Q3 trying to find the username the Glitch Geist executed the script under. The alert i have found in kibana rela...