Forum Discussion

gilly32's avatar
gilly32
Bronze I
1 month ago

Wizard Spider DFIR: Ep.9 – Sigma

The question I'm stuck on is :  Modify the rule file "file_event_win_macro_file.yml" to also include ".docm" file types. Convert this rule using Sigmac and use the output within Elastic. How many pot...
challenges
help & support
immersive labs
neeemu's avatar
neeemu
Icon for Ambassador rankAmbassador
1 month ago

Hi gilly32​ , there's another window for Elasticsearch, you just need to click that tab at the top of the page. Once you've opened that tab use Analytics > Discover to perform the search.