Advanced ELK Queries

Walkthrough summary

Advanced ELK Queries TryHackMe walkthrough with 14 answered prompts and lab methodology notes.

Sample prompts covered

• How do you escape the text "password:Me&Try=Hack!" (Not including the double quotes)
  Open the walkthrough page to inspect the full answer and command flow.
• Using wildcards, what will your query be if you want to search for all documents that contain the words "hacking" and "hack" in the "activity" field?
  Open the walkthrough page to inspect the full answer and command flow.
• Task 3 - Q1 - How many incidents exist where the affected file is "marketing_strategy_2023_07_23.pptx"?
  Open the walkthrough page to inspect the full answer and command flow.
• How many incidents exist where the affected files in file servers are titled "marketing_strategy"?
  Open the walkthrough page to inspect the full answer and command flow.
• There is a true positive alert on a webserver where the admin and it users were logged on. What is the name of the webserver?
  Open the walkthrough page to inspect the full answer and command flow.