Splunk 3

Walkthrough summary

Splunk 3 TryHackMe walkthrough with 33 answered prompts and lab methodology notes.

Sample prompts covered

• List out the IAM users that accessed an AWS service (successfully or unsuccessfully) in Frothly's AWS environment? Answer guidance: Comma separated without spaces, in alphabetical order. (Example: ajackson,mjones,tmiller)
  Open the walkthrough page to inspect the full answer and command flow.
• What field would you use to alert that AWS API activity has occurred without MFA (multi-factor authentication)? Answer guidance: Provide the full JSON path. (Example: iceCream.flavors.traditional)
  Open the walkthrough page to inspect the full answer and command flow.
• What is the processor number used on the web servers? Answer guidance: Include any special characters/punctuation. (Example: The processor number for Intel Core i7-8650U is i7-8650U.)
  Open the walkthrough page to inspect the full answer and command flow.
• Bud accidentally makes an S3 bucket publicly accessible. What is the event ID of the API call that enabled public access? Answer guidance: Include any special characters/punctuation.
  Open the walkthrough page to inspect the full answer and command flow.
• What is Bud's username?
  Open the walkthrough page to inspect the full answer and command flow.