1. What are the two most prevalent "data.win" fields? Hint: data.win.___ and data.win.__ (SIEM Search Expressions GE 1.2)

Career Paths SOC Analyst
1

Can someone help with this question? Thank you!

2

When you look under Available Fields you will find a slew of fields labeled data.win.“something”.“something more”.“other stuff”. We are looking for the two most numerous “something”.

3

The following appears to be the popular fields: data.win.eventdata.failureReason, data.win.eventdata.subjectUserName, data.win.system.message, and data.win.system.severityvalue. When I enter any two of these they don’t answer the question.

4

We are just looking for the first subcategory following data.win. The answers are in your post.

5

I have tried these combination, (data.win.eventdata data.win.system) , (eventdata system) . I am still missing the acceptable formatting.

6

We don’t need the data.win part in the answer.

7

Got it! Thank you for taking the time to help.

1 Like