Getting Started with Elastic Stack: Queries Lab - Wrong Answers

I believe I have run into wrong answer on the Getting Started with Elastic Stack: Queries lab. Question 3 asks:

How many logon failures did Windows user snoopy have?

I used the below query and receive 14 but the answer is not accepted.

Summary

event.code:4625 and user.name:snoopy

Question 4: How many web (HTTP) requests were made in the time frame selected?
I use this query to get all http requests, but it is also wrong.

Summary

http.request.method : *


Are my queries wrong or is the answer in the lab wrong?

For the Snoopy login failures, we are looking for a winlog.event_data field. Your answer is not “wrong”, it’s just capturing both login failures and endpoint security events.

For the “HTTP Requests” question, you are looking at Apache web server logs:

What we are looking for are HTTP connections made from the client (think destination port). I have changed the question to help clarify this.

Got it, thanks for the pointers. So the difference between question 2 and 3 is one asking for how many events vs how many actual failures? Since in question 2 I got the answer using the query

Summary

event.code:4624

I think it would also help if the instructions explained those queries bit more. The winlog.event_data field was not covered in any of the material but rather the other query was presented as the method to use.