SIEM Search Expression Challenge Exercise

General
1

Help..???
Which command may i use to find out three accounts? data.win.system.eventID:4624 and data.win.eventdata.targetUserName:administrator/SYSTEM/cybrary…?
no good result even with more boolen(not)

image
image1855×821 216 KB

2

Remember you are looking for logon failures, so not Event ID 4624.