Unlocking the Potential of SPL: A TryHackMe Guide
Written on
Understanding SPL in TryHackMe
Discover the foundational elements of Search Processing Language (SPL) in this engaging TryHackMe walkthrough. This resource provides insights into utilizing SPL effectively, making it essential for those interested in cybersecurity and data science.
This video provides a thorough exploration of using SPL within TryHackMe, guiding viewers step-by-step through the learning process.
Examining Search Queries
As you delve into SPL, you may encounter questions such as:
- What is the name of the host listed in the Data Summary tab?
- Answer: cyber-host
- In the search history, what is the seventh search query?
- Answer: index=windowslogs | chart count(EventCode) by Image
- Which Source IP has recorded the highest number of events in the left field panel?
- Answer: 172.90.12.11
- When applying a time filter for events on 04/15/2022 from 08:05 AM to 08:06 AM, how many events are returned?
- Answer: 134
- How many events are found when searching for Event ID 1 AND User as James?
- Answer: 4
- How many events are recorded with Destination IP 172.18.39.6 AND destination Port 135?
- Answer: 4
- What is the Source IP with the highest count from the following search query?
- Search Query: index=windowslogs Hostname="Salena.Adam" DestinationIp="172.18.38.5"
- Answer: 172.90.12.11
- In the index windowslogs, how many events contain the term "cyber"?
- Answer: 0
- Searching for the term "cyber*", how many events are returned?
- Answer: 12,256
- What is the third EventID returned from this search query?
- Search Query: index=windowslogs | table _time EventID Hostname SourceName | reverse
- Answer: 4103
- When using the dedup command before the reverse command, what is the first username returned?
- Answer: Salena.Adam
- Using the reverse command with the query index=windowslogs | table _time EventID Hostname SourceName, what is the HostName at the top?
- Answer: James.browne
- What is the last EventID returned when the query is updated with the tail command?
- Answer: 4103
- Sorting the above query by SourceName, what is the top SourceName returned?
- Answer: Microsoft-Windows-Directory-Services-SAM
- List the top 8 Image processes using the top command — what is the total count of the 6th Image?
- Answer: 196
- Using the rare command, identify the user with the least activity recorded.
- Answer: James
- Create a pie-chart using the chart command — what is the count for the conhost.exe process?
- Answer: 70
Join us as we continue to explore and uncover more about SPL in our next session!
This video further enhances your understanding of SPL and provides practical examples from the TryHackMe walkthrough.