Browser LabLD-ELA-LAB-002Medium
Browser LabLD-ELA-LAB-002Medium20 min
Aggregate the Answer
Two sources are hammering Jisr's VPN portal. Before leadership chooses a response, name the technique from the aggregation, not the word 'failure'. You have an Elastic aggregation of failed logins split by source.ip, with both a count and a unique count of user.name.
What you will be able to do
- Use count vs unique count to separate volume from spread.
- Classify brute force vs password spray from the aggregation.
- Name the aggregation that distinguishes them.
SIEM OperationLog AnalysisThreat HuntingT1110.003 — Password SprayingT1110.001 — Password Guessing
Sign in to start this lab.
Sign in