2026-04-13 10-02-48

Speakers

• Speaker 1 0:07
• Speaker 2 0:06
• Speaker 3 0:25
• Speaker 4 0:30

1. 0:06

   Poglavlje 1: In this video, we're going to walk through a short kind of hypothetical threat hunt just to look at the threat hunting process in Splunk from a more theoretical view, including, you know, what kind of queries you can do when pivoting and things like that. 302s · Speaker 2

   In this video, we're going to walk through a short kind of hypothetical threat hunt just to look at the threat hunting process in Splunk from a more theoretical view, including, you know, what kind of queries you can do when pivoting and th…

2. 5:08

   Poglavlje 2: have the asterisk in there for that wildcard. 106s · Speaker 1

   have the asterisk in there for that wildcard. And we're also looking as part of the command line that was entered in there for the letters enc for encoded. We are looking for that somewhere in that command line. Now, there's many different …

3. 6:55

   Poglavlje 3: Again, there are many, many different ways to kind of build this query. 301s · Speaker 2

   Again, there are many, many different ways to kind of build this query. This is just one option. Now, say you don't have sysmon because you can see with the event code equals one, that is also the name of the index. Strong indication that w…

4. 11:57

   Poglavlje 4: So remember to include the index. 210s · Speaker 1

   So remember to include the index. Just by default, start your query with index equals, and then whatever the name of the index you're looking through is. Make sure your time frame is correct on your search query. Again, that can be very fru…