# Question

#### Question 1

Navigate to http\://\[Target IP]:8000, open the "Search & Reporting" application, and find through an SPL search against all data the account name with the highest amount of Kerberos authentication ticket requests. Enter it as your answer.

```
index="main" sourcetype="WinEventLog:Security" EventCode=4768 | stats count by Account_Name | sort - count | head 1
```

* **`EventCode=4768`**: Event ID 4768 represents Kerberos TGT ticket requests.
* **`stats count by Account_Name`**: Counts the number of events for each account, grouped by the `Account_Name` field.
* **`sort - count`**: Sorts the results in descending order based on the number of requests.
* **`head 1`**: Returns only the first result (the account with the highest number of requests).

***

#### Question 2

Navigate to http\://\[Target IP]:8000, open the "Search & Reporting" application, and find through an SPL search against all 4624 events the count of distinct computers accessed by the account name SYSTEM. Enter it as your answer.

```
index="main" sourcetype="WinEventLog:Security" EventCode=4624 Account_Name="SYSTEM" | stats dc(ComputerName) as Distinct_Computer_Count
```

* **`EventCode=4624`**: Filters only successful logon events (4624). 
* **`Account_Name="SYSTEM"`**: Filters only events where the account name is `SYSTEM`. 
* **`stats dc(ComputerName) as Distinct_Computer_Count`**:

`dc(ComputerName)`: Counts the distinct values ​​of the `ComputerName` field, which represents the computers accessed.

`as Distinct_Computer_Count`: Renames the output column to something more readable.

***

#### Question 3

Navigate to http\://\[Target IP]:8000, open the "Search & Reporting" application, and find through an SPL search against all 4624 events the account name that made the most login attempts within a span of 10 minutes. Enter it as your answer.

```
index="main" sourcetype="WinEventLog:Security" EventCode=4624 | stats range(_time) as time_range count by Account_Name | where time_range <= 600 | sort - count | head 1
```

* **`EventCode=4624`**: Filters only successful login events.
* **`stats range(_time) as time_range count by Account_Name`**:
* Calculates the maximum time difference (`range(_time)`) in seconds for each `Account_Name`.
* Counts the number of events (`count`) per account.
* **`where time_range <= 600`**: Filters accounts whose time range (`time_range`) is 10 minutes (600 seconds) or less.
* **`sort - count`**: Sorts accounts by the highest number of attempts.
* **`head 1`**: Returns only the account with the highest number of logins.