HTB CDSA Practice Questions - HTB Certified Defensive Security Analyst Exam

In Elastic/KQL, which query correctly searches for all Windows Security events with Event ID 4688 (process creation)?

event.code:4688 AND winlog.channel:Security SELECT * FROM Security WHERE EventID=4688 index=windows EventCode=4688 event_id=4688 source=WinEventLog:Security

Correct Answer:

event.code:4688 AND winlog.channel:Security

Access more questions from this quiz

Continue to HTB CDSA Practice Questions - HTB Certified Defensive Security Analyst Exam for more practice questions and the full quiz experience.

Access More Questions