SAL2 Practice Questions - TryHackMe Security Analyst Level 2 (SAL2) Exam

index=windows EventCode=4624 | stats dc(ComputerName) as host_count by user | where host_count > 3 index=windows EventCode=4624 | timechart span=10m count by user index=windows EventCode=4625 | stats count by user | sort -count index=windows | search EventCode=4624 AND LogonType=3 | table user ComputerName