@Marqui It's been years since I've taken the course, but a quick look at the lab guide for Module 5 Task 2 reads: 7. Click Search to start a new search. 8. Search for fail* AND password over All time. Review the results and notice the port values for a few of the events. You want to see users trying to log into the SSH port we have open, port 22. 9. At the end of the search string, type: 22 10. Click the Search button or press Enter to run the search. 11. Notice that not only events with port 22 are selected, but any events with the number 22 in them. 12. Replace the number 22 in your search with: "port 22". Make sure to use the quotation marks. 13. Notice that you are now only seeing events the entire phase. 14. Page through the results. There are many login failures. In step 12, your search should be: fail* AND password "port 22" Assuming the lab and test data agree, you should see results with host=web_server sourcetype=linux_secure.
... View more