[Solved] Identify the error in this threat hunting query:search event where source_ip == 10.0.0.1 and action = 'login' | Cybersecurity

Cybersecurity - Advanced Threat Protection

Identify the error in this threat hunting query:
search event where source_ip == 10.0.0.1 and action = 'login'

ADouble equals (==) is invalid in this syntax

BIP address should be in quotes

CMissing semicolon at end

DAction field cannot be filtered

Step-by-Step Solution

Solution:

Step 1: Check syntax for IP address filtering
IP addresses in queries usually require quotes to be treated as strings.
Step 2: Verify other syntax elements
Double equals and single equals are often interchangeable; semicolons are not required; action filtering is valid.
Final Answer:
IP address should be in quotes -> Option B
Quick Check:
IP strings need quotes in queries [OK]

Quick Trick: Always quote IP addresses in queries [OK]

Common Mistakes:

MISTAKES

Master "Advanced Threat Protection" in Cybersecurity

9 interactive learning modes - each teaches the same concept differently

More Cybersecurity Quizzes

Identify the error in this threat hunting query: