minor edit

subbyte · subbyte · commit 2c8b81586c91 · 2024-08-06T19:31:22.000-04:00
diff --git a/huntbooks/01. GoldenSAML AD FS Mail Access Hunt.ipynb b/huntbooks/01. GoldenSAML AD FS Mail Access Hunt.ipynb
@@ -198,7 +198,7 @@
     "\n",
     "# an alternative way is to use FIND from our previous variable `win_events`\n",
     "#procs = FIND process RESPONDED win_events\n",
-    "#        WHERE device.hostname LIKE \"%adfs01%\"\n",
+    "#        WHERE endpoint.hostname LIKE \"%adfs01%\"\n",
     "\n",
     "DISP procs ATTR name, pid, endpoint.hostname"
    ]

Original file line number	Diff line number	Diff line change
`@@ -198,7 +198,7 @@`
`198`	`198`	`"\n",`
`199`	`199`	"# an alternative way is to use FIND from our previous variable `win_events`\n",
`200`	`200`	`"#procs = FIND process RESPONDED win_events\n",`
`201`		`- "# WHERE device.hostname LIKE \"%adfs01%\"\n",`
	`201`	`+ "# WHERE endpoint.hostname LIKE \"%adfs01%\"\n",`
`202`	`202`	`"\n",`
`203`	`203`	`"DISP procs ATTR name, pid, endpoint.hostname"`
`204`	`204`	`]`