Using Splunk Applications

Hey everyone, I am stuck in this question:

Access the Sysmon App for Splunk, go to the “Network Activity” tab, and choose “Network Connections”. Fix the search and provide the number of connections that SharpHound.exe has initiated as your answer.

I put SharpHound.exe in the Edit Search and I got 48 events. But 48 is the wrong answer. If anyone can point me to the right direction on this, it would be greatly appreciated!

hint: Destination Port Name

(hint)You might want to use stats command and count by TaskCategory . GoodLuck

sysmon EventCode=3 Image=“*SharpHound.exe”
| stats count it worked for me

I looked at it as the edit search shouldn’t have SharpHound in it. I wanted to setup to search for a file so i kept the image as a variable. So when I input SharpHound in the dashboard textbox it will query as such. So I used the idea @slimchady presented but kept the image as a variable. Hope this helps