A help-desk account shows a burst of failed civic logons and later a success. Which SPL pair shows whether brute force later succeeded?
Select an answer to reveal the explanation.
Short Explanation
Line the help-desk logons up like tickets at a window. The first failure and the last success tell whether the pounding eventually opened the door. That is first() and last(), not a guess.
Full Explanation
first() and last(), or earliest and latest, return ordered values inside a grouped set of events. Comparing the first failed logon with the last successful logon on a civic help-desk account shows whether a brute-force burst was later followed by success. rex, makeresults, and foreach do not provide that intra-group order. This is the blueprint FIRST/LAST use in security analysis.