The last Lab4 Question can´t be solved because of missing data.
Bot-iful Timestamp: Spot the Process
Select process.name and process.args as columns. Look at the documents with timestamp Mar 8, 2022 @ 18:29:12.393 (you may have to scroll down in your results list). What is the process name that contains "bot"?
host.name: "dc01" AND process.name: *.exe AND process.args: *
The times shown in the kibana UI might not be in the same timezone ... it's a poorly formatted question. Put the time picker back to BLISTER and try again. This question isn't really about that specific time, it's about whether you can find the "suspect" processes with a KQL or Lucene search. We know the bad guys will call their bot processes <some-bot-or-another.exe".