# Elastic Security SIEM challenge 7.4

**URL:** <https://discuss.elastic.co/t/elastic-security-siem-challenge-7-4/382594>\
**Category:** Elastic Training\
**Created:** [October 10, 2025, 11:11pm UTC](https://discuss.elastic.co/t/elastic-security-siem-challenge-7-4/382594 "2025-10-10T23:11:17Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Nana\_Kwesi\_Baah](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nana_kwesi_baah/32/145329_2.png) [@Nana\_Kwesi\_Baah](https://discuss.elastic.co/u/Nana_Kwesi_Baah)\
**Post date:** [October 10, 2025, 11:11pm UTC](https://discuss.elastic.co/t/elastic-security-siem-challenge-7-4/382594/1 "2025-10-10T23:11:17Z")

</div>

I’ve been sitting all day just to answer this question. Any suggestion to find the other forms of telemetry here?

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/e/4/e41400bf6dff01299d5b9c5122b86d6c94c277d1.jpeg)

---

<div class="post-metadata">

**Author:** ![Tortoise](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tortoise/32/147587_2.png) [@Tortoise](https://discuss.elastic.co/u/Tortoise)\
**Post date:** [October 12, 2025, 5:53am UTC](https://discuss.elastic.co/t/elastic-security-siem-challenge-7-4/382594/2 "2025-10-12T05:53:18Z")

</div>

Hello @Nana_Kwesi_Baah

Welcome to the Community!!

The answer can be any of below , i had used file & it worked :

_We can see other forms of telemetry collected by Defend such as file, library, network and registry events leading up to this event._

Thanks!!

---

<div class="post-metadata">

**Author:** ![Nana\_Kwesi\_Baah](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nana_kwesi_baah/32/145329_2.png) [@Nana\_Kwesi\_Baah](https://discuss.elastic.co/u/Nana_Kwesi_Baah)\
**Post date:** [October 15, 2025, 3:22am UTC](https://discuss.elastic.co/t/elastic-security-siem-challenge-7-4/382594/3 "2025-10-15T03:22:02Z")

</div>

I get it now. Thank you!