Strelka in Hunt interface

[blarson1105]

Greetings all,

I am trying to figure out why I don't see more events in the hunt interface for strelka. When I check "/nsm/strelka/processed/"
I see four files ( 1 pdf and 3 exe's) collected in the last 24 hours (installed yesterday). However, when I go to the hunt interface and query "event.module:strelka | groupby scan.exiftool.FileType" I only see the pdf.

Why do I not see the three executables?

Thanks.
Brandon

[weslambert]

Do you get the same result when searching in Kibana? What about if you only search for event.module:strelka

[blarson1105]

Wes,
Thanks for the response. All seems to be working correctly now. I must have selected a field that wasn't in the exe file data or some other syntax error.

Thanks again,
Brandon