Conventions used

There are a number of text conventions used throughout this book.

Code in text: Indicates code words in text, database table names, folder names, filenames, file extensions, pathnames, dummy URLs, user input, and Twitter handles. Here is an example: "With this tool, you can create an autorun.inf file that will be automatically executed when the device (USB, DVD, or CD) is inserted."

A block of code is set as follows:

//Identify USB HID Devices
let MalPnPDevices =
    MiscEvents
    | where ActionType == "PnpDeviceConnected"
    | extend parsed=parse_json(AdditionalFields)
    | sort by EventTime desc nulls last
    | where parsed.DeviceDescription == "HID Keyboard Device"
    | project PluginTime=EventTime, ComputerName,parsed.
ClassName, parsed.DeviceId, parsed.DeviceDescription, AdditionalFields;

Any command-line input or output is written as follows:

sudo apt-get install telnet

Bold: Indicates a new term, an important word, or words that you see onscreen. For instance, words in menus or dialog boxes appear in bold. Here is an example: "Those settings can be accessed for configuration and verification (audit) on the Windows Group Policy Editor under Advanced Audit Policy configuration."

Tips or important notes

Appear like this.