## Chapter 9 — Four minutes is 23:47 to 23:51 ### Lesson map Lesson 09. Map, example, EX055. ```mermaid flowchart TD S["23:47 is a lab token"] --> D["Subtract from 23:51"] R["23:51 is prose"] --> D D --> F["Four minutes"] F --> Q{"Is 23:51 a lab column?"} Q -->|No| K["The rule stays outside the script"] ``` The gap is arithmetic beside the file. The file does not store the rule. ### Logical drawing ```text lab sees Fri 23:47 BR prose sees rule created 23:51 difference 4 minutes script columns user, when, country ``` ### Learning outcomes After this chapter, you should be able to: 1. Subtract the two Friday-night clocks. 2. Say which clock is a tuple field. 3. Refuse a rule column the script does not have. ### 9.1 The sign-in token is in the list. The rule clock is not. Friday 23:47 is the third tuple's time field, and the lab prints it. The forwarding rule was created at 23:51, four minutes later. Four is `23:51` minus `23:47`. The rule forwards any email containing "invoice" or "payment" to an outside address and deletes the copy. None of that text is a field in `signins`. The loop never reads a rule, a keyword, or an outside address. The address itself is not printed in this book, and this chapter does not invent one. The second Brazil sign-in, Saturday 00:02, is eleven minutes after 23:51 if someone subtracts those clocks. That subtraction is not the four-minute gap, and it is not a lab column either. The script does not subtract times at all. It only parses an hour for the night test. Minutes never enter the predicate, so 23:47 and 23:51 would share hour 23 if both were tokens. Only 23:47 is a token. MITRE ATT&CK is the name already used for email forwarding rules as a collection technique. BrightPath used that name while searching mailboxes. The search result is prose. This script does not emit a detection, a query, or a rule in the Sigma sense. NIST SP 800-92 is why Leo asked for 90 days of sign-in logs. The records this incident needed covered Thursday's fake page through Monday's call, which the earlier chapter calls a few days. Ninety days is the retention ask, not a printed span of this incident. | Clock | Where it lives | |---|---| | 23:47 | Third tuple, printed | | 23:51 | Prose about the rule | | Four minutes | Subtraction beside the file | | Saturday 00:02 | Sixth tuple, a different gap | ### 9.2 Worked example | Offered sentence | Where the fact lives | Decision | |---|---|---| | "23:47 is on the third line." | The tuple | Keep | | "The rule is four minutes later." | Prose subtraction | Keep, labelled as prose | | "The lab printed 23:51." | No such field | Refuse | | "The script detected the rule." | It never reads rules | Refuse | > **Synthetic case.** The outside address stays unprinted. ### Errors and limits Do not add a rule column so that four minutes looks like program output. ### Apply - **EX055 — Two clocks.** What is 23:51 minus 23:47, which of those clocks is a lab field, and does the script see the forwarding rule? *Rubric:* 3 = four minutes; 23:47 is the tuple; 23:51 is prose; the script has no rule column and does not print the outside address;; 2 = four minutes, and only 23:47 is in the print;; 1 = one clock;; 0 = none. ### Continue studying — lesson 09 (chapter 09 of 20) [← Chapter 08](#ch-08) · [Course chapter index](../SUBJECTS.md) · [Chapter 10 →](#ch-10) Continue to the next authored lesson. ## Worked answers **EX055.** Four minutes. 23:47 is the lab field. 23:51 is prose about the rule. The script has no rule column and does not print the outside address.