[Splunk Question] Use index=botsv3. 

Frothly competitors are looking to take intellectual property from them, and the Chief Information Officer believes that they may try to compromise online Frothly systems.  The following questions are related to possible attack on the Frothly computer systems.

Use index=botsv3. 

1.Provide a list of all the Windows users at Frothly and the IP address of their workstations. 

2. What IP address uploaded a suspicious file to a Frothly OneDrive account? What makes this file suspicious?

3. Frothly uses Microsoft Azure Active Directory for centralised authentication services. What expired user has logged in successfully from an external IP address?