All right, so this is super, super exciting.
Now, before we get into, you know, validating all of our data is getting into flux, we need to do
a couple of things.
Number one, take snapshots of everything right now just right.
Click on your VMS or go up to them, go to snapshot and put it take snapshot.
You want to do this for each of the tabs you have over here because you don't want to lose any data
if something breaks, you want to have a pristine state to go back to and get your seatbelt passed.
Right.
I think we're going to we're going to make sure that we can get our data into sports.
And so let's log into Splunk for the first time.
We're looking into Splunk Enterprise with Ataman and the password you created in the last lecture,
whatever that was.
All right.
So you're going to see the search, your reporting app, right?
This is the main app that you're using, Splunk, when you're trying to do incident response and then
hunting and things like that.
So I'm going to say never receiving a password.
And I get it.
Hoping to get more value from.
Yeah, whatever.
So if you go to certain sporting.
So I got to calm down.
I'm so excited right now.
But if you go to certain reporting, you'll see that you can look at a data summary after we get past
this tour.
Actually, you might want to go through the tour if you've never used Punke go through the tour, don't
skip it.
But right now, I just want to show you something.
If you go into the data summary right here.
You'll see it says, waiting for results.
You're probably wondering why, what gives?
Like, why don't I see any data?
That's because we need to configure the receiver.
OK, so we need to configure report on Splunk to receive the events from all of the instrumented endpoints.
So if we go to settings forwarding and receiving, right, then you go down here to configure receiving,
you'll probably notice there's nothing here.
So we're going to go ahead and add a new receiver.
So a new receiving port like that.
And we're going to put in nine nine nine seven.
It looks good, click save now we've got our receiver and it's enabled.
Very good.
All right, search and reporting, loading, loading, loading.
All right, we'll collect data summary.
And you can see one, this PC has some data coming in.
If you look you see we have application logs.
We have the security logs we have set up.
We have everything we configured, you know, back in the earlier videos.
Right.
You can see our source types here.
So, you know, this is really, really good.
For example, you know, if we click on one of these, click on the security logs.
You'll see we've got our logs here, right?
We can look at the ports on our network, we can look at the computer.
Of course, right now the computer's only PC one because two PC two over here is turned off.
But we're going to fix all that and we're going to make sure that the DC is getting data in as well.
But right now, what we need to do is get the other logs in.
OK, so I want to make sure that we have the transcription logs and everything else properly configured.
So if you go into that transfer that we created earlier, you notice it's empty, right?
So let's go out and test what's going on.
I take power, shell control shift enter to open an elevated prompt.
Administrator.
So we're going to leave that window in the background so you can see both and we're going to take some
powerful comments and show you something
I do like invoke Webcke request
and I pull yourself up like Google, right?
Or if I do get services.
You should see transcription here, Roger, and you are very good now, I was going to say, if it didn't
work, what you could do is the following.
What you don't want to do is go into the group.
Policy editor edit.
And you want to know this as an admin,
you run as administrator.
Oh,
God, mode activated man.
Whenever I say God, I think of doing that.
You guys ever play the game back in the day game?
All right.
So so if we go to administrative templates, Windows components.
Windows power show noticed that transcription is on, but it is not working for you, what you could
do if you could set the path here, you could say transcript output directory and put in second backslash.
Right.
Then you click apply, you click.
Okay.
And he commands that you type here would be echoed in that transcription log so we can actually take
a look at that log.
Double click it.
And you can see the exact command I typed, so obviously this is exactly what you want as a defender.
I mean, look, this is exactly what I typed and there's the output.
So we want to make sure we're getting this log.
So how do we make sure we're logging everything we want?
Because right now we don't have sismondo inside, as you might have noticed, that we don't have Windows
Defender.
We don't have power.
So it's the input, Sturckow.
So what we're going to do is I'm going to modify that file and show you how you can do.
And you can see the path where we're located.
C Colon Backslash Program Files, Universal Forwarder ETSI Apps spoke Universal Forwarder, local inputs.
I know it's a mouthful, but you'll get used to this as you go through this course.
But here you can see these are the inputs, right?
This was the data, the data we saw in Splunk.
So what we're going to do is we're going to first add those transcription logs and actually a bunch
of different things.
So I'm going to include everything I need to add inside of the resource section of this course so that
you don't have to manually type out everything.
Right, because there's a lot of data that I'm just going to copy and paste everything in and then we'll
check back and Splunk to see if it's collecting.
So here you can see we are monitoring the directory that contains our transcription logs or creating
a new source type called Partial Transcript and the Paracel index.
We are also logging all the power show events.
And we're seeing that and what this source type here, we're doing the same for this morning.
Sort of type says on.
So we got a double here, so let's take this one out.
We don't need both
and then we've got Windows Defender, right?
So this should do it.
I'm going to go ahead and save it.
And then close it out and restart the universal forwarder service
services that MASC.
Run as admin.
Again, I'm going to skip down to the as part of services.
Speaking of her supporters running, let's go ahead and click restart.
And if this fails, it's probably because you have a typo somewhere inside of your inputs dot com,
which means that I gave you a typo Burgen to copy and paste.
So hopefully that doesn't happen until this starts up.
All right, so it is running back over to the browser
and let's go back.
Take me back, baby, OK, take me back.
OK, I'll stick to sidebar, I'll stop with the singing.
Dated summer, and that's cool, look, our damage control was automatically coming in.
That's pretty cool, right?
It.
And you can see some of the stuff is already coming in.
Look, we've got Windows Defender.
And some of the other actually start to come in as many as we ran into this morning, look at what we
can do in the next lecture, which is going to make sure that our shop and our open sense appliances
are also something different as well.
OK, so I'll see you guys in the next lecture by.