All right, so my last lecture, we got our open since data and two o'clock, as you can see the beauty
before your eyes.
And now we're going to do the same for.
Got it.
So in order to make this work, we need to download these T8 for Surakarta.
So if you just go to this link here or you Google sponte for sars-cov-2, you get to this page, you'll
see it says an app has been archived.
You know, it's old, doesn't matter.
It still works.
So don't let that scare you away.
So we're going to do this.
We're going to click login to download.
We're just going to log in with our Splunk Cretz.
All right.
Let's grab it.
Agreed to download, yes.
All right, so the download is done.
Let's go ahead and copy it over to our appliance.
Fire up the good old command prompt CD downloads and there it is right there, right?
So what we can do is we have SEP built into Windows 10 by default.
It ships with Windows 10, which is really convenient for us because now we can use ASEP to basically
send this file over.
So we're going to put the file name in there.
I'm going to log it as a route and we're going to put it in route home directory.
We're going to connect, yes, and we'll put in a password for Root on our open sense appliance and
it's been copied.
Now we can association as well
and we can press eight to go into a shell.
You see, we are in route's home directory.
And if we do it, unless you can see we now have this Pontiac right there.
Right.
That's what we're going to do, is we're going to send it to the right directory so we can to extract
the zip.
We were both in the file name is Splunk T for Cerqueira and we're going to send it to Opt Splunk Forwarder
Etsi EPP's.
And that's exactly where we wanted to be.
So let's go ahead and go to that directory.
This system.
At the apps.
All right, so we're there.
And you can see we've got the folder there, T8, Dash, Surakarta.
OK, so that is our circle of Splunk app and we just need to do some configuration now.
So if we go to the we're going to configure the output configuration file.
You see, it doesn't exist, so we're going to create it.
How do we know it doesn't exist?
Because when I hit Tab, I don't see it.
It is just a dot.
So we're going to create outputs that come in in here.
I'm going to type TCP out.
In their default group equals cyber range.
And then we'll do TCP out in the name of that group, cyber range server, and this is going to be our
Splunk index indexer
scape.
Chief thesea, let's make sure the file is there as we think it is.
I'd like to verify it is we should be able to carry it out.
Yeah, so that looks pretty good.
All right, now, what we're going to do is we're going to back up the current inputs that come in and
create a new one.
And this is going to basically give us the magic we need to ship Surakarta into Splunk.
So let's go ahead and move the existing input's
file in the Circle app.
That's what we're doing here.
We're going into the Surakarta app, the one we just set to this box, and we're going to say that.
We're going to save it as inputs that that back.
All right, what we're going to do is open the original input stack of.
I am we're going to monitor a couple of things first, we want to monitor the EHV log, so if we do
two slashes forward slash, the next slash represents the slash for the directory.
So this is slash VA.
Bar in that directory, there's a lot folder is a kind of folder, and then there is a EHV Jason file,
that's what we want to monitor under the source type Surakarta post will be the hostname of our firewall
and index will be sort of Qatar.
And we also want to monitor, monitor the sensa logs
or the log files in that folder.
And the source type here will name it, since they both equals open since and the index equals network.
That looks good.
You know, we can do is restart the universal forwarder.
And then once it's restarts, we're going to go back in his bunker to make sure it's actually working.
All right, very, very cool, let's flip back over and next equals Surakarta.
This is a good sign, guys, we've got the circle of here and just for sanity check, let's make sure
that it's being passed.
Look at that.
That is beautiful.
You've got the alert signatures, we've got the signature severities, all this is this is this is so
good.
You see the source type here, Sakata.
Let's see if we have the Sensa logs index equals.
Network source type equals syncing.
Oh, yes, yes, yes, yes, yes.
And we have a sense logs, so this isn't processed nicely because we don't have a technical.
We don't have to say.
But I bet if we go to open at Facebook, we're going to see some awesomeness, let's just double check
this out here.
Oh, yeah, look at these dashboard's look at how beautiful it is.
I mean, guys, this is what you want to see in your lap.
This is our summer range where we can learn, we can hack, we can attack, we can run red team exercises
and penetration tests, and then we can build the defenses and detections.
And this is how you learn, guys, and it's just going to get even better.
We see the upcoming lectures that I have in store for you guys, and this is going to be insane.
I you look at this, I'm getting my traffic destination's top sources.
You know, I'm looking at everything I need to do into those spots.
Right.
So this that's what we want.
Guys, in the next lecture, we are going to jump into Duchamp.
I'm going to show you how you can put those Web application logs in textbooks.
That way we can see a sequel injection, ximo external entity attacks and all that goodness crosshatch
scripting.
We're going to see all that stuff in catalogues.
So I'll see you guys in the next lecture by.