And with that, we also need to validate the same for Hunt.
Let's hop into the lab again and demonstrate that we can see and use
the information using Security Onion's own Hunt.
And here I am back at the Security Onion dashboard.
Now, as I alluded to earlier in this module,
Hunt is something that we can use for threat hunting and
managing alerts and events and stuff like that,
sending them over to TheHive for case management.
So it can be considered your SOC operations tool or one of your good SOC
operations tools when you're working with Security Onion.
What's cool about it is that helps reduce the noise when
we're trying to identify indicators of compromise and hunt
for specific issues in the network.
And so let's hop over there and open up that dashboard.
And as you can see, it brings up some more visualizations.
We have the timeline of events.
We have some graphs with the occurrences that are here and everything like that.
Now let's go ahead and filter some of this data though instead of just
looking at the general alerts and everything like that.
As you can see, we have a lot of the same ones.
This is out of the box and not tuned,
so that's why a lot of this stuff is showing up.
But we can click on this drop‑down and go and try to
look just for the Zeek dataset, for example.
And it's looking for the last 24 hours.
This doesn't appear to have anything,
so let's go ahead and look for something else.
Let's look for instead of the general Zeek dataset,
let's look for the weird logs right here.
And there we go.
We have some good information here.
And then we also have some metrics and alerts.
We have our events here as well.
So we have possible split routing, we have unknown RPC authentication types,
so on and so forth.
And then if we look at these,
we see a lot of the information from the logs themselves.
So this is from that weird log.
What I really like about Zeek is we can go ahead and
show that PCAP for that event as well.
So we have automated pivoting from the logs and alerts themselves to going
to pull up the PCAPs for these events that are occurring.
So that's a cool capability that Security Onion provides where Zeek can
directly pivot from the Zeek logs into the PCAPs for these.
And then,
the last thing that I want to show you before we move on to the next
module is that we can just easily add or escalate these events to
TheHive so we can assign the cases to individuals.
So just by the click of that button, that's the escalate button,
so we can do that straight from the Hunt dashboard.
And like I said, we are looking at Zeek's logs here.
So we can just do that,
and we'll be able to send this off to the different personnel to investigate.
So this is a really cool tool,
and it gives us some decent visualizations as well.
Now if we jump over to the case manager of TheHive
and log in with our credentials,
we have that one case escalation that we have here that
we can go in and we can view the logs,
investigate it, and add additional information to here, add
some additional observables if we wanted to or if we found
anything relating to this as well.
So, we essentially just pivoted from seeing the Zeek logs in
Kibana to seeing the alerts from Zeek in Hunt,
sending them to a case manager and/or downloading the
PCAPs or viewing the PCAPs for them.