In this article, we’ll learn more about how Cyber threats occur, how we can detect them and how we can avoid them. Watch the Video https://www.youtube.com/watch?v=_Xw43NLo2kg&ab_channel=GrantCollins 00:00 all right so i'm finally back with the 00:01 cyber security home lab project and in 00:02 today's video 00:03 it's going to be over a sem or system 00:06 information event management 00:07 system i've done a video here talking 00:09 about what asm does 00:11 and how it works and in today's video 00:13 i'm going to be 00:14 working with splunk splunk is a industry 00:17 grade 00:18 sem and they offer a community edition 00:20 so what i'm going to be doing today 00:22 is setting up this sem and using a 00:24 universal forwarder 00:26 to forward data from a linux server over 00:29 to the sem so that i can visualize 00:32 and understand what's going on with the 00:34 different systems connected to the scent 00:36 i really have no idea what i'm doing 00:38 here 00:38 so it's going to be a lot of research so 00:40 yeah let me go ahead and give you an 00:42 overview of what i have found so far 00:44 all right so transitioning over to my 00:45 computer here i have a couple of things 00:47 that i'm running right now so i'm gonna 00:48 be separating myself 00:49 from the virtualization that i've done 00:51 on my other cybersecurity home lab 00:53 computer 00:54 and i'm actually gonna be using lenode 00:56 here and in front of me 00:58 i have a couple of machines already set 01:00 up this includes my splunk test 01:02 environment 01:03 as well as a basic linux server so i'm 01:06 gonna be using leno to 01:07 power this project i'm gonna be working 01:10 with 01:10 this guide here to go ahead and just 01:12 basically set up the splunk dashboard 01:15 and from there i can use the splunk 01:17 official documentation 01:19 to understand what's going on with uh 01:22 the universal forward or to get data 01:23 into 01:24 the dashboard probably a lot more 01:25 resources i'll be working with but here 01:27 is what i have so far so let's go ahead 01:28 and get started by setting up the splunk 01:30 dashboard 01:38 all right a couple hours later here i am 01:40 in front of me i have 01:42 the splunk dashboard up and running 01:45 so as you can see here i went ahead and 01:48 set up the splunk dashboard 01:49 on my base ubuntu server node 01:52 and from that i'm able to get into the 01:55 splunk enterprise website 01:57 by going through the ip address as well 01:59 as the default 02:00 port i'll leave that link up in the 02:02 description below so now the next thing 02:04 is to go ahead and get the data into the 02:07 splunk machine and understand what the 02:08 heck is going on here all right so while 02:10 setting up the splunk 4 i want to 02:12 quickly mention 02:12 the flexispot desk which has been sent 02:15 to me by the flexispot team 02:17 i already have a couple of flexispot 02:18 desks and they were actually generous 02:20 enough to send over 02:21 one for my home office specifically i 02:23 received the 02:24 flexi spot glass black eg8b from my home 02:27 office and so as you know i'm 02:29 all about productivity with these 02:31 standing desks the flexi spot glass 02:33 black 02:34 is a perfect standing test to meet my 02:36 productivity needs 02:37 comes with a motorized lifting system 02:39 for ease of use 02:40 there are four different numbered modes 02:42 you can use to set different height 02:44 adjustments 02:45 whether you want to stand sit or if 02:47 something in between but it also comes 02:49 with the standard up and down arrows 02:51 to meet your height needs the glass 02:53 finish looks great even comes with a 02:54 little 02:55 drawer supply for notepads and pencils 02:58 the flexispot glass black desk is a 03:00 perfect desk to boost your productivity 03:02 so if you're interested you can go ahead 03:03 and use the link in description below 03:05 and 03:05 thanks again for spot team for sending 03:08 one of these over 03:10 okay so after getting lost for a long 03:12 time i finally used that youtube video 03:14 and i figured out something the splunk 03:16 architecture processing components 03:18 so here they are in smug we have three 03:20 major components 03:21 forwarders indexers and search heads 03:23 borders are used to 03:25 forward or send data into the splunk 03:28 enterprise machine 03:29 this is going to be the centralized 03:30 device which is going to store all that 03:32 information 03:33 and populate that data so that it can be 03:35 queried after the data is forwarded it's 03:37 indexed meaning it's stored 03:39 indexers store the data so that it can 03:41 be query once the data is stored 03:43 you can go into the search heads this is 03:45 where you can actually look up the data 03:47 look for what is anomalous whatever type 03:49 of data that you're looking for 03:50 and you can use the search query 03:52 language to set up 03:54 and actively look for different types of 03:56 data and populate dashboards 03:58 from that so now that we know the basic 04:00 splunk processing components 04:02 it's time to set up this universal 04:04 forwarder okay so to actively 04:05 set up the universal forwarder you can 04:07 actually download the 04:09 splunk universal folder on the official 04:11 web page 04:12 i'm gonna be using a bare bones linux 04:14 server so i'm going to use the wpit 04:16 command 04:16 to go ahead and install this folder into 04:19 my 04:26 machine all right so it's a couple hours 04:29 later 04:29 and i finally finished kind of my basic 04:32 goal of getting 04:33 data into splunk so that i can go ahead 04:35 and search 04:36 for it all right so here in front of me 04:38 as you can see i have my 04:40 linux machine which is running splunk 04:42 right now 04:43 as well as another linux machine running 04:46 the splunk forwarder 04:48 sending data specifically the syslogs 04:51 into 04:51 my splunk dashboard here so if we close 04:54 out it here you can go ahead and see the 04:56 data coming in like i said before we can 04:58 go ahead and use 04:59 the search query for specific data 05:01 matching 05:02 a pattern or a string so in this case 05:04 you can go ahead and 05:05 use host but you can go ahead and pipe 05:08 things and 05:09 you can add other information such as 05:11 using the table 05:12 to go ahead and query for specific data 05:15 so here in front of me as you can see i 05:17 went ahead and created a table 05:19 with the source type in date hour and as 05:21 you can see it just pops up here 05:23 the query language in splunk is very 05:25 powerful 05:26 i didn't really touch a lot on it but 05:28 definitely a lot to be learned 05:29 in that front because i'm interested in 05:31 the security side of splunk i went ahead 05:33 and tested some 05:34 test use cases where you would actually 05:37 look for indicators of compromise 05:38 what i tried doing was a basic test 05:42 i wanted to see if i let's say logged 05:46 into a linux machine 05:47 and had the root username and password 05:50 as nothing 05:51 or whatever information would it be sent 05:54 to the splunk 05:54 son so that's what i went ahead and did 05:56 with a new putty session uh you can see 05:58 that the logs are sent 06:00 to the dashboard you know let's say you 06:02 had 5000 different login attempts 06:04 in two minutes and you didn't have rate 06:06 limiting or 06:07 some sort of control on that linux 06:10 machine that could be a tell that 06:11 someone is trying to break into that 06:13 linux server for instance 06:16 so just want to see you know other types 06:18 of indicators of compromise or other 06:20 types of activities that you could do on 06:22 a linux machine 06:23 so that was just a basic one that i just 06:25 performed there another very powerful 06:27 feature that i 06:28 figured out here of course i knew this 06:30 before but actually doing it 06:32 is you can go ahead and create new 06:34 dashboards 06:35 from the data that is sent to the send 06:38 so for instance you could visualize this 06:40 data so that 06:41 you know you could show in a dashboard 06:43 how many attempts you have per day 06:45 on that linux server with ssh very basic 06:49 stuff here and what you can do is you 06:51 can add new dashboards and you can 06:53 create the different types of 06:55 panel content now i didn't create any 06:56 dashboards because i didn't have a 06:58 sufficient amount of data but 07:00 using a quick youtube search as you can 07:02 tell you can make some pretty powerful 07:04 graphs line graphs bar graphs all types 07:07 of different 07:08 dashboards to visualize your data so 07:10 that was it 07:11 for what i did within this project a 07:14 very basic setup of setting up splunk 07:16 and getting a universal forwarder to 07:18 send data into splunk to search for that 07:19 data all right so that is it for today's 07:21 video 07:21 this actually wraps up the cyber 07:23 security home lab project 07:25 so today's video was pretty basic with 07:28 setting up 07:28 a sem and getting data inside it 07:30 hopefully you have enjoyed this 07:32 series and finally it is time to wrap 07:35 up alright so that is it for today's 07:36 video until the next video 07:38 have a good day English (auto-generated) AllRelatedWatched

YouTube

Read My Stories

Too Long; Didn't Read

Questions about cloud security? Get answers here.

How to Detect Cyber Threats

Too Long; Didn't Read

Company Mentioned

Grant Collins

About Author

TOPICS

THIS ARTICLE WAS FEATURED IN...

How to Detect Cyber Threats

Too Long; Didn't Read

Company Mentioned

Grant Collins

About Author

TOPICS

THIS ARTICLE WAS FEATURED IN...

RELATED STORIES