First, we're going to start with Chicago right now, I want to be able to assess each into this box
from a machine in our last and a production environment, you probably wouldn't do this, but this is
a lab and we're learning I'm definitely going to do it.
So when we go into open sets, first we need to first go to this wizard so we can go next and we'll
keep the hostname.
We'll teach it to me to carbon, like nonlocal, providing us 10, 150, zero, dark 50 and the second
18 we put in there, that looks pretty good.
All right.
So we'll keep the time servers and I'll change the time zone.
To make it relevant.
Cool and everything else in here looks good.
So it's enable secure shall SFH we go to system?
Settings administration.
Scroll down a little bit, enable Chicago permit route and password login save.
Changes have been applied successfully, very cool, so now we just need to update the appliance so
firmware.
Update's.
And we're just going to check for updates.
All right, so we've got some updates here, we're going to install this latest package, so I'm going
to get close.
Yeah, there's a lot here.
Let's get everything update now.
Firewall will reboot directly after this four hour update.
That's good.
In one of its updates, we should be able to assess into the appliance and sort of check up on it,
so let's see, 100 zero, not one.
All right, let's do that.
All right, so it's still up.
And still updating, so we'll just come back once this finishes.
So you guys are a little bit like the connection went down.
And we can just ping the target maybe 100 times to wait until it comes back, and I got that from here,
tech in count number of echo requests to send.
OK, so we're getting supplies into that clear.
All right, and we got the Web interface back, that's a good sign.
It's a lot back in.
All right.
So let's enable a few plug ins.
So we go to system firmware plug ins.
We can type in OS, dash themed apps, rebellion.
That's our dark theme and that's what we need to get configured first os the rebellion.
There we go.
A suitably dark theme.
Yes, install.
Right, that's done.
Let's go back to plug ins.
And then the other one we're going to type in is the telemetry E.T..
There it is.
So what is it like being stubborn here?
And let that rip.
Something's locked up here, so you may need to reboot something before we can do this or putting it
into the box and kill that process.
But in the meanwhile, let's just enable the theme so we can get a system settings.
General, in here, we can change the theme to rebellion.
Scroll down and save.
All right, that looks pretty good.
Now let's check out our services and then we can contract system and go down to services, intrusion
detection and administration.
We just want to make sure it's enabled by mode and promiscuous mode and we get all the blogging we need
for the pattern matching, we'll change this to hyper scan.
And for the interfaces, we'll just keep it up, man, right now.
Now, if you were installing since you just wanted to be on one of these, you can't have it on both.
Specifically, the land needs to be disabled.
If we're not installing Sansei, then you can enable both interfaces.
But since I'm installing since I am only going to enable when and this is for Cerqueira, this section
here, the Intrusion Detection Administration section.
All right.
So this all looks good so far.
I click apply.
Go to download, so we want all these emerging threat rules, right?
We weren't compromised.
We want, you know, emerging ActiveX, emerging chat.
All this good stuff.
Now, this is the free ruleset.
And we tried to install the we're going to install the ETTY Pro.
We'll set in a moment.
But first, let's get the free working.
I'm going to click this top checkbox and then I'm going to say enable selected and then this enabled
column should change from EXIS.
To checkboxes nice.
Mean we should be able to go down to the bottom and download an update rules so it's not installed,
that should change.
Let's give it a second.
All right.
Looking really good.
Let's see if we can go over to rules.
We should see our rules populate.
We got them all here.
These are all of our signatures.
We have tons of them, as you can see.
We've got yet thousands of rules, very, very cool.
And we don't have any user defined rules.
There should be no alerts because we just set this up and that's that.
You can see it is running.
That's what the green box means.
OK, so in the next lecture, we're going to get into the process.
So I'm going to show you how you can set that up and how we can upgrade our rules to get maximum detections
for the attacks we in our lab.
Right.
I'll see you guys in the next lecture by.