All right, now that we have set up and ready to go, it's time to jump in to.
So we love to paint.
I can click something and it's going to take me to a set up whether I click on Dashboard to start.
All right.
So they hit us with the licensing lawyer lingo legally stuff the end user license agreement.
You should read through this, but I'm just going to go to the bottom and I'm going to say, yes, let's
go.
All right.
So this part, it's just doing the hardware check into.
The main thing it's looking for is your memory.
You remember when you sense that you need at least eight gigabytes of RAM apportioned to your open sense
virtual machine.
All right.
So we're good there.
The CPU, we've got it.
Amber checkmark.
As long as it's not an X, we're good to go.
So we're going to click next and she's going to move us through this list of tabs.
So we're going to install a local Mongo DB.
Database, which is kind of.
Redundant because DB stands for database, but anyway, I've got an install that.
I'm going to let this rock come back once it finishes.
All right, that took about five minutes, a solid five minutes.
So I'm going to click next.
And for the interface, we're going to leave the deployment mode to routed mode.
And then we're going to add this interface.
Now.
This only works because if you go to where is it, I don't want to leave the screen, but earlier in
the earlier lectures, I told you, when you're setting up Surakarta, when you're actually setting
up the firewall and the intrusion detection set piece, you only want to enable one interface.
You don't want to enable both.
If you enable both, then you can't run since.
And it actually gives you an error message telling you you need to disable one of them.
I hope that's not too confusing if it is, just go back to it's two or three lectures back when we talk
about configuring Sakata and the intrusion detection piece.
All right.
So we should be good there.
We're going to click next.
And this is a cloud reputation servers that we can use, so basically the nice thing about Sensa is
it's like a poor man's Palo Alto network firewall, right?
So it can go out and look at the cloud, a reputation for, you know, any other URLs that are being
accessed in your environment.
And if it has a negative reputation, it can deny access.
That's pretty cool.
The local domain name to exclude from cloud queries would be Kalvin.
Like that local.
Right, that looks good, next.
Right to health check is good.
Like green deployment, science is going to be home for me.
I have a maximum of 15 devices and slap right?
Not even that much.
We're done.
I don't need to put my email address in.
I don't like spam, so I'm going to click finish.
All right, let's hit refresh.
All right, so we're not going to purchase the subscription and we're just going to do this on the cheap,
although there is a premium option, if you wanted that, I'm not going to dismiss here.
And I'm going to dismiss this one as well.
And this one and if you scroll down, you can see we've got the sense packet engine and maggoty be right
in the cloud and it's actually stopped.
But here's the thing, right?
You can actually put this thing in bypass mode and this is what you might want to do when you're running
a red team engagement to get your lap.
That way, you can see what would have been blocked by a blue team in your infrastructure.
So that's kind of cool.
So we'll leave that stopped.
The key thing I want to show you right here is reports to when we go into reports, there's a lot of
U.S. goodness.
And, you know, I love this screen.
There's a couple of spins, like a reports and policies, but let's think of reports first.
All right, so first we look at Hildur.
You can filter by all these different categories, right, so you can look at HTP version and you can
filter by a specific DNS query or a operating system, right.
The user agent stream, you know, maybe, you know, all your endpoints are using Windows 10 and you
can search for user industry.
That's not Windows 10 to find something bad.
And even applications you can look for rogue applications.
Right.
That equals equals.
And you have some logic you can put there.
But these built-In dashboards are really sweet.
So you get app categories, breakdown by the different applications in your environment, top local
hosts, top remote hosts, top egressed users.
And right now there's not a lot of traffic here.
Because we just did it up, but one of my favorite things to look at here is down here, OK?
Yeah, I like the top destination location because obviously if you're communicating with a server in
a country that you typically don't do business with, that could be a concern.
The Egressed new connections heat map is kind of nice.
And then you can see a list of all the apps, right, so we've got Microsoft Defender, which is normal,
right?
But if you see an app in here that does not look normal, then that would be cause for concern.
YouTube, you know, this is all legit stuff because we just fired up our lab in the top reports.
Right.
We saw like four four four five or nine thousand one or one three three seven.
You probably got a show on your network somewhere and you've been hacked.
So is it even a table of the remote hosts?
You can see the number of bytes that were sent out.
The cool thing here, I don't keep saying the cool thing is so many things, but you can actually look
at the live sessions.
You go to live session explorer.
You can see the sessions as they go out and you can actually set the refresh in a role that you can
search by different things like the source IP or whatever.
You know, it's a nice little graph.
So if you don't want to set up Splunk, you could just do all the work in this dashboard and you could
be very productive.
I mean, as you can see, you can filter by all this stuff.
It's crazy, right?
I can take my refreshing well, you know.
Of course, it's going to put a bigger load on your system to lower the refreshing level, but that's
kind of cool.
You can also search for different things inside this box.
You can choose which columns you want to see.
I mean, look at all these columns.
It's bonkers, right?
I mean, it's just absolutely amazing, all the information you can get in here.
See if we can close this out.
That's pretty cool.
Then you can go through threats.
You know, again, you know, just really explore this now we have no threats detected, but you should
see, you know, when you start running attacks against your environment, if any of the attacks are
detected here.
Right, then you can try to find ways to bypass it.
You can look at all the traffic that's been blocked.
You can also look at the live blog sections, explore so you can see live blocks out there happening.
I mean, this is a fully functional Next-Generation Firewall, guys.
I mean, it is really impressive.
So you have the hardware to set up since I strongly suggest that you set this up in your environment.
I mean, look, you can look at DNS query distributions if you see any anomalous queries or queries
to a location that you typically don't visit, maybe they're at the long end of the graph.
Then you can now look into that other thing that's really interesting at the policies.
So we typically there's one thing we do want to enable here.
I want to enable and if the malware piece.
So when you go into the policy section, you can look at this policy here.
You click actions.
And you can see right now essential security is disabled, so I'm going to enable block malware, block
phishing servers, block spam sites, block hacking sites, right block park domains, all this stuff
is getting enabled.
They've got some advanced functionality on the right side, but you can't enable that for free.
You need a premium subscription for that.
But you can see all the stuff that you could do if you paid extra, which just kind of cool, say these
changes.
Finally in app control, well, not really.
Finally, but you can actually.
See, all different applications we go, all the different applications that you're able to detect and
these are all subfolder, so these are grouped into smaller folders in here.
Because a lot of intelligence of different apps, right?
You've got Cisco, WebEx, Zoom, you know, Microsoft team.
These are things that you can actually block and detect and respond to, which is really, really nice
in each of these folders, has even more apps contained inside of them.
And then the web controls right now are set to permissive, if you want to go custom, you need to pay
for that.
That's a premium option, but you can change it to moderate.
You just want to block like adult sites, advertisements, things like that.
And then you can even send it to high control blocking your right.
So very, very capable product.
I hope you guys see the utility of Sensa in the next lecture.
We're going to instrumented our clients with this fourth quarter.
Don't worry, we're going to get to the point of setting up a router, but we need to at least get a
square on the box and get it partially set up.
So I'll see you guys the next election.