All right, so on the last picture, we got the juice shop logs ingested in this park and now we're
just going to install the apps and then we'll be done.
And these are apps that are really going to take you through hunting and you're blaming incident response,
all that stuff to the next level.
And so I'm just going to click on apps and more apps.
Let's start with a six month assessment app.
Facebook will install this one.
And these are your Splunk dotcom credentials that you put here.
All right, we will restart later because we have a few to install, will also install the Splunk ad
on for Microsoft this month.
Click, login and install.
We start later right now that we've got this one here.
Let's get the power show logs past.
Hacker Hurricaine Labs add on for windows, partial transcription logging.
All right, and then we need some Windows apps.
So spoke out on four Microsoft Windows.
You want the Microsoft defender ATP.
We want the defender to from Microsoft Defender.
This one is Windows Defender, built into every version of Windows.
This is Microsoft Defender for Endpoint, which is a premium Edgar Eppy, endpoint detection, a response
tool kind of like carbon black crowd strike Phalcon a counter-attack by Gosha Care.
You know, it's top of the line and we're actually going to try to get this installed in the next lecture.
But for this one, we're just going to install the to for Microsoft Windows defender here so that our
defender logs our past properly.
I believe we already installed the SIM.
We did OK, that's good.
And then the last thing we want is the security essentials.
You're really going to like this out.
Security essentials is really, really cool.
Right.
So let's go ahead and restart everything and then we'll come back once we're able to get back into the
portal.
All right.
So we're back after about five minutes that like five long minutes.
Because I was just staring at the screen, so now to go to Splunk Enterprise.
You're going to see something pretty cool.
Look at all these apps.
Pretty cool, right?
So one of my favorites is.
This one, security essentials.
So this is a app, there's a lot of places you can go with it and we're not going to get into the details
over here.
There are tons of free tutorials online about how to use it.
But I just want to show you something.
If you go to find content and then click on advanced detection contact.
You can click on the advanced threat detection.
You can see the security journey, but this is a really fun thing right here.
You've got all these kind of hand searches.
So if you want to look at, you know, basic tour traffic, you know, or you want to detect past the
harsh attacks or, you know, a bit more clearing events.
I mean, there's so many in here and you can just go through all the, like, minicabs, right?
This is all the stuff you can detect just by clicking through these different portals.
So let's say, like I want to look at Windows event, like clearing events first, you can see we are
operating on the live data, not the demo data.
And then it tells you what this does, right.
You're looking to see if the Windows audit logs were tampered with.
Scroll down.
It maps everything against the might attack.
You can click here for details.
And if you scroll down even more, get even more goodness.
So it's telling you you have all the prerequisites, right?
We have the Windows security logs, we have system logs and we have these audit log events.
That's because of the work we did in earlier lectures.
All this is built out.
So now this query runs.
And we can see.
Pretty much what it does, it detected on the Windows Dominque controller.
There was this one one 00 event.
So, you know, this is kind of interesting because, you know, our boxes haven't been exploited.
We haven't ran any attacks yet.
And it's showing us windows a bit more clear that.
And which is perfectly normal in this case, so you always have to investigate everything to make sure
you know that it's actually legitimate or not.
And by the way, some of these apps might not do everything you want them to do.
It might require some tuning.
So if we go back to the app list, I want to click on this map and show you something.
We click on the system on apass blog.
You'll notice that the dashboards are broken, but I want you to see how you can fix it, right?
It's not that difficult.
It can be, but it's not impossible for you to do this.
So you see here, it's saying like waiting for him, but right now, showing you anything, or if you
click on edit, you can edit the dashboard looking at the source.
And if you scroll down the example, you can see the query.
Has this thing right here, it says Single tactics, isman tactic, that's a macro.
OK, so if you go to settings, I believe it's advanced search.
In a search, macro's.
And we'll type in this month, and if you look at the definition and notice, that source type is incorrect.
That's not the type that we can think of for Zisman.
So what we need to do is click this macro and edit it.
Sauce equals Systema.
That's what it should be.
We'll save it and then we'll go back to this morning and see if it works.
Click submit.
Now no longer says waiting for data.
So we're making progress, right?
So what you can do is you can go back to the search your reporting app and back the data summary.
And you can look at the source type.
OK, so we see the source type is actually Sesemann, not source.
There's no source called the assessment, so we should change the source type assessment, but that's
the type click save.
But back over here.
Should get some data and refresh the page so it pulls down the new data.
And we can kind of investigate what's going on here.
If we click on this little search button, you'll see it's actually using the wrong fields in the stats
count because, you know, these apps aren't necessarily developed in concert with the app they're monitoring.
Right.
So Sismondo has its own development lifecycle.
An assessment spot app has its own development lifecycle.
So sometimes the buildings change.
When that happens, you get this right.
But look, we can point this out if he's looking for a field named event description.
Right.
Take this out just from the macro by itself.
You'll see there's no the best description.
Well, it's not showing up here because we're not allowed to change it over to we're both.
Yeah, so you don't see it if we go to all fields and we type description, there's no field with any
description.
There it is.
So it's actually called the description, not event description, so you'd have to modify the app and
change it to description in order for that part of the functionality to work.
But you can see everything else is here for the computers, the messages, everything is being adjusted,
the we want to take.
I just wanted to show you that, and in the next lecture, we're going to we are going to jump in to
Microsoft to the point of.