All right, so we went ahead and set up our powerful lobbying we finalized at the last election.
Now we're just going to download this universal folder so the configurations can take a couple of steps.
We're not going to get all that done in this particular passage.
But, you know, I just want to kind of give you an overview of what's longest.
So this is our security information and it means monitor transmission.
So Splunk, Enterprise Travelers.
This is a paid product.
So we're going to use the trial version of the what it lets you do.
It lets you search, you can analyze, you can visualize all the data that's coming in from all the
components to your infrastructure.
And you take the data from all of your applications, all your devices, anything.
That's a network where he gets funneled into this box.
So it's really, really cool.
And what we're going to do is we're going to download the universal folder.
So if we go to products and then our free trials and downloads, we can grab this.
And the forwarder is kind of a trimmed down version of this black enterprise instance.
And it just forwards data to another enterprise.
And it's really it's just a way of shipping logs from an endpoint you want to monitor to the SIM so
that you can perform analytics, correlations and all kinds of analysis.
What we could do is scroll down here.
And click download now for the Universal Forwarder, you can see here what it does, right?
This is how you send data to Splunk Enterprise.
All right, very cool.
Let's get the latest version.
All right, so if you don't have an account, you can create one here, it's free to create an account,
but you'll need that in order to get the universal photo.
I'm just going to login with mine.
All right, so now what we're going to do is find windows, we've got windows here, so we're going
to get the 64 bit version right here.
Let's go out and grab that.
All right, and let's see if we can also get a VW, get someone to click here.
All right, so we got this w get.
Got this covered to the clipboard and let's see if we can run it.
Power show.
So Windows actually doesn't include full command for it get there is no you get like command for windows,
right?
But it does exist here, right.
So let me show you what's going on.
We do get command or GCM, which is an alias for good command.
I can type command type alias.
And I can see all the Eleusis impartial, if I had the tech name and I put it, you can see that it
is actually an alias for invoke Web request, right.
So really what we're doing is running and retrogressed under the hood.
And so you could just do this part in the dry and run it.
But we don't need to do that.
So I just want to show you kind of show you, you know, how it is working here.
Clear.
So let's right.
Click inside the window and paste it inside one percenter.
All right, we're going to let this download when it's done, we'll be able to install it.
So it looks like this finished sweet.
So let's see if we can find the MSRA package, we've got it right there.
So can we find a move operation?
Move item.
So can we say move item path?
Can we just like move it to a target destination?
Let's see.
Second, I think it did.
Very cool.
So now we can run this Amazigh.
And I know what kind of farce with that will show you how to use power and future lessons that don't
worry about it, at least not right now.
So we're not going to be able to set this up completely because we don't have the Splunk Enterprise
server set up completely yet.
But what we're going to do is go as far as we can.
So we're going to set up an unprincipled enterprise instance, we'll say customize options, we'll keep
it in the default directory.
We're not going to worry about certificates for a lab and we'll install it as local system and whether
we want to log application security and the system log in the set up log is also a good idea.
You don't need all this other stuff.
It just creates way too much noise.
So now we need to create an account for the universe of forwarder.
So I'm just going to create a default account.
Looks good.
We don't have a deployment server, but we are going to have a receiving indexing, so let's just keep
this the way it is for now.
And what we're going to do now is we're going to build out our second PC, which is going to make it
a clone.
Our second piece is going to be just like our first PC.
You know, we're going to set up the logging, all the stuff that we did for, you know, Sismondo,
the Power Sherlockian.
We just need to do that one more time.
And it's good practice.
You know, you want to get you want to repeat, because the more you repeat these things, the better
you'll get at understanding, you know, exactly how your systems are instrumented and how they're set
up.
So what I want you to do at this point is build your second PC and then in the next lecture, you know,
once you're done with that, start the next lecture, which is when we will set up our Windows Server
2019 domain controller.
And by the way, don't forget to take a snapshot of this right now.
So actually control up to escape.
And we can go here and we can say take snapshot
about to install this universal forwarder.
Take snapshot and you can see down here the snapshot state.
Right now, snapshot states with flat definition that we should be good and you may be tempted to open
a library and like, right click and then try to copy the VM or clone it.
Don't do that, because for Windows, it you know, Windows has like unique goods and said you're going
to have, like, duplicate objects when we join them to domain a little bit later.
So we don't want to do that.
So you just have to manually go through the process of recreating the PC, you know, create the PC
to set up all the logging and everything else that you've learned so far.
Then come back and we'll start the next lecture, which is setting up our dummy controller.
So I'll see you guys in the next lecture by.