All right, so in the last lecture, we set up Sensage and now we're going to instrumented open sets,
so we need to ship our logs into them so that we can look at Alert's we look at the rhetoric and monitor
our tax time and learn and find ways to respond and adapt.
So we're going to do is we're going to go to Splunk, you go to Spike dot com and you go to products,
you scroll down to free trials and downloads to take you here.
And you just go down to the bottom and you click on the Universal Floetry.
You could download now and then it's going to lock you up.
Well, you need to login with your credentials, which is free.
If you don't have them, just click free Splunk and create an account.
And when you get to this page, are we going to go over to FreeBSD?
Because that's what open since users and we're going to download the state zip file.
So we click download now.
And then we can copy this command so we can click here and we can pull this down from the appliance.
Right.
Let's flip over to the appliance or we can do it here as we open up the command line and we can, as
I say, Jen, as Route 10, 100, 01.
Right, well, press eight to go into the shell, right, and then we should just be able to right.
Click to paste this in just right.
Click inside the window present.
Presenter We getting that out.
That's interesting and good.
That means that open senses hardened by default.
Right.
Because a lot of times attackers will use tools on the victim workstation, such as you get and Kearl
to copy over their attack tools from the attacker machine into the victim post.
And so by removing Weskit and Kearl and similar tools, you are essentially making more difficult for
an attacker to compromise your appliance.
So I'm happy to see that open since has a disabled by default.
But what we're going to do is we're going to install a package install we get.
All right, Jeff, we want to install it very good now we can press up twice and we should work and
it does.
Beautiful.
All right, now that we've got that in our root directory, this is the directory for the user root
nut slash, which is the root of the file system, if you need to know the difference and you can look
at my LERN Linux fast course, which goes into the details of the differences between root and root.
I know it sounds it sounds ambiguous and it kind of is, but it's not that complicated.
All right.
So now that we've got this downloaded right here, you can see I can read file against it.
So it's an XY compressed data.
So what do I want to do?
I want to extract it to extract the zip beever both for this file has tapped to complete.
And where is it going?
It's going into root directory.
So now I can going to opt yes, and it's there, so I should be able to go in this punk band and from
here we can run the executable.
So I'll type Splunk start except license test for that.
Right.
I think I did just like to license.
All right.
My administrator username will be adamant.
This is for the universal voter type in a default password.
It's relatively weak.
How would you like to change the ports?
No, I would not make.
Port has already bonded.
Eighty eighty nine, so it's in us that's that panel grep eighty, eighty nine
that's dead.
It is.
All right, grab eighty, eighty nine.
Not showing their.
So I found it here.
And let's see if we can kill this process pide.
Seven, six, three, 29.
Now, will it work as both except license wrong, too, except license?
All right, it looks like.
It kind of work, did it done?
So I still talk about something, but he's still completed.
I don't know what's up there.
All right, so we got past that part.
Let's go ahead and set Splunk to start one boot and evil boot start get access to Ask.com.
No such file or directory.
OK, I'll make it.
And then you have to be a little creative.
Now let's try it.
Yeah, it looks like it did it.
I don't understand Linux and spunk sometimes, but we got around that so that we can look in that file.
It should say like Splunk started here.
Oh see
there's a lot of text in here.
Yeah.
So.
Yes, OK, so generated by smoking, able to start, so we are good there, and if you're wondering
how I'm doing all this great magic and all that stuff, don't worry, that's in my spot in my Linux
world, Linux fast core.
So I'm not going to get into all that.
This, of course, is complicated enough for me to teach you the ground basics of my next right.
So let me check out that course.
If you want to go deep with Linux itself right now that we've got that, let's clear the screen and
let's now what should we do next with Eddie Forwarder?
So speak at forward forward server 10 100 zero ninety nine nine nine seven is the default port and the
credentials will set up for me at least quadripartite password.
What do you think should be wired?
This all makes sense in later lessons when we set up Splunk.
All right, what's this thing?
Oh, you know what, it timed out because it couldn't actually make the ATP Request to the server.
I think that's why it's valid, because it's like, you know, trying to ping an address.
It doesn't exist.
So we might not be able to go all the way forward with this.
What we'll do is we'll leave off here for the limitation and then we'll pick up the rest of this.
Once we actually get our indexers up to in the next lecture, we're going to move into setting up our
juice shop virtual machine.
This is our portable webcam.
And then after we get that set up, we put smoke on it.
Then we will set up our Splunk index indexer and everything will come together as one big piece.
OK, so I'll see you guys in the next lecture by.