1 hour 37 minutes
welcome back to the course will be returning to O S S E C. To gather more. Luxor's in this case will be using Sonic Fall, which is believed to be a type of far will. I have personally not use it, but this is not impede me from unionizing in our exercises. Opiate registers for it. So let's copy and paces into a red X or tool,
you know, to start working with it.
Now, let's try to comprehend what's exactly in this lock source. Lux file.
First, we can determine the date right over here,
followed by an I P.
Could I d
a serial number
the time off the event
firewall I Pete,
you're followed by another lock. Sources
believe a message
source i p source poured
type of connection. And if you wanna call dead and then the same thing, basically for the destination, followed by a particle.
Now, whatever world building Raj exits, we need to take into consideration what exactly we're gonna be building.
For instance, let's bring this little no pad into our table.
Now let's put it on here when it won't interfere. Stretch a little bit sure
fits perfectly, and I'm gonna stretch a little outside of the stream. That what? I can click on it and work back and forward it.
So let's see what type of values I might be able to acquire for her. Right?
First of all
right, things we can gather,
that we can or could together
It's the date.
luck source. As we can see right around here
that this state itself, it's the date for the
entry of the data. Not necessarily when the event cure. Okay, so keep that in consideration. We'll go over this again.
Dirt. If t i t
a place i d
The fourth thing is the serial number
the fifth again, The time
off the event.
Not necessarily the same
We're gonna be seeing
fire while I pee or what? It seems to be the farm while I pee.
will be looking at the message. Now, this will change based on the tool, the application applying. So you gotta be careful of this right
now. Afterwards will be seen the source I p
right, followed by sore sport
and what we can call maybe the type of connection and I apologize for typos over there,
and that's a cola type
And then basically, this same parameters are repeated for this nation. So it will be the destination I p
the destination poured
wth e type. If you want to call it that, I apologize again.
Type of connection and
Now, afterwards, in some of these looks, I'll surely also CIA protocol with the protocol.
Ah, port. So let's site here particle
So after you got all of these, you have to consider what exactly
you want to see when you're building your attics is when you're gathering data and you won't use all of them. He will most likely be using the message really important. You need to know what you're doing or what the applications of the system is doing, right.
So you also need the time.
Otherwise you won't be able to do any correlation. Most likely also did the source. And at the station you need to know what being targeted
in the attack
like animation earlier. The message is also highly important. You need to know what's happening in order to be able to test it right now.
Give it a minute
What else do you need?
If this is the only thing you're watching,
that should do it. However,
if I ever infrastructure, let's say you pulling this into a s. I am that you also need the I d or the type of appliance, right? Something that lets me
validate or see what it's this bringing the data in right? And why do I say this? You want to make sure you don't confuse the fire warlocks with windows Event logs, for example, also for infrastructure has several of the does this device the Syrian A. Knock, for example. Then you will need the device name in order to be able to trigger correlate
which activities being targeted in which it's an external or external
for our, for the purpose of this lesson will concentrate in these first. For that first mentioned, It's like a little space here, and let's start building on register four time
now you can see time. It's mentioned twice here in the beginning, Indian likened mentioned earlier 1st 1 It's mostly related
to when the event comes in. If you can see most of them have very, very similar types time, especially this to However, when you compared these to the time stamps on the right, you can see the actual a few seconds between them. There's most likely it's the cost that
even though the events happened in a constant matter, maybe 234 in the second. Let's say you just put out numbers.
You might not be pulling these records instantly, and you might be pulling a millisecond intervals of five minutes, 10 minutes, 15 minutes, maybe once a day. And that's why you have to be really careful in which time stamp you use. When you were referring to time for the purpose of ethics class. Obviously, what? We're gonna concentrate on the actual time stamp off the event?
No, it's in prior lessons
if we want to capture it. Attempts always important to look
to what is behind and what it's afterwards. We want to capture, and we actually want to build our Reddick space on that.
So let's try something here. Try to build it, Reg IX as much as we can. We don't actually having to type it into the cheat cheat, right?
So first of all, Sierra number, right. We break this symbol
and we type slashed devil plants that waits work since his attributes and letters followed by a space. Right
now, let's feel what's afterwards.
So what's afterwards? It's the far wall, right? Far Will it be so again to space? Far will break the symbol. And this case, it's an I p. So we use the formula for the I. P is correct,
but you don't really need to go that far. Just with the f w should be more than enough.
So now let's try to figure out how to write this little portion over here to portion it the actual time on it.
Like I mentioned prior classes and basically the whole course, there's more than one way to capture this weaken focus. End up,
uh, digits. If you want to call it that way, you know, for to To To to to write for for the year two for the day in the Mont and then to four hours, minutes and seconds and you can see here can also have another turn of using while carts.
Right? And you guys use kept the whole book with a walk hard. So let's try this first, right?
Let's say you're gonna have to write. And this is the 1st 1 Is this actually very commonly used in most of my activities? And you're going to see this immediately? Capture once I pace to here. Perfect, Right?
remember, if you're doing this, you wanna actually capture the specific content which will be here,
Uh, sorry from wreck it
the area. Otherwise, you'll be captured the whole string of deer. So again, this is more towards when you do it in s I am so not necessarily when you do d o p or a double Louis. Say, right, this is more when you want to capture a segment off the whole Ridge IX.
You might also be required to do this in forensic tools, but
I have not encountered that aspect first. I'm mostly used for in six for keyword searches.
Now, let's try to you the 2nd 1
for it is right. We actually have to use the word time,
right? And And just to be honest, we can also use time for the walk hard.
Um, but it's just, you know, we're trying to practise different concentrator and that one very important thing it's in order to reduce the amount of the data for you. For example, we were capturing time. And we just want to capture this segment that we actually have to put also de quotations in here. Okay,
you gotta be very careful. Like I said,
we'll build it as s Miguel's. Obviously, there might be chances off what we record to troubleshoot. So let's update this right here
and let's cover the 2nd 1 and built a 2nd 1 together.
Now, Like I said earlier, we're gonna focus in the in the digits. And obviously, as we focus on the digital need to break these special symbols,
we're gonna keep this in here
again. This use focus on building, and then we can move to have brackets out.
No, actually, no. Never mind. Let's just not completely
I just need them. And that started to write
the magics again.
Since you already know howto build him
from the previous one, we're just gonna literally right thumb from here. So it's four digits for a year
and then being lazy, let's copy paste is and then two digits for
the day flash month. So this copy paste is twice
right, and it once you eliminate the symbol
Boom. There's the date.
Now I want to add a space right and that we could do it with the time of the day.
So it's too
All right. So paste it
break the symbol for colon
two for minutes on. That's at seconds. And there we go. And like in our previous instance, right
for the brackets. Put something afterwards in order to reduce the amount of errors. Yes. You can put the, uh, equal symbol you can leave it out
again, will practice in different concepts in order to get the best out of this course.
Now, once you get here,
you basically have to implement little brackets, like always. If you're a s i e. M type of environment.
So we would put this around here
here if you want to capture the date.
here, if you want to capture the time
when you have these two, basically
you allowed to do this and you can just separated in your suffer and capture groups. Right?
Um however, let me show you. Actually, this is curator. This is Ah. Scient might personally uses an image from Google,
and you can see here in the bottom, left his capture group So you can tell him, Hey, I want you to cover the first group or the second group,
and, uh, that's basically house changes.
Now the theme would capture groups. Is that like an mentioned prior instances, it is way better to write to sink Texas instead of one again.
It's easy here for the software and the appliance to Reed's two separate sentences of Red X is off then one. It's just the appliance I've personally used.
Maybes belong. Maybe tools that I have not personally used might be ableto work differently, but again that once I have used worked like this.
So let's go back here.
I believe that's it. You already know how to capture either the time or a date, and you can basically break it to telling it the capture group.
Let's go over more. No more sources. In a few seconds