Time
6 hours 28 minutes
Difficulty
Intermediate
CEU/CPE
7

Video Transcription

00:00
in her last lesson, we were building up to Rogic's. In order to capture those custom properties, we had to take a short break. However, let's continue where we left off.
00:10
Now
00:12
I just mentioned you can actually modify it,
00:15
right?
00:16
So you can come here
00:19
erratic ce again,
00:22
right? And then that expand this again so I could see more. There we go.
00:31
And there we go. Never gonna do Let's say source port right here. So I'm gonna call it P f sense
00:41
source point,
00:43
and I'm gonna show you how capture works room now.
00:47
So you have one friend. ISS is here and the other one here, right? And that's why I was talking about that We can actually modify. So if you come here
00:57
actually added a wrong, then we'll apologize.
01:03
And this can actually gonna do
01:06
this is well right. You can see
01:10
marking this one. However, if we change to capture group to capture 22 you see it now captured the source. I s or support. I apologize. And if you go to three, it captures the destination port so you can see that you can actually use the same Roger can just change a little valley at the end as well, and it's a good option a swell to do this. So
01:27
in this case, for example, I can copy it. Is it too? Because it's gonna be a sore sport, right? For PF sends
01:34
it's safe and then you can literally come again.
01:38
It's gonna be like a fast value at the tragic
01:42
call it p f sense
01:48
destination poured. And then here come 23 test. It's working, and you're gonna make sure
01:55
on the tom it's highlighted. And this is itself highlighting. I don't have any search functions, as you can see, And then it's safe. And now you can see that you're getting 1234 different values, right? The other thing, we gotta search it. Search for the action itself, in this case, the action being blocked. Right?
02:14
So let's go back to the D. S. N.
02:17
Apologies a customer even extract
02:22
spend it.
02:24
I'm gonna do PF sense action, right? In this case, we can type the whole thing even though we're not gonna use the holding because technically, we have to get up to here and the last thing's curator process the battery in my opinion so I can come up to here, for example,
02:44
and stop this and see how much it attacks. And that's pretty good. Let's remove two more.
02:51
Yes, to be safe.
02:53
So around here and elite, I like to leave the coma in their ***, A lasting to the tack
02:59
of that way.
03:01
Um, uh,
03:04
it doesn't keep searching for more information. You have found the coma. That's it. It's not gonna be like a W. Plus, this is all that's a lot of characters. No,
03:10
stop in a coma if there's a space. Even better in many, many software do have spaces when they're sending sister locks, and I will use this space itself to determine where a variable lens. So now we have it here, right?
03:25
You're gonna add that capture group right here.
03:35
You actually wrote that by accident?
03:38
Unseen.
03:43
You're a period for some reason.
03:46
Yeah,
03:47
block right. Test it, Detective. I know it's on the top, always attracted,
03:54
and it's safe. And now you should see the action source poured Destination port sort sport source. I pian destination. I pee into default domain and this basically it to wrap up for how to create custom properties. Now, obviously, if you go back to return to event, lose right
04:14
when you come here, you can now see,
04:16
you know. Here.
04:18
See, it still says this, but if you come to at it, search right.
04:26
And the second front to load
04:30
it's taking a little bit longer than a second. There we go. And we're gonna do
04:38
It's just keeping us is five minutes. Right? And now here, we're gonna search for a p of sense,
04:46
All right?
04:46
And all of these variables we're gonna add in here.
04:49
Okay, So I'm gonna grab all of them
04:53
and put him in there and then all of them
04:56
and moved him up. Up, up, up, up, up, up, up, up.
04:59
Right. Except one thing I do want to have in the top is e start time,
05:05
all right?
05:06
And that's its search.
05:09
And you can see I will perform the surge. And here we go. And here's itself how you can see the
05:16
curator data formatted to RPF sends so you can see the answers in actions block from this source. I p to this destination. I pee. Sorry. Destination port. Ah, source Port start sleepy. Now, if you don't like the order, you can always come back and its search
05:34
right. And here you can. Don't say OK, I want to see the source. I pee first.
05:39
So our sleepy following a dissonant bite. A sore sport? Let's see,
05:43
followed by the destination eyepiece alibi, the destination port and the harder I want youto action beginning or the end whistle I want It's the first thing I want to see. So let's go with port
05:54
and then search again.
05:58
Here you go, Right. Sore sleepy source. Forward Destination I p Destination poured and named Locke sorts, et cetera. You can see you can play around. Once you do that, you can save the criteria. You can say this is P F Sense.
06:14
All right, you can, including a quick search chair with everyone, in case somebody else wants to use that really time because you want to see the real time you can set. Ask your default search. That way, whenever you come into lock searching, you see the PF sense log. Okay. Now one of the pros and cons. That's obviously that this is very specific for this,
06:33
and obviously,
06:34
if you have other locks, sources And obviously you won't see the data or the eyepiece will not match. And therefore, that's the option of the universal, the Ascender you can create
06:45
Farmer. This is the wrap up for today and carry on.
06:49
What did we learn today? We created custom properties for new Luxor. Speed of sense. Inside Curator.
06:56
It took a little bit of building using Rand Texas.
07:00
And if you're not familiar with them, I highly recommend the Reddick scores on some Red X tutorials.
07:06
In order to build these custom, Red X is in your own environment.
07:11
In our next lesson, we're actually gonna go over and used a custom to you send for P f Sense. You will notice that this integration it's more complete and better overall for even correlation
07:24
Hope to see soon. Have a great day.

Up Next

Building an InfoSec Lab

This course will guide you through the basics of incorporating several Information Security Engineering Tools in your home and/or lab. By building this lab you will be able to obtain corporate-level security within your home network, as well as a higher understanding of the capabilities and advantages these tools bring to your network.

Instructed By

Instructor Profile Image
Kevin Hernandez
Instructor