Time
6 hours 28 minutes
Difficulty
Intermediate
CEU/CPE
7

Video Transcription

00:00
Welcome back to the savory course in building. You're in for a sec lap. I'm your host and instructor Kevin Hernandes.
00:06
Blast lesson. Well integrated pf sense locks into curator and created it as a universal GSM luck source
00:15
in today's lesson actually gonna start creating custom properties for RPF since locks we thin curator.
00:22
Now let's get started.
00:25
Last realists off. We basically integrated pf since logs through. Curator We had a status
00:34
system logs
00:39
settings
00:40
right here.
00:44
Even though we incur incorporated these logs
00:47
into curator,
00:49
you have to do it manually through the universal log D s. Um,
00:54
that's a scene on the screen
00:57
now, even though we integrated these one of the issues is that it is not properly formatted. The reason we have to create either a universal
01:07
the ascend four p of sense I know scramble of words, right? Or we have to create custom variables. Now, let's go ahead and posit We're right here.
01:19
So we pause to capture from curator hitting the pause button on the top right corner.
01:25
And now we're gonna open a P of sense event such as this one.
01:30
There we go.
01:30
Yes, you can see
01:33
you have information here,
01:34
but not much to do. Now,
01:38
that's a mention. In the last videos, we can create
01:42
a new GSM right, or we can actually extract barrels from here.
01:47
Let's go ahead and show you the extract properties or create custom Bibles for this option. 1st 2 status.
01:55
So,
01:56
yeah, let's go down here to locks again.
01:59
Right.
02:00
And here are the system looks now, obviously, you deaf system. And we also have the far wall. She's the ones we're looking at, right? So one good thing we're gonna do here is we're actually gonna take a swan screen shot of this
02:13
and then compare it to what we have here.
02:15
No,
02:16
I also do a side by side, if you like.
02:21
I didn't come here.
02:23
Shrink this a little, and then come here.
02:30
Put them side by side.
02:32
I can also work.
02:36
It's up to preference.
02:38
So here, Right, you have the date or time, right?
02:44
Have the rule. Are pretty sure that's what it iss. And then you can see
02:47
her. Cyril values right.
02:51
Such as
02:52
filter long. Five.
02:55
Several values, right. Interfaces match block. Right.
03:00
So in here,
03:06
if I expended a little
03:07
All right, you can actually see some of this information.
03:12
However, it's not in the second order. So you gotta be aware of that
03:15
when trying to match one toe, One the information. Okay,
03:24
so
03:25
let's go back
03:27
and see the other one.
03:30
That one thing you can do,
03:31
you can right click here
03:34
and you say
03:36
filter on lockers is P f sense. Unless add the last 15 minutes.
03:42
And there we go. We have a lot more data to play with.
03:49
Okay,
03:50
here we are.
03:52
Right.
03:53
1 20 So let's try to find
03:55
thes event in there,
04:01
Okay?
04:02
Once I went to dynamically. Um, is there a normal view? Was able to find
04:08
1 2050 to 1 52 15
04:12
Right here. The port for 4193
04:15
Great.
04:16
Whoops. Sorry. I'm sure I did that.
04:20
I'm gonna go ahead and search for it. It for 4193 Right.
04:26
And you have the porter here.
04:29
You can see the 32 80 Here. You see the 30 to 60 m sign right here, and you can could get a general idea. Now, why this one? And this is what we really wanted to do.
04:39
So let's go ahead and copy
04:43
this over here
04:44
and Alice to extract property.
04:47
That's why for it to load
04:49
I want to do is create custom barrels. For these is to show you how we can do a couple of, um regarding curator. Right. So we're going to extraction base, right? Test feel it's where are pale is gonna be. In this case, you can see actually pasted it in here, so I don't have to do too much. Now here comes the exact new property. This case, we could
05:10
create one cold.
05:11
Um,
05:13
here. Right source. I p just 1 20
05:17
right?
05:18
So you can call it
05:21
source I p
05:24
maybe actually at a p f sense. And the reason I like to do p of sound source I p
05:30
because that way, if you're trying to use your psyche for something else, you don't. All right, You're certainly be for everything else. Okay. And for me to say, this is the source i p
05:41
for he have sends.
05:44
Let's scroll down a little. I'm gonna actually
05:46
creases sign of this. A little
05:48
fits. You guess It's a universal descend lobsters. You can actually attach it to be a sense itself. even need. We can actually jump into that later on. But right now I'm gonna show you how to you. Simple right, Jax, to read this data. Now, if you taking my course and Reddick, you already should be a little bit familiarized with this.
06:09
Otherwise, I'm gonna do
06:10
ah, little quick and true about it. Not too complex right now. You can see you do have to bracket. Now, if you want to get the date,
06:19
we can actually start from left to right, or we can actually start with the i p. I got ready stated. So
06:29
the problem if we start here, is that when you have to create this portion under Rogic's for all of these,
06:34
right and it's a lot of information, to be honest with you.
06:40
So what you can do is we can start instead around
06:46
here,
06:48
great.
06:48
And the reason I say it's we concerned around here is because it's not that hard or we can actually use this colon.
06:57
The reason I mentioned a Collins because it is the last colon there is, and therefore it shouldn't be that hard to play around with. So let's start with that colon right and it's been detected, followed by
07:09
let's say a little bit bigger now. I can see So the colon, Right. And you can see there's one,
07:15
two,
07:16
three different Collins. Now, the difference is you see carefully here.
07:20
This one has a space afterwards. So we're gonna use that
07:24
to Reg IX scenario. We're starting right now. There could be a dot or not, um, you know, digit or not. So in this case, what I'm gonna do is we're gonna create a
07:35
while card.
07:38
All right?
07:39
You're gonna say cute for cannot be there. Right? And they were gonna do a coma.
07:46
What a wild card I can or cannot be. They're actually going to repeat this several times
07:53
until we get
07:56
to everyone. And then here, for example,
07:59
You have digits, right? So it's a slash d plus. So you cover all those numbers, then you do another coma. In this case, it's a word,
08:09
right? Causes the interface so you can do slash
08:11
doubly. Pull us right. You're actually going to repeat this? Same one several times now,
08:20
Mom.
08:20
Um um
08:24
um you see,
08:26
it's gonna be a little bit long,
08:28
but it's gonna be okay.
08:31
Isn't something.
08:35
They're right.
08:39
No,
08:39
period.
08:54
Uh, slash Totally
08:58
plus
09:00
flush
09:01
Kuma.
09:03
Right?
09:03
And then you can say
09:07
Molly or no Valley slash did it? Plus,
09:16
because
09:20
coma
09:22
Flint digit plus
09:26
coma
09:28
Such teaching. Plus, they're gonna keep repeating these. Okay, Until we get to the point where we want to reach right slash w
09:37
it was
09:39
You can see once we go to the d S m, it might be a little bit or a lot cleaner,
09:45
so
09:48
you'll be happy then
09:50
coma. I slashed w plus for a TCP
09:56
Kuma
09:58
flash d plus
10:01
another coma and he usually actually gonna have to source i p.
10:05
So
10:07
here's where we do the capture. Now, before you do the capture group, one of the things I'm gonna recommend, it's for a ride the whole
10:16
thing up to maybe hear the destination port. Okay.
10:20
And the reason I say that is
10:24
you can then use the same rejects for everything you're gonna do instead of having to rewrite everything again and miss up because you forgot where to capture proper capture groups is okay Now for the I P addresses itself. You. It's very right at Radic specifically for it.
10:43
And I'm actually gonna open my note pad
10:46
for dad.
10:50
Okay, Not for eyepiece write. What you want to do is you're gonna have one digit
10:56
indeed. It from 1 to 3 digits, right? You're ever gonna have a period.
11:01
And this is basically destruct for an I P. And you got that
11:05
four times, right? Not only for periods. And if he's copy and paste is in there,
11:13
hopefully should work that. There we go, and then you do
11:16
another coma and he pays another. Oh, does write another coma. There's one poor, another coma,
11:26
nursey, other port. And let's leave it at here for now. Okay?
11:31
And this is gonna be our red IX. Now, what if you're gonna say OK, but didn't you just said
11:37
why not
11:39
do one Red tricked itself for everything instead of searching for this? Yeah, you could do that. And if you want to do that, what you have to do is then, instead of starting from here, you will start with this bracket and then do slash w plus Sorry. Move every little space or no space slash d +122
12:00
space or no space and slash de colon slash t to colon slash me too
12:05
space and then the work, right? So the way that will work is
12:13
it's such
12:15
mom. And then you're gonna say
12:18
flash double year three.
12:22
All right.
12:24
Space slash d, too
12:31
space
12:35
slash d
12:37
two.
12:39
Colon gonna have copies two more times.
12:43
So the two. D two, this is a space
12:46
slash doubly plus slash colon. Right? And if you copy this right in the beginning and hopefully Adam break in
12:58
up to here.
13:01
All right, you shoot now, see? Everyday. Let's see.
13:09
Wants it backwards. Copy this first.
13:15
There you go.
13:16
Stretch it so I can see everything.
13:20
And then it should be from here on.
13:26
So let me taste it again,
13:31
is
13:33
and their theory.
13:35
So let's test us.
13:37
But if it doesn't work, it's because we mess up the beginning. Right?
13:41
So
13:43
there we go. No sleepless to lead
13:48
these.
13:50
Okay, so we got three.
13:52
We got a space.
13:54
Yeah. Two digits
13:58
without a space. You got two digits.
14:03
Colon,
14:07
we got two digits.
14:07
You got a colon.
14:09
You have two digits. You got a space?
14:13
We have a word. We were calling. We got a space.
14:16
So that's to the phone.
14:20
I think this is a problem here If we do this in theory,
14:26
and you can see why I wanted to start with the colon, right? Not the beginning.
14:31
And that's weird, right? This manually, actually. So you can test it
14:35
every game, so you can see we're gonna type exactly the same tree.
14:41
Three. Space,
14:45
two
14:46
space,
14:50
two
14:52
colon.
14:56
Two,
15:00
huh?
15:01
Okay.
15:03
Cheerio.
15:05
Colon.
15:07
Two
15:09
space
15:13
word.
15:16
Cone
15:18
space. Right.
15:20
Copy this and put it right
15:28
here. Right. Which is where we had the other one.
15:35
You see, I actually have a never
15:37
Arrgh!
15:39
Oh, here. I forgot to break the digit. Okay, so that's the error I type. I apologize for that.
15:46
Now, we know if we actually
15:50
do it like this,
15:54
and then
15:56
copy this
15:58
on pace to here. There we go. Covers everything right. And if you want to add the other numbers in the beginning, and you can actually do it
16:12
and I say one through four and there we go. Okay. And that's how wretched works. Now,
16:19
we haven't actually captured a field, and that's what we're gonna go to now. And you said I p and we're gonna to source like people. She's gonna beat this one, right? So in this case, let's go back here
16:30
to the Raj ex Rain.
16:33
We're gonna look for this air right here, okay?
16:37
And you start a captured group before, after the coma,
16:41
right? Which is
16:45
right here,
16:45
right
16:48
after the coma before the did it. So open parentheses
16:53
and go to the last portion
16:56
and close the currency, which is a captured. Right. And you can see in the top. It's already being highlight. That's how you know it's gonna work. Have you test? Yes. In matches, Then it's safe.
17:08
Copied is real quick. Before we hit Save
17:11
not in there,
17:15
it's safe. And now you have a source. I p
17:18
right there. And if you see it now, it's gonna add the violet right here in the top. This is all kind of a lot of work. Have to do that mentally for each field. Yeah, but technically, already did the hard work. So as you come here
17:30
right and apologise, it's so big now, it's just, like wasn't able to see the screen earlier. But then, you know,
17:37
summation. I p right.
17:41
And what you're gonna do is literally time heretics in there and you can see it's capturing that group. You already know where to search
17:49
on here. Stunt
17:51
first parentheses.
17:56
Here's the part of it. And you can actually have both if you prefer,
18:04
right and just change to capture group.
18:07
And I'll show you how to do that in a second. Okay.
18:11
Sorry. That's in the wrong place. Insurance before
18:15
assemble. Okay.
18:21
There. You see, I'm missing one
18:23
of the digits, so let's go back.
18:26
And that's why it's so good to do this here like that. And you can see there is destination I p sir, uh,
18:34
test. Right.
18:37
You see, it's matches and okay. And safe. And now we have destination. I p it appears up right. And this is the whole thing. I'm suspension earlier. You have to
18:48
three of Sands Destination I P.
18:52
And that's because otherwise it's over, right? Other destination eyepiece. And once you load it, you can see it right here as well.
18:59
Now,
19:00
I just mentioned you can actually modify it,
19:03
right?
19:03
So you can come here
19:07
and their attics again,
19:11
right? And then that expand this again so I could see more. There we go.
19:19
And there we go. Never gonna do let's say source port right here. So I'm gonna call it P f sense
19:29
source point,
19:32
and I'm gonna show you how capture works room now.
19:36
So you have one friend. ISS is here and the other one here, right? And that's why I was talking about that we can actually modify. So if you come here
19:45
actually added a wrong, then we'll apologize.
19:52
And this can actually gonna do
19:55
this is swell, right? You can see
19:57
marking this one. However, if we change to capture group to capture 22 you see it now captured the source. I s or support. I apologize. And if you go to three, it captures the destination port so you can see that you can actually use the same. Roger can just change a little valley at the end as well. And it's a good option a swell to do this. So,
20:17
in this case, for example, a comet is it too? Because it's gonna be a sore sport, right? For PF sends
20:22
it's safe and then you can literally come again.
20:26
It's gonna be like a fast value at the tragic call it p f sense
20:37
destination port. And then here come 23 Tests. It's working and you're gonna make sure
20:44
on the Tom it's highlighted. And this is itself highlighting. I don't have any search functions, as you can see, and then it's safe. And now you can see that you're getting 1234 different values, right? The other thing, we gotta search it, search for the action itself and in this case, the action being blocked. Right,
21:03
So let's go back to the D. S. N.
21:07
Apologies. A customer event extract.
21:11
Spend it.
21:14
I'm gonna do PF sense
21:17
action, right? In this case, we can type the whole thing. I know we're not going to use the halting because technically, we have to get up to here and the last thing's curator process the battery, in my opinion, So I can come up to here, for example,
21:33
and stop this and see how much it attacks. And that's pretty good. Let's remove two more.
21:40
Yes, to be safe.
21:41
So around here and elite, I like to leave the coma in their ***, a lasting to the tack
21:48
of that way.
21:51
Um uh,
21:52
it doesn't keep searching for more information. You have found the common. That's it. It's not gonna be like a W. Plus, this is all in. It's a lot of characters. No,
22:00
stop in a coma if there's a space. Even better in many, many software do have spaces when they're sending sister locks. And I will use this space itself to determine where a variable lens. So now we have it here. Right?
22:14
You're gonna add that capture group right here.
22:22
Do you actually wrote that by accident?
22:27
See,
22:32
you're a period for some reason.
22:36
Yeah,
22:37
block. Right. Test it, Detective. I know it's on the top. Always attracted,
22:42
and it's safe. And now you should see the action source poured. Destination port sort sport source. I pian destination. I pee into default domain. And this basically it to wrap up for how to create custom properties. Now, obviously, if you go back to return to event, lose right,
23:02
then you come here. You can now see,
23:04
you know, Here.
23:07
See, it still says this, but if you come to at it, search right.
23:15
And the second front to load
23:19
it's taking a little bit longer than a second. There we go, and we're gonna do
23:26
It's just keeping us is five minutes, right And now here we're gonna search for a p of sense,
23:34
All right?
23:36
And all of these variables we're gonna add in here.
23:38
Okay, So I'm gonna grab all of them
23:41
and put him in there. And then we're all of them
23:45
and moved him up. Up, up, up, up, up, up, up, up.
23:48
Right. Except one thing I do want to have in the top is e start time.
23:55
All right?
23:56
And that's it. Search
23:57
and you can see I will perform the surge. And here we go. And here's itself how you can see the
24:04
curator data formatted to RPF sense. So you can see the answers in actions block from this source. I p to this destination I pee. Sorry. Destination port. Ah, source Port start sleepy. Now, if you don't like the order, you can always come back and its search.
24:23
Right. And here you condone Say OK, I want to see the source. I pee first.
24:26
So our sleepy following a dissonant bite. A sore sport. Let's see,
24:32
followed by the destination eyepiece alibi, the destination port and the harder I want youto action beginning or the end whistle I want It's the first thing I want to see. So let's go with port
24:42
and then search again.
24:47
Here you go. Right. Sore sleepy source. Forward Destination I p Destination poured and named Locke sorts, et cetera. You can see you can play around. Once you do that, you can save the criteria. You can say this is P F Sense.
25:03
All right. You can, including a quick search chair with everyone, in case somebody else wants to use that really time because you want to see the real time. You can said Ask your default search. That way, whenever you come into lock searching, you see the PF sense log. Okay. Now one of the pros and cons. That's obviously that this is very specific for this.
25:22
And obviously,
25:23
if you have other lock sources and obviously you won't see the data or the eyepiece will not match, and therefore that's the option of the University of Sunday. You can create
25:33
Farmer. This is the wrap up for today and carry on.
25:38
What did we learn today? We created custom properties for new Luxor speed of since inside curator.
25:45
It took a little bit of building using Rand Texas.
25:48
And if you're not familiar, with them. I highly recommend the Reddick scores on some rad X tutorials.
25:55
In order to build these custom, Red X is in your own environment.
26:00
In our next lesson, we're actually gonna go over and used a customer you've sent for P F Sense. You will notice that this integration it's more complete and better overall for even correlation.
26:12
Hope to see you soon. Have a great day.

Up Next

Building an InfoSec Lab

This course will guide you through the basics of incorporating several Information Security Engineering Tools in your home and/or lab. By building this lab you will be able to obtain corporate-level security within your home network, as well as a higher understanding of the capabilities and advantages these tools bring to your network.

Instructed By

Instructor Profile Image
Kevin Hernandez
Instructor