Welcome back to the savory course in building. You're in for a sec lap. I'm your host and instructor Kevin Hernandes.
Blast lesson. Well integrated pf sense locks into curator and created it as a universal GSM luck source
in today's lesson actually gonna start creating custom properties for RPF since locks we thin curator.
Now let's get started.
Last realists off. We basically integrated pf since logs through. Curator We had a status
Even though we incur incorporated these logs
you have to do it manually through the universal log D s. Um,
that's a scene on the screen
now, even though we integrated these one of the issues is that it is not properly formatted. The reason we have to create either a universal
the ascend four p of sense I know scramble of words, right? Or we have to create custom variables. Now, let's go ahead and posit We're right here.
So we pause to capture from curator hitting the pause button on the top right corner.
And now we're gonna open a P of sense event such as this one.
you have information here,
but not much to do. Now,
that's a mention. In the last videos, we can create
a new GSM right, or we can actually extract barrels from here.
Let's go ahead and show you the extract properties or create custom Bibles for this option. 1st 2 status.
yeah, let's go down here to locks again.
And here are the system looks now, obviously, you deaf system. And we also have the far wall. She's the ones we're looking at, right? So one good thing we're gonna do here is we're actually gonna take a swan screen shot of this
and then compare it to what we have here.
I also do a side by side, if you like.
Shrink this a little, and then come here.
Put them side by side.
It's up to preference.
So here, Right, you have the date or time, right?
Have the rule. Are pretty sure that's what it iss. And then you can see
her. Cyril values right.
Several values, right. Interfaces match block. Right.
if I expended a little
All right, you can actually see some of this information.
However, it's not in the second order. So you gotta be aware of that
when trying to match one toe, One the information. Okay,
and see the other one.
That one thing you can do,
you can right click here
filter on lockers is P f sense. Unless add the last 15 minutes.
And there we go. We have a lot more data to play with.
1 20 So let's try to find
thes event in there,
Once I went to dynamically. Um, is there a normal view? Was able to find
Right here. The port for 4193
Whoops. Sorry. I'm sure I did that.
I'm gonna go ahead and search for it. It for 4193 Right.
And you have the porter here.
You can see the 32 80 Here. You see the 30 to 60 m sign right here, and you can could get a general idea. Now, why this one? And this is what we really wanted to do.
So let's go ahead and copy
and Alice to extract property.
That's why for it to load
I want to do is create custom barrels. For these is to show you how we can do a couple of, um regarding curator. Right. So we're going to extraction base, right? Test feel it's where are pale is gonna be. In this case, you can see actually pasted it in here, so I don't have to do too much. Now here comes the exact new property. This case, we could
here. Right source. I p just 1 20
maybe actually at a p f sense. And the reason I like to do p of sound source I p
because that way, if you're trying to use your psyche for something else, you don't. All right, You're certainly be for everything else. Okay. And for me to say, this is the source i p
Let's scroll down a little. I'm gonna actually
creases sign of this. A little
fits. You guess It's a universal descend lobsters. You can actually attach it to be a sense itself. even need. We can actually jump into that later on. But right now I'm gonna show you how to you. Simple right, Jax, to read this data. Now, if you taking my course and Reddick, you already should be a little bit familiarized with this.
Otherwise, I'm gonna do
ah, little quick and true about it. Not too complex right now. You can see you do have to bracket. Now, if you want to get the date,
we can actually start from left to right, or we can actually start with the i p. I got ready stated. So
the problem if we start here, is that when you have to create this portion under Rogic's for all of these,
right and it's a lot of information, to be honest with you.
So what you can do is we can start instead around
And the reason I say it's we concerned around here is because it's not that hard or we can actually use this colon.
The reason I mentioned a Collins because it is the last colon there is, and therefore it shouldn't be that hard to play around with. So let's start with that colon right and it's been detected, followed by
let's say a little bit bigger now. I can see So the colon, Right. And you can see there's one,
three different Collins. Now, the difference is you see carefully here.
This one has a space afterwards. So we're gonna use that
to Reg IX scenario. We're starting right now. There could be a dot or not, um, you know, digit or not. So in this case, what I'm gonna do is we're gonna create a
You're gonna say cute for cannot be there. Right? And they were gonna do a coma.
What a wild card I can or cannot be. They're actually going to repeat this several times
to everyone. And then here, for example,
You have digits, right? So it's a slash d plus. So you cover all those numbers, then you do another coma. In this case, it's a word,
right? Causes the interface so you can do slash
doubly. Pull us right. You're actually going to repeat this? Same one several times now,
it's gonna be a little bit long,
but it's gonna be okay.
And then you can say
Molly or no Valley slash did it? Plus,
Such teaching. Plus, they're gonna keep repeating these. Okay, Until we get to the point where we want to reach right slash w
You can see once we go to the d S m, it might be a little bit or a lot cleaner,
you'll be happy then
coma. I slashed w plus for a TCP
another coma and he usually actually gonna have to source i p.
here's where we do the capture. Now, before you do the capture group, one of the things I'm gonna recommend, it's for a ride the whole
thing up to maybe hear the destination port. Okay.
And the reason I say that is
you can then use the same rejects for everything you're gonna do instead of having to rewrite everything again and miss up because you forgot where to capture proper capture groups is okay Now for the I P addresses itself. You. It's very right at Radic specifically for it.
And I'm actually gonna open my note pad
Okay, Not for eyepiece write. What you want to do is you're gonna have one digit
indeed. It from 1 to 3 digits, right? You're ever gonna have a period.
And this is basically destruct for an I P. And you got that
four times, right? Not only for periods. And if he's copy and paste is in there,
hopefully should work that. There we go, and then you do
another coma and he pays another. Oh, does write another coma. There's one poor, another coma,
nursey, other port. And let's leave it at here for now. Okay?
And this is gonna be our red IX. Now, what if you're gonna say OK, but didn't you just said
do one Red tricked itself for everything instead of searching for this? Yeah, you could do that. And if you want to do that, what you have to do is then, instead of starting from here, you will start with this bracket and then do slash w plus Sorry. Move every little space or no space slash d +122
space or no space and slash de colon slash t to colon slash me too
space and then the work, right? So the way that will work is
mom. And then you're gonna say
flash double year three.
Colon gonna have copies two more times.
So the two. D two, this is a space
slash doubly plus slash colon. Right? And if you copy this right in the beginning and hopefully Adam break in
All right, you shoot now, see? Everyday. Let's see.
Wants it backwards. Copy this first.
Stretch it so I can see everything.
And then it should be from here on.
So let me taste it again,
But if it doesn't work, it's because we mess up the beginning. Right?
there we go. No sleepless to lead
Okay, so we got three.
without a space. You got two digits.
You have two digits. You got a space?
We have a word. We were calling. We got a space.
So that's to the phone.
I think this is a problem here If we do this in theory,
and you can see why I wanted to start with the colon, right? Not the beginning.
And that's weird, right? This manually, actually. So you can test it
every game, so you can see we're gonna type exactly the same tree.
Copy this and put it right
here. Right. Which is where we had the other one.
You see, I actually have a never
Oh, here. I forgot to break the digit. Okay, so that's the error I type. I apologize for that.
Now, we know if we actually
on pace to here. There we go. Covers everything right. And if you want to add the other numbers in the beginning, and you can actually do it
and I say one through four and there we go. Okay. And that's how wretched works. Now,
we haven't actually captured a field, and that's what we're gonna go to now. And you said I p and we're gonna to source like people. She's gonna beat this one, right? So in this case, let's go back here
We're gonna look for this air right here, okay?
And you start a captured group before, after the coma,
after the coma before the did it. So open parentheses
and go to the last portion
and close the currency, which is a captured. Right. And you can see in the top. It's already being highlight. That's how you know it's gonna work. Have you test? Yes. In matches, Then it's safe.
Copied is real quick. Before we hit Save
it's safe. And now you have a source. I p
right there. And if you see it now, it's gonna add the violet right here in the top. This is all kind of a lot of work. Have to do that mentally for each field. Yeah, but technically, already did the hard work. So as you come here
right and apologise, it's so big now, it's just, like wasn't able to see the screen earlier. But then, you know,
summation. I p right.
And what you're gonna do is literally time heretics in there and you can see it's capturing that group. You already know where to search
Here's the part of it. And you can actually have both if you prefer,
right and just change to capture group.
And I'll show you how to do that in a second. Okay.
Sorry. That's in the wrong place. Insurance before
There. You see, I'm missing one
of the digits, so let's go back.
And that's why it's so good to do this here like that. And you can see there is destination I p sir, uh,
You see, it's matches and okay. And safe. And now we have destination. I p it appears up right. And this is the whole thing. I'm suspension earlier. You have to
three of Sands Destination I P.
And that's because otherwise it's over, right? Other destination eyepiece. And once you load it, you can see it right here as well.
I just mentioned you can actually modify it,
So you can come here
and their attics again,
right? And then that expand this again so I could see more. There we go.
And there we go. Never gonna do let's say source port right here. So I'm gonna call it P f sense
and I'm gonna show you how capture works room now.
So you have one friend. ISS is here and the other one here, right? And that's why I was talking about that we can actually modify. So if you come here
actually added a wrong, then we'll apologize.
And this can actually gonna do
this is swell, right? You can see
marking this one. However, if we change to capture group to capture 22 you see it now captured the source. I s or support. I apologize. And if you go to three, it captures the destination port so you can see that you can actually use the same. Roger can just change a little valley at the end as well. And it's a good option a swell to do this. So,
in this case, for example, a comet is it too? Because it's gonna be a sore sport, right? For PF sends
it's safe and then you can literally come again.
It's gonna be like a fast value at the tragic call it p f sense
destination port. And then here come 23 Tests. It's working and you're gonna make sure
on the Tom it's highlighted. And this is itself highlighting. I don't have any search functions, as you can see, and then it's safe. And now you can see that you're getting 1234 different values, right? The other thing, we gotta search it, search for the action itself and in this case, the action being blocked. Right,
So let's go back to the D. S. N.
Apologies. A customer event extract.
I'm gonna do PF sense
action, right? In this case, we can type the whole thing. I know we're not going to use the halting because technically, we have to get up to here and the last thing's curator process the battery, in my opinion, So I can come up to here, for example,
and stop this and see how much it attacks. And that's pretty good. Let's remove two more.
So around here and elite, I like to leave the coma in their ***, a lasting to the tack
it doesn't keep searching for more information. You have found the common. That's it. It's not gonna be like a W. Plus, this is all in. It's a lot of characters. No,
stop in a coma if there's a space. Even better in many, many software do have spaces when they're sending sister locks. And I will use this space itself to determine where a variable lens. So now we have it here. Right?
You're gonna add that capture group right here.
Do you actually wrote that by accident?
you're a period for some reason.
block. Right. Test it, Detective. I know it's on the top. Always attracted,
and it's safe. And now you should see the action source poured. Destination port sort sport source. I pian destination. I pee into default domain. And this basically it to wrap up for how to create custom properties. Now, obviously, if you go back to return to event, lose right,
then you come here. You can now see,
See, it still says this, but if you come to at it, search right.
And the second front to load
it's taking a little bit longer than a second. There we go, and we're gonna do
It's just keeping us is five minutes, right And now here we're gonna search for a p of sense,
And all of these variables we're gonna add in here.
Okay, So I'm gonna grab all of them
and put him in there. And then we're all of them
and moved him up. Up, up, up, up, up, up, up, up.
Right. Except one thing I do want to have in the top is e start time.
And that's it. Search
and you can see I will perform the surge. And here we go. And here's itself how you can see the
curator data formatted to RPF sense. So you can see the answers in actions block from this source. I p to this destination I pee. Sorry. Destination port. Ah, source Port start sleepy. Now, if you don't like the order, you can always come back and its search.
Right. And here you condone Say OK, I want to see the source. I pee first.
So our sleepy following a dissonant bite. A sore sport. Let's see,
followed by the destination eyepiece alibi, the destination port and the harder I want youto action beginning or the end whistle I want It's the first thing I want to see. So let's go with port
and then search again.
Here you go. Right. Sore sleepy source. Forward Destination I p Destination poured and named Locke sorts, et cetera. You can see you can play around. Once you do that, you can save the criteria. You can say this is P F Sense.
All right. You can, including a quick search chair with everyone, in case somebody else wants to use that really time because you want to see the real time. You can said Ask your default search. That way, whenever you come into lock searching, you see the PF sense log. Okay. Now one of the pros and cons. That's obviously that this is very specific for this.
if you have other lock sources and obviously you won't see the data or the eyepiece will not match, and therefore that's the option of the University of Sunday. You can create
Farmer. This is the wrap up for today and carry on.
What did we learn today? We created custom properties for new Luxor speed of since inside curator.
It took a little bit of building using Rand Texas.
And if you're not familiar, with them. I highly recommend the Reddick scores on some rad X tutorials.
In order to build these custom, Red X is in your own environment.
In our next lesson, we're actually gonna go over and used a customer you've sent for P F Sense. You will notice that this integration it's more complete and better overall for even correlation.
Hope to see you soon. Have a great day.