Time
6 hours 28 minutes
Difficulty
Intermediate
CEU/CPE
7

Video Transcription

00:00
Welcome back to the savory course in building. You're in for a sec lap. I'm your host and instructor Kevin Hernandes.
00:06
Last listen, we created custom properties for P f sense within our curator environment in today's lesson to actually gonna take it a little step of of that and create a custom the of sense for P f sense itself.
00:20
Now let's get started.
00:22
Let's mention of her prior lesson.
00:24
Another option we have to our custom barrels were concerned. Property.
00:28
It's the d S M editor itself. However, before we go, then
00:32
let's go ahead and copy this. And now go to
00:36
Chapman
00:38
scroll down a little.
00:39
The nearest is, um, editor.
00:42
All right. Yeah.
00:43
You got a second for its load
00:46
and it's gonna surfer
00:48
you gonna take PF sounds. You can see there's nothing you can do is, for example, you can say universal.
00:55
Do you serve in any create new?
00:58
All right. You can call it p f sentence.
01:02
You save it
01:03
right?
01:04
But when you select it
01:07
and here it will be basically the same thing. But it earlier regarding the variables,
01:11
Okay,
01:12
the only big difference is that now we actually modify it here with the variables you see on the left side for a set of heading. Ah pf send destination. I pee wee just modified a field here. Assist Destination I p Okay, so
01:26
we've gotta pace
01:29
the payload week acquired and lock it in here. Now you can see the data that's been extracting down here in the bomb, and you can see it's pretty much empty because it's not properly
01:38
interacting. Are interpreting interpretative. What's being detected for destination eyepiece? It's not being so. Detectives, you're gonna override it, right? Are gonna go back to our no pad.
01:52
All right, we're gonna capture this, right? You're gonna paste it here.
01:57
Expression. There we go.
02:00
Actually, it is detecting a couple of them
02:05
up here and see the 1st 1 in Texas. A source, I p. That's most likely because we
02:10
had the brackets right there.
02:14
Yeah.
02:15
So let's delete this.
02:20
Let's go to the other one.
02:23
Here we go.
02:23
Now the search for this I believe you should be here.
02:30
It's not. We'll move around
02:30
because it's actually no, it's one less
02:34
right here. Sorry. It's hard to see the comas in the periods today.
02:38
I have allergies. It's seriously bad. It will be here. In there. That's the destination. I peek for mustering batter required.
02:49
It's actually dollar one Apologize, curator. And you can see the destination piece right here, right now. Now what we're gonna do is that same dame. I'm gonna do it for the
03:00
source. I p So let's scroll down
03:05
alphabetically. Order over. Right. And remember, the Rogic's itself was probably former for source I p. So all you have to do a dollar sign. One hit, okay? And if you scroll to the side, you could see the source. I p Now they're Reagan. You can see. Basically the hard part about this was building that rejects will be able
03:23
in their fire. Listen.
03:24
And now this is like a piece of cake moving forward. Now,
03:30
let's go ahead and
03:32
do the
03:36
ports, right?
03:38
Foreign imports.
03:39
We want to capture the other ones.
03:42
You know what? Let's actually do the following. Sorry.
03:45
This open different windows either way. So the destination port we're going over there, right? That a swell projects I'm gonna search for does
03:54
parentheses right there.
03:58
I'm gonna Sorry. Parentheses.
04:01
Yeah.
04:02
Surfer it right there.
04:05
See there,
04:08
Mom and I search for the other one.
04:12
Yeah.
04:14
Handed out
04:16
deleted there, Tex Charity. And let's move to deports
04:21
you remember, the 1st 1 is for the stores. The second was for a destination. We're in destination. So before we do anything, that's copy paste this since it's clean. Now
04:31
let's do this.
04:33
Understood. Destination port, Remember, in this case is we're building a Rat IX itself. We have to actually put the capture group this case We only have one. So we put one
04:43
it. Okay,
04:45
You should have it in there now.
04:47
80 80 80 80. Perfect. And let's go toe sore sport
04:53
over rate. In this case, it traffics again. Paste it. This case, you already know it's this one,
05:00
um
05:01
bomb. Sorry.
05:04
There we go and capture one because we only have one heat. Okay. Now, for example, we're gonna search for action or event name, so let's go for
05:17
a su event. I d
05:19
I'm gonna do 1 34 here so we can do, for example, bomb.
05:25
He wanted
05:27
four digits. Let's say even though we do see three
05:30
bump and this actually put the parentheses
05:34
in here
05:38
for mystery
05:40
dollar one
05:42
he k is even I d. And then it's not that most like like firewall rule. But you get an idea that we won't have to recreate the many things right.
05:53
And now the only thing we need is gonna have the date or time. That's Dellis reading it properly. Since it's going live, you have to reinvent the way over that one. But if you want to use the system time in case there's some latent see, you can actually capture that. And what I would do is ah from here, right.
06:12
Open the parenthesis here and then do all the red X up to here, which, if you remember it was, um, you know, actually, space w here. So colon flash D to slash space writing and captured her here before the space and that should be able to work.
06:31
Um,
06:33
let's look for one more thing in here,
06:36
which is the action, right?
06:39
We're not. We don't need the whole Berries, only their attics up to that point. So as we know, we don't need two digits and lets the eyepiece. So we get the race from fear forward, right, And
06:53
copy this and let's go back here
06:58
right and let's go for action and see if there's anything regarding action
07:03
or anything regarding. Ah, activity event. Something like that, missy. There's not much regarding that.
07:15
Drink this very go and drink this. Here we go.
07:23
So
07:24
let's see here. Nothing. It doesn't mean it's not there. You can always say search for action.
07:32
Plus,
07:34
you can see here you can actually sign another set off custom properties. However, since you're here, you actually search PF sense action.
07:44
There you go.
07:46
Right.
07:46
And then you can select it and poop. There we go. And then you save it. Flew from joining property for ending. Okay,
07:54
so where you go, but what about enable And you really have to modify it. But apparently we do have to rewrite it. So let's go ahead and type this again. Obviously, let's remove things that are not required.
08:09
So from here, for example,
08:13
all right, and let's keep erasing.
08:16
I think it's up to here
08:20
a little bit more,
08:24
a little bit more
08:28
there. And if you recall there was extra got here that we didn't need, and that's it. Uh,
08:33
so
08:37
for here
08:37
whom?
08:41
Um and there's the action captured one. Okay,
08:46
well, it's it's safe
08:48
and technically wants you to kiss to remove the filter. You can now see
08:56
everything in here. Action, peeps in action. Very go See now, just one. Show it in order. But just so you get a general idea, right, and you can save it.
09:07
Close it.
09:09
All right.
09:11
You're gonna have auto discovering.
09:13
Sure you can do that. I don't trust it. The he, uh I have mixed feelings about it. Sometimes it works something. This gives you Ron data. And the problem is, if it doesn't know what it is, you're gonna have it. Especially here. That doesn't have, like, little parables. A little field
09:33
to have, like identifier, for example. Doesn't say s r c e I, p, you know, in the payload. So now that you're here and you created that, one of things you can do is you can come back to the lock source,
09:43
come
09:46
that little click to edit, and here you can select an extension and you can see that the p of seven blocks short extension is there,
09:52
and you can save it.
09:54
Great. And what happens is
09:58
that new locks coming in, right?
10:01
You see here, you're going to see that in theory. See, now there you go.
10:07
It should load the values specific to this. So let's go ahead and
10:13
clearness filter.
10:15
Oh, I didn't want to do that. Sorry.
10:18
Here we go.
10:20
You can actually see this variable staying there now
10:22
and you can see
10:24
should be working now
10:28
you can see
10:30
that it's reading the variables asked. It's supposed to Obviously, things in the past will not read the proper way. And you can also see that since we actually added the
10:41
variables or the values right for source. I, uh, certainly piano those things and we modified actually properties. And we didn't include these properties in the search itself. It's not going to read them right,
10:56
So you can see, however, it's detected the source i p now and it's supposed to, and it's detecting two sorts. Poor destination. I pian destination port. That way it's supposed to, and you can actually see
11:05
that it's working as intended now, PF since action, you might need to work a little bit more on that to actually do it and a p f sense event name I. Even then we can actually added a swell and edit it. Now, what can we do here? We can actually go and say we're going to do. Ah, you search right now. He seems like a good place to take a chirp. Rick, see you soon.

Up Next

Building an InfoSec Lab

This course will guide you through the basics of incorporating several Information Security Engineering Tools in your home and/or lab. By building this lab you will be able to obtain corporate-level security within your home network, as well as a higher understanding of the capabilities and advantages these tools bring to your network.

Instructed By

Instructor Profile Image
Kevin Hernandez
Instructor