WEBVTT

1
00:00.000 --> 00:04.530
In this video, we get to take a closer look at the wonderful world of an event

2
00:04.530 --> 00:04.880
handler.

3
00:04.880 --> 00:08.560
And on the 40 analyzer, when you hear the word event handler, I like to think

4
00:08.560 --> 00:09.280
of the analogy

5
00:09.280 --> 00:12.920
of a security guard with a set of rules. And those rules are what the security

6
00:12.920 --> 00:13.680
guard is following.

7
00:13.680 --> 00:18.240
So if the security guard, for example, sees this or this or that, or these four

8
00:18.240 --> 00:18.800
or five things in a

9
00:18.800 --> 00:22.630
specific order, security guard then takes action and does something. Well, an

10
00:22.630 --> 00:23.600
event handler on the

11
00:23.600 --> 00:27.440
40 analyzer does that with log information that's coming in based on a set of

12
00:27.440 --> 00:28.560
rules, which are part

13
00:28.560 --> 00:32.120
of each and every single event handler based on those rules, it can then go
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

13
00:28.560 --> 00:32.120
of each and every single event handler based on those rules, it can then go

14
00:32.120 --> 00:33.440
ahead and take action.

15
00:33.440 --> 00:37.440
And one of those actions, as in the name, is to go ahead and create an event.

16
00:37.440 --> 00:37.760
And that way,

17
00:37.760 --> 00:41.720
we can see that event. And then furthermore, we could take that information and

18
00:41.720 --> 00:42.400
we could take

19
00:42.400 --> 00:46.400
those events and create incidents like a case or a ticket to follow up. And if

20
00:46.400 --> 00:46.960
we want to,

21
00:46.960 --> 00:50.850
we also have event handlers that could automatically take that next logical

22
00:50.850 --> 00:52.240
step and create a ticket

23
00:52.240 --> 00:55.660
or an incident for us to follow up with. So again, in this video, we're going

24
00:55.660 --> 00:56.720
to focus on the

25
00:56.720 --> 01:00.440
wonderful world of event handlers and a couple of options regarding event
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

25
00:56.720 --> 01:00.440
wonderful world of event handlers and a couple of options regarding event

26
01:00.440 --> 01:01.440
handlers exist. Number

27
01:01.440 --> 01:05.730
one, we have a whole bunch of prebuilt event handlers, like lots and lots of

28
01:05.730 --> 01:06.880
them. We'll take a look

29
01:06.880 --> 01:10.740
at them here in just a moment. And some are considered basic event handlers.

30
01:10.740 --> 01:12.320
And the basic event handler

31
01:12.320 --> 01:17.140
has a bunch of rules, actually one or more rules. And if any of those rules are

32
01:17.140 --> 01:17.760
matched,

33
01:17.760 --> 01:21.570
it triggers that event handler and it creates an event. And that's a basic

34
01:21.570 --> 01:22.480
event handler.

35
01:22.480 --> 01:26.570
And there's also a super fancy event handler is called a correlation event

36
01:26.570 --> 01:27.520
handler. And a

37
01:27.520 --> 01:32.070
correlation event handler isn't looking for just like matching on any rule is
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

37
01:27.520 --> 01:32.070
correlation event handler isn't looking for just like matching on any rule is

38
01:32.070 --> 01:33.360
looking for a sequence

39
01:33.360 --> 01:36.940
of events or conditions that happen, for example, within five minutes, or

40
01:36.940 --> 01:37.920
within two minutes, or

41
01:37.920 --> 01:42.680
with three or four specific log types or messages popping up all related to

42
01:42.680 --> 01:43.840
each other. When that

43
01:43.840 --> 01:47.860
happens, it can go ahead then and create an event. So in either case, whether

44
01:47.860 --> 01:48.480
it's a basic

45
01:48.480 --> 01:52.690
or a correlation event handler, the goal of these handlers is to based on the

46
01:52.690 --> 01:53.680
log information,

47
01:53.680 --> 01:57.820
create events for us. So let's take a closer look here at the 40 analyzer at

48
01:57.820 --> 01:59.040
our event handlers.

49
01:59.040 --> 02:03.490
So here we are back at the 40 analyzer. And to see our event handlers, we're
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

49
01:59.040 --> 02:03.490
So here we are back at the 40 analyzer. And to see our event handlers, we're

50
02:03.490 --> 02:04.000
going to go into

51
02:04.000 --> 02:08.740
instance and events in this version of the 40 analyzer. And under incidents and

52
02:08.740 --> 02:09.440
events, we're

53
02:09.440 --> 02:14.800
going to go to the event handlers. And just as a reminder, if we go back to our

54
02:14.800 --> 02:16.000
events, if we had

55
02:16.000 --> 02:19.920
the column for here in the events, it's going to show us which event handler

56
02:19.920 --> 02:21.680
generated that event.

57
02:21.680 --> 02:25.810
So again, back at the event handlers, here's the beautiful default list. I don

58
02:25.810 --> 02:26.240
't think I've

59
02:26.240 --> 02:29.330
created any from scratch. In fact, we can confirm that by going to more. And

60
02:29.330 --> 02:30.880
then I'll go ahead and
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

60
02:29.330 --> 02:30.880
then I'll go ahead and

61
02:30.880 --> 02:35.980
say just show custom and I have no yet custom event handlers. I'm just going to

62
02:35.980 --> 02:36.800
show us our

63
02:36.800 --> 02:41.860
predefined event handlers. And there are hundreds of them. We can also go ahead

64
02:41.860 --> 02:42.720
and use the gear,

65
02:42.720 --> 02:45.840
of course, to add or remove columns. So I'm going to clean this up a little bit

66
02:45.840 --> 02:46.720
, remove some columns

67
02:46.720 --> 02:49.530
that we're not using at the moment. Some event handlers can go ahead and

68
02:49.530 --> 02:50.720
automatically create an

69
02:50.720 --> 02:54.110
instant for us. I'm going to remove that for the moment as well from columns.

70
02:54.110 --> 02:54.800
And I'm also going

71
02:54.800 --> 02:57.700
to remove the notification profile for the moment. And let's see if that gives

72
02:57.700 --> 02:58.480
us a little more real

73
02:58.480 --> 03:01.780
estate to work with. And let me also go ahead and collapse the left hand side
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

73
02:58.480 --> 03:01.780
estate to work with. And let me also go ahead and collapse the left hand side

74
03:01.780 --> 03:02.720
to under incident

75
03:02.720 --> 03:06.330
and events event handlers. So let me go ahead and collapse the left hand side.

76
03:06.330 --> 03:07.200
Fantastic. And

77
03:07.200 --> 03:12.350
let me show you how you can visually identify a basic event handler, which is

78
03:12.350 --> 03:13.520
matching on any of

79
03:13.520 --> 03:17.800
the rules in that event handler versus a correlation event handler. So this

80
03:17.800 --> 03:19.200
icon right here looks like

81
03:19.200 --> 03:22.630
a little notebook with a set of rules. That's the icon that I'm pointing to

82
03:22.630 --> 03:24.000
right now for a basic

83
03:24.000 --> 03:27.010
event handler. And let's go ahead and take a look at this one right here as an

84
03:27.010 --> 03:28.240
example. So this

85
03:28.240 --> 03:32.080
default botnet communication detection has a whole bunch of rules. Let's go
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

85
03:28.240 --> 03:32.080
default botnet communication detection has a whole bunch of rules. Let's go

86
03:32.080 --> 03:33.040
ahead and double

87
03:33.040 --> 03:37.290
click on it to take a closer look. So there's the name, the description, it has

88
03:37.290 --> 03:38.400
some minor tech

89
03:38.400 --> 03:41.600
IDs that's associated with. We'll take a closer look at that as well as we

90
03:41.600 --> 03:42.800
continue. If we scroll

91
03:42.800 --> 03:47.540
down here are all the rules. Now with a basic event handler as shown right up

92
03:47.540 --> 03:48.880
here, any of these

93
03:48.880 --> 03:53.390
rules matching is going to effectively trigger with this event handler. And it

94
03:53.390 --> 03:54.320
's going to create

95
03:54.320 --> 03:59.510
an event. So if a system had traffic from their device going to a command and

96
03:59.510 --> 04:00.640
control network,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

96
03:59.510 --> 04:00.640
control network,

97
04:00.640 --> 04:04.140
and it was blocked by the 40 gate and shown in a virus log, that would trigger

98
04:04.140 --> 04:04.880
on this one.

99
04:04.880 --> 04:08.560
Or if it showed up as detected in a virus log where it was identified but not

100
04:08.560 --> 04:08.960
stopped,

101
04:08.960 --> 04:14.160
that would also trigger. That's this rule right here. Or if the DNS query for a

102
04:14.160 --> 04:15.040
command and control

103
04:15.040 --> 04:18.620
website was blocked, that would trigger on this rule, etc, etc. And we can also

104
04:18.620 --> 04:19.680
see the details by

105
04:19.680 --> 04:23.210
expanding each of those right here. And if we wanted to, we could also go ahead

106
04:23.210 --> 04:24.560
and edit. However,

107
04:24.560 --> 04:29.360
it's probably a better idea if we want to tweak or modify to go ahead and clone

108
04:29.360 --> 04:30.640
an existing event
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

108
04:29.360 --> 04:30.640
an existing event

109
04:30.640 --> 04:34.680
handler and then make our own and tweak it. There's also good news, the option

110
04:34.680 --> 04:35.760
if we disable some

111
04:35.760 --> 04:38.860
and then realize later, Oh, we need that. We can go ahead after we save it. I

112
04:38.860 --> 04:40.080
'll click on OK to save

113
04:40.080 --> 04:42.770
that. And then later, if we decide we need to set that back, we can go ahead

114
04:42.770 --> 04:43.680
and double click on it

115
04:43.680 --> 04:46.710
to edit it and then click right here on factory reset, which will set them all

116
04:46.710 --> 04:47.600
back. We'll click

117
04:47.600 --> 04:50.520
on OK, and then just double check. Sure enough, they're all set. And we'll

118
04:50.520 --> 04:51.280
change it again. I'll go

119
04:51.280 --> 04:55.500
ahead and disable these three top rules. Just an example, click on OK. Another

120
04:55.500 --> 04:56.320
way of resetting

121
04:56.320 --> 05:01.480
it is to select this, which is right here. And then from the more option, click
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

121
04:56.320 --> 05:01.480
it is to select this, which is right here. And then from the more option, click

122
05:01.480 --> 05:02.800
on factory reset,

123
05:02.800 --> 05:05.250
and looking for enforcement, we're going to reset this event handler. We'll

124
05:05.250 --> 05:06.400
click on OK. Then if

125
05:06.400 --> 05:10.080
you go back in, once again, it's restored to its defaults. Or if you got kind

126
05:10.080 --> 05:10.960
of crazy and change

127
05:10.960 --> 05:14.480
five or six, you can select five or six. And then from the menu here, you could

128
05:14.480 --> 05:15.520
go ahead more

129
05:15.520 --> 05:19.920
and factory reset and click on OK. So again, this icon right here is the icon

130
05:19.920 --> 05:21.120
for a basic event

131
05:21.120 --> 05:26.920
handler. And let's compare and contrast that to a correlation event handler. So

132
05:26.920 --> 05:27.680
let's go down

133
05:27.680 --> 05:30.200
and let's find, let's go ahead and do another be fun. I hope this one right
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

133
05:27.680 --> 05:30.200
and let's find, let's go ahead and do another be fun. I hope this one right

134
05:30.200 --> 05:31.200
here, that'd be great.

135
05:31.200 --> 05:34.090
So this is the icon right here. It looks a little puzzle. So puzzle has

136
05:34.090 --> 05:35.760
multiple pieces. And the

137
05:35.760 --> 05:39.100
implication there is that with a correlation event handler, we have a whole

138
05:39.100 --> 05:39.840
bunch of stuff

139
05:39.840 --> 05:43.620
that happens together or with a certain timeframe. So that's the icon for a

140
05:43.620 --> 05:45.040
correlation event handler,

141
05:45.040 --> 05:49.310
like a correlation of log or messages that happen. And it triggers. So let's

142
05:49.310 --> 05:49.840
take a look at this

143
05:49.840 --> 05:53.060
one right here. We'll open it up. So this right here, here's the correlation

144
05:53.060 --> 05:53.840
sequence. It's looking

145
05:53.840 --> 05:58.450
for five failed login attempts followed by login success. And when it sees that

146
05:58.450 --> 05:59.200
, it's going to go

147
05:59.200 --> 06:01.920
ahead and it's going to trigger. And thank goodness, we don't have to write all
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

147
05:59.200 --> 06:01.920
ahead and it's going to trigger. And thank goodness, we don't have to write all

148
06:01.920 --> 06:02.880
these ourselves because

149
06:02.880 --> 06:07.800
can be kind of tricky narrowing it down to exactly what you're looking for. And

150
06:07.800 --> 06:08.400
by default,

151
06:08.400 --> 06:12.680
there's tons and tons of event handlers, both basic and correlation event

152
06:12.680 --> 06:13.840
handlers that can do

153
06:13.840 --> 06:17.030
the job we want. And I would recommend that if you need a customized event

154
06:17.030 --> 06:18.000
handler, maybe take

155
06:18.000 --> 06:21.760
one that's close to what you need, and then tweak it rather than creating it

156
06:21.760 --> 06:22.880
all from scratch. So

157
06:22.880 --> 06:27.440
this is an example of the details for a correlation event handler. Again,

158
06:27.440 --> 06:29.280
thinking of multiple events

159
06:29.280 --> 06:32.780
that have to happen in sequence or together or within a timeframe. And if we
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

159
06:29.280 --> 06:32.780
that have to happen in sequence or together or within a timeframe. And if we

160
06:32.780 --> 06:33.440
look at another

161
06:33.440 --> 06:36.640
basic one, like at that icon right here, we'll go and open it up. It simply

162
06:36.640 --> 06:37.600
means that any of

163
06:37.600 --> 06:40.550
these rules, if they're matched, are going to trigger. And as a result, it's

164
06:40.550 --> 06:41.200
going to go ahead

165
06:41.200 --> 06:44.850
and create an event. All right, let me cancel that. Another cool thing is that

166
06:44.850 --> 06:45.760
if we create an event

167
06:45.760 --> 06:49.920
handler, and we want to share that with another administrative domain, there's

168
06:49.920 --> 06:50.800
a great option for

169
06:50.800 --> 06:53.060
taking one right here, for example, let's imagine this is a custom one. And

170
06:53.060 --> 06:54.400
[garbled], this is clone one.

171
06:54.400 --> 06:58.080
Let's go ahead and let's clone this one right here. So we'll clone it. We'll

172
06:58.080 --> 06:59.120
call it our cloned

173
06:59.120 --> 07:03.270
event handler. And we'll click on OK. And let's go ahead and do more here and
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

173
06:59.120 --> 07:03.270
event handler. And we'll click on OK. And let's go ahead and do more here and

174
07:03.270 --> 07:04.320
say, let's just show

175
07:04.320 --> 07:07.770
our custom ones. And there it is. So there's our clone one. We can also create

176
07:07.770 --> 07:08.400
a new one and put

177
07:08.400 --> 07:11.620
in all the details either way. If we wanted to share that with administrators,

178
07:11.620 --> 07:12.240
for example,

179
07:12.240 --> 07:16.000
in a different administrative domain, we could go ahead and export it. So here,

180
07:16.000 --> 07:16.640
with that selected,

181
07:16.640 --> 07:20.920
we click on more and click on export, we could go ahead and include any details

182
07:20.920 --> 07:22.160
we wanted to here,

183
07:22.160 --> 07:26.820
and then choose the format, text, CLI or zip, click OK, it'll save that for us.

184
07:26.820 --> 07:27.360
And then what we could

185
07:27.360 --> 07:30.390
do on the other side is send it over to them, and they could go ahead and do
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

185
07:27.360 --> 07:30.390
do on the other side is send it over to them, and they could go ahead and do

186
07:30.390 --> 07:31.360
the import. So I'll

187
07:31.360 --> 07:34.050
click OK there. I'll save that to my downloads folder. And then just for

188
07:34.050 --> 07:34.880
granted, I'm going to

189
07:34.880 --> 07:37.450
right click and delete that one. We'll pretend we're in a different

190
07:37.450 --> 07:38.800
administrative domain. In fact,

191
07:38.800 --> 07:42.510
we don't have to pretend. Let's go ahead and do it. We have eight arms set up.

192
07:42.510 --> 07:43.280
So we'll go back to

193
07:43.280 --> 07:47.620
BR one ADOM, and currently has no custom event handlers. So let's go ahead and

194
07:47.620 --> 07:48.480
do it import by

195
07:48.480 --> 07:53.680
going to more and import. So I'll go ahead and drag and drop it right there.

196
07:53.680 --> 07:55.120
And boom, there it is

197
07:55.120 --> 07:59.920
in the new ADOM. So we have this one here now in this BR one dash ADOM. If we

198
07:59.920 --> 08:01.840
go back to our root ADOM,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

198
07:59.920 --> 08:01.840
go back to our root ADOM,

199
08:01.840 --> 08:04.690
it's not there anymore because I deleted it. But we get imported here again as

200
08:04.690 --> 08:06.080
well by going to more

201
08:06.080 --> 08:10.580
import and importing that custom event handler, which I'll do right now. It's

202
08:10.580 --> 08:11.120
just by drag and

203
08:11.120 --> 08:14.960
dropping, clicking OK, and boom, it's now there again. And because we don't

204
08:14.960 --> 08:15.760
need it, I'm going to

205
08:15.760 --> 08:18.810
right click and go ahead and delete it. So let me go ahead and click on OK, and

206
08:18.810 --> 08:19.920
then more, and I'll

207
08:19.920 --> 08:24.290
click on show predefined, and we're back to square one. So let me demonstrate

208
08:24.290 --> 08:25.600
how an event handler

209
08:25.600 --> 08:29.630
in action is working. So let's go ahead and just bring back the left hand side

210
08:29.630 --> 08:30.640
here. Let's go to
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

210
08:29.630 --> 08:30.640
here. Let's go to

211
08:30.640 --> 08:36.330
event monitor. And I'm going to specify for the last five minutes. Oh, import

212
08:36.330 --> 08:38.000
40 analyzer config

213
08:38.000 --> 08:40.850
fail. What happened there? I don't know. So it went south. So we could

214
08:40.850 --> 08:42.000
investigate that, or we could

215
08:42.000 --> 08:44.760
right click on it and suppress it and click on OK, I'm just going to right

216
08:44.760 --> 08:46.080
click and acknowledge it

217
08:46.080 --> 08:48.790
and click on OK. And that way we don't have to look at them. So in a production

218
08:48.790 --> 08:49.680
environment, I'd

219
08:49.680 --> 08:52.670
take a closer look at that to make sure it's not something critical. But for

220
08:52.670 --> 08:53.360
now in this demo,

221
08:53.360 --> 08:56.800
I'm OK with that. Okay, so on to the demonstration. So for the last five

222
08:56.800 --> 08:58.560
minutes here, we're looking at

223
08:58.560 --> 09:02.480
the event monitor. And currently in our event handlers, let's go ahead and take
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

223
08:58.560 --> 09:02.480
the event monitor. And currently in our event handlers, let's go ahead and take

224
09:02.480 --> 09:03.040
a default one

225
09:03.040 --> 09:07.290
that we can trigger. So right here, this is great. Default botnet communication

226
09:07.290 --> 09:08.080
detection.

227
09:08.080 --> 09:12.890
And so the rules are any of these, if they match is going to go ahead and

228
09:12.890 --> 09:14.160
trigger based on this

229
09:14.160 --> 09:18.010
event handler and create a new event. So let's go ahead and do a DNS resolution

230
09:18.010 --> 09:19.200
for a domain name

231
09:19.200 --> 09:23.520
that's associated with botnet or command and control network. So to do that,

232
09:23.520 --> 09:24.000
let's go over to

233
09:24.000 --> 09:27.440
firewall one. And let's find one. So we're going to make a road trip right here

234
09:27.440 --> 09:28.480
to firewall one.

235
09:28.720 --> 09:32.500
And here at firewall one, my administrative session has expired. So I'll log
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

235
09:28.720 --> 09:32.500
And here at firewall one, my administrative session has expired. So I'll log

236
09:32.500 --> 09:33.760
back in. So here we are

237
09:33.760 --> 09:38.210
at firewall one. And currently, if we go to policy and objects, in fact, we get

238
09:38.210 --> 09:39.600
on to security profiles

239
09:39.600 --> 09:43.710
and DNS, that might be a faster way to find it. So we have this DNS filter

240
09:43.710 --> 09:45.120
called our DNS filter.

241
09:45.120 --> 09:49.700
That's currently in use one time. So we'll click on that. And it is used with

242
09:49.700 --> 09:50.800
our end out policy

243
09:50.800 --> 09:54.060
with LDAP fantastic. And that's the one that's being matched on quite a bit. Or

244
09:54.060 --> 09:54.880
at least it will

245
09:54.880 --> 09:58.270
be by one of our clients going through the firewall. So let's go ahead and open

246
09:58.270 --> 09:59.520
up that profile by

247
09:59.520 --> 10:03.450
double clicking on it. So currently, this DNS filter profile is redirecting bot
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

247
09:59.520 --> 10:03.450
double clicking on it. So currently, this DNS filter profile is redirecting bot

248
10:03.450 --> 10:03.920
net command and

249
10:03.920 --> 10:08.090
control request to the block portal. And there's over 8000 domains in the bot

250
10:08.090 --> 10:09.280
net package. Great.

251
10:09.280 --> 10:13.150
So let's go ahead and let's click on the botnet package. And let's do some

252
10:13.150 --> 10:14.000
tests. So I should be

253
10:14.000 --> 10:17.450
able to try to resolve any of these names from one of our clients behind the

254
10:17.450 --> 10:18.480
firewall. And that

255
10:18.480 --> 10:21.780
should show up in the logs. And if it shows up in the logs, those send over to

256
10:21.780 --> 10:22.560
40 analyzer,

257
10:22.560 --> 10:26.360
it should trigger based on that event handler. So I'm gonna go ahead and grab

258
10:26.360 --> 10:27.280
PC to here,

259
10:27.280 --> 10:31.280
which is behind firewall to, which is fording traffic through firewall one to
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

259
10:27.280 --> 10:31.280
which is behind firewall to, which is fording traffic through firewall one to

260
10:31.280 --> 10:31.920
get to the public

261
10:31.920 --> 10:35.120
internet. So we can test some name resolution for domains associated with

262
10:35.120 --> 10:36.000
command and control

263
10:36.000 --> 10:40.420
networks right here. So here is PC to let's open up a effect. Let's do a

264
10:40.420 --> 10:41.360
command line.

265
10:41.360 --> 10:47.430
Actually, I don't really want to try to go to any, um, you know, URL, which are

266
10:47.430 --> 10:47.760
botnet,

267
10:47.760 --> 10:51.200
command and control, but I don't mind resolving their names. So let's go ahead

268
10:51.200 --> 10:52.160
and use NS lookup,

269
10:52.160 --> 10:55.600
or we could also use dig, I think as well. Let's use NS lookup. So we'll type

270
10:55.600 --> 10:55.760
it in

271
10:55.760 --> 10:59.300
this lookup, we'll go into interactive mode. And let me bring in our list of

272
10:59.300 --> 11:00.880
domains. So here is our
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

272
10:59.300 --> 11:00.880
domains. So here is our

273
11:00.880 --> 11:07.210
list of domains that are identified in the 40 gate. So let's go ahead and let's

274
11:07.210 --> 11:08.080
try a few that are

275
11:08.080 --> 11:13.880
maybe some safer work ones. Let's go ahead and let's do the combat shell. So

276
11:13.880 --> 11:15.440
resolve combat shell

277
11:15.440 --> 11:19.520
dot com and sure enough, that's being redirected. So that's hitting there. And

278
11:19.520 --> 11:20.400
let's take one other

279
11:20.400 --> 11:26.870
one. How about office RSVP? So office dot RSVP. That's also being redirected.

280
11:26.870 --> 11:27.760
Great, great, great,

281
11:27.760 --> 11:31.460
great. You know, it's the same addresses for IPV four and IPV six. And that's
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

281
11:27.760 --> 11:31.460
great. You know, it's the same addresses for IPV four and IPV six. And that's

282
11:31.460 --> 11:32.560
the 40 gate firewall

283
11:32.560 --> 11:36.580
firewall one doing that redirection. So let me go ahead and click on cancel

284
11:36.580 --> 11:38.480
there and scroll down.

285
11:38.480 --> 11:43.120
And sure enough, for IPV four, I specified the redirect IPV four, dress of 1040

286
11:43.120 --> 11:44.160
, 0100. All right,

287
11:44.160 --> 11:48.260
let me go ahead and click on cancel there. And let's go back now to the 40

288
11:48.260 --> 11:49.360
analyzer. So back

289
11:49.360 --> 11:53.730
of the 40 analyzer under instant events and event handlers, this specific event

290
11:53.730 --> 11:54.240
handler

291
11:54.240 --> 11:57.580
should have just been triggered. So to see whether or not it actually did its

292
11:57.580 --> 11:58.320
work and created an

293
11:58.320 --> 12:02.150
event, let's go back to event monitor. And for the last five minutes and sure
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

293
11:58.320 --> 12:02.150
event, let's go back to event monitor. And for the last five minutes and sure

294
12:02.150 --> 12:03.200
enough, there's office

295
12:03.200 --> 12:07.680
RSVP and combat shell. It's also showing us right here in the handler, the

296
12:07.680 --> 12:08.720
exact handler that

297
12:08.720 --> 12:12.750
caused it. So we click on the hyperlink for that handler. It'll also show us

298
12:12.750 --> 12:14.000
specifically which

299
12:14.000 --> 12:17.690
rule was matched as part of that handler that caused that event to be generated

300
12:17.690 --> 12:18.320
. So here we

301
12:18.320 --> 12:21.520
could right click and go ahead and assign it. Let's go ahead and assign it to

302
12:21.520 --> 12:22.320
myself. Logged

303
12:22.320 --> 12:26.930
on as an event, click OK, so so right click and add a comment that this is for

304
12:26.930 --> 12:27.680
a demo. That way

305
12:27.680 --> 12:30.170
other administrators, if they look at it, not that they will on this lab
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

305
12:27.680 --> 12:30.170
other administrators, if they look at it, not that they will on this lab

306
12:30.170 --> 12:31.520
environment, but that way

307
12:31.520 --> 12:35.520
your other team members can see your comments and messages will click on OK.

308
12:35.520 --> 12:36.240
And we can right click

309
12:36.240 --> 12:41.470
here as well and go ahead and view the logs. So there's our log entry that came

310
12:41.470 --> 12:42.720
over from firewall

311
12:42.720 --> 12:46.730
one and we'll double click on it. And this one was for the quad a record. So we

312
12:46.730 --> 12:47.440
'll go ahead and

313
12:47.440 --> 12:50.530
double click on it. There's our log message will open it up. And there's the

314
12:50.530 --> 12:51.280
details on that

315
12:51.280 --> 12:55.230
DNS request or another way of looking at that would be to right click and then

316
12:55.230 --> 12:56.560
go to log view.

317
12:56.560 --> 13:01.310
And that'll take us to a new tab or new window in 40 analyzer under log view
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

317
12:56.560 --> 13:01.310
And that'll take us to a new tab or new window in 40 analyzer under log view

318
13:01.310 --> 13:02.960
logs with that specific

319
13:02.960 --> 13:08.110
filter put in place. So here we can see that we have the a record for IPv4 as

320
13:08.110 --> 13:08.880
well as the

321
13:08.880 --> 13:12.120
quad a record that we're being requested. And if we needed more detail, we

322
13:12.120 --> 13:12.880
could actually

323
13:12.880 --> 13:16.750
specify this log and go to more and say, you know what, I want to see the raw

324
13:16.750 --> 13:17.680
log and look at all

325
13:17.680 --> 13:21.110
the individual details, which can be helpful if we're trying to dig down to

326
13:21.110 --> 13:22.320
what's really going on

327
13:22.320 --> 13:26.240
or if we need to create an event handler, we could use some of this information

328
13:26.240 --> 13:27.440
in the raw log

329
13:27.440 --> 13:30.870
to go ahead and create our own custom event handler. So this is for the a
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

329
13:27.440 --> 13:30.870
to go ahead and create our own custom event handler. So this is for the a

330
13:30.870 --> 13:32.240
record here. And this is the

331
13:32.240 --> 13:36.010
IPv6 quad a record here. And these are the log entries of the 40 gate sent over

332
13:36.010 --> 13:37.360
to the 40 analyzer

333
13:37.360 --> 13:42.160
where the event handler saw them and as a result, created the event. So we

334
13:42.160 --> 13:43.360
close this tab, we'll go

335
13:43.360 --> 13:46.610
back to our original pane here. And just to foreshadow in our next skill that

336
13:46.610 --> 13:47.840
we're going to cover

337
13:47.840 --> 13:52.120
is the next logical step then would be to also take events that we're concerned

338
13:52.120 --> 13:53.120
about and right

339
13:53.120 --> 13:57.110
click on them and then create a brand new instant. Think of an instant like a

340
13:57.110 --> 13:58.320
ticket that we can then

341
13:58.320 --> 14:02.080
do more analysis on and investigation on and add notes to and add reports on
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

341
13:58.320 --> 14:02.080
do more analysis on and investigation on and add notes to and add reports on

342
14:02.080 --> 14:02.960
and so forth to help

343
14:02.960 --> 14:06.110
identify what's really going on on the network and to lock down any security

344
14:06.110 --> 14:06.960
vulnerabilities or

345
14:06.960 --> 14:10.080
problems that we may be having. And again, we'll cover incidents in that next

346
14:10.080 --> 14:11.120
logical step in a

347
14:11.120 --> 14:15.420
separate skill. So in summary, event handlers are going to be looking based on

348
14:15.420 --> 14:16.240
a set of rules

349
14:16.240 --> 14:20.400
at the log information that's coming in and then based on their rules matching,

350
14:20.400 --> 14:20.960
they would go ahead

351
14:20.960 --> 14:24.610
and create an event. And the one we just triggered was this one right here. And

352
14:24.610 --> 14:25.280
this is the event

353
14:25.280 --> 14:28.960
handler responsible for creating the events that we just looked at.