Note: Use the key to close any dialog boxes that may be interfering with your work. You may need to repeat this process until you see some detail in the graph. Narrow the time range in the Total Log Count Over Time visualization by clicking and dragging to select an area around the graph data point. To view more details, you need to narrow the amount of time that is displayed. You will see a graph appear with a single entry showing. Open Kibana (username analyst and password cyberops) and set an Absolute time range to narrow the focus to log data from January 2017.Ĭ. Login to Security Onion with the analyst username and cyberopsī. You will need to pinpoint the exact time. To help you get started, you are informed that the attack took place at some time during January 2017. In Part 1, use Kibana to answer the following questions. Instructions Part 1: Use Kibana to Learn About a Malware Exploit You have been given the following details about the event: Your goal is to answer a series of questions using Sguil, Kibana, and Wireshark in Security Onion. You have been asked to demonstrate your ability to pinpoint the details of an attack in which a computer was compromised. You have decided to interview for a job in a medium sized company as a Tier 1 cybersecurity analyst. Note: This lab requires a host computer that can access the internet. Thanks to for permission to use materials from his site. This lab is based on an exercise from the website which is an excellent resource for learning how to analyze network and host attacks.
Part 2: Investigate the Exploit with Sguil.Part 1: Use Kibana to Learn About a Malware Exploit.Instructor Note: Red font color or gray highlights indicate text that appears in the instructor copy only. 27.2.15 Lab – Investigating a Malware Exploit (Instructor Version)
0 kommentar(er)
