WEBVTT 00:09.090 --> 00:10.310 Hello, everybody. 00:10.310 --> 00:15.270 Welcome back to the continuation of the OpenSOC CTF Tools. 00:15.430 --> 00:18.630 Our next speaker, Tim Dot Zero, a.k.a. 00:18.630 --> 00:19.730 TJ, a.k.a. 00:19.730 --> 00:23.510 Tim Johnson, will be giving us a walkthrough of the Kibana tool. 00:23.810 --> 00:29.330 This product is near and dear to my heart, being an elastic engineer, and hopefully everybody enjoys it. 00:29.330 --> 00:34.290 If you have questions, hit us up in the text WORKSHOP TRACK 1, channel again. 00:34.290 --> 00:36.950 We will try to redirect you as best as possible. 00:36.950 --> 00:41.730 There's also the Recon InfoSec Discord channel that you can go into. 00:41.830 --> 00:49.050 There is actually a section that, unfortunately, I didn't write down, Tim, but ask for help, I think. 00:49.190 --> 00:52.350 Yeah, you can ask for help from other OpenSOC veterans. 00:52.850 --> 00:58.670 Yeah, so definitely take advantage of the Discord channels that are out there so you can get more directed help. 00:58.670 --> 01:04.130 At this point, I'm going to turn it over to TJ and sit back and relax. 01:05.590 --> 01:07.450 Hey, how's it going, everybody? 01:08.030 --> 01:10.970 We're very excited about OpenSOC this year. 01:10.970 --> 01:16.750 We got new scenarios, got some new tools for you to use, and we got some tools that you already know about. 01:16.750 --> 01:27.230 But for those of you who are attending DEF CON for the first time or participating in OpenSOC for the first time, we're going to get you familiar with those tools and show you what kind of weapons you have in your arsenal. 01:29.630 --> 01:34.370 Like he said, my name is TJ, aka Tim.0 on Twitter. 01:34.590 --> 01:37.430 You can hit us up anytime. 01:37.430 --> 01:43.790 We'll retweet you, we'll talk to you, we'll get in our Discord, and we'll try to help you out, try to make you better hunters. 01:44.110 --> 01:48.450 But without further ado, we're going to jump into some Kibana. 01:50.710 --> 01:57.090 So right when you log into Kibana, you're going to actually see this screen here. 01:58.850 --> 02:04.150 And it's no different than if you've used Greylog before or other tools like this. 02:04.250 --> 02:10.750 It's a UI for your Elasticsearch database on the back end, and it helps you visualize your Elasticsearch data. 02:11.590 --> 02:20.410 And here you'll be able to create indexes to filter out and look through all of your agents pushing logs to your Logstash server. 02:21.670 --> 02:23.230 And that's just a little background. 02:23.230 --> 02:28.090 I won't teach you about the tool because I don't work for Elastic, but I do love this tool. 02:29.170 --> 02:32.530 So first off, I'd like to tell everybody the disclaimer. 02:32.530 --> 02:35.550 Do not ever forget your time frame. 02:36.170 --> 02:38.450 You've got to pay attention to the time filter. 02:38.950 --> 02:45.450 So you're going to get intel drops, you're going to get information saying that a particular event happened at a particular time. 02:45.450 --> 02:48.770 And you've got to make sure that you're looking for events during that time. 02:50.350 --> 02:57.250 So right up here in the right corner here, you're going to see your... by default, it'll open up and load as last 15 minutes. 02:57.250 --> 03:04.270 And if you click that right there, it'll actually provide you, by default, some of the quick... 03:04.910 --> 03:06.390 Hey, I just want to look at the last week. 03:06.390 --> 03:07.950 Hey, I just want to look at the last month. 03:07.950 --> 03:10.210 Oh, this happened in the last 30 minutes. 03:10.790 --> 03:18.430 Obviously, because we're hunting on a non-live environment, we want to look pretty specific, right? 03:19.090 --> 03:23.410 So you're going to go in here and you can pick your time and your date here. 03:23.410 --> 03:29.690 And the cool thing about it, if you notice that I clicked a date, it zeroes out the start time. 03:30.790 --> 03:36.270 And if you click another date, it pulls it down to 2359 where it's the end of the day. 03:37.070 --> 03:44.370 That's a very useful tool there because you're going to be looking at a lot of different time frames and we want to make sure that you're getting the right data. 03:44.550 --> 03:48.310 So pay attention to your time frame because you don't want to hunt in the wrong place. 03:49.130 --> 03:54.730 Also, you'll go back and forth in between your hunts into different time frames. 03:54.850 --> 03:58.490 And this will actually show you some of the last ones you picked. 03:58.490 --> 04:02.610 So it makes it a lot easier on you to jump between one time frame and another. 04:04.510 --> 04:06.050 But we'll keep pushing. 04:07.570 --> 04:15.930 One of the things I like about Kibana is for the not so seasoned hunter. 04:15.930 --> 04:20.590 When I first started, Kibana was a great tool for me to try to learn and understand. 04:20.770 --> 04:26.250 Because you get to understand based on the data that you're given. 04:26.250 --> 04:28.030 You're looking at all your logs right here. 04:28.030 --> 04:32.110 So in the last 15 minutes, I'm looking at 131,000 logs. 04:32.110 --> 04:37.130 So I usually just start off by looking at some of the stuff that I'm seeing here. 04:37.570 --> 04:40.270 But you'll notice that you're getting logs from different sources. 04:40.270 --> 04:45.850 So here we got this type here showing that it's a log. 04:46.450 --> 04:51.530 But you might also filter that out and say, what other type of logs do I have here? 04:54.530 --> 05:02.890 And you open that up and you can see I use this little magnifying glass as you filter or you hover over some of these fields here. 05:02.890 --> 05:09.410 You can go and add and say I want to filter for that value and I want to take out that value. 05:09.470 --> 05:20.410 And you'll see that that value for the log type is actually filtered out and I'm only seeing now syslogs. 05:22.130 --> 05:26.350 So if you would, I like to call this the point-and-click hunt method. 05:26.350 --> 05:33.250 You can actually go through here and be like, well, I don't want to see DESPORT 3306 and take it out. 05:33.470 --> 05:36.770 And as you do that, you'll see your filters just pile up here. 05:37.510 --> 05:42.970 And if you want to, you can actually go and start adding your own filters from scratch. 05:57.670 --> 06:08.710 So you might not have a range of IPs or a specific IP that you know is just a distractor or maybe just noise or for your specific hunt, you don't want to see that traffic. 06:08.710 --> 06:14.750 So you can go in here and select that IP and say I don't want to see anything from that IP address. 06:15.150 --> 06:18.050 And you'll see my events drop because it took them out. 06:21.770 --> 06:23.990 Also, columns. 06:24.230 --> 06:29.990 Looking at this view here, you can see that right now all I see is the time and the source. 06:30.870 --> 06:38.470 But what if you want to see in a single view source IP or maybe the DESP IP? 06:38.470 --> 06:46.850 You can actually go through and here are all your columns that you could create based off of the fields in each of these logs. 06:52.540 --> 07:00.720 Another thing you can do is if you open up a log and you say, well, there's my DESP IP there. 07:00.720 --> 07:05.140 You see this small icon here that looks like a column. 07:05.680 --> 07:14.680 If you click that there, it automatically throws it up into the DESP IP column on this table. 07:15.460 --> 07:20.640 So now as you start narrowing down your hunts, you see the data that's pertinent to you. 07:20.640 --> 07:27.060 I'm looking for this specific actor talking to this specific network resource because it shouldn't be happening. 07:27.060 --> 07:34.680 Because the ultimate goal here, right, when you're hunting is to make this number as small as possible in your searches. 07:35.740 --> 07:40.400 Because you know for a fact that that's activity that should not be happening. 07:41.880 --> 07:50.180 Now, obviously, as you go, you're going to see some traffic that you need to deconflict and say, well, that is legit traffic and I don't want to see it. 07:50.400 --> 07:52.740 That's when I recommend building those filters. 07:52.740 --> 08:01.720 So as you go through, make sure you create filters for things that you don't find necessary in your searches. 08:04.020 --> 08:12.540 Moving on here, we're going to talk about how to query in Kibana. 08:12.540 --> 08:17.720 So, Kibana uses Lucene query language. 08:18.060 --> 08:22.940 If you're not familiar with it, there's lots of data out there on it. 08:22.940 --> 08:27.400 But the primary information you need to know about it is the operators that it uses. 08:29.020 --> 08:36.640 So, for example, let's say there's two specific IP addresses that you care about. 08:36.680 --> 08:39.640 And we'll look at these two here. 08:40.720 --> 08:46.980 So you want to know when and if these two machines here we're talking. 08:47.940 --> 08:57.240 So, what you can do is, you want to say source underscore IP. 09:10.950 --> 09:17.380 Source IP is that. 09:19.540 --> 09:25.400 And specifying that it has to match that operator. 09:25.400 --> 09:29.720 So you're saying it has to match this IP here. 09:29.720 --> 09:32.600 Otherwise, you don't want to see it. 09:39.510 --> 09:40.450 Boom. 09:40.450 --> 09:47.070 So you're saying those devices have never talked to each other in the last 15 minutes. 09:47.070 --> 09:53.990 Now, what if you say, well, I just want to know when this IP has talked to anybody. 09:54.510 --> 09:57.450 And when this IP, anybody's talked to it. 09:57.450 --> 09:58.590 Either or. 09:58.950 --> 10:04.290 So that's when you just drop change that and to an or operator. 10:07.290 --> 10:11.530 And now you're going to see that IP as the source. 10:14.100 --> 10:19.980 Somewhere down the line you'll see the other IP as the dest in a lot of the traffic. 10:21.360 --> 10:26.320 So, you just have to pay attention to some of your syntax. 10:26.720 --> 10:31.340 Again, there's a few things you want to consider. 10:31.760 --> 10:34.560 Lucene does use regex. 10:35.020 --> 10:43.680 So, what you might do is, maybe there's a file called evil file that you know about. 10:43.680 --> 10:52.580 You had an Intel drop and they say, hey, I need to go find, I know they clicked on a document and someone executed evil file. 10:53.260 --> 10:55.720 So, how would you search for that, right? 10:55.920 --> 11:02.840 Well, in Kibana, you can actually say, well, I just want to see anything called evil file. 11:03.980 --> 11:04.840 Okay. 11:05.040 --> 11:06.840 That's in the last 15 minutes. 11:06.900 --> 11:09.740 Maybe the last 24 hours. 11:19.210 --> 11:19.850 Nope. 11:19.850 --> 11:20.590 Nothing. 11:20.590 --> 11:21.450 Okay. 11:21.450 --> 11:25.390 So, what if I want to use regex? 11:25.390 --> 11:29.470 Well, because evil might be capitalized, or file might be capitalized. 11:30.030 --> 11:49.590 So, what you would do here, you specify here that you're throwing in some regex, and then here, wildcard, here, wildcard, and then do your search. 11:51.880 --> 11:54.760 Now, the problem is, there is no evil file. 11:56.320 --> 12:03.960 So, but what if you wanted everything in the last hour with the word file? 12:04.400 --> 12:05.240 Okay. 12:12.300 --> 12:17.760 So now, if you pull down here, it's referencing FileBeat. 12:19.780 --> 12:25.520 And mostly, you're going to see FileBeat because that is the agent that's pushing these logs to you. 12:25.520 --> 12:26.360 Okay. 12:26.360 --> 12:30.060 Well, let's take out FileBeat because I know that's my agent. 12:30.060 --> 12:31.540 I don't need to look at that. 12:31.660 --> 12:33.720 So, I go and filter that out. 12:34.460 --> 12:37.260 The negative sign magnifying glass. 12:41.230 --> 12:46.570 So, now, is there anything else referencing file? 12:46.690 --> 12:48.490 Program files. 12:48.730 --> 12:54.530 Oh, I didn't specify that I wanted it to end in file that wasn't plural. 12:56.390 --> 12:58.670 So, that's some of the things you've got to pay attention to. 12:58.670 --> 13:02.590 If you're really good with regular expressions, that can be helpful. 13:02.950 --> 13:10.470 Also, you can come in and specify that... because right now, I just said lowercase F, right? 13:10.610 --> 13:16.130 But what if you want to tell in regex, it could be also uppercase F. 13:19.380 --> 13:27.400 And as you notice, I'm getting pretty specific with the regex and already my events in the last hour have dropped down to 12,000. 13:28.300 --> 13:37.580 And our goal at the end of the day is to make our events as little as possible so you can start narrowing down the bad. 13:41.690 --> 13:42.130 Alright. 13:42.130 --> 13:43.970 So, another useful tool. 13:44.810 --> 13:52.220 So, sometimes you're going to come across logs that don't have the data that you're looking for. 13:53.940 --> 13:56.900 I see destip with an empty field here. 13:56.940 --> 13:59.260 Sometimes you're going to see message fields with an empty field. 13:59.260 --> 14:01.980 Sometimes you're going to see file paths with an empty field. 14:02.840 --> 14:07.520 Sometimes that's something worth looking at, but sometimes you're like, I really need to know the file path. 14:07.520 --> 14:09.020 I really need to know the destip. 14:09.020 --> 14:13.040 So, we'll use destip as the example here. 14:13.120 --> 14:15.500 So, I'll pick a source IP. 14:24.620 --> 14:33.200 So, what I'm saying here is I want to know when this system talks to anybody. 14:33.380 --> 14:42.060 Because if I just search that there, I will still see this log with no destination IP. 14:43.660 --> 14:49.000 But, I want something with some data. 14:49.000 --> 14:55.080 So, what I'll do here is an exist operator. 15:04.320 --> 15:14.900 And now I'm saying I want to know when that IP is the source and the destip has content in the field. 15:15.420 --> 15:17.200 So, let me update that up. 15:17.400 --> 15:18.440 So, what does that tell me? 15:18.440 --> 15:26.900 That tells me that system never talked to anybody or there's no log of that system talking to anybody in the last hour. 15:27.180 --> 15:31.820 We can go back a week and let's see if we find anything. 15:31.820 --> 15:32.820 Nope. 15:33.620 --> 15:44.880 So, that might be worth looking into because you've now got a log of this system talking, but what is it doing? 15:44.880 --> 15:46.440 So, that might be worth investigating. 15:46.440 --> 15:49.840 Obviously, if Intel provides that kind of content. 15:50.920 --> 15:52.520 Let's push here. 15:55.550 --> 15:58.350 Let's talk about what else you could search. 15:58.550 --> 16:01.630 So, important artifacts, right? 16:01.630 --> 16:04.390 Hashes, imp hashes. 16:05.110 --> 16:15.290 The way that, and I forgot to tell you this at the beginning, but Kibana is actually showing you the same data that Greylog is showing you. 16:15.290 --> 16:30.750 As you can see by the index here, there's one single index, which on other instances of your ELK stack, you might see multiple index patterns that are saying that I'm getting logs from multiple different sources. 16:30.750 --> 16:37.150 But for the OpenSock range, this tool is actually pointing to the same data that Greylog is pointing to. 16:37.150 --> 16:44.550 So , disclaimer, if you use Greylog, if you use Kibana, you can choose what you feel more comfortable with. 16:46.350 --> 16:50.950 What you find easier to use, but they're both showing the same data. 16:52.030 --> 17:03.170 So, but I will say the way that Greylog is parsing this data is different than how Kibana is getting this data parsed in. 17:03.170 --> 17:14.830 So, you have to consider, if you're looking for an imp hash, there's a possibility, there's a field for it in Greylog, and there's a possibility that there's not a field for it here. 17:15.290 --> 17:16.610 They do exist. 17:17.130 --> 17:19.990 So, why are imp hashes important? 17:20.750 --> 17:22.930 Well, find out. 17:25.520 --> 17:37.200 So, what I'm doing here is I'm actually just looking for any imp hash and find out what field that data is in, because there is no imp hash field. 17:44.010 --> 17:46.290 So, I've got a few hits on it. 17:46.670 --> 17:51.610 Right now, no source and destination IPs, but let's go ahead and expand a log and see what we're looking at. 17:54.570 --> 18:06.350 So, we've got a driver called agent.exe and remote IPs, and we've got an imp hash for this file. 18:06.350 --> 18:15.490 Now, if you deem this file to be bad at any point, then you now got the imp hash for it and you can find every execution of it. 18:15.490 --> 18:24.750 So, that's another quick artifact, but all I did was search the word imp hash, and I found all the logs that have imp hashes associated with it. 18:24.750 --> 18:32.570 Now, you're going to have to do some more digging and filtering because, obviously, you're going to find a file with an imp hash that could be legit. 18:32.970 --> 18:34.730 So, just something to consider. 18:35.630 --> 18:39.270 That's just a plain text query there. 18:40.790 --> 18:49.920 Also, more basic, if you're looking for event IDs, everybody knows what a 4624 is. 18:50.740 --> 19:00.720 And if you don't, get your event IDs out, Google a sheet of the top event IDs to keep an eye on. 19:00.720 --> 19:08.800 Microsoft has a sheet from severity levels that's important to look at. 19:09.540 --> 19:18.820 But if you look here, I just looked for all the 4624s for this week, and I'm now looking at all the logons. 19:18.980 --> 19:20.120 Successful logons. 19:20.120 --> 19:21.940 You've got security IDs. 19:23.100 --> 19:30.020 And something I failed to mention, you want to pay attention to the message column here. 19:30.020 --> 19:36.300 So, what I like to do is keep the... I'm going to pull this out here. 19:36.300 --> 19:40.680 Go down to the message field and actually filter out for that column. 19:41.100 --> 19:53.540 Because now, I can just scroll down and start looking through and saying, hey, this is some stuff, but I don't care about S100, Sid. 19:54.140 --> 19:55.940 I don't care about that. 19:57.460 --> 20:00.500 So, let's see how we can filter that out. 20:03.620 --> 20:05.280 So, not. 20:07.240 --> 20:08.440 Excuse me. 20:09.160 --> 20:10.360 And not. 20:36.710 --> 20:37.830 There we go. 20:37.830 --> 20:45.830 I just took out all the S100s, and now I can start seeing some other security IDs that have logged in. 20:45.870 --> 20:50.550 And if you want, you can go down and start narrowing down the system names. 20:50.550 --> 20:52.050 There's your host names there. 20:52.050 --> 20:55.070 And you can say, I don't care about ACC1. 20:55.070 --> 20:56.430 That guy's a good guy. 20:56.430 --> 20:58.090 Let me keep moving. 20:58.370 --> 21:00.050 But I do care about... 21:01.010 --> 21:02.210 Let's maybe say... 21:04.170 --> 21:05.790 Who we got here? 21:06.330 --> 21:07.890 Under host name. 21:08.910 --> 21:11.290 Oh, that's ACC101 again. 21:11.410 --> 21:13.110 But you get the drift, right? 21:13.110 --> 21:17.330 I'll filter out for ACC... that was the username, but same difference. 21:19.890 --> 21:22.550 So, I've now filtered out for ACC1. 21:22.550 --> 21:28.030 I said, I want to see 4624s, but I don't care about S100. 21:29.650 --> 21:31.650 That's how you would do that there. 21:32.170 --> 21:40.970 You can get a little bit more complex here and start looking at data paths and file paths and image path names. 21:41.570 --> 21:43.030 So, let's look at... 21:43.550 --> 21:45.590 Let me pull this out here. 21:46.250 --> 21:47.530 Flip to a new one. 21:50.370 --> 21:50.850 And... 21:51.830 --> 21:52.890 I want to see... 21:54.110 --> 21:55.590 Let's just look at... 21:56.650 --> 21:58.150 System on here. 21:59.450 --> 22:01.430 Let's just look at Beats logs. 22:02.190 --> 22:03.970 So, I'm going to say, I want to see... 22:09.710 --> 22:10.870 Here we go. 22:11.190 --> 22:13.290 Something to keep in mind, Beats, right? 22:13.370 --> 22:17.010 Beats are the agents that are actually shipping the logs to your log stash. 22:17.830 --> 22:24.410 Now, keep in mind, Winlogbeat, Windows event logs, security, application, then you've got your PowerShell logs. 22:24.410 --> 22:28.250 Everybody knows PowerShell is always good, but you might want to look at it anyway. 22:28.490 --> 22:29.290 Hint, hint. 22:29.630 --> 22:34.810 So, what I'm going to do here is go ahead and filter out and say, I just want to see Winlogbeat logs. 22:39.240 --> 22:40.000 And then... 22:47.140 --> 22:50.180 I want to search for a specific event ID. 22:51.020 --> 22:55.000 Or, you know, better yet, let's see if we can start filtering for different file paths. 22:55.000 --> 22:58.740 So, let's find the file path field. 23:15.350 --> 23:16.510 Here we go. 23:16.670 --> 23:18.290 Very minimal logs, right? 23:18.290 --> 23:20.150 Where the file path exists. 23:20.410 --> 23:22.670 So, here's the file path. 23:22.670 --> 23:25.330 I've got users, I've got folders here. 23:25.330 --> 23:29.570 But I want to just know where this user here might have looked at... 23:30.990 --> 23:36.170 Or what files this user has actually executed, or file created, right? 23:36.170 --> 23:39.450 So, let's say I want to filter by file create. 23:39.450 --> 23:40.910 So, I go here. 23:42.630 --> 23:48.470 And I can either say in a specific path, or I can say a specific user. 23:48.470 --> 23:52.890 But I want to know when anything, let's say, created in this AppData path here. 24:18.080 --> 24:20.360 So, I'm going to do a regex here. 24:28.350 --> 24:28.910 Say... 24:28.910 --> 24:30.190 Anything. 24:31.350 --> 24:34.190 And then close my regex. 24:34.250 --> 24:35.370 Anything. 24:38.960 --> 24:43.940 And then, because it's regex, you've got to escape your characters. 24:47.380 --> 24:53.680 And we'll take out... for simplicity. 25:11.570 --> 25:13.070 There we go. 25:13.270 --> 25:15.190 That's a hefty one there. 25:15.330 --> 25:19.970 But, I'm down to 32 events in the last 15 minutes, right? 25:19.970 --> 25:28.510 That, right there, is I've now narrowed down every time a file was created by Claudia Davis, or maybe not by Claudia Davis, just in her path. 25:30.490 --> 25:32.210 In the AppData path. 25:32.210 --> 25:33.510 And what's in AppData? 25:33.510 --> 25:34.410 Temp folders. 25:34.410 --> 25:35.950 So, keep that in mind. 25:35.950 --> 25:36.930 Keep going. 25:39.550 --> 25:41.410 So, something else you can do. 25:42.410 --> 25:51.270 And, if you come across a query, like this hefty one here, that maybe sometimes, oh, I want to just swap out the user and use that search over again. 25:51.310 --> 25:53.430 You could just copy and paste it to a text file. 25:53.430 --> 25:58.410 Or, you can get real fancy with it and go and start saving some of your searches. 25:58.410 --> 26:04.110 And so, Claudia Davis file create. 26:04.110 --> 26:04.910 Great. 26:06.370 --> 26:08.390 So, you confirm that. 26:08.890 --> 26:15.150 And, at any given time, you start opening up a fresh Kibana page. 26:17.170 --> 26:20.950 You can go in and say, where's my search? 26:20.950 --> 26:22.030 Oh, there we go. 26:22.030 --> 26:23.410 Claudia Davis. 26:23.410 --> 26:29.310 Because now I want to look at James Brown, or I want to look at Kanye West. 26:29.410 --> 26:34.550 So, that's some of the things you want to start doing as you go, because you're going to use these queries over again. 26:34.550 --> 26:39.310 If not, you're going to use the shell of it for a different file path for a different user. 26:39.510 --> 26:42.370 And that's something that might be useful for you down the line. 26:44.410 --> 26:48.230 Now, there's some other stuff you can do with visualizations. 26:48.230 --> 27:00.430 So, you can actually pull in a visualization and save search as a visualization, or you can create your own. 27:00.650 --> 27:03.850 A lot of times I like to create tables and look at time frames. 27:03.850 --> 27:18.230 They're real good for looking at live data, but you can also look at over a span of time and say, hey, I want to see how many times this system has used SMB, or I want to see how many times Quad4 protocol was used. 27:18.430 --> 27:24.710 And then you can actually just have it on a table, throw it in a visualization, and pop it up any time you want to start. 27:26.390 --> 27:31.190 Just keep in mind, hey, this came across during this time frame that I'm already inspecting. 27:31.430 --> 27:33.290 And then you can use that. 27:33.290 --> 27:38.270 And I'll just show you a quick one here, because you can get pretty caught up in it. 27:42.800 --> 27:44.460 We're going to do the count here. 28:00.790 --> 28:03.170 We're going to aggregate it on a term. 28:04.650 --> 28:11.810 In the field, we're going to add, let's say, IP source. 28:12.190 --> 28:14.230 Excuse me, source IP. 28:18.450 --> 28:19.810 There it is. 28:20.310 --> 28:23.050 And we're going to say you want to see the top five. 28:23.950 --> 28:27.210 You can call that source, you can label it, whatever you want. 28:28.750 --> 28:30.090 Hit play. 28:30.410 --> 28:31.530 There you go. 28:31.530 --> 28:37.450 What this is showing you here is just the log counts for each of these sources here. 28:37.530 --> 28:42.790 That's a super quick way to start seeing, in this time frame, who was talking the most. 28:42.790 --> 28:43.950 Is that data exfil? 28:43.950 --> 28:46.830 Is that port scanning? 28:46.830 --> 28:49.210 Is that some of the stuff you want to start paying attention to? 28:49.210 --> 28:50.750 Look at the count of the logs. 28:50.750 --> 28:52.850 That's a low-level hunt that you can do. 28:53.290 --> 28:58.170 But you can go in and you can use the same concept and throw in protocols. 28:58.170 --> 29:00.230 You can make a bar graph out of it. 29:00.230 --> 29:02.030 You can make a pie graph out of it. 29:02.030 --> 29:05.390 But I like to use them more for live hunts. 29:05.790 --> 29:09.710 But for this exercise, you're probably going to spend most of your time in Discover. 29:19.150 --> 29:20.190 All right. 29:20.850 --> 29:27.750 I think I kind of gave you the low-level, or high-level rather, rundown of everything. 29:27.750 --> 29:29.170 I don't want to take up more of your time. 29:29.170 --> 29:31.070 You've got a lot of tools to learn today. 29:31.450 --> 29:35.510 And there's a lot of time you can go spend playing with Kibana. 29:36.170 --> 29:40.370 There's a couple of videos out there that you can do. 29:40.370 --> 29:46.030 I can give you all some resources if you just hit me up in the Open Sock Discord channel. 29:46.030 --> 29:47.630 We've got a Kibana channel. 29:47.630 --> 29:52.730 And then also, there's some more advanced Kibana users out there. 29:52.730 --> 29:57.170 I'm definitely not the know-all, but I've seen my way around it. 29:57.490 --> 30:04.350 But we've got an Ask for Help channel over in the Open Sock Discord willing to answer any questions. 30:04.350 --> 30:10.450 A lot of the Open Sock veterans that have played Open Sock before have used Kibana before. 30:10.450 --> 30:17.270 They've got some tips and tricks, and they can get you sorted out. 30:17.270 --> 30:19.590 So, thank you for your time today. 30:19.590 --> 30:23.630 If you need anything, again, just hit us up on the Discord, and we'll talk soon. 30:25.950 --> 30:27.250 Thanks a lot, TJ. 30:27.250 --> 30:28.610 That was a great talk. 30:29.050 --> 30:34.130 As he pointed out, check out the Recon Iposec Discord channel if you're looking for Open Sock questions. 30:34.350 --> 30:37.330 They're over there to assist you as needed. 30:37.730 --> 30:38.510 I appreciate it. 30:38.510 --> 30:39.190 Thanks again.