Active Directory Project (Home Lab) | Part 3

Summary

This video tutorial guides viewers through the installation and configuration of Sysmon and Splunk on a server, emphasizing the importance of monitoring and analyzing security data. It covers the creation of an 'endpoint' index, setting up data reception, and verifying incoming events. The speaker encourages viewers to engage with additional resources for a deeper understanding and highlights potential troubleshooting. Viewers are invited to participate in a giveaway and to stay tuned for the next segment, which will focus on Active Directory installation. The overall aim is to enhance users' skills in cybersecurity and data analysis.

Takeaways

• 😀 The Splunk server configuration is finalized by logging into the Splunk web portal.
• 🔍 Create an index called 'endpoint' to store events as defined in the inputs.conf file.
• 📥 Ensure the Splunk server can receive data by configuring the default receiving port (9997).
• 🗂️ The newly created 'endpoint' index can be verified in the list of available indexes in Splunk.
• 📊 Use the search bar to query the 'endpoint' index and view incoming events.
• 🕒 Events are displayed for the last 24 hours, allowing for immediate analysis.
• 📋 Confirm the presence of hosts and sources as specified in the inputs.conf file.
• 📖 The video encourages viewers to refer to Splunk documentation for detailed guidance.
• 👩‍🏫 A SOC course is available, focusing on building queries in Splunk to detect malicious activity.
• 🔄 Remember to restart the Splunk service after updating the inputs.conf file to ensure changes take effect.

Q & A

What is the primary purpose of configuring Splunk in this video?

The primary purpose is to install and configure Splunk to receive and analyze data from Sysmon, enhancing monitoring and security capabilities.

What credentials are used to log into the Splunk web portal?

The credentials used are the username and password created during the installation of Splunk on the server.

How do you create a new index in Splunk?

To create a new index, go to Settings > Indexes, then click on 'New Index', enter the name 'endpoint', and save it.

What is the significance of the 'endpoint' index?

The 'endpoint' index is where all events defined in the inputs.comom file are sent and stored for analysis.

Which port is configured for receiving data in Splunk?

Port 9997 is configured as the default receiving port for incoming data.

How can you verify that data is being received in Splunk?

To verify data reception, select Apps > Search and Reporting, input 'index=endpoint', and check for events within the last 24 hours.

What steps should be taken after configuring Splunk and Sysmon?

After configuration, ensure that the Splunk service is running, update the computer name to 'ad DC01', and restart the machine.

What is suggested for those who want to learn more about Splunk?

Viewers are encouraged to check Splunk's documentation and consider enrolling in the speaker's course on building queries for security analysis.

What should viewers do if they encounter issues during setup?

Viewers are advised to research any uncertainties or problems they encounter during the setup process.

What interactive element is included in the video for viewers?

The video includes a giveaway, inviting viewers to leave a heart in the comment section to participate.