# SOC Practical Assessment

## Task:

SOC ENGINEERING: PRACTICAL&#x20;

Link: **http://198.96.95.202:5601/login?next=%2F**&#x20;

### A. SIEM

Local Audit Policies:&#x20;

* Add local audit policies to your machine.

Log Generation:

* Generate some administrative activities that trigger logs.

Log Transmission:

* Send logs using Winlogbeat.

Hostname Format:

* Ensure your machine’s hostname follows the&#x20;
* format: GROUP#\_FIRSTNAME\_LASTNAME

### B. Fluentbit

Regex Parser:

* Write a regex parser for this log file (extract at least 8 key fields, but you MUST extract the source IP and Destination IP).

Log Indexing:

* Send the parsed logs to the SIEM.
* Your index should be named: GROUP#-FIRSTNAME-LASTNAME-Fluentbit

Dashboard Creation:

* Create a descriptive dashboard for the logs, visualize some important fields. &#x20;

### C. SOAR

Create a new workflow in Tines and do the following steps:

IP Extraction:

* Using the Fluentbit index created in elastic, extract all destination IP addresses.

Threat Intelligence:

* Send the IP addresses to VirusTotal to scan their reputation.

Email Notification:

* Send an email to soc.weinnovate@gmail.com containing the filtered IP addresses that seem to be malicious.&#x20;
* The subject of your email MUST be in this format: GROUP#\_FIRSTNAME\_LASTNAME&#x20;

### Bonus Challenge:&#x20;

* Integrating additional threat intelligence feeds (ex: AbuseIPDB).
* Using winlogbeat index created extract logs with event id: \[4720,4725,4726]
* Extract Most important details from extracted logs (ex: event.action, related users, targetUser).
* Send an email to Soc.WeInnovate@gmail.com containing Extracted details, The subject of your email MUST be in this format: GROUP#\_FIRSTNAME\_LASTNAME\_Account\_Management\_Summary

## A. SIEM

Let's begin by configuring Local Security Policies on our system.

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2FsYhFuXjLYBo6ASXsv5vZ%2FScreenshot(1).png?alt=media&#x26;token=bc48c2cd-728a-482a-932e-86490ab60f86" alt=""><figcaption></figcaption></figure>

* **Success** (to log successful account changes)
* **Failure** (to log failed attempts)

Now, let's generate some logs by creating a new user and then deleting it to verify that everything is functioning correctly.

To create a new user account:

```powershell
net user Ahmed ahmed123 /add
```

To disable the user account:

```powershell
net user Ahmed /active:no
```

To delete the user account:

```powershell
net user Ahmed /delete
```

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2Fsmg3JNctbiYtfma2Oku3%2FScreenshot(2).png?alt=media&#x26;token=03c2dc26-2fc5-4799-a252-0946c69b4fd9" alt=""><figcaption></figcaption></figure>

Let's ensure that these actions are properly recorded in the log files.

**4720** → A user account was created.

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2FcBjyvDndbVfNSb7Aeak7%2FScreenshot(3).png?alt=media&#x26;token=447332bb-f3ec-4147-ad53-213c3f7ea913" alt=""><figcaption></figcaption></figure>

**4725** → A user account was disabled.

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2FHuoKpIwfbJKP1fZAdBqu%2FScreenshot(4).png?alt=media&#x26;token=a0a7085d-3ad0-49c1-b2d0-63609e65b0a2" alt=""><figcaption></figcaption></figure>

**4726** → A user account was deleted.

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2FaPTJhrrZEJjtNjoHEm1x%2FScreenshot(5).png?alt=media&#x26;token=73f6b8c7-f969-4968-a0f2-a1648ddef289" alt=""><figcaption></figcaption></figure>

Next, we will download Winlogbeat and configure its configuration to forward logs to Elasticsearch.

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2FqkmiQi3fj2ASxThpcMBN%2FScreenshot(6).png?alt=media&#x26;token=5231fe81-ab9f-42ff-ac9f-e9caa3baaf4e" alt=""><figcaption></figcaption></figure>

Next, we will initiate the Winlogbeat service to begin forwarding logs to Elasticsearch.

```powershell
Start-Service winlogbeat
```

Now, let's test the output, and if everything is functioning correctly, we will forward the logs to ELK.

```powershell
.\winlogbeat.exe test output -c .\winlogbeat.yml -e
```

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2FWbL89If6V5LVIZ8NY6zq%2FScreenshot(7).png?alt=media&#x26;token=77d87799-955e-4168-aa87-2ed8919c4400" alt=""><figcaption></figcaption></figure>

```powershell
.\winlogbeat.exe -c .\winlogbeat.yml -e
```

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2FG2OvXwLyY8CBIiwtXgAw%2FScreenshot(8).png?alt=media&#x26;token=7db1ce07-40af-4a4c-ad39-84b6af9b64d3" alt=""><figcaption></figcaption></figure>

Now, let's access ELK to verify that the logs have been successfully sent.

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2FEQv4SMImZfDJk91Lizgo%2FScreenshot(9).png?alt=media&#x26;token=ff9d3fa7-0248-47a3-ba2a-b7c54062ca74" alt=""><figcaption></figcaption></figure>

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2FOTVVLD4pgbav72JkArLS%2FScreenshot(10).png?alt=media&#x26;token=764f9575-f41d-443c-a054-ec2f0d5c43e8" alt=""><figcaption></figcaption></figure>

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2FSh3ZC5h2VN45iLlSCToH%2FScreenshot(11).png?alt=media&#x26;token=c9558a66-3c2f-4450-8c59-5af3aa126134" alt=""><figcaption></figcaption></figure>

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2F0vdS0miwyRQyQgU5V5gk%2FScreenshot(12).png?alt=media&#x26;token=0499bd92-f865-43d0-aacf-bb7eb058226c" alt=""><figcaption></figcaption></figure>

## B. Fluentbit

Let's begin by installing Fluent-Bit on Windows.

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2Fmm4MbdVucayfgPhFS6jr%2FScreenshot(13).png?alt=media&#x26;token=20c6c8ab-8676-4f04-a131-eadfa3127e28" alt=""><figcaption></figcaption></figure>

We have a log file named _**`firewall-log.log`**_ that we need to be ingested into the ELK stack. To ensure accurate data extraction, we will begin by crafting an appropriate regular expression to parse the required information.

```regex
date=(?<date>\d{4}-\d{2}-\d{2})\s+time=(?<time>\d{2}:\d{2}:\d{2})\s+
devname="(?<devname>[^"]+)"\s+devid="(?<devid>[^"]+)"\s+logid="(?<logid>[^"]+)"
\s+type="(?<type>[^"]+)"\s+subtype="(?<subtype>[^"]+)"\s+eventtype="
(?<eventtype>[^"]+)"\s+level="(?<level>[^"]+)"\s+vd="(?<vd>[^"]+)"\s+
policyid=(?<policyid>\d+)\s+sessionid=(?<sessionid>\d+)\s+srcip=(?<srcip>\d{1,3}\.
\d{1,3}\.\d{1,3}\.\d{1,3})\s+srcport=(?<srcport>\d+)\s+dstip=(?<dstip>\d{1,3}\.
\d{1,3}\.\d{1,3}\.\d{1,3})\s+dstport=(?<dstport>\d+)\s+srcintf="
(?<srcintf>[^"]+)"\s+dstintf="(?<dstintf>[^"]+)"\s+service="
(?<service>[^"]+)"\s+hostname="(?<hostname>[^"]+)"\s+profile="(?<profile>[^"]+)
"\s+direction="(?<direction>[^"]+)"\s+virusname="(?<virusname>[^"]+)"\s+action=
"(?<action>[^"]+)"\s+msg="(?<msg>[^"]+)"
```

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2FH6ujsaEgen18Rhy0ISdt%2FScreenshot(14).png?alt=media&#x26;token=cf2a6c97-bc7b-4292-a1aa-46590f8fa1fc" alt=""><figcaption></figcaption></figure>

Next, we need to modify the **`parsers.conf`** file located in **`C:\Program Files\fluent-bit\conf`.**

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2FuKFsXhtAVJ90PJvFq9gE%2FScreenshot(22).png?alt=media&#x26;token=fb57a8d7-0c84-4119-a380-104b930516cb" alt=""><figcaption></figcaption></figure>

Next, we need to configure the `fluent-bit.conf` file, located at `C:\Program Files\fluent-bit\conf`, to forward logs to the ELK stack.

```yaml
[SERVICE]
    flush        1
    parsers_file parsers.conf
    plugins_file plugins.conf

[INPUT]
    Name         tail
    Parser       firewall-logs
    Path         C:\Users\Fares\Downloads\firewall-log.log
    Tag          firewall.logs
    
[OUTPUT]
    name    	  es
    Host    	  192.168.204.146
    Port    	  9200
    Match   	  *
    HTTP_User     elastic
    HTTP_Passwd   =Op+25maKY3GqC=IrV7m
    Index         group1faresmorcy
    tls           on
    tls.verify    off 
    Trace_Output  on 
    Suppress_Type_Name on

[OUTPUT]
    name  stdout
    match *
```

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2FbzqroosGGPlvwo1YKysK%2FScreenshot(16).png?alt=media&#x26;token=541b8a1f-2d88-44e2-b7aa-c86298c17187" alt=""><figcaption></figcaption></figure>

Now, let's run Fluent Bit:

```powershell
.\fluent-bit.exe -c 'C:\Program Files\fluent-bit\conf\fluent-bit.conf'
```

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2FeLfIBcCjNLCXom50YNhK%2FScreenshot(21).png?alt=media&#x26;token=7025d190-1cf6-498f-b577-15cab95cb367" alt=""><figcaption></figcaption></figure>

We need to duplicate some lines within the _**`firewall-log.log`**_ file and save the changes.

Let's confirm whether the logs are successfully being forwarded to ELK.

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2F7ymzRcE2NFCFSWcA6szX%2FScreenshot(23).png?alt=media&#x26;token=0e507185-0522-43ea-a059-c4feb5d63603" alt=""><figcaption></figcaption></figure>

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2FdPJKLuEVgXGolwlAvC7o%2FScreenshot(24).png?alt=media&#x26;token=47ca0081-8a4a-416d-9f94-6f921e00beac" alt=""><figcaption></figcaption></figure>

Now, it is time to create a dashboard utilizing these logs.

First, I created a new data view using the `group1faresmorcy` index. Next, I will proceed with building a dashboard for this index.

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2FYFVbisiru1iyN1d0CixX%2FScreenshot(25).png?alt=media&#x26;token=4958c8ed-b1f7-4d1d-ab6a-f47d51d7db9f" alt=""><figcaption></figcaption></figure>

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2FRFml4LdYnELm4CnemD8G%2FScreenshot(26).png?alt=media&#x26;token=1797b36b-c8ea-4a87-8cde-41799c81ff37" alt=""><figcaption></figcaption></figure>

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2FRr57MOOonAawGRv1SDG7%2FScreenshot(27).png?alt=media&#x26;token=a1a73f42-ebc2-4ab3-9f8a-41028568aba8" alt=""><figcaption></figcaption></figure>

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2FJHn74vDVvapFsFLBoBTs%2FScreenshot(28).png?alt=media&#x26;token=2fa40979-3101-423c-896b-86bf3b3560dd" alt=""><figcaption></figcaption></figure>

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2FhBMrOPPzp78jxmFhdaj3%2FScreenshot(29).png?alt=media&#x26;token=d6d19159-3bfc-4438-a5ab-5bcc6dee104f" alt=""><figcaption></figcaption></figure>

## C. SOAR

Using the Fluentbit index created in elastic, we need to extract all destination IP addresses.

First, we need to configure Ngrok to establish a secure connection between Tines and the Elasticsearch.

```bash
ngrok http https://192.168.204.146:9200/
```

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2F87mDAgbOM19YVHDeILay%2FScreenshot(30).png?alt=media&#x26;token=eb630ce2-4805-4070-9551-ef3948577150" alt=""><figcaption></figcaption></figure>

Let's send an HTTP request using Tines to retrieve the information of the **`group1faresmorcy`** index.

First, let's examine this URL to determine the necessary information.

**`https://70fa-197-43-37-185.ngrok-free.app/group1faresmorcy/_search`**

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2FBC5u6YM43UmHlar5m5iF%2FScreenshot(31).png?alt=media&#x26;token=2046d3ef-d650-4eec-8bb3-bbef6dab0f75" alt=""><figcaption></figcaption></figure>

Now, let's send an HTTP request to this URL to retrieve only the destination IP address for further analysis and action:&#x20;

**`https://70fa-197-43-37-185.ngrok-free.app/group1faresmorcy/_search?_source=dstip&filter_path=hits.hits._source.dstip`**

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2FsCq1p992auuE1DiKE3fO%2FScreenshot(36).png?alt=media&#x26;token=ef336af6-34f2-481f-adeb-d2aa3b2f2f34" alt=""><figcaption></figcaption></figure>

We need to incorporate two additional configurations:

1. **Basic Authentication**
2. **Disable SSL verification**

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2FQSlyEzKBhPOeoKgwHhWZ%2FScreenshot(37).png?alt=media&#x26;token=5f45d774-b345-4b59-9da4-d1dc8905bd04" alt=""><figcaption></figcaption></figure>

Next, we will send the request and analyze the response.

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2F9I3lPi6RiTySN6D8bnGr%2FScreenshot(38).png?alt=media&#x26;token=da3d6e93-72c2-4715-9207-1937b569db5f" alt=""><figcaption></figcaption></figure>

Now, we need to extract the four destination IP addresses and submit them individually to VirusTotal for analysis.

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2F9Rly5fxn8Fum7CCsMceK%2FScreenshot(39).png?alt=media&#x26;token=0d420c8a-e132-409b-a7c7-850627ac13a4" alt=""><figcaption></figcaption></figure>

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2Fon1WEFSEadlqcsJNsZs9%2FScreenshot(40).png?alt=media&#x26;token=a75b458a-d792-4404-8796-19c66b86102f" alt=""><figcaption></figcaption></figure>

Next, we will submit these IP addresses to VirusTotal to determine whether they are associated with any malicious activity.

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2FyrO9lEJP7XaVJYn1s3e8%2FScreenshot(41).png?alt=media&#x26;token=febf5b70-f419-4678-8605-0e8f6a75d7ae" alt=""><figcaption></figcaption></figure>

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2FgYW6MJzlHp2gpNrZCmUX%2FScreenshot(42).png?alt=media&#x26;token=fdc8d46e-7821-41c1-982f-0d04098445b5" alt=""><figcaption></figcaption></figure>

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2FR6TPrI8tltLRGiKDLhRd%2FScreenshot(43).png?alt=media&#x26;token=a1254e1a-b2d9-4b29-ad10-2b260d4267f4" alt=""><figcaption></figcaption></figure>

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2FgrWBdKEKiLZDYstNalzO%2FScreenshot(44).png?alt=media&#x26;token=ececc420-ee80-480c-a60f-901c82318266" alt=""><figcaption></figcaption></figure>

Next, we need to determine whether the IP address is malicious.

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2FlzqNMbDcHglQRG3kR9du%2FScreenshot(45).png?alt=media&#x26;token=a79f226f-ade0-4b1b-9b1d-ea17507fafbe" alt=""><figcaption></figcaption></figure>

Next, we will send it to our email account.

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2FII5q6EPaZLIyVD9V2l28%2FScreenshot(46).png?alt=media&#x26;token=4f5da4c3-2db0-4f61-a8ab-0b615fa0c828" alt=""><figcaption></figcaption></figure>

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2FIDVVl6DTquHSITBRtmEY%2FScreenshot(47).png?alt=media&#x26;token=ba41a3e9-cfda-465c-81e3-53a7750f4847" alt=""><figcaption></figcaption></figure>

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2FmyQjJjoLq2TTX5GN18TH%2FScreenshot(48).png?alt=media&#x26;token=666c1503-f60c-4538-8bd7-daff11074f47" alt=""><figcaption></figcaption></figure>

## Bonus Challenge:&#x20;

* Integrating additional threat intelligence feeds (ex: AbuseIPDB).

Let's search for the IP addresses flagged as malicious by VirusTotal on AbuseIPDB.

First, we need to create an account and obtain an API key, which will be used to perform IP searches on AbuseIPDB through Tines.

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2FTBWXS86wLEte1X50JPZp%2FScreenshot(49).png?alt=media&#x26;token=9840379b-f4ed-447c-9f07-b3a48787bdbc" alt=""><figcaption></figcaption></figure>

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2FBTKvpw7OMI2RTmxzrJVD%2FScreenshot(50).png?alt=media&#x26;token=91067d7a-8d9f-4bce-9127-3dad8ef2189f" alt=""><figcaption></figcaption></figure>

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2F73xsNkMr1o90mhqKo05p%2FScreenshot(51).png?alt=media&#x26;token=c1b41a3a-4776-43c4-af58-76a4a40a733b" alt=""><figcaption></figcaption></figure>

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2FnJsv7R1HUePIP9RWBpNi%2FScreenshot(52).png?alt=media&#x26;token=231c634f-314e-415c-97b8-1f10e6a058b1" alt=""><figcaption></figcaption></figure>

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2FEIwC7BV0tF688mKHwHny%2FScreenshot(53).png?alt=media&#x26;token=112bc5d9-02f8-4e0a-8f09-d5b3e8fc9633" alt=""><figcaption></figcaption></figure>

Based on the data obtained from AbuseIPDB, we can send details of the malicious IP address, its associated domain, and the number of reports to our Gmail account.

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2FlmjUMWqvyAwIGJ4oAWIj%2FScreenshot(54).png?alt=media&#x26;token=92516063-4971-4846-94a4-fa81cc651add" alt=""><figcaption></figcaption></figure>

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2FMzOrJwJhIUcz4cgNfPa8%2FScreenshot(55).png?alt=media&#x26;token=afdc11be-c95e-4b06-89f1-78e7bfa467c3" alt=""><figcaption></figcaption></figure>

* Using winlogbeat index created extract logs with event id: \[4720,4725,4726]
* Extract Most important details from extracted logs (ex: event.action, related users, targetUser).

First, let's rename the Winlogbeat index we initially created to a different name.

But first, we need to create a new index to reindex the data from the old index into the new one.

```json
PUT /winlogbeat-fares-morcy
{
  "settings": {
    "number_of_shards": 1,
    "number_of_replicas": 1
  }
}

POST /_reindex
{
  "source": {
    "index": ".ds-winlogbeat-8.17.2-2025.02.24-000001"
  },
  "dest": {
    "index": "winlogbeat-fares-morcy"
  }
}
```

Let's verify that the logs are now present in the new index.

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2FA5qtGnFWqSNqeYf29JAb%2FScreenshot(59).png?alt=media&#x26;token=b4916c51-8e06-4593-982e-602ac33da7bb" alt=""><figcaption></figcaption></figure>

I have added additional columns to retrieve the necessary details and send them to our email account.

Now, let's make another story on tines and send HTTP Request to get the info of `winlogbeat-fares-morcy` index.

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2F4CYnR8XCyWuSfT1zIUw8%2FScreenshot(60).png?alt=media&#x26;token=de030992-e914-42c0-a9a1-8710c58a0111" alt=""><figcaption></figcaption></figure>

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2F42NN6MguVrFIcmaiDH9j%2FScreenshot(61).png?alt=media&#x26;token=63c7a2eb-4ed4-4c5d-a427-d7f3fc8e73ca" alt=""><figcaption></figcaption></figure>

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2Fw9ODKunpknQpgSJjsU7h%2FScreenshot(62).png?alt=media&#x26;token=06f179d6-d049-42e8-baf5-bfd2b22142a9" alt=""><figcaption></figcaption></figure>

We now need to isolate each event individually to facilitate further analysis and actions.

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2FRO977XL9cT6wbl3OuAtC%2FScreenshot(63).png?alt=media&#x26;token=05c198ae-fece-4c43-9dd9-3706c74863ed" alt=""><figcaption></figcaption></figure>

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2FvXSmkhKZJa3Y6zMC7Cor%2FScreenshot(64).png?alt=media&#x26;token=781ef72b-047e-415a-be07-ab4dec223c6c" alt=""><figcaption></figcaption></figure>

We now need to send the important information to our email account, including details such as `event.action`, `related users`, and `targetUser`.

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2FS5OcUiBibSVOpEEmc4UX%2FScreenshot(66).png?alt=media&#x26;token=86ff05a5-fcfc-49d9-b4c3-6075d6fa52f5" alt=""><figcaption></figcaption></figure>

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2F8SHM4AoH0IU0vECDGQSg%2FScreenshot(67).png?alt=media&#x26;token=0cfbe267-5c8b-4b9d-9066-43787313a9f2" alt=""><figcaption></figcaption></figure>
