How I prepared my toolkit and mindset for a week-long SOC and Digital Forensics challenge.
Introduction
The challenge's foundation was established on Day 1. I installed necessary tools, prepared the DFIR lab environment, and adjusted my perspective for a week-long, systematic dive into digital forensics and SOC operations. To properly develop, evaluate, and probe in the days ahead, this preparation guaranteed the technical readiness and unclouded focus required.
The Mindset - Prepare to Perform
- There is a limit to the usefulness of theory. The real learning happens when you dig into packets, decode log entries, and follow leads through a disk image. I was overjoyed to take part in the week-long SOC and DFIR competition known as HackSecure Secure Track.
- The Crucial Takeaway: Troubleshooting tool installations on the first day of a competition is the fastest way to lose momentum.
- My objective for 'Pre-Day 0' is to remove any technical barriers in advance. My lab would be a specialized area where my ability, not my setup, would be the only variable.
Choosing Your SIEM - The SOC's Brain
What is a SIEM?
A contemporary SOC is built around a Security Information and Event Management (SIEM) system. It is the "central pane of glass" where logs from all systems—servers, networks, and endpoints—are combined, compared, and risks are examined.
Splunk Enterprise (Free Version) is what I would choose.
What makes Splunk? SPL, its robust query language, is a standard in the industry. Being proficient in this area is quite beneficial.
What's the Free Version for? It can process up to 500MB of data per day, which is more than sufficient for most challenging situations and a personal lab. Despite having this daily data cap, it is entirely functional.
Downloading Splunk Enterprise
Step 1: Navigate to the Splunk Website
You can go to the official Splunk website and find the "Download Splunk Enterprise page.
Step 2: Select the Correct Package
Since my host machine is Windows 10/11, I selected the Windows MSI installer.
Create Account
I need to create an account to download the free version. Accept the license agreement and download.
Installing Splunk Enterprise
Run the Installer
Could you execute the downloaded MSI file? The installation wizard is straightforward.
Accept the license agreement.
Choose the installation directory. The default is usually fine (C:\Program Files\Splunk).
Complete Setup
The installer will set up all necessary services. Once finished, Splunk will be running as a service on your machine.
Accessing the Splunk Enterprise
First Access
Open your web browser and go to http://localhost:8000
The first-time login credentials are:
Username: admin
Password: xxxxxxxx
Recognizing the Data Collector, or Universal Forwarder
What is Universal Forwarder?
One function of the Universal Forwarder (UF), a lightweight, specialized Splunk version, is to dependably gather data from a source machine and forward it to your primary Splunk server (the Indexer).
Why do I need it?
The server that generates logs is not where you would examine them in a real lab. They would go to your central SIEM. The agent you install on Windows, Linux, and macOS computers to import their data into Splunk is called the UF.
Is it necessary for an introductory lab?
You may monitor files using Splunk's built-in inputs for a simple setup on a single machine. Nonetheless, setting up and designing a UF is advised for a more realistic lab and is an essential professional skill.
The Splunk Enterprise Dashboard
Setting Up and Configuring a Conceptual Universal Forwarder
- Download the UF first: I downloaded the Splunk Universal Forwarder package for Windows from the same Splunk download page.
- Install the UF: I launch the installation on the Windows server virtual machine that I wish to watch. I gave it instructions on where to pass the data during installation.
Setting up the Forwarder
First, you can just install on a cloud instance and then establish a credential. This is not the same as the setup credentials you use for both cloud and enterprise Splunk.
Server deployment with a universal forwarder
Setting up
Setting up the Windows credentials
UF Configuration (Critical Step)
- The UF-installed computer's command line interface (CLI) is used for this.
- A PowerShell or Administrator Command Prompt should open.
- To access the bin directory of the UF, use cd "C:\Program Files\SplunkUniversalForwarder\bin", for example.
Find the path to the Splunk executable file.
A folder named "Splunk Universal Forwarder" will be created for you after a forwarder has been installed.
Type "dir" into the prompt in the same directory.
Installing Splunk.exe in PowerShell
Type the following command on PowerShell as an admin: splunk.ex app c:\user\samueladeduntan.COTI\Desktop\splunkclouduf.spl
Restart the forwarder
To restart the forwarder, use this command:
.\splunk exe restart
Check the status
To check the status of the forwarder, use this command:
.\splunk.exe status
Verifying the Configuration and Next Actions
How to Check if it Worked:
- On the central Splunk server (localhost:8000), log in.
- Click on Search & Reporting.
- Run a basic search: index=* | head 100
- This searches all data indexes and returns the first 100 events. Which shows Data is flowing.
The lab is now ready for you!
You have a functional core for your SOC. Future planning ought to incorporate:
- Including practice data as an example.
- Creating dashboards and notifications.
- Adding other forensic tools to your workflow, such as Autopsy, Wireshark, and Volatility.
Top comments (0)