On-Premise Setup Tutorial 30-Day MyDFIR SOC Analyst Challenge | BONUS

About this Video

• Video Title: On-Premise Setup Tutorial 30-Day MyDFIR SOC Analyst Challenge | BONUS
• Channel: MyDFIR
• Speakers: Stephen (implied)
• Duration: 00:54:50

Introduction

This video provides a tutorial on setting up a 30-day MyDFIR SOC analyst challenge on-premise using VirtualBox. It covers the installation and configuration of multiple virtual machines, including ELK stack, Mythic, Fleet server, OSticket, and Kali Linux, and their integration for security monitoring and incident response.

Key Takeaways

• Network Configuration: The video details setting up a NAT network in VirtualBox and configuring network settings for each VM to ensure communication.
• VM Specifications: Recommended VM specifications are provided for optimal performance, acknowledging limitations based on individual hardware capabilities.
• Software Installation and Configuration: The tutorial walks through the installation and configuration of Elasticsearch, Kibana, Elastic Agent (on Windows and Ubuntu), Sysmon, Mythic, and OSticket.
• Port Forwarding: The importance of port forwarding in VirtualBox for SSH access to VMs is emphasized, with step-by-step instructions.
• Snapshotting VMs: The video stresses the importance of taking snapshots of VMs at various stages to easily revert to a known good state if errors occur.
• Integration of Tools: The process of integrating ELK, Fleet, Mythic, and OSticket is shown, including generating enrollment tokens and API keys. The video covers pushing Sysmon and Windows Defender data to the ELK stack.
• Generating Telemetry: Methods for generating SSH and RDP telemetry are explained using Metasploit and Crowbar, respectively.