Thanks! One question: does WinRM and the associated WinRM firewall rules in Defender need to be enabled on all clients as well as the Windows Event Collector (WEC)? Specifically, you run "winrm quickconfig -quiet" & "Set-Service -Name WINRM -StartupType Automatic" on the collector during your first steps, but you do not mention that this needs to be compelted for all clients. Another tutorial has me enabling the service and firewall rules via a seperate WinRM Group Policy Object and applying this GPO to all domain comptuers. Without this extra step, I have been unable to get it to work. Maybe you mention this and I overlooked it, but it would be great to hear your input on this issue/topic. Thank you!
هذشي راه بزاف. اينهم المسؤولين المغاربة. بركة من هذا المهزلة تاع اليد الممدودة. الدولة والحكومة لهم مسؤؤلية الدفاع عن المواطنين والمصالح الوطنية. وابزاف هذشي. ماذا تنتظرون؟ تنتظرون العالم ان يأتي اليكم ليقول لكم فعلا الجزائر ظالمة. لا احد سيعير اهتماما لك اذا لم تطالب بحقط. اش هذ الزبل كاع تفو على بنادم موسخ بلانا به الله وهذ الحكام الخانعين المنونخين لي حاكمينا. الله يرحم الحسن الثاني هذشي لي كاين وصافي. اما ملي واحد البوال وسكيري بوخنونة دارو لنا هذ الحالة وباقين كنزقزقوا اليد الممدودة فراه هزلت
Hello! Im not sure if you are still responding to comments but i have a question :( Video cleared lot of things for me, but I didn't understand the part with the group policy. Should I create a seperate Group policy for each WEC? Or shoud I just add other WECs to "subscription manager string"?
Love this video. I was able to follow along. Rather than just using your repo, I downloaded it with git then coped the relevant functions and log files from es.py into my script so I could see how it worked. Really good walkthrough - appreciate the knowledge sharing. Thank you.
Im using Windows Server 2022, Member servers are not reporting to the Collector. Are there different commands to run and does the GPO need different settings?
The only issue I had was when I put in the subscription manager, I used domain.local:5985/wsman/SubscriptionManager/WEC,Refresh=120 <- Here I accidently put a period instead of a coma. Once I fixed this issue. The issue was resolved. Great Video! Subscribed for more great content.
Hi. I'm trying to convert the file YAML to JSON. It gives me an error. KeyError: 'PRE'. Now I used and online YAML-->JSON converter, but then ATTACK Navigator says; WARNING: Uploaded layer version (1.2) does not match Navigator's layer version (4.4). The layer configuration may not be fully restored. When I click continue, I get the empty Matrix and no colouring or values. Is someone that could help me with this?
Thanks for taking the time and answering our concerns!! I am trying to learn a little bit about this framework, am wondering how would you map an EDR, which is a blackbox, like Falcon from Crowdstrike? Or which will be your approach, thanks man.
Thanks for the awesome explanation!! Quick question, around minute 4:00 you uploaded to the Navigator the JSON file of Sysmon, from where that file came from? Was that file generated by DeTTECT? How? That file clearly had more coverage than regular Windows logs, but am wondering how that mapping was done, thanks.
@@HASecuritySolutions Got it, I was afraid you will say it was a manual work XD, thanks for the time you took answering our concerns, great video man!!
question: i have running for long time vmware esxi 6.7 pre installed in DELL EMC , which i wish to put it into a vmware center to control it and, i've just recently buyed another poweredge640 dell EMC whic also has vmware esxi7.0 . Can i create or download a vcenter to control both vmwares? thsnks thoug