In this demo, let's check out the installation of Maltrail.
So here, I'll be using an AWS instance to install Maltrail.
So I have an AWS instance up and running.
This is an Ubuntu instance.
So now let's connect to this Ubuntu instance.
So here we are inside the shell of Ubuntu.
Let's first run the apt‑get update command to update its list of repositories.
Done.
Now let's try and install the library dependencies
required to get Maltrail up and running.
So here are the list of dependencies required to get Maltrail all set.
Let's try and install it.
It's done.
Let's install one more Python dependency.
That's why we installed pip earlier.
And here, the version of pip that we are using is pip 3.
Done.
Now let's try and clone the Maltrail report from Git,
and then let's go inside the Maltrail directory.
So at the moment, we are in this path.
Let's give ls.
Here, the two most important scripts are sensor.py and server.py.
Sensor.py will basically sense all the blacklisted traffic,
the threats coming from blacklisted IPs and several threat actors.
And then,
we'll run the server.py to observe the same and monitor it via the dashboard,
that is the Maltrail dashboard.
And the third most important thing is its configuration,
which we'll see later in the demo, and that is maltrail.conf file.
So now, let's start the sensor.
Here is the command to run the Python file.
Let's try and execute it.
So this has started updating the trails,
and this will start tracking the threat actors from the already listed
or blacklisted IPs within its updated storage rep.
Fantastic.
So the sensor has started.
Now, let's open a new terminal and start the server.
So let's connect to the same Ubuntu instance running on AWS.
Let's go inside the Maltrail directory, and now let's start the server. Bingo.
The server is up and running.
So now let's check out the dashboard.
The dashboard will be up on this particular IP and port number.
In our case, it will be the public IP of this AWS EC2 instance.
So let's open the browser and enter this link. Bingo. So the
dashboard is up and running. Now let's enter the credentials to log
in inside the dashboard. Here, the username, or the default
username, is admin, and the default password is changeme and then
exclamation mark. Enter. Excellent.
So the dashboard is up and running. And here, we can visualize all the threats,
the source of the threats, from which location and which IP
address it's coming from, and to which IP it's targeting and the
port number it's targeting. And we can even check out the severity
levels of each of these threats.