In this demo, let's monitor and analyze these threats using Maltrail dashboard.
Now let's try and check whether everything is up and running.
So let's open a new shell and connect to the same Ubuntu
instance where our server and sensor is running.
We'll not disturb the server and the sensor.
We'll open a new terminal and connect to the instance.
So to test the application now, let's run the below two commands.
First, let's ping the IP, and then let's trace the log.
Okay, now let's try and test the capturing of DNS traffic.
Let's run this command, and let's check out the log.
Perfect.
So here we get the TCP/IP. It's a known attacker from the blocklist, and there
are a couple of IPs being traced kept into multi different categories, such as
mass scanner, sinkhole malware, andromeda malware.
Let's observe the same on the dashboard.
So these events are stored as server logs inside the server.
Let's capture these events on the dashboard.
Let's try and refresh this link.
Perfect.
So as we can see over here,
we get seven threats pertaining to seven events and the severity level.
If we click over here on Severity and this is how it's
being divided into high and low.
If I click on High, below,
I'll get all the logs or the threats from the high‑severity events.
And if I click on Low, it will be from low.
Let me close this.
So here, as we can see, the top part holds a sliding timeline
where user can select logs for past events. And here, dates are
grouped by months where for month period of a date are displayed
inside the widget itself.
Let's click over here.
So however,
by using the provided slider, user can easily
access events from previous months.
Once clicking the date, all events for that particular date should be
loaded and represented by the client's web browser. Depending on number
of events and the network connection speed,
loading and display of logged events could take from a
couple of seconds up to several minutes.
So this is today's date.
Now, let's come to this middle part where we have threats,
events, severity,
sources, and trails. This middle part holds a summary of displayed events.
Events box represents the total number of events in a selected
24‑hour period where a red line represents IP‑based events, blue
line represents DNS‑based events. And if there is a yellow line,
it represents URL‑based events.
Let's scroll down a bit. In the Type section, we get to know
whether it's IP‑based, DNS‑based, or URL‑based.
Now, let's go to the Sources section. Here, the Sources box represents a number
of events per top sources in form of a stacked column chart with the total
number of sources on top, as you can see over here.
So this particular stacked column has one event of DNS and one of the IP‑based.
Let's click over here. And as we click over here interactively, the
threats per page section at the bottom gets changed.
Let me click over here on this IP,
this one. As you can see, the source IP over here gets changed, and here
is the country source or the geolocation from where it is coming. And the
first column over here represents the threat ID, and then we get the
destination IP. This destination IP is the private IP of my AWS EC2
instance. Let's check it out. As we can see over here, the destination IP
is 172.31.9.19.
Let's go to the AWS console. And as we can see over
here, the private IP details.
It's 172.31.9.19.
Let me close this, and let me go to the Threats section.
Awesome. Threats box represents percentage of top threats in the
form of a pie chart with total number of threats on top, as we
can see over here. As we click over here, interactively, below
the details get changed.
These are all the threat IDs. Now, let's go to the Trail section. Trails box
represents percentage of top trails in form of a pie chart with total number
of trails on top. Each of those boxes are active.
Hence, the click on one of those will result with a more detailed
graph. As we have seen in all the sections,
we have got detailed graph.
So this is basically the source IP. And if I go over here in
the src_ip section, we'll get the flag of that particular
geography from where it's coming from.
So it's quite a detailed summary that we get within this interactive chart.
Let me close this. And as we see over here in total, there are seven entries
being shown. So here the column threat holds threat's unique ID, as we can
see over here. Let me try and maximize the font.
So these are the threat IDs which are unique. And each of them have a
severity level, such as high or low. Severity _____ evaluated severity of
threat, which is calculated based on values in info and reference columns,
prioritizing malware‑generating traffic.
Let's try and hover around the source IP and destination IP. So when
moving mouse over src_ip and dst_ip table entries,
information tooltip is being displayed with detailed reverse DNS
and _____ information, event details, for example source port,
destination port, protocol, etc.
Now, let's go towards the trails column and hover my mouse around trail.
So when hovering mouse pointer over the threats trail for a couple
of seconds, it will result in a frame consisted of results using
the trail as a search term performed against search encrypt search
engine. In lots of cases, this provides basic information about the
threat itself,
eliminating the need for user to do the manual search for it. In upper‑right
corner of the opened frame window, there are two extra buttons. By clicking
the first one, the resulting frame will be opened inside the new browser's
tab. And the second one will close it.
Let's try and open the same in a new tab. Bingo.
As we have seen, it's a fantastic way to describe threats
individually so all threats can be diagnosed and monitored from
this particular dashboard so that the safety and security of an
enterprise network is ensured.