In this lecture I will start explaining about Elsa.
So Elsa or enterprise lock search and archive is a three tiered log receiver archival And Dixer and
we print it for income and just look it can be accessed in security union from the chromium browser
which it works best with.
So here I will click on the icon of Elsa and we see this message that is saying that our connection
is not private or not secure.
And I have to click on advanced and then proceed to local host and it asks us for username and password
which is the same username and password used with the signal since Elsa authenticates and against the
signal database.
So here we see the web interface of Elsa and the first thing we have to focus on is the from two fields
which specify the time range that Elsa will search for the logs for and it is for the last two days
by default.
So I will change the from date to be this date for example so that it will search for logs resulted
from running the TCB really a comment that we have used in the previous lectures and also I have to
specify a class here and I will specify the class to be pro connection so that I will search for logs
coming from Pro which is an intrusion detection system program and now I will click hit enter or click
on submit query.
So we see here that we have more than 1000 records and the first 100 records are shown by default and
we see also that the results are displayed in seven days where we have 15 records their page and we
can change that if we want and also we see highlighted in yellow that the records or logs are coming
from the program and class pro connection and also we see information like the source IP Source Bought
and
destination IP and destination bought and also the connection duration.
The number of bytes number of packets and also the country which is here in the U.S. so the country
that the IP block belongs to.
So we see the country here is us and here we see also that we have a record that the country is Russia
so we can also get the same result by using another way.
So here we close this stop and I will remove the class from the query field and I will go to the actor
drop down menu and I will select select for connection and then class connection and we see that it
populates the class in the query field and then I also I will hit submit query or hit Enter so we see
that we have gotten the same results here.
So that way I have explained how to start using Elsa and how to specify a class and a time range to
get the logs that we are searching for and in the next lecture I will continue explaining about Elsa
and specifically about how to use the group by close.