In this lecture I will explain about how to buy votes from squeeze into other tools.
So first I will close the step and we see here that we have so many alerts so if we want to focus our
analysis on specific alert or a specific group of alerts we can buy what into other tools by right clicking
into the pilot I.D. and then choose a tool.
So for example network minor
and here we see information about the hosts files including malicious ones.
Once if any emails misses credentials sessions DNS and other information
and we can by vote into wire shark for example
where we can analyze the packet in detail.
So for example we can extract possible emails whose files there that were transferred analyze them ourselves
or submit them to we analyzed on sites such as Virus Total and we will explain more about why a shark
in the next lectures
and we can get more info about the specific IP address.
For example we can make a query from the query menu and then clearly by IP and then it does select this
IP on ninety five to two the two fifty three that ninety two and then click on built and then I have
to change the date to include ads or events that these IBD involved in.
So then I will click on submit.
Here we see that we have about forty eight records about this IP so I will close the tab and we can
also buy what about the IP into other tools.
So let us try and divert into Elsa for example so I will click right click on this IP and then choose
Elsa look up and search for that IP as a source.
So now we see that we have to enter our credentials into Elsa Logan
and we did not get any results because of the dates or I will change the date once more time and then
hit enter.
So here we see the info about that IP in Elsa crewed by the program like snot broken action profiles
and pro TDB
let us try and buy what into another tool for example Virus Total but let us try with another IP so
let us try with this one.
So what we have tried to click on it and in select Virus Total and then source IP and here we see information
about that Ivy like the country.
The domain names the detected
malicious you are else and how many antivirus is detected.
That as malicious.
So for example this one is detected by three out of 64
and below that we find it malicious files that were downloaded from that IP and the hashes and also
undetected and detected
malicious downloaded files
detected and undetected files that communicated with that IP and here we see the dates that there was
a malicious activity associated with that IP.
So it might not be malicious now and because we have used TCB really comment with VB cat files our timestamps
where of the date we run the comment.
But if you want to get timestamps in Alsace grill and squirt with the dates that those B cups files
were originally created we have to use the saw and board script and in that case we will get timestamps
close to those shown here in Virus Total and in fact if this was a life attack attacking reduction then
it is recommended to use internal analyses method instead of an external one because attackers could
know about that.
We are tracking them
and also we can buy what about the source sport and destination bot.
So in this lecture I have explained about how to buy what from squeal into other tools and in the next
lecture I will explain about how to categorize events in squeal.