In this lecture I will explore squared which easy graphical Web interface.
On top of screen so I will click on the icon of squared and we see that we are being asked for our credentials
and you might see me say before that saying that the connection is not private or not so cute.
So we have to click on advanced and then proceed as we have done with Elsa.
And that is okay here in our lab environment but in production you have to say to your trusted certificate
authority.
So now I will take or submit and the first thing we have to sit here and squirt is to change the date
of the alert because by default the alerts are displayed for the last date.
So I will click on this link here and from school we see that the date of our alert is the twenty sixth
of June.
So in script I will select the month to June and then the date to be this date and we see now that the
alerts are displayed.
And we see the purity percentages and numbers for the alerts and we can focus on specific ability.
For example the high Bertie events or alerts by clicking on this link
and we want to find the alerts that we have classified before school as Category 7 or partisan fictions.
We can find those under the malicious category.
So we have here 48 alerts that we have classified before us in squeal as partisan fiction.
So I will click on this link and here we see those alerts.
So we have two groups of twenty four alerts the first group is the E.T. Trojan and the second group
is the E.T. will she be itchy.
So let us click on this one
click one more time and here we see these events that were classified as category 7 and now I will clear
the filter of this category.
Now if we want to find the events that we have not classified has category 7 in its will but you should
do that now in squirt me see those 48 events as not classified out of seventy two alerts with the E.T..
Will she be the XY signature.
So twenty four of those are classified as malware but 48 are not.
So I will click on those now and we can classify for example these first 12 of them so I will click
here and
we can
classify or categorize an individual events by three by checking on one of them or we can classify all
of them so I will classify all of the alerts and then I will press on seven.
So now we see that these alerts are classified now as Category 7 or virus infections and we see that
the number of the malicious category is increased to be 60 instead of forty eight and we can see the
events that we have escalated before and screen by clicking on this link.
So we have two events or alerts
we see
alerts that we have escalated before in screen.
And as we have seen it screen we can be right by what into other tools by clicking on the alert I.D.
and then by boat into other tools specifically the academy tool that views become files and that we
have seen before when working with Elsa.
So now she's become me.
And here in this tool can also download the backup file and analyze it using other tools such as white
shark for example
we can also buy what about specific IP address as we have done in squirrel by clicking on it and we
can search for that IP here on script has a source or destination for example or we can buy what for
example into other tools such as domain tools Elsa Google malware domain list Safe Browsing Virus Total.
And other tools and we can buy but also about bots into other tools or hair and in.
We can also group and and group events so here if I clear the filter and then go here and click on this
link.
So events are by default grouped in script but I can disable grouping so I click on that one or this
link and then click on refresh.
We see that the alerts are now grouped and I can group them again if I want so in this lecture we have
explored squared and in the next lecture I will explain about the so inboard script.