1 1 00:00:00,330 --> 00:00:02,850 Searching and Piping Commands. 2 2 00:00:02,850 --> 00:00:03,840 In the last lesson 3 3 00:00:03,840 --> 00:00:06,480 we started talking about SIEM correlation rules 4 4 00:00:06,480 --> 00:00:08,460 and we talked about SIEM queries. 5 5 00:00:08,460 --> 00:00:09,630 Now, I mentioned the idea 6 6 00:00:09,630 --> 00:00:11,520 of searching for some kind of information, 7 7 00:00:11,520 --> 00:00:12,900 and we left it very generic, 8 8 00:00:12,900 --> 00:00:14,550 but in this lesson we're going to dive 9 9 00:00:14,550 --> 00:00:16,620 much deeper into that concept. 10 10 00:00:16,620 --> 00:00:18,960 Now, when you create a SIEM correlation rule, 11 11 00:00:18,960 --> 00:00:20,130 this is usually going to involve 12 12 00:00:20,130 --> 00:00:22,560 searching with some kind of a string. 13 13 00:00:22,560 --> 00:00:24,270 Now, to do this more effectively, 14 14 00:00:24,270 --> 00:00:26,430 we can use regular expressions. 15 15 00:00:26,430 --> 00:00:29,280 Now, regular expressions or regex, as you'll hear it called, 16 16 00:00:29,280 --> 00:00:30,390 is a group of characters 17 17 00:00:30,390 --> 00:00:33,330 that describe how to execute a specific search pattern 18 18 00:00:33,330 --> 00:00:35,040 on a given set of text. 19 19 00:00:35,040 --> 00:00:37,590 Now, regex is really important to learn 20 20 00:00:37,590 --> 00:00:39,450 as a good cybersecurity analyst, 21 21 00:00:39,450 --> 00:00:41,550 because if you can use regex efficiently, 22 22 00:00:41,550 --> 00:00:43,860 you can search through mountains of log data 23 23 00:00:43,860 --> 00:00:45,540 and find what you're looking for, 24 24 00:00:45,540 --> 00:00:48,390 whether that's a threat, an incident, or an attack. 25 25 00:00:48,390 --> 00:00:50,460 But for the CySA Plus exam, 26 26 00:00:50,460 --> 00:00:52,080 you just need to know the basics. 27 27 00:00:52,080 --> 00:00:53,520 They don't expect you to be an expert, 28 28 00:00:53,520 --> 00:00:54,840 but you may get a question 29 29 00:00:54,840 --> 00:00:57,120 that asks you to look at regular expression 30 30 00:00:57,120 --> 00:00:59,400 and figure out what the response would be, 31 31 00:00:59,400 --> 00:01:00,570 coming from that tool. 32 32 00:01:00,570 --> 00:01:02,100 So we're going to cover the basics here 33 33 00:01:02,100 --> 00:01:03,150 and if you want to learn more, 34 34 00:01:03,150 --> 00:01:05,340 I'm going to give you a handy website to go 35 35 00:01:05,340 --> 00:01:08,370 and practice this concept and learn a lot more about regex, 36 36 00:01:08,370 --> 00:01:09,750 because again, in the real world, 37 37 00:01:09,750 --> 00:01:12,090 it's really helpful to know this stuff. 38 38 00:01:12,090 --> 00:01:13,830 Now, the first commonly used element 39 39 00:01:13,830 --> 00:01:17,130 inside a regex syntax is the brackets. 40 40 00:01:17,130 --> 00:01:19,710 Now, I have it here as bracket dot dot dot bracket, 41 41 00:01:19,710 --> 00:01:20,820 but really, it's what we put 42 42 00:01:20,820 --> 00:01:22,530 in the brackets that's important. 43 43 00:01:22,530 --> 00:01:23,580 When we look at the brackets, 44 44 00:01:23,580 --> 00:01:25,350 this is going to match a single instance 45 45 00:01:25,350 --> 00:01:27,450 of a character within those brackets. 46 46 00:01:27,450 --> 00:01:30,750 So for example, if I use bracket A dash Z, 47 47 00:01:30,750 --> 00:01:32,370 that's going to give me a lowercase letter. 48 48 00:01:32,370 --> 00:01:35,610 If I have capital A dash Z, it'll gimme an uppercase letter. 49 49 00:01:35,610 --> 00:01:37,620 Zero through nine gives me a number. 50 50 00:01:37,620 --> 00:01:39,780 If I have something written like A dash Z, 51 51 00:01:39,780 --> 00:01:43,380 capital A dash capital Z, zero dash nine, 52 52 00:01:43,380 --> 00:01:46,680 it's going to find me an uppercase, lowercase, or a number 53 53 00:01:46,680 --> 00:01:50,010 as a single digit or single character from that range. 54 54 00:01:50,010 --> 00:01:52,830 If I want to use a white space, I'm going to use slash S. 55 55 00:01:52,830 --> 00:01:55,260 If I want to use a digit, it's slash D. 56 56 00:01:55,260 --> 00:01:56,790 That would give me any single digit. 57 57 00:01:56,790 --> 00:01:59,250 These are some of the examples of what you can search for 58 58 00:01:59,250 --> 00:02:01,380 when you're using the brackets. 59 59 00:02:01,380 --> 00:02:03,540 The next thing we can use is a plus sign. 60 60 00:02:03,540 --> 00:02:05,880 And a plus sign is going to match one or more occurrence 61 61 00:02:05,880 --> 00:02:08,070 and this is also known as a quantifier. 62 62 00:02:08,070 --> 00:02:11,370 Now, for example, if I use slash D, that's a single digit, 63 63 00:02:11,370 --> 00:02:14,790 but if I use a plus, that's going to match one or more digits 64 64 00:02:14,790 --> 00:02:17,490 because I have the plus after the slash D. 65 65 00:02:17,490 --> 00:02:18,600 Next, I have a star, 66 66 00:02:18,600 --> 00:02:20,850 and it's going to match zero or more occurrences. 67 67 00:02:20,850 --> 00:02:23,160 So if I have slash D star, 68 68 00:02:23,160 --> 00:02:26,520 this matches zero digits or any number of digits 69 69 00:02:26,520 --> 00:02:28,170 that I might find in the search string. 70 70 00:02:28,170 --> 00:02:30,030 The difference between the star and the plus 71 71 00:02:30,030 --> 00:02:31,620 is that the star starts at zero 72 72 00:02:31,620 --> 00:02:33,450 where the plus starts at one. 73 73 00:02:33,450 --> 00:02:35,070 And next, we have a question mark. 74 74 00:02:35,070 --> 00:02:37,230 A question mark is another type of quantifier. 75 75 00:02:37,230 --> 00:02:39,720 It's going to match one or none 76 76 00:02:39,720 --> 00:02:41,670 of the times that defines that thing. 77 77 00:02:41,670 --> 00:02:44,100 So in a slash D question mark scenario, 78 78 00:02:44,100 --> 00:02:47,040 I'm going to match zero or one digits. 79 79 00:02:47,040 --> 00:02:48,630 Next, I have my curly braces. 80 80 00:02:48,630 --> 00:02:51,210 And usually you'll see a number written inside of them. 81 81 00:02:51,210 --> 00:02:52,950 This is going to match the number of times 82 82 00:02:52,950 --> 00:02:54,330 within the curly braces. 83 83 00:02:54,330 --> 00:02:56,730 For example, going back to my digit example, 84 84 00:02:56,730 --> 00:03:00,450 slash D curly brace three and curly brace. 85 85 00:03:00,450 --> 00:03:02,850 This says I want to match three digits, 86 86 00:03:02,850 --> 00:03:05,580 and if I use something like slash D brace 87 87 00:03:05,580 --> 00:03:07,470 seven dash 10 brace, 88 88 00:03:07,470 --> 00:03:10,230 that would match anything from seven to 10 digits. 89 89 00:03:10,230 --> 00:03:12,570 And so for instance, if I was looking for a phone number, 90 90 00:03:12,570 --> 00:03:13,620 I know in the United States 91 91 00:03:13,620 --> 00:03:15,810 those are seven digits or 10 digits, 92 92 00:03:15,810 --> 00:03:18,000 I could use something that looks like this. 93 93 00:03:18,000 --> 00:03:19,830 Next, I have parentheses. 94 94 00:03:19,830 --> 00:03:21,150 And parentheses are going to define 95 95 00:03:21,150 --> 00:03:23,280 a matching group with a regex sequence 96 96 00:03:23,280 --> 00:03:25,170 placed between those parentheses. 97 97 00:03:25,170 --> 00:03:27,060 And then each group can subsequently 98 98 00:03:27,060 --> 00:03:29,670 be referred to by slash one for the first group, 99 99 00:03:29,670 --> 00:03:32,010 slash two for the second group, and so on. 100 100 00:03:32,010 --> 00:03:33,870 This way I can set up lots of different groups 101 101 00:03:33,870 --> 00:03:36,360 and be able to find any of those matching groups. 102 102 00:03:36,360 --> 00:03:39,270 The next one we have is the OR logical operator, 103 103 00:03:39,270 --> 00:03:41,310 which looks like the pipe character. 104 104 00:03:41,310 --> 00:03:42,990 This is going to be used to match conditions 105 105 00:03:42,990 --> 00:03:45,180 such as this or that. 106 106 00:03:45,180 --> 00:03:46,740 The next one we have is the caret, 107 107 00:03:46,740 --> 00:03:49,230 and this is an anchor or boundary character. 108 108 00:03:49,230 --> 00:03:51,360 This is going to say only return the matches 109 109 00:03:51,360 --> 00:03:52,800 that start at the beginning of a line 110 110 00:03:52,800 --> 00:03:54,510 when you're searching with regex. 111 111 00:03:54,510 --> 00:03:56,520 Now, this is as opposed to the dollar sign. 112 112 00:03:56,520 --> 00:03:58,260 The dollar sign is the opposite. 113 113 00:03:58,260 --> 00:03:59,220 It's only going to match 114 114 00:03:59,220 --> 00:04:01,110 at the end of a line when you're searching. 115 115 00:04:01,110 --> 00:04:03,210 And so you can use the caret for the beginning 116 116 00:04:03,210 --> 00:04:04,620 and the dollar sign for the end. 117 117 00:04:04,620 --> 00:04:07,080 This way you can find the beginning or end of any line. 118 118 00:04:07,080 --> 00:04:08,490 Now, as I said, this was just 119 119 00:04:08,490 --> 00:04:10,590 a very brief introduction to regex, 120 120 00:04:10,590 --> 00:04:13,230 but if you want to learn more about regular expressions 121 121 00:04:13,230 --> 00:04:14,130 and how to build them 122 122 00:04:14,130 --> 00:04:16,560 and practice building them with an interactive tool, 123 123 00:04:16,560 --> 00:04:20,220 I highly recommend you go to regexr.com. 124 124 00:04:20,220 --> 00:04:22,200 This is a free site and you can go there 125 125 00:04:22,200 --> 00:04:23,370 and start playing around with this 126 126 00:04:23,370 --> 00:04:25,950 and getting better using the hands-on tools there 127 127 00:04:25,950 --> 00:04:27,960 because it really will help you in the field. 128 128 00:04:27,960 --> 00:04:28,920 The next thing we want to talk about 129 129 00:04:28,920 --> 00:04:31,170 is a couple of commands that rely on regex. 130 130 00:04:31,170 --> 00:04:33,113 The first one we want to talk about is grep. 131 131 00:04:33,113 --> 00:04:37,020 Grep is a command on Unix, Linux and macOS systems 132 132 00:04:37,020 --> 00:04:40,230 that involves simple string matching or regex syntax 133 133 00:04:40,230 --> 00:04:42,780 to search text files for a specific string. 134 134 00:04:42,780 --> 00:04:44,010 Now, as we look at grep, 135 135 00:04:44,010 --> 00:04:45,840 let's take a look at some examples here. 136 136 00:04:45,840 --> 00:04:49,970 First, grep dash F, 192.168.1.10 access.log. 137 137 00:04:53,280 --> 00:04:54,840 What is this telling me? 138 138 00:04:54,840 --> 00:04:56,460 Well, grep is the command. 139 139 00:04:56,460 --> 00:04:59,310 The dash F says, I want to do a simple search. 140 140 00:04:59,310 --> 00:05:01,020 I want to treat the next thing 141 141 00:05:01,020 --> 00:05:02,940 as a literal that I want to search. 142 142 00:05:02,940 --> 00:05:07,140 And that thing is an IP address, 192.168.1.10. 143 143 00:05:07,140 --> 00:05:08,640 And then where do I want to search it? 144 144 00:05:08,640 --> 00:05:11,250 Inside this file called access.log. 145 145 00:05:11,250 --> 00:05:13,890 That's a very simple way to use grep. 146 146 00:05:13,890 --> 00:05:18,233 Next we have grep, quote 192.168.1.10 quote star. 147 147 00:05:20,700 --> 00:05:22,230 Now, the fact that we have grep there 148 148 00:05:22,230 --> 00:05:23,850 tells us we're going to grep something. 149 149 00:05:23,850 --> 00:05:25,650 What's inside the quotes is the literal. 150 150 00:05:25,650 --> 00:05:27,360 So instead of using dash F, 151 151 00:05:27,360 --> 00:05:29,580 we can replace that with the quote marks. 152 152 00:05:29,580 --> 00:05:30,540 And then the star says, 153 153 00:05:30,540 --> 00:05:33,900 I'm going to search all files for this particular IP address. 154 154 00:05:33,900 --> 00:05:35,220 Here's another example. 155 155 00:05:35,220 --> 00:05:40,220 Grep slash R 192 slash dot 168 slash dot one slash dot 156 156 00:05:42,780 --> 00:05:47,760 bracket slash D bracket curly brace one comma three 157 157 00:05:47,760 --> 00:05:49,470 curly brace dot. 158 158 00:05:49,470 --> 00:05:50,550 Wow, that's a long one. 159 159 00:05:50,550 --> 00:05:51,780 It looks pretty complex, right? 160 160 00:05:51,780 --> 00:05:54,810 But if we take it step by step, it's really not that hard. 161 161 00:05:54,810 --> 00:05:56,640 So first in this line, we have grep, 162 162 00:05:56,640 --> 00:05:59,250 which says, we're going to issue the grep command. 163 163 00:05:59,250 --> 00:06:00,870 Then we have dash R. 164 164 00:06:00,870 --> 00:06:02,880 And dash R means recursion. 165 165 00:06:02,880 --> 00:06:05,520 We are going to look inside this file or directory 166 166 00:06:05,520 --> 00:06:07,080 and all of the subsequent files 167 167 00:06:07,080 --> 00:06:08,550 and directories underneath it. 168 168 00:06:08,550 --> 00:06:10,350 So if the command is giving it a directory, 169 169 00:06:10,350 --> 00:06:13,350 in this case, we are with the dot means present directory, 170 170 00:06:13,350 --> 00:06:15,690 I'm going to look for any files in the present directory 171 171 00:06:15,690 --> 00:06:16,950 or in it's sub directories, 172 172 00:06:16,950 --> 00:06:20,490 and I'm going to search for them using this regular expression. 173 173 00:06:20,490 --> 00:06:22,440 Now, the reason I know this is a regular expression 174 174 00:06:22,440 --> 00:06:26,220 is because I don't have dash F and I don't have quote marks. 175 175 00:06:26,220 --> 00:06:28,170 So this is a regular expression. 176 176 00:06:28,170 --> 00:06:30,330 Now, how do I read this regular expression? 177 177 00:06:30,330 --> 00:06:34,860 Well, 192 is a number, so I'll just read it as 192. 178 178 00:06:34,860 --> 00:06:36,930 The slash is an escape character, 179 179 00:06:36,930 --> 00:06:39,210 and that means the next thing that's being shown 180 180 00:06:39,210 --> 00:06:41,850 should be treated as a literal character. 181 181 00:06:41,850 --> 00:06:43,680 So we have to put that slash there 182 182 00:06:43,680 --> 00:06:47,820 because otherwise the dot has it's own meaning inside regex. 183 183 00:06:47,820 --> 00:06:49,290 And so we want to make a slash, 184 184 00:06:49,290 --> 00:06:52,290 so it treats it as a dot that we use in an IP address, 185 185 00:06:52,290 --> 00:06:54,060 and not as the special character dot 186 186 00:06:54,060 --> 00:06:55,710 that might be used in regex. 187 187 00:06:55,710 --> 00:06:56,940 Then we have 168. 188 188 00:06:56,940 --> 00:06:58,380 Again, a literal number. 189 189 00:06:58,380 --> 00:07:00,180 Slash is the escape character. 190 190 00:07:00,180 --> 00:07:01,800 Again, we're showing the dot. 191 191 00:07:01,800 --> 00:07:03,360 One slash dot. 192 192 00:07:03,360 --> 00:07:05,130 And then we get to this other part. 193 193 00:07:05,130 --> 00:07:09,270 Now, bracket slash D says, I want any single digit. 194 194 00:07:09,270 --> 00:07:11,250 Then I have the curly braces. 195 195 00:07:11,250 --> 00:07:12,810 If you remember from earlier in this lesson, 196 196 00:07:12,810 --> 00:07:15,810 it says, I want a number that has this many digits. 197 197 00:07:15,810 --> 00:07:18,150 So the fact that we have one comma three says, 198 198 00:07:18,150 --> 00:07:20,460 show me anything that has one digit, 199 199 00:07:20,460 --> 00:07:22,260 two digits or three digits. 200 200 00:07:22,260 --> 00:07:23,700 And that is what's being shown here 201 201 00:07:23,700 --> 00:07:25,320 inside this grep expression. 202 202 00:07:25,320 --> 00:07:30,320 So what I'm searching for is 192.168.1 dot something. 203 203 00:07:31,020 --> 00:07:32,520 Any digit that is either one, 204 204 00:07:32,520 --> 00:07:34,620 two, or three digits in length. 205 205 00:07:34,620 --> 00:07:36,600 That's what we're looking for here. 206 206 00:07:36,600 --> 00:07:38,130 Let's take a look at another one. 207 207 00:07:38,130 --> 00:07:39,660 This one is grep dash R. 208 208 00:07:39,660 --> 00:07:41,220 So again, recursion. 209 209 00:07:41,220 --> 00:07:42,480 Again, the target is dot, 210 210 00:07:42,480 --> 00:07:44,220 which is the present working directory. 211 211 00:07:44,220 --> 00:07:47,460 And then you'll see 192 escape character dot 212 212 00:07:47,460 --> 00:07:49,890 168 escape character dot 213 213 00:07:49,890 --> 00:07:51,540 one escape character dot, 214 214 00:07:51,540 --> 00:07:54,840 and then I have these bracketed of zero to 255. 215 215 00:07:54,840 --> 00:07:56,640 What am I looking for here? 216 216 00:07:56,640 --> 00:07:59,400 Here, I'm looking for a specific IP address, 217 217 00:07:59,400 --> 00:08:01,110 a valid IP address. 218 218 00:08:01,110 --> 00:08:04,380 Now, in the one before that I just used, the slash D one, 219 219 00:08:04,380 --> 00:08:07,830 I looked for any one, two, or three digit number. 220 220 00:08:07,830 --> 00:08:12,830 So I could have had 192.168.1.999. 221 221 00:08:12,930 --> 00:08:15,960 Well, 999 is not a valid IP address. 222 222 00:08:15,960 --> 00:08:19,170 So instead, by using this zero dash 255, 223 223 00:08:19,170 --> 00:08:22,260 I'm saying show me all the numbers from zero to 255, 224 224 00:08:22,260 --> 00:08:25,500 which are all the numbers that could exist as an IP address 225 225 00:08:25,500 --> 00:08:27,720 because anything from 256 and beyond 226 226 00:08:27,720 --> 00:08:29,730 is not going to be a valid IP address. 227 227 00:08:29,730 --> 00:08:31,020 So this is just another way to search 228 228 00:08:31,020 --> 00:08:33,630 for an IP address by using that syntax. 229 229 00:08:33,630 --> 00:08:34,463 All right. 230 230 00:08:34,463 --> 00:08:36,780 So the last little bit we need to talk about here with grep 231 231 00:08:36,780 --> 00:08:38,820 is some of the command line options. 232 232 00:08:38,820 --> 00:08:41,280 You'll notice I threw in that dash R for recursion, 233 233 00:08:41,280 --> 00:08:42,780 but there's other ones too. 234 234 00:08:42,780 --> 00:08:44,640 For instance, you have Dash I, 235 235 00:08:44,640 --> 00:08:47,190 which says ignore case sensitivity. 236 236 00:08:47,190 --> 00:08:49,860 By default, grep is going to be case sensitive. 237 237 00:08:49,860 --> 00:08:53,280 So if I have uppercase password versus lowercase password, 238 238 00:08:53,280 --> 00:08:54,990 those are two different names, 239 239 00:08:54,990 --> 00:08:56,430 but by using Dash I, 240 240 00:08:56,430 --> 00:08:59,400 I will find both of those regardless of the case. 241 241 00:08:59,400 --> 00:09:01,260 The next one is dash V. 242 242 00:09:01,260 --> 00:09:04,230 Dash V is going to reverse grep's default behavior. 243 243 00:09:04,230 --> 00:09:06,420 So instead of finding me things that match, 244 244 00:09:06,420 --> 00:09:08,910 it's going to find me everything that doesn't match. 245 245 00:09:08,910 --> 00:09:10,260 This is really helpful, for instance, 246 246 00:09:10,260 --> 00:09:12,000 if I wanted to look at somebody's machine 247 247 00:09:12,000 --> 00:09:14,280 and find all the cases where somebody logged in 248 248 00:09:14,280 --> 00:09:17,100 who wasn't the person who's assigned to that computer. 249 249 00:09:17,100 --> 00:09:20,460 For instance, I'm the only person who logs into my computer. 250 250 00:09:20,460 --> 00:09:22,560 So if anybody logs in and they're not Jason, 251 251 00:09:22,560 --> 00:09:23,550 I want to know about it 252 252 00:09:23,550 --> 00:09:26,040 and I can run dash V with a grep search 253 253 00:09:26,040 --> 00:09:28,740 to find anyone who is not Jason. 254 254 00:09:28,740 --> 00:09:30,300 Next we have dash W, 255 255 00:09:30,300 --> 00:09:33,810 and dash W is going to treat your search strings as words. 256 256 00:09:33,810 --> 00:09:36,360 Now, by default, when you search for something, 257 257 00:09:36,360 --> 00:09:37,193 for instance, let's say 258 258 00:09:37,193 --> 00:09:39,990 I was searching for the word no, N-O. 259 259 00:09:39,990 --> 00:09:42,810 Well, it's going to find all the instances of the word no, 260 260 00:09:42,810 --> 00:09:45,930 but it's also going to find the word nano and nowhere 261 261 00:09:45,930 --> 00:09:48,360 and anything else that has N-O inside of it. 262 262 00:09:48,360 --> 00:09:49,410 And I might not want that. 263 263 00:09:49,410 --> 00:09:52,020 I might only want to find the word no. 264 264 00:09:52,020 --> 00:09:53,940 So by using dash W in front, 265 265 00:09:53,940 --> 00:09:56,010 I'm only going to find the word N-O 266 266 00:09:56,010 --> 00:09:58,710 where N-O was by itself, no. 267 267 00:09:58,710 --> 00:10:00,390 Next, we have dash C, 268 268 00:10:00,390 --> 00:10:01,320 which is going to return 269 269 00:10:01,320 --> 00:10:04,140 the total count of matching strings only. 270 270 00:10:04,140 --> 00:10:06,330 So if I'm searching for the word no, 271 271 00:10:06,330 --> 00:10:09,360 in this case, I'm not going to get the words no back, 272 272 00:10:09,360 --> 00:10:11,070 I'm only going to get the number of times 273 273 00:10:11,070 --> 00:10:13,680 it found the word no inside that file. 274 274 00:10:13,680 --> 00:10:15,000 So for instance, if I wanted to look 275 275 00:10:15,000 --> 00:10:16,260 for a particular IP address 276 276 00:10:16,260 --> 00:10:17,400 and find out how many times 277 277 00:10:17,400 --> 00:10:19,620 it called out to a particular server, 278 278 00:10:19,620 --> 00:10:21,780 I can do that by searching for that IP address 279 279 00:10:21,780 --> 00:10:23,940 and then finding all those instances. 280 280 00:10:23,940 --> 00:10:27,300 Next, I have dash L and this is a lowercase L. 281 281 00:10:27,300 --> 00:10:30,600 This is going to return the names of files with matching lines. 282 282 00:10:30,600 --> 00:10:33,540 So if I'm going to search multiple different files, 283 283 00:10:33,540 --> 00:10:34,890 for instance, I use the search 284 284 00:10:34,890 --> 00:10:37,380 of the present working directory with the recursion, 285 285 00:10:37,380 --> 00:10:39,510 I'm going to have lots of files I'm looking at. 286 286 00:10:39,510 --> 00:10:41,220 Well, instead of finding the lines 287 287 00:10:41,220 --> 00:10:43,170 that have whatever I'm searching for, 288 288 00:10:43,170 --> 00:10:45,240 I can just find the files that have that. 289 289 00:10:45,240 --> 00:10:46,860 So for example, let's say I was searching 290 290 00:10:46,860 --> 00:10:48,060 for something that is a password 291 291 00:10:48,060 --> 00:10:49,980 that I know has been compromised. 292 292 00:10:49,980 --> 00:10:52,230 I can search all the files on a server 293 293 00:10:52,230 --> 00:10:54,300 for that particular password string, 294 294 00:10:54,300 --> 00:10:56,190 and it will return to me all those file names 295 295 00:10:56,190 --> 00:10:57,570 that have that password. 296 296 00:10:57,570 --> 00:10:59,190 And so now I can go in and figure out 297 297 00:10:59,190 --> 00:11:02,940 who created those files and who gave away our passwords. 298 298 00:11:02,940 --> 00:11:04,710 And the last one we have is dash L. 299 299 00:11:04,710 --> 00:11:06,930 This one is a capital L this time. 300 300 00:11:06,930 --> 00:11:08,700 This is going to return the names of the files 301 301 00:11:08,700 --> 00:11:10,710 without matching the lines. 302 302 00:11:10,710 --> 00:11:13,620 In this case, it's going to work like the dash V option 303 303 00:11:13,620 --> 00:11:15,690 and give you just the names of the files 304 304 00:11:15,690 --> 00:11:18,180 that contain the non-matching lines. 305 305 00:11:18,180 --> 00:11:19,800 So if I'm looking for all the files 306 306 00:11:19,800 --> 00:11:21,810 that don't contain this thing, 307 307 00:11:21,810 --> 00:11:23,790 it's going to go ahead and return those for me. 308 308 00:11:23,790 --> 00:11:25,410 Now, grep is an awesome tool, 309 309 00:11:25,410 --> 00:11:29,340 but you're only going to find it on Unix, Linux and macOS. 310 310 00:11:29,340 --> 00:11:31,380 You don't find it on Windows by default. 311 311 00:11:31,380 --> 00:11:33,540 Instead for Windows, we have two commands. 312 312 00:11:33,540 --> 00:11:36,150 We have the find command for basic strings, 313 313 00:11:36,150 --> 00:11:38,850 and findstr for regex searching. 314 314 00:11:38,850 --> 00:11:41,160 Both of these will work a lot like grep. 315 315 00:11:41,160 --> 00:11:43,350 Now, the next command we want to talk about is cut. 316 316 00:11:43,350 --> 00:11:46,110 And cut is a command that enables the user to specify 317 317 00:11:46,110 --> 00:11:49,740 which text on a line they want removed from the results. 318 318 00:11:49,740 --> 00:11:51,690 This makes it easier for you to read. 319 319 00:11:51,690 --> 00:11:55,327 So for example, if I have have cut dash c5 syslog.txt, 320 320 00:11:57,240 --> 00:12:00,120 this is going to return only the fifth character in each line 321 321 00:12:00,120 --> 00:12:02,580 from the syslog.txt file. 322 322 00:12:02,580 --> 00:12:04,080 Now, I know that sounds kind of weird, right? 323 323 00:12:04,080 --> 00:12:05,310 But if you think about it, 324 324 00:12:05,310 --> 00:12:08,250 all our logs come in a standard format usually, 325 325 00:12:08,250 --> 00:12:09,930 based on whatever program you're using. 326 326 00:12:09,930 --> 00:12:12,990 So maybe the fifth character inside of a log file 327 327 00:12:12,990 --> 00:12:15,660 might tell you if it was an inbound for I 328 328 00:12:15,660 --> 00:12:17,970 or outbound O as the character 329 329 00:12:17,970 --> 00:12:19,860 to tell you which direction traffic went. 330 330 00:12:19,860 --> 00:12:21,180 And you just want to get a quick display 331 331 00:12:21,180 --> 00:12:23,070 of all the inbound and outbound traffic, 332 332 00:12:23,070 --> 00:12:24,270 so you could see how many things were in 333 333 00:12:24,270 --> 00:12:25,200 and how many were out. 334 334 00:12:25,200 --> 00:12:26,033 It's a silly example, 335 335 00:12:26,033 --> 00:12:28,260 but that would work by using this command. 336 336 00:12:28,260 --> 00:12:29,340 Now, in addition to this, 337 337 00:12:29,340 --> 00:12:31,830 you can actually modify this command just a little bit 338 338 00:12:31,830 --> 00:12:33,150 by adding another number. 339 339 00:12:33,150 --> 00:12:37,890 For instance, if I did cut dash c5 dash five syslog.txt, 340 340 00:12:37,890 --> 00:12:40,890 this is going to return only the fifth through 10th characters 341 341 00:12:40,890 --> 00:12:43,950 in each line in the syslog.txt file. 342 342 00:12:43,950 --> 00:12:45,270 This would allow you maybe to just get 343 343 00:12:45,270 --> 00:12:47,768 a column of information that you wanted, 344 344 00:12:47,768 --> 00:12:50,070 like usernames or passwords or IP addresses 345 345 00:12:50,070 --> 00:12:51,450 or whatever it was that you needed 346 346 00:12:51,450 --> 00:12:53,670 and you knew exactly where it was in the file, 347 347 00:12:53,670 --> 00:12:54,720 how many characters in 348 348 00:12:54,720 --> 00:12:57,120 and how many characters that thing was going to be. 349 349 00:12:57,120 --> 00:12:59,400 Another way you can use cut is like this. 350 350 00:12:59,400 --> 00:13:04,400 Cut dash D quote space quote dash f1 dash four syslog.txt. 351 351 00:13:06,030 --> 00:13:07,020 Now, this is going to return 352 352 00:13:07,020 --> 00:13:09,000 the first four entries of each line 353 353 00:13:09,000 --> 00:13:11,310 as delimited by the space character. 354 354 00:13:11,310 --> 00:13:12,960 So if you have a format like that, 355 355 00:13:12,960 --> 00:13:16,050 you can then say, give me the first four pieces on each line 356 356 00:13:16,050 --> 00:13:19,470 as you get the first four words separated by spaces. 357 357 00:13:19,470 --> 00:13:21,720 The next command we're going to talk about is sort, 358 358 00:13:21,720 --> 00:13:24,390 and sort is a command that can be used to change the order 359 359 00:13:24,390 --> 00:13:26,190 of something is going to be outputted in. 360 360 00:13:26,190 --> 00:13:27,840 So for instance, if I had a text file, 361 361 00:13:27,840 --> 00:13:29,550 and I wanted to sort it in different ways, 362 362 00:13:29,550 --> 00:13:31,920 I can do that using the sort command. 363 363 00:13:31,920 --> 00:13:35,220 For instance, if I use sort syslog.txt, 364 364 00:13:35,220 --> 00:13:38,220 this will give me the contents of the syslog.txt file 365 365 00:13:38,220 --> 00:13:41,280 in alphabetical order, going from A down to Z. 366 366 00:13:41,280 --> 00:13:42,690 Now, if I wanted to do it backwards, 367 367 00:13:42,690 --> 00:13:45,930 I could use sort dash R syslog.txt. 368 368 00:13:45,930 --> 00:13:48,150 This returns the contents of the syslog file 369 369 00:13:48,150 --> 00:13:52,020 in reverse alphabetic order, going from Z down to A. 370 370 00:13:52,020 --> 00:13:53,580 Now, if I want to do this with numbers, 371 371 00:13:53,580 --> 00:13:55,410 I can do that using dash N. 372 372 00:13:55,410 --> 00:13:58,080 Sort dash N syslog.txt 373 373 00:13:58,080 --> 00:14:00,750 will return the contents of the syslog.txt file 374 374 00:14:00,750 --> 00:14:03,360 in numerical order from zero to nine. 375 375 00:14:03,360 --> 00:14:06,240 Now, another way I can sort things is based on columns. 376 376 00:14:06,240 --> 00:14:10,440 If I use sort dash K and then a number like dash K two, 377 377 00:14:10,440 --> 00:14:12,120 this will allow me to sort that file 378 378 00:14:12,120 --> 00:14:13,710 and return the contents of the screen 379 379 00:14:13,710 --> 00:14:15,480 based on the column specified. 380 380 00:14:15,480 --> 00:14:17,250 In this case, the second column. 381 381 00:14:17,250 --> 00:14:18,600 Now, another way I can use sort 382 382 00:14:18,600 --> 00:14:20,400 is by using the dash T command. 383 383 00:14:20,400 --> 00:14:23,280 So in this case, I can use sort dash T 384 384 00:14:23,280 --> 00:14:28,280 quote comma quote dash K two syslog.txt. 385 385 00:14:28,320 --> 00:14:31,110 And this is going to return the contents of the syslog file 386 386 00:14:31,110 --> 00:14:33,540 in order based on the column specified. 387 387 00:14:33,540 --> 00:14:35,190 In this case, the second column. 388 388 00:14:35,190 --> 00:14:36,960 Now, how does it determine a column? 389 389 00:14:36,960 --> 00:14:40,170 By default, it uses spaces, but because I used dash T, 390 390 00:14:40,170 --> 00:14:43,140 I said I want you to use these columns based on commas. 391 391 00:14:43,140 --> 00:14:46,560 So this might be a CSV or comma separated value file, 392 392 00:14:46,560 --> 00:14:48,720 and that's why I'm going to go through it that way. 393 393 00:14:48,720 --> 00:14:51,630 Again, there's lots more to learn about cut and sort, 394 394 00:14:51,630 --> 00:14:53,970 and if you use the man pages on your Linux system, 395 395 00:14:53,970 --> 00:14:55,500 you can learn all about them. 396 396 00:14:55,500 --> 00:14:57,420 For the CySA Plus exam though, 397 397 00:14:57,420 --> 00:14:58,650 you should just know the basics 398 398 00:14:58,650 --> 00:15:01,230 of what cut is and what sort is. 399 399 00:15:01,230 --> 00:15:03,240 The next command we want to talk about is head, 400 400 00:15:03,240 --> 00:15:04,440 and head is going to be a command 401 401 00:15:04,440 --> 00:15:07,860 that gives you the first 10 lines of any file specified. 402 402 00:15:07,860 --> 00:15:11,010 For example, if I did head syslog.txt, 403 403 00:15:11,010 --> 00:15:12,510 the first 10 lines of that file 404 404 00:15:12,510 --> 00:15:14,400 are going to be displayed to my screen. 405 405 00:15:14,400 --> 00:15:15,870 Now, this isn't nearly as useful 406 406 00:15:15,870 --> 00:15:16,980 when you're dealing with logs though, 407 407 00:15:16,980 --> 00:15:18,990 because logs tend to write things 408 408 00:15:18,990 --> 00:15:21,540 at the bottom of the file with the most current stuff. 409 409 00:15:21,540 --> 00:15:24,060 So in that case, we would use tail. 410 410 00:15:24,060 --> 00:15:27,000 Tail is going to give you the last 10 lines of a file. 411 411 00:15:27,000 --> 00:15:30,240 So again, if I use tail syslog.txt, 412 412 00:15:30,240 --> 00:15:32,850 you're going to get the last 10 lines of that file. 413 413 00:15:32,850 --> 00:15:34,950 This is really useful when dealing with logs, 414 414 00:15:34,950 --> 00:15:35,910 because you're always going to get 415 415 00:15:35,910 --> 00:15:39,750 the 10 most recent log entries in that particular file. 416 416 00:15:39,750 --> 00:15:42,180 The last thing we're going to talk about here is piping, 417 417 00:15:42,180 --> 00:15:44,490 and piping is a character on your keyboard 418 418 00:15:44,490 --> 00:15:46,950 which is right over your return or enter key. 419 419 00:15:46,950 --> 00:15:49,530 If you hit the shift button over the backslash, 420 420 00:15:49,530 --> 00:15:51,120 this will give you that character. 421 421 00:15:51,120 --> 00:15:53,700 This basically looks like a straight up and down line. 422 422 00:15:53,700 --> 00:15:55,740 Now when you use piping, this is the process 423 423 00:15:55,740 --> 00:15:57,720 of using the output of one command 424 424 00:15:57,720 --> 00:16:00,330 as the input for a second or third or fourth command, 425 425 00:16:00,330 --> 00:16:02,490 and you can pipe lots of things together. 426 426 00:16:02,490 --> 00:16:04,620 Now, when we deal with piping, it looks like this. 427 427 00:16:04,620 --> 00:16:06,690 For instance, I had this command, 428 428 00:16:06,690 --> 00:16:10,770 grep "NetworkManager" slash var slash log slash syslog 429 429 00:16:10,770 --> 00:16:14,760 pipe cut dash D quote space quote 430 430 00:16:14,760 --> 00:16:19,320 dash f1 dash five pipe sort dash T 431 431 00:16:19,320 --> 00:16:22,200 quote space quote dash K three. 432 432 00:16:22,200 --> 00:16:24,300 Now, what is this telling me to do? 433 433 00:16:24,300 --> 00:16:26,250 Well, we're always going to read it from left to right, 434 434 00:16:26,250 --> 00:16:29,400 and on a Linux system, this would all be on one line. 435 435 00:16:29,400 --> 00:16:30,570 I just put it on two lines here 436 436 00:16:30,570 --> 00:16:32,760 so we could read it a little bit easier. 437 437 00:16:32,760 --> 00:16:34,320 Now, we're going to start out with grep. 438 438 00:16:34,320 --> 00:16:35,250 What are we doing? 439 439 00:16:35,250 --> 00:16:36,660 We are going to search for the word, 440 440 00:16:36,660 --> 00:16:38,730 the literal word NetworkManager 441 441 00:16:38,730 --> 00:16:42,900 inside the file var slash log slash syslog. 442 442 00:16:42,900 --> 00:16:46,530 So anytime I find NetworkManager in that syslog file, 443 443 00:16:46,530 --> 00:16:49,620 I'm going to then pipe it and send it to the next command. 444 444 00:16:49,620 --> 00:16:51,600 So I've gone through and I've done the grep 445 445 00:16:51,600 --> 00:16:53,280 and I found all that information. 446 446 00:16:53,280 --> 00:16:55,020 I now, instead of putting it onto the screen, 447 447 00:16:55,020 --> 00:16:56,640 have passed it to cut, 448 448 00:16:56,640 --> 00:16:58,290 and cut is going to do something with it. 449 449 00:16:58,290 --> 00:17:01,770 It's going to use Dash D quote space quote, 450 450 00:17:01,770 --> 00:17:04,830 which basically says I'm going to delimitate based on spaces 451 451 00:17:04,830 --> 00:17:08,910 and then I'm going to use dash f1 dash five. 452 452 00:17:08,910 --> 00:17:11,520 Now, what is that dash f1 dash five? 453 453 00:17:11,520 --> 00:17:14,010 Well, that is going to cut the characters 454 454 00:17:14,010 --> 00:17:15,120 based on the delimiters. 455 455 00:17:15,120 --> 00:17:16,860 So every time we have those delimiters, 456 456 00:17:16,860 --> 00:17:19,200 we are going to see the first five columns 457 457 00:17:19,200 --> 00:17:22,350 for each line inside of that syslog. 458 458 00:17:22,350 --> 00:17:24,570 Then we are going to sort, 459 459 00:17:24,570 --> 00:17:25,740 we're going to pass all that stuff 460 460 00:17:25,740 --> 00:17:27,690 that we just cutted into sort, 461 461 00:17:27,690 --> 00:17:31,260 and sort is then going to use dash T quote space quote, 462 462 00:17:31,260 --> 00:17:32,820 which, again, is the delimiter, 463 463 00:17:32,820 --> 00:17:34,380 we're doing this based on spaces, 464 464 00:17:34,380 --> 00:17:36,750 and we're going to look for the third column. 465 465 00:17:36,750 --> 00:17:39,480 So how we're sorting this file that we've now created 466 466 00:17:39,480 --> 00:17:41,550 is based on that third column. 467 467 00:17:41,550 --> 00:17:44,130 And now that we've done all three of those steps, 468 468 00:17:44,130 --> 00:17:46,860 we are then going to push it to the screen and show it to you. 469 469 00:17:46,860 --> 00:17:47,693 So at this point, 470 470 00:17:47,693 --> 00:17:49,410 instead of just getting a big long list 471 471 00:17:49,410 --> 00:17:52,740 of all the times we found NetworkManager inside of syslog, 472 472 00:17:52,740 --> 00:17:54,000 we are now going to find 473 473 00:17:54,000 --> 00:17:55,920 that we only have the first five columns 474 474 00:17:55,920 --> 00:17:59,910 and they're all sorted by the third column inside of syslog. 475 475 00:17:59,910 --> 00:18:01,710 That gives me something that's a lot more useful 476 476 00:18:01,710 --> 00:18:03,123 as an analyst to go through.